quectophoton

This page has a short explanation of the default way in which Go downloads modules, with links for more details: https://sum.golang.org/

Then you have companies like AWS, they were sending invoices from `no-reply-aws@amazon.com` but last month they changed it to `no-reply@tax-and-invoicing.us-east-1.amazonaws.com`.

That looks like a phishing attempt from someone using a random EC2 instance or something, but apparently it's legit. I think. Even the "heads-up" email they sent beforehand looked like phishing, so I was waiting for the actual invoice to see if they really started using that address, but even now I'm not opening these attached PDFs.

These companies tell customers to be suspicious of phishing attempts, and then they pull these stunts.

Alternatively, cloud->clown.

Clown Computing, Clownflare, Google Clown Platform, etc.

Related comment from a recent thread that I can't unsee: https://news.ycombinator.com/item?id=45152476

They mention that they're "demonstrating that privacy-respecting AI services are feasible", knowing their duck.ai is sending the prompts to other AI services, and then in the same paragraph they mention leaks and hacks.

To their credit, their privacy policy says they have agreements on how the upstream services can use that info[1]:

> As noted above, we call model providers on your behalf so your personal information (for example, IP address) is not exposed to them. In addition, we have agreements in place with all model providers that further limit how they can use data from these anonymous requests, including not using Prompts and Outputs to develop or improve their models, as well as deleting all information received once it is no longer necessary to provide Outputs (at most within 30 days, with limited exceptions for safety and legal compliance).

But even assuming the upstream services actually respect the agreement, their own privacy policy implies that your prompts and the responses could still be leaked because they could technically be stored for up to 30 days, or for an unspecified amount of time in the case of the exceptions mentioned.

I mean, it's reasonable and a good start to move in the direction of better privacy, way better than nothing. Just have to keep those details in mind.

[1]: https://duckduckgo.com/duckai/privacy-terms

But this is not excessive, it's Legitimate Interest and absolutely needed to provide a good service /s

Take for example FreeBSD, it's not mainstream but also not too obscure, they get some funding through the FreeBSD foundation, and yet wifi drivers are still an issue.

Thanks!

> 20 Milliarden Euro

Yep, so the source uses the long scale "milliard" and the translations use short scale "billion", it checks out.

> Is 20b euro enough to be a real alternative?

Since we're talking about Europe, my first instinct here is that I want to double-check what they mean by "billion"[1].

This article being in English makes me assume short scale, but SAP being German makes it possible (even if unlikely) that it could be a mistranslation that everyone else just copied.

If only any of these articles could link to a source. But searching for literal quotes doesn't seem to return any authoritative source, or even any transcripts (if this was announced verbally).

[1]: https://en.wikipedia.org/wiki/Long_and_short_scales#German-s...

Nowadays it's mostly inertia.

But I think it all began with disliking systemd and at the same time being obsessed with ricing and minimalism. Tiling window managers, simple terminals, LuaKit as a web browser (!), stuff like that.

Back then I was young and had very strong opinions, and also had the time to be switching OS whenever I wanted, and apparently I didn't mind setting up stuff again and again (ugh). My first choice was actually Artix Linux, but it broke at some point. I was already using Alpine Linux and FreeBSD in VPSs (Linode and Digital Ocean respectively), and they were still working fine so they seemed stable enough, so I started experimenting with installing FreeBSD locally and just setting up i3wm on it (also Poudriere got me curious about compiling packages by myself with only the flags I needed). Then when I got a laptop I went with Alpine Linux there, it was already a minimal distro that I was familiar with, so if I could get i3wm working there it should be good enough.

And I have survived with them so far with no reason to change, so it's probably just coincidence that I was using Alpine Linux (and FreeBSD) when I decided to "settle down".

But like I said, today it's mostly inertia, just a personal preference thing like buying Ketchup from a specific brand whenever possible because I'm most used to how this one tastes but no big deal if it's not available. It hasn't given me any surprises or any annoyances big enough for me to seriously consider switching.

I do have Linux Mint on a third[1] computer tho, mostly for Steam, but ready to be quickly repurposed in case of any surprises.

I still have some leftover dislike of systemd and its scope creep, but it's not a religious dislike like back then; today it's similar to a "why does this website have 20MB of JavaScript just to show text and why does it ask for my location"-kind of dislike, but back then was like "the GNU Project declaring war against any software that doesn't use specifically a GNU license even if that software has an OSI-approved license"-kind of dislike. Recently when I used Hetzner for some stuff and found out they don't have Alpine Linux or FreeBSD as (easy) choices, I was like "oh well, Fedora it is".

So yeah, there you have it.

[1]: Why a third computer? Well, you can thank two spicy pillow incidents for that. Don't buy Medion laptops.

My 2 cents. I have been using Alpine Linux as my main Linux distro for... I don't know how long, but probably more than 5 years at this point.

My only issues have been:

* Nvidia proprietary drivers (when I was building a PC with an old GPU).

* DRM (Netflix).

* I think I also had problems with SQLite3 while trying to install the Twitch test server thingy inside an Alpine container.

