ryanisnan

Happy birthday YC!

What does this mean? Is this super racist or am I just interpreting it that way?

To be fair to RUM pricing, there are also horrible incentives for workflow invocation based pricing models, or workspace count models.

I thought this would a stavros post. Thanks for your efforts!

The surrounding facts matter a lot here. For example, there are plenty of instances of governments hacking companies of their competing nations. Motives are incredibly easy to come by as well, be they political or economical. We also have no proof that aliens exist at all, so you've not only conjured them into existence, but also their motive and their skills.

Are you trolling me?

[flagged]

> Models from American companies at least aren’t surprising us with government driven misinformation, and even though safety can also be censorship

Being a citizen of a western nation, I'm inclined to agree with the general sentiment here, but how can you definitively say this? You, or I, don't know with any certainty what interference the US government has played with domestic LLMs, or what lies they have fabricated and cultivated, that are now part of those LLMs' collective knowledge. We can see the perceived censorship with deepseek more clearly, but that isn't evidence that we're in any safer territory.

I've experienced the same thing even looking straight at vehicles.

I enjoyed this read far more than I expected. It’s kind of a dark glimpse into a weird future.

Great job, you're going to go far Daniel.

Great points. I totally agree, don't use hard-coded static creds, especially here. But in reality, many services and/or API keys don't support OIDC or short-lived credentials, and the design of secrets in GitHub promote using them, in my opinion.

One really interesting omission to this post is how the architecture of GitHub actions encourages (or at the very least makes deceivingly easy) making bad security decisions.

Common examples are secrets. Organization or repository secrets are very convenient, but they are also massive security holes just waiting for unsuspecting victims to fall into.

Repository environments have the ability to have distinct secrets, but you have to ensure that the right workflows can only access the right environments. It's a real pain to manage at scale.

Being able to `inherit` secrets also is a massive footgun, just waiting to leak credentials to a shared action. Search for and leak `AWS_ACCESS_KEY_ID` anyone?

Cross-repository workflow triggering is also a disaster, and in some circumstances you can abuse the differences in configuration to do things the source repository didn't intend.

Other misc. things about GHA also are cool in theory, but fall down in practice. One example is the wait-timer concept of environments. If you have a multi-job workflow using the same environment, wait-timer applies to EACH JOB in the environment. So if you have a build-and-test workflow with 2 jobs, one for build, and one for test, each step will wait `wait-timer` before it executes. This makes things like multi-environment deployment pipelines impossible to use this feature, unless you refactor your workflows.

Overall, I'd recommend against using GHA and looking elsewhere.

Super interesting. It seems to get hung up on a few core concepts, like the size of the walrus vs. the limited utility of a pelican beak.

I don't disagree with you that people who design these things should be capable. That isn't what the post is about though, it's about whether or not they care.

I appreciate this post, and that HN clearly isn't moderating it in a way outside of their stated policies.

It is really hard to see the backpedaling of big tech with regards to identity politics as something other than virtue conformance. The sad and natural question that gets drawn is, where does the real virtue start and the performance begin?

This is a really uninformed article that comes off as just plain whiny. Taking the traffic curb example, it's entirely plausible that the person who designed that ramp isn't a cyclist, and didn't think about what it would actually be like to be a cyclist making that curve.

I hired a contractor once, who was a fantastic one. We were designing some changes to one of our rooms, and he had a proposal that would have made for some interesting, yet unfortunate corners in one of our rooms. It would have been more annoying and more expensive, but I don't think for one minute that it was because they didn't care.

They just didn't live in the space, they didn't spend enough time sitting in the problem to appreciate other solutions. I however had, and when I presented them with a cleaner solution, they ruminated on it for a bit and loved it. Saved a ton of time and money, and the end solution was better.

All it took was a conversation, and building a shared understanding of the needs and possibilities.

I don't think any of your points detract from the original argument. Having more dependencies just widens the attack surface area, and makes an attack like this easier, depending on the motivation and resources of an MCA.

This is awesome! I may try to get this working locally with my 6 year old son!

This is incredible. Nice work kiddo!

A couple of things I think would make the game a bit smoother are: - Feedback on the charging status, so I could more easily tell when I can use a move - Move the math prompt out of a modal if you can, and into the window, or something where I can click the answer

Keep it up!

How is that true? I use my macbook mic occasionally with the lid closed, and an external monitor.

Or a dual-headed whistle, with one head as that of Corey Quinn, and the other as Bezos...

I'm sure the creation of HN profiles filled with AI-created drivel is nothing new, but this is the first time it seems so obvious to me. It'd be great if there was a way to track these accounts...

Can you say more about what the pain points are?

I will be buying one of these, looks super rad! Nice work!

I think you're being overly critical. When it says that it adds support for Trusted Publishers, it links directly to this page: https://docs.pypi.org/trusted-publishers/.

This page clearly explains how this uses OIDC, and uses GitHub Actions as an example. At no point in my read did I feel like this was shilling me a microsoft product.

This strikes me as a really strange way to define EdTech:

> In this article, I’m defining EdTech as any student-employed, internet-connected digital device; this includes computers, laptops, tablets, cell phones, and smart watches. I am not discussing or evaluating the use of digital devices by teachers.

Aren't there a huge swath of self-defined "EdTech" startups aimed at tools for teachers, and-or use in the class, perhaps exclusively by the teacher?

I think the community needs more browser options, sure, but I don't understand why Kagi needs Orion. It seems like a distraction to your core competencies. I'm curious if the writing is on the wall for search alone?

You do not need your own browser. Keep Firefox alive.

This is the only thing that has me clinging to hope, is that last time it didn't turn out terribly. I have a sense of foreboding about what the supreme court will look like at the end of his term, and the consequences we'll have to live with for decades as a result. And a potential WW3, which seems more plausible on a daily basis. A large scale conflict feels almost unavoidable; I would prefer a cool, calm, collected individual at the helm when it hits.

Hey Taimur! Great job on the acquisition. Looking forward to seeing what you do next.