robszumski

it really baffles me that Apple lets this happen with a design system/framework that has had years of battle testing. Clearly it's not working if today's apps are all insanely hard to use on a daily basis. Users that are power users. The system needs to protect us from app devs being able to ship stuff this hard to use. The remote is not helping of course.

I was part of the team that proposed this manner of operation (Kubernetes Operator)[1]/controller and it's immensely cool to see a competent team make what seems like an incredible one that really scales the business.

I had always assumed databases would be the silo that had the most benefits for an Operator. There are a few good Postgres Operators, but not many outside of that which actually do the day 2 operations.

[1]: https://operatorhub.io/what-is-an-operator

I'm sure they take detailed close out photos and likely video of the entire handling process.

Really cool. It would be interesting to see a demo of an app that is clearly more bespoke, like your Tesla account, online banking, movie theatre ticketing, etc.

example analysis on a Dependabot PR: https://github.com/daniellockard/tiltify-api-client/pull/36#...

I commented elsewhere but our team built a custom static analysis engine for JS/TS specifically for the dep update use-case. It was hard, had to do synthetic execution, understands all the crazy remapping and reexporting you can do, etc. Even then it’s hard to penetrate a complex Express app due to how the tree is built up.

Totally hear you on the noise…but we should want to auto-merge vs ignore, no? Given the right tooling of course.

We’ve built a modern dependabot (or works with it) agent: fossabot analyzes your app code to know how you use your dependencies then delivers a custom safe/needs review verdict per upgrade or packages groups of safe upgrades together to make more strategic jumps. We can also fix breaking changes because the agents context is so complete.

https://fossa.com/products/fossabot/

We have some of the best JS/TS analysis out there based on a custom static analysis engine designed for this use-case. You get free credits each month and we’d love feedback on which ecosystems are next…Java, Python?

Totally agree with the author that static analysis like govulncheck is the secret weapon to success with this problem! Dynamic languages are just much harder.

We have a really cool eval framework as well that we’ve blogged about.

Thanks for sharing, really helpful to see your thinking. I haven't fully embraced FaaS myself but never regretted it either.

Curious to hear more about Renovate vs Dependabot. Is it complicated to debug _why_ it's making a choice to upgrade from A to B? Working on a tool to do app-specific breaking change analysis so winning trust and being transparent about what is happening is top of mind.

When were you using quay.io? In the pre-CoreOS years, CoreOS years (2014-2018), or the Red Hat years?

no, but still being super impressive. CEO of a company rebuilding a CAD rendering engine because they put an LLM on top of it. So you describe the mechanical specs of the part you want and it models it. Takes all the tedium out of modeling stuff. Super cool and many applications.

Same author talked about adversarial license plates that trick these cameras with a sequence of black blocks, discussed here in original form [1]. He is interested in breaking both the plate detection (ideal) and character recognition (good). The examples are pretty cool looking.

[1]: https://youtu.be/Pp9MwZkHiMQ?&t=1428

exactly. standard move when you aren't going to get a second shot.

We built and launched this product about 2 months ago, HN thread here: https://news.ycombinator.com/item?id=45439721

Totally agree that AI is great for this, it will work harder and go deeper and never gets tired of reading code or release notes or migration guides. What you want instead of summaries is to find the breaking changes, figure out if they matter, then comment on _that_.

If a giant chunk of the constellation can act as a truly huge antenna, what can you get from that? Super high resolution? Seek/dwell time on a target that is effectively infinite?

It requires you to go deep in both the code analysis and the research, which is expensive at their scale

And, as someone who's start up (EdgeBit was acquired by FOSSA recently) wrote a new JS/TS static analysis engine, it's just hard to get correct.

Rob from EdgeBit (YC W23) – super excited to bring our dependency autofix tech + static analysis tools to FOSSA!

You can read more on our blog: https://edgebit.io/blog/edgebit-joins-fossa/

For reference, Rocket Lab's Electron has a wet mass of 13,000 kg. This rocket is much smaller at 1,312 kg wet mass.

Curious if auto-merge philosophy changes between libraries and applications. The library definitely has a larger user base to break and a wider matrix of use-cases. IMO, auto-merge is more palatable for an application – do you agree? Especially when you're under SOC2/FedRAMP/etc.

How do you scale this besides keeping the dep list short? Are you reading every item or just scanning for words like "deprecated" or "breaking change"?

How does a customer use this?

Point it at a publicly available webapp? Run it locally against dev? Do I self-host it and continually run against staging as it's updated?

Author of the post, love to see this here.

Curious what folks are seeing in terms of consistency of the agents they are building or working with – it's definitely challenging.

Fair criticism. I was going for the colloquial usage of "you get one shot" but yeah I did read that Google paper the other day referring to these as zero-shot.

We were working on this at CoreOS before Kubernetes came about – called fleet https://github.com/coreos/fleet. Distributed systemd units run across a cluster, typically running containers or golang binaries with a super minimal OS underneath. I always thought it was cool but it definitely had its challenges and Kubernetes is better in most ways, IMO.

Really excited for text-wrap: balance. This will prevent a ton of breakpointing or manual line breaks for web headers.

This KILLS me. It's so frustrating. APFS is supposed to be great at deduping files and such, but in practice it seems like it really sucks. It's bad at both saving a file to the desktop and dumping a million npm files into a directory.

Ah right

You have to hold the fund on the ex-dividend date...

Pays out once in Dec. If you buy in Feb and sell in Oct, you're not getting your dividend although you earned most of it... If you had VTI, you'd get 3 of them.

The zero fund I am familiar with (FZILX) has a once-a-year dividend schedule which I'm sure nets them a lot of money, vs paying out more frequently. If you want to unload, you can only do it once a year without throwing away your earned dividend.

this is an area that is top of mind for me right now. you don't have to vendor your deps to get a detailed report of what changed, and bonus, how your app calls into it. just wrote about it: https://edgebit.io/blog/code-diff-reachability/

If you're looking to run software in a Nitro Enclave but work with it like a docker container or a Kubernetes pod, check out https://github.com/edgebitio/enclaver