Other than that it's just minor things, just like every distro has some things that are different but no big deal.

> I think that, if you have a very consistent usage of Alpine, where you are mostly doing the same thing and using the same tools, you could find a comfy workflow there.

Yeah, or in my case it's because I try to keep the host minimalist and clean, and do most of the dirty/experimentation stuff in Docker, just to be able to nuke it from orbit once I'm done.

It's also dumbproof to make your own native packages if you want, for example if you want to use fonts but you can't just `git clone` because they require a build step (!).

Apparently some people have had issues with DNS, but I've never had any. I don't know if it's because I always point to my Unbound instance for DNS, or if it's just been a coincidence.

With family and friends you can just be yourself[1] though. If they watch the recording after 5 or 10 years, they will probably look at it affectionately, at most with some light teasing.

They're not going to, for example, start harassing you online just because at some point during your presentation you said the word "blacklist" (or other words that are nowadays are considered worse than they were back then).

So I'd say part of the reason of why it's easy with family/friends but stressful with strangers, is subconscious fear of this kind of judgement where you don't know how this large amount of people will react, and fear that something you say or something you do will cause a response way more negative than you expect. Sure, you can imagine some possible negative responses, but because you don't know them personally, you don't know what's their "upper bound" for a negative response (how far they will go).

And once you start talking the nerves go away because, once you start, running away suddenly becomes a worse choice (easier to get a negative response) compared to finishing the talk.

That would be my guess.

[1]: Some might cross lines, but those should be the exception, and you probably wouldn't be relaxed with them anyway.

And most of the steps in the interview process are not even technical (depending on the company), so most of your final score probably comes from your sales presentation^W^Wcommunication skills.

I would be very interested in an API similar to the plates[1] library, but with support for event bindings (instead of being just a one-off rendering of plain HTML). My first thought is that it might not be very maintainable, and at best might only be useful for small templates or templates that are heavy on microdata[2].

But there's just something about this type of binding that makes me want to give it a serious chance, at least once, before completely giving up on it.

[1]: https://github.com/flatiron/plates

[2]: https://developer.mozilla.org/en-US/docs/Web/HTML/Guides/Mic...

Yeah that has been on my backlog. I admit that I haven't given them too much priority, but at some point I want to try an AI agent that works offline and is sandboxed.

Don't agents still depend on LLMs to produce a human-readable response, rather than as a source of information/knowledge? And aren't they still vulnerable to prompt injection attacks, due to being unable to separate the information/knowledge part vs the prompt, because their prompt "parsing" is coupled to an LLM?

I call them a "soup" because AFAIK there's no intent behind them:

I'll stop calling them a soup when the part that generates a human-readable response is completely separate from the knowledge/information part; when an untrained program can respond with "I don't know" due to deliberate (/debuggable) mapping of lack of data to a minimal subset of language rules and words that are encoded in the program, rather than having "I don't know" be a series of tokens generated from the training data.

The first use case that comes to mind (if this had an API, which I don't think it does), is to easily convert a list of Spotify links into different links that can be downloaded from `yt-dlp`.

A fuzzy search engine with a better "semantic index"[1] than classic search engines, but the trade-off is that instead of returning links it returns a generated soup of words that are semantically close to your "query".

Mostly useful when you're only looking for the presence of words or terms in the output (including the presence of related words), rather than a coherent explanation with the quality of human-written text.

Sometimes the response is accidentally a truthful statement if interpreted as human text. The quality of a model is judged by how well-tuned they are for increasing the rate these accidents (for the lack of a better word).

[1]: EDIT: In the sense of "semantic web"; not in the sense of "actually understanding meaning" or any type of psychological sense.

You just made me imagine if Wikipedia had titles like "Is the Heliocentric model wrong?" or "The third planet of the Solar System has a generic name! Learn everything about it", and half of it behind a paywall.

Or worse, if its content were distributed in short videos: "What to know what's that giant fire ball on the sky? Watch until the end!", with a like-and-subscribe animation covering the bottom 20% of the video every 5 seconds.

Would it be accurate to describe Jujutsu as "a Mercurial-inspired frontend for Git"?

Also, another question I have for people who have used Jujutsu: Is it focused on interactive use, or is it also convenient to use for automatic/non-interactive use?

For example, situations like:

* A CI/CD pipeline that periodically adds stuff to the repo, or a pipeline that modifies files when triggered by specific events.

* Server setup scripts that clone a repo with common config and then make a new commit after applying patches for host-specific changes.

I thought only the way to avoiding the full firehose was connecting to Bluesky's centralized Jetstream instances, and that if anyone else wanted to host Jetstream without depending on Bluesky infra other than the PDS, they would still need to pay the full price for the firehose bandwidth and storage.

I'd be happy to be wrong here though.

... and then that `callNewModule` has weird bugs like mysteriously replacing `+` with spaces, sometimes labels are empty but only if they are shipped to a specific company, sometimes the invoices are generated multiple times for the same shipment, after 1 year after Sales has already sold this multi-item shipment feature to massive companies it suddenly stops working because the new module wasn't properly hooked for auto-renewing credentials with a specific service and the backlog of unshipped items but marked as shipped grows by the second...

