quectophoton

If I had to use AI with neovim I'd probably use https://github.com/ThePrimeagen/99 or one with a similar workflow.

Except instead of sending through post offices, it'd probably be through "runners" like on Mirror's Edge.

And even then, getting interviews is one thing, but getting offers is something completely different.

And there's also the advantage of having a current job, instead of an increasingly larger jobless gap that not only decreases your chances over time, but also contributes to the cycle of "less chance -> wider gap -> increased anxiety -> less chance".

Fumble the first few months due to a combination of a lack of interviewing practice, and of job postings that never intended to hire anyway or that are looking for someone that checks literally all their shopping list of boxes, all while still dragging you for a 4-8 journey, and suddenly your position is not that good anymore.

Not exactly a "news" site, but this is still an example site that you'd expect would have a feed:

https://mistral.ai/news/

> Language is filled with those types of phrases, the one which bugs me once it was pointed out (even though I use it myself) is "to be honest...", which could carry the implication anything said without that qualifier may be dishonest.

Supernatural highlights this on S1E08, at 27:28. Dean was talking with someone and starts saying "the truth is" but the other person instantly cuts him off saying "you know who starts their sentences with 'the truth is'? Liars".

Thank you, I was going to say something like this. I've been reading all the comments here and thinking, "do ChatGPT/LeChat/etc even allow running CLIs from their web or mobile interfaces?".

I'll add one that's very common in HN: "Don't let perfect be the enemy of good."

Instantly closes the door to any thoughtful discussion.

Same.

Also I tend to do the "Don't recommend -> I don't like this video" for those that have the thumbnails with "that face" (you know, the YouTube Thumbnail Clickbait Face, I don't even know if there's an actual term for it).

When I actually enter a video, you have my attention by default and you'll get an instant dislike for:

- "Don't forget to like and subscribe."

- Showing those like and/or subscribe buttons on screen.

- If I get suspicious that you're padding video length, talking just for the sake of stalling.

And how do you get those residential IP addresses?

Well, you just need people to install your browser extension. Or your proprietary web browser. Or your mobile app. Or your nice MCP. Maybe get them to add your PPA repository so they automatically install your sneakily-overriden package the next time they upgrade their system.

Anything goes as long as your software has access to outgoing TCP port 443, which almost nobody blocks, so even if it's being run from within a Docker container or a VM it probably doesn't affect you.

Questions. I want to get into coding agents, so, out of curiosity: which one(s) did you use and how much money has it costed you? (Any metric is fine)

I wouldn't say without fear, since you're one typo away from executing a typo-squatted malicious package.

I do use it on CI/CD pipelines, but I wouldn't dare type uvx commands myself on a daily basis.

I'm just wondering if this strong hate applies to Google as well, is all.

Does he still work for Google?

If so, I wonder what his views are on Google and their active development of Google Gemini.

Abbreviated as "VC Cleanup Specialist".

With the ambiguity in the meaning of "VC" being intentional.

Better blacklist Google as well. You don't want anyone on the team searching anything on Google lest their search accidentally triggers the LLM response (meaning: they prompted Google Gemini).

Thank you, this (and jillesvangurp's comment) sounds way more reasonable than the article's suggestion.

If I have a daily cron job that is copying files to a remote location (e.g. backups), and the _operation_ fails because for some reason the destination is not writable.

Your suggestion would get me _both_ alerts, as I want; the article's suggestion would not alert me about the operation failing because, after all, it's not something happening in the local system, the local program is well configured, and it's "working as expected" because it doesn't need neither code nor configuration fixing.

> No one outside of someone trying to be obtuse would put HN and Tiktok in the same category.

Definitely not the ones enforcing it, when it serves their purpose.

FWIW they do seem to regret it, but goes to show how very tempting it is for projects to go down the ads route once they have users.

> Docker Compose is simple: You have a Compose file that just needs Docker (or Podman).

And if you want to use more than one machine then you run `docker swarm init`, and you can keep using the Compose file you already have, almost unchanged.

It's not a K8s replacement, but I'm guessing for some people it would be enough and less effort than a full migration to Kubernetes (e.g. hobby projects).

And don't forget when Caddy was putting ads in your servers via a `Caddy-Sponsors` header.

(It was reverted after the situation gained visibility, as is tradition.)

Random trivia: Memes in that format are known as "speed of lobsters" memes, where you take a screenshot of some text/post/tweet/whatever and then delete/hide words and letters to make up completely different sentences.

Surprisingly, something I still haven't seen anywhere is having a "choice" with three buttons like:

- "Yes" -> Consent.

