nazcan

Thoughts on why it hasn't been solved?

Matrix federated chat - who needs gatekeepers.

Golang it is then! I'm really enjoying the fast compile time compared to C++...

My guess is if you are in China they can MITM you with their own root certs.

I tried it on Firefox, but see it failed because it doesn't have WebGPU (on linux). Same thing on Chromium actually:

main.js:145 Myth browser startup failed Error: WebGPU adapter was not available. at Module.initialize (foster-webgpu.js:400:9) at async main.js:61:3 (anonymous) @ main.js:145 main.js:146 Error: WebGPU adapter was not available. at Module.initialize (foster-webgpu.js:400:9) at async main.js:61:3

Just a choice of polluting the ground or the air.

Thanks for the excerpts! I was trying to understand the reasoning, which seem to just be in the 2nd excerpt:

- The rules of signed/unsigned are complicated and there is too much auto-conversion - does that mean languages that make this more explicit means this is fine? It just seems ideal to have stronger typing. - It is mentioned that you can initialized an unsigned int to "-2" - but that presumably could also be fixed in the language.

I'm trying to separate out which is "don't do this in C/C++" and which is "don't do this in any language".

But where do you get the checksum from? I realize in some cases you are downloading from a mirror (thus as long as you trust the source of the checksum, that is quite useful) - but if it is from the same host - then you are just comparing against the same webserver.

Totally agree with one shotting GUI tools. I especially have liked it to create a single-file web app, and then open it with Chromium locally (no web server needed).

In my case, it built a tool for splitting sounds and a tool for defining hitboxes for a game. Tools made exactly for more workflow. Wild times.

To clarify, when does this run? Like you download malware A, run malware A and this function definition changes sudo for it, or sudo for other cases?

Yeah, makes sense.

I wonder if for closed-source apps if governments can not just force the key collection the same way they would force decryption with centralized keys.

I still don't understand the note that the companies can't decrypt the messages with e2e encryption. Isn't it as simple as a software update that says:

"If user = foo, then send the on device keys elsewhere"?

Or if those keys are part of a TPM, then a software update that just asks it to send in the decrypted messages?

Can judges not order this now, but can order decryption if the keys are stored centrally?

The debugging improvements have been huge for me too. I was debugging some financial software, and while it took a few shots, just with access to my code and not to the database that showed the issue, it found a fairly complex problem.

It may not be the biggest bottleneck, but if you can have a similar amount of time, but reduce the number of engineers by 30%, that's a huge win.

And having less people involved means there is much less communication and alignment.

Not to say it's a panacea.

The recent is very recent, so not much uptake yet (https://caniuse.com/webtransport) - but hopefully can be used without fallback to WebSockets in a couple years.

And that's why you gotta just use one domain. Or mix ads and important content on one domain.

Agreed. Upgrading just one piece, and ensuring every committed write survives is critical in most commercial applications.

How does this work to discover things on the LAN from a browser?

The favourite model I've seen is the main branch is free, licensed MIT or whatever, but if you want release artifacts that are tested - then you pay for it. You can always compile your own.

But if you want some redundancy, k8s let's you just say run 4 of this, 6 of this on these 3 machines. At least I find it quite straight forward.

The database is more complex since there is storage affinity (I use cockroachDB with local persistent volumes for it) - but stateful is always complicated.

I find it interesting how this all comes down to what do you trust. Like.. why not <1 minute keys? Or 1-request?

So both mics will pick up both people (at least somewhat, in the same room) - but because there is no, I assume 20-100ms latency going through the system, to discord, and back - it avoids a slight difference in timing of the two mics picking up the same sound slightly differently. Is that right?

Very cool!

I have not seen anything about pricing (when running on your hardware). Anyone else found anything?

Positive EV for the employees vs. another company that pay less and has less lay-offs (assuming random)? I guess it depends on how much less pay the other company is...

It seems like having a feedback loop to the DDOS protector could help a lot - i.e. saying how busy you are.

At some level, it's like they become your edge router.

100% to libraries having permissions. If I'm using some code to say compute a hash of a byte array, it should not have access to say the filesystem nor network.

I'm supportive of going further - like restricting what a library is able to do. e.g. if you are using some library to compute a hash, it should not make network calls. Without sub-processes, it would require OS support.

Yes, but they are saying that if you allow economic hedging, you are also allowing gambling - just a bit more indirectly.

I've never attempted to use IoT devices for development, but my recommendation is to make the copy quickly explain what problem you are solving. E.g. "Stop spending months building infrastructure to manage your IoT device systems, instead integrate in days"

Perhaps with a concrete example with and without your product.

> having a main branch allows a casual observer(management) to browse your project in the gui and see what is currently live.

I never found this very compelling. What is main in that world is not the source of truth, and it's rare to have a system atomically in one state or the other - but normally there are progressive rollouts. And if you ever need to rollback in production, I assume no one is changing where main is.

> I like the opportunity to force a second set of testing, and code review. Especially if the team is big enough that you can have different people doing code review for each branch.

To be explicit for code review, do you mean there is (1) main, (1) development, and then a bunch feature branches - and that there is review when merging into development and main? Having a two-tiered review process seems extremely difficult to do - versus just having more reviewers on the first merge - especially dealing with merge conflicts and needing to merge again into development.

> You can also have your CI/CD do longer more thorough testing while merging to main vs development.

I think it's fair to do more testing later. I think the equivalent I'm used to (which is pretty close, so not a huge difference), is only building releases from the commit that passed the bigger/slower tests.

But also, assuming there are multiple deployments coming from one repo, if you block merging into main, that means you'd be blocking on all tests passing - while release branches for a given product can select a subset of tests when deciding on release candidates.

> If it's a project with a single deployment, version tagging is kind of pointless, it's much easier to just use a branch to reflect what is live, and roll back to a merge commit if you have to. Then you can still merge directly to main in the event of a hotfix.

I think it's worth maintaining the flexibility of how many releases come from a repo. Needing to fork repos just because you want another deployable release in the future seems painful to me.