Of course Eager Beaver didn't learn from this experience because they left the company a few months ago thinking their code was AWESOME and bragging about this one nicely scalable service they made for shipping to multiple addesses.

Meanwhile Grey Beard is the one putting out the fires, knowing that any attempt to tell Project Manager "finding and preventing situations like this was the reason why I told my estimate back then" would only be received with skepticism.

I agree with you, generally you can expect good faith to be returned with good faith (but here I want to make heavy emphasis that I only agree on the judge part iff good faith can be assumed and the judge is informed enough to actually be able to make an informed decision).

But not everyone thinks that's the purpose of robots.txt. Example, quoting Wikipedia[1] (emphasis mine):

> indicate to visiting web crawlers and other web robots which portions of the website they are allowed to visit.

Quoting the linked `web robots` page[2]:

> An Internet bot, web robot, robot, or simply bot, is a software application that runs automated tasks (scripts) on the Internet, usually with the intent to imitate human activity, such as messaging, on a large scale. [...] The most extensive use of bots is for web crawling, [...]

("usually" implying that's not always the case; "most extensive use" implying it's not the only use.)

Also a quick HN search for "automated robots.txt"[3] shows that a few people disagree that it's only for crawlers. It seems to be only a minority, but the search results are obviously biased towards HN users, so it could be different outside HN.

Besides all this, there's also the question of whether web scraping (not crawling) should also be subject to robots.txt or not; where "web scraping" includes any project like "this site has useful info but it's so unusable that I made a script so I can search it from my terminal, and I cache the results locally to avoid unnecessary requests".

The behavior of alternative viewers like Nitter could also be considered web scraping if they don't get their info from an API[4], and I don't know if I'd consider Nitter the bad actor here.

But yeah, like I said I agree with your comment and your interpretation, but it's not the only interpretation of what robots.txt is meant for.

[1]: https://en.wikipedia.org/wiki/Robots.txt

[2]: https://en.wikipedia.org/wiki/Internet_bot

[3]: https://hn.algolia.com/?dateRange=all&query=automated%20robo...

[4]: I don't know how Nitter actually works or where does it get its data from, I just mention it so it's easier to explain what I mean by "alternative viewer".

Yeah, my main worry here is how we define the unwanted traffic, and how that definition could be twisted by bigcorp lawyers.

If it's too loose and similar to "wanted traffic is how the authors intend the website to be accessed, unwanted traffic is anything else", that's an argument that can be used against adblocks, or in favor of very specific devices like you mention. Might even give slightly more teeth to currently-unenforceable TOS.

If it's too strict, it's probably easier to find loopholes and technicalities that just lets them say "technically it doesn't match the definition of unwanted traffic".

Even if it's something balanced, I bet bigcorp lawyers will find a way to twist the definitions in their favor and set a precedent that's convenient for them.

I know this is a mini-rant rather than a helpful comment that tries to come up with a solution, it's just that I'm pessimistic because it seems the internet becomes a bit worse day by day no matter what we try to do :c

Probably not.

But it's the same thing with random software from a random nobody that has no license, or has a license that's not open-source: If I use those libraries or programs, do I think they would sue me? Probably not.

I don't know about this. This means I'd get sued for using a feed reader on Codeberg[1], or for mirroring repositories from there (e.g. with Forgejo), since both are automated actions that are not caused directly by a user interaction (i.e. bots, rather than user agents).

[1]: https://codeberg.org/robots.txt#:~:text=Disallow:%20/.git/,....

> So, my problem with how this is modeled is it assumes order doesn't matter in one aspect, but that it does in another.

Yeah, I'm with you here. Assuming heads=girl and tails=boy:

* If order does NOT matter (GB=BG), then it means Alice-Albert (GB, Heads-Tails) is the same as Albert-Alice (BG, Tails-Heads).

* If order DOES matter (GB!=BG), then it means Alice-Barbara (GG, Heads-Heads) is different than Barbara-Alice (GG, Heads-Heads). Thereforce, GG!=GG.

Either way, the stated problem seems badly defined.

Understandable.

The way I see it, a software project has only (1) code you maintain or pay someone to maintain for you, and/or (2) throwaway code that you will eventually need to replace with an incompatible version.

Nothing wrong with a project that is just gluing throwaway code because it's a gamble that usually pays off. But if that code is from third-party dependencies, just don't believe for a second that those dependencies (or any compatible forks) will outlive your project, or that their developers have any incentive at all to help you maintain your project alive.

I don't get spam emails, but I get spam phone calls. Sometimes it happened suspiciously a few minutes before a call that's actually related to the position I applied for.

But a phone number is expected here where I live (Spain). Few companies seem to respond via email (some do, but it's rare). Everyone just wants you to give them your phone number so, if they decide to call you, they will do a surprise call a few weeks after you applied, at the most inconvenient moment, with no advance notice of any kind.

And since first impressions are important, not being available during that inconveniently-timed surprise screening call is probably a negative point at least on a subconscious level.