- "No" -> Popup asks you again some time later.

- "Don't ask again" -> Meaning "Yes, and don't ask again".

Having the continuation bytes always start with the bits `10` also make it possible to seek to any random byte, and trivially know if you're at the beginning of a character or at a continuation byte like you mentioned, so you can easily find the beginning of the next or previous character.

If the characters were instead encoded like EBML's variable size integers[1] (but inverting 1 and 0 to keep ASCII compatibility for the single-byte case), and you do a random seek, it wouldn't be as easy (or maybe not even possible) to know if you landed on the beginning of a character or in one of the `xxxx xxxx` bytes.

[1]: https://www.rfc-editor.org/rfc/rfc8794#section-4.4

This prompted me to check, and seems like KeePassXC supports storing passkeys, at least if you use the browser extension and enable a flag in its config. Until now I had thought it only supported unlocking your database with passkeys, I didn't know about it being able to actually store them.

I guess I'll try setting them up on some unimportant website to see for myself what all the hype is about.

It probably is, currently. But even if cookies are not used, the identifier for this type of functionality would still need to be stored somewhere and passed to the server in some way to avoid showing another CAPTCHA to the user.

Whatever mechanism they choose to uniquely identify you, they will insist it's necessary for another purpose and they totally are not piggybacking on it for tracking (e.g. for the CAPTCHA example, they would insist it's absolutely necessary to protect themselves from DDoS).

As another example, they can always respond with HTML where all links themselves are an opaque hash that internally contain "route + your id" when decrypted. Then emphasizing that all links are always different even for same routes to "show they are randomly generated", and saying that they do this because... idk, detecting scraping or something random but plausible-sounding. Or whatever sneaky variation of the `?PHPSESSID=` query param from old times.

(Yeah I know the last example doesn't a lot make sense, I didn't think too hard about it, the point is that they will probably find a way somehow.)

Not the person you asked, but I am running mpd[1] ("musicpd" in some package repos), using its httpd output to serve on localhost, and use a normal reverse proxy with Nginx to expose it on my VPN with HTTPS. To manage playlists and stuff, I connect to mpd from my LAN using ncmpcpp[2].

Nowadays there's probably better alternatives though.

[1]: https://www.musicpd.org/

[2]: https://github.com/ncmpcpp/ncmpcpp

> then website operators will just find another method to fingerprint users

Example: The identifier you get when you pass anti-bot challenges (Cloudflare, Anubis, etc).

This also allows more freedom in the directory structure, instead of the `$USERNAME/$REPONAME` that is enforced by basically every hosted solution.

Yeah, `git request-pull` is only a helper to create a pull request, while GitHub/GitLab/etc include that in addition to a (convenient) vendor-specific way to track received pull requests and a code review web interface.

Initiatives like ForgeFed are trying to define a more neutral way to share this information, but I don't think there's any estimate date for when there'll be an actual implementation of it. If that ever happens, it'd be possible to get vendor-neutral tooling for that kind of collaboration.

Right, my bad, seems like I misunderstood the question. Glad you could still find an answer.

For more context on why I thought that link would have been helpful: In Go you download dependencies "straight" from the source[1], while in npm and other languages you download dependencies from a completely unrelated registry that can have any random code (i.e. whether the published artifact was built from the alleged source repository, is a flip of a coin).

So not having this kind of third party registry eliminates the point of failure that caused the issue commented in the article. The issue was caught because of a centralized place, yes, but it was also caused because npm dependencies are downloaded from a centralized place and because this centralized place only hosts artifacts unrelated to the source code itself; package authors can `npm publish` artifacts containing the exact source code from their repos if they want though. If.

With Go, having a mirror of the source code is still third party infra, but is more an optimization than anything else, and checksums are generated based on the source itself[2] (rather than any unrelated artifact). This checksum should match even for people not using any proxy, so if you serve different code to someone, there will be a mismatch between the checksum of the downloaded module and the checksum from the SumDB. This should catch force-pushes done to a git repository version tag, for example.

Also, Go downloads the minimum version that satisfies packages, so it's less likely that you'll download a (semver) "patch" release that someone pushed hours ago.

All this makes me both like and dislike how Go handles dependencies.

[1]: Well, from a mirror, unless you set `GOPROXY=direct`. Reasoning explained in next paragraph.

[2]: The checksum is calculated from a zip file, but it is generated in a deterministic way, and this checksum is also generated and validated locally when you download dependencies. More info at https://go.dev/ref/mod#zip-files and https://go.dev/ref/mod#go-mod-verify