HNHacker News
TopNewBestAskShowJobs

sgbeal

2,392 karma · joined August 19, 2013

https://wanderinghorse.net
submissionscomments
sgbeal··on Show HN: Orange Juice – Small UX improvements that make HN easier to read
This is pretty darn cool. i've not yet seen any mention of one particular quirk so will point it out: on Firefox it flashes between "normal" and "upgraded" mode pretty starkly (A) when switching pages and (B) when tapping "add comment" (which is apparently done via page reload rather than the HN API). i've no clue whether an extension/app has any influence over the timing of that so cannot suggest how it might be resolved, but will say that it's particularly jarring.
sgbeal··on Show HN: Orange Juice – Small UX improvements that make HN easier to read
> What features would you welcome?

1. Dark mode

2. (Now that i'm seeing it in action for the first time) inline responding. That said: this increases the weight of the page considerably (in JS code), so delegating it to the various third-party apps is arguably the better approach for this specific platform. (But now that i've seen it in use here i'll have to add this to the Fossil SCM's forum at some point, as this is sooooo much more comfortable.)

sgbeal··on Ask HN: We got 100 stars. A weekend project got 12k. What are we missing?
> What are we missing?

To re-frame the question: why do you care how many stars (presumably you're talking about github stars?) you have? Does the number of stars change what you develop or how you develop it?

Losing sleep over github star count is akin to losing sleep over up/downvotes on HackerNews or thumbs on Your Favorite Social Media Site. Tying one's self-worth to them, or one's self-image of one's own works to them, is... well, kinda sad.

> i might just be wrong about what the market wants right now.

Github stars are no indication of "what the market wants" - they're an indication of how many people (or scripted bots) have seen the project, thought "huh, interesting," and clicked the star so that they have a bookmark of it for later reference in their github settings.

sgbeal··on Microsoft terminated the account VeraCrypt used to sign Windows drivers
>> Linux is the only hope at this point for the future of computing.

Linux is the most obvious, but there are numerous flavors of BSD as well.

> and yet... still unusable by the mass majority of people.

That info is 20+ years out of date. Distros like Suse and Ubuntu made Linux "click, click, click, it's installed" more than two decades ago. i've watched complete non-techies switch to Mint Linux long-term, the only intervention from me (their resident techie) being showing them how to boot up the USB stick installer.

sgbeal··on SQLite in Production: Lessons from Running a Store on a Single File
> Does cp actually work on live sqlite files? I wouldn’t expect it to, since cp does not create a crash-consistent snapshot.

cp "works" but it has a very strong possibility of creating a corrupt copy (the more active the db, the higher the chance of corruption). Anyone using "cp" for that purpose does not have a reliable backup.

sqlite3_rsync and SQLite's "vacuum into" exist to safely create backups of live databases.

sgbeal··on Parse, Don't Validate – In a Language That Resists It
If the author is here: the link to King's article (https://lexi-lambda.github.io/blogs/2019-11-05-parse-don-t-v...) is incorrect (wrong date format). Try: <https://lexi-lambda.github.io/blog/2019/11/05/parse-don-t-va...> instead.
sgbeal··on Caveman: Why use many token when few token do trick
> There is actual research suggesting concise prompting can reduce response length substantially without always wrecking quality,

Anecdote: i discussed that with an LLM once and it explained to me that LLMs tend to respond to terse questions with terse answers because that's what humans (i.e. their training data) tend to do. Similarly, it explained to me that polite requests tend to lead to LLM responses with _more_ information than a response strictly requires because (again) that's what their training data suggests is correct (i.e. because that's how humans tend to respond).

TL;DR: how they are asked questions influences how they respond, even if the facts of the differing responses don't materially differ.

(Edit: Seriously, i do not understand the continued down-voting of completely topical responses. It's gotten so bad i have little choice but to assume it's a personal vendetta.)

sgbeal··on I ported yt-dlp to WebAssembly to create a 100% client-side media downloader
It crashes on the first video i tried:

https://www.youtube.com/watch?v=XO9FKQAxWZc

Relevant part:

> ERROR: [youtube] XO9FKQAxWZc: Sign in to confirm you’re not a bot. Use --cookies-from-browser or --cookies for the authentication. See https://github.com/yt-dlp/yt-dlp/wiki/FAQ#how-do-i-pass-cook... for how to manually pass cookies. Also see https://github.com/yt-dlp/yt-dlp/wiki/Extractors#exporting-y... for tips on effectively exporting YouTube cookies

The app provides no way to pass flags, though (and the browser is confirmed to be logged in to youtube).

sgbeal··on Stamp It! All Programs Must Report Their Version
> --moreversion

Suggestion: more conventional and intuitive would be: --version --verbose

sgbeal··on Get alerts of stolen bikes in your area – Register your bike in case of theft
Does this not also create a single point of data for thieves wanting to know where the best bikes can be found? One tiny data breach, or one disgruntled employee, and all those address/bike combinations are on the dark web?
sgbeal··on Brain scans reveal how to enters a psychedelic-like trance without drugs
> - if you have trouble with nose breathing like me, use Nose strips (that helps for me)

Just to clarify your intent there: do mean you _must_ breathe through your nose or that you _must_not_ breathe through your nose? (And what on earth is a Nose Strip?)

If this requires mouth-breathing, it's a non-starter for me :(. (Radiation treatment deleted many of my salivary glands, so my mouth dries out, to a painful degree, very quickly, when breathing through my pie hole.)

sgbeal··on Show HN: M. C. Escher spiral in WebGL inspired by 3Blue1Brown
Note to other viewers: getting the Escher-esque effect requires tapping a checkbox at the top of the page (easy to miss on a large monitor).
sgbeal··on Ask HN: How Do You Relax?
- Programming and/or documenting personal projects

- Tabletop games, though probably 90% of this means either tinkering with games (as opposed to playing them, e.g. creating inserts or new pieces for them) and/or hanging out on BoardGameGeek dot com.

- Reading, mostly anthologies of fiction from Wildside Press which collect many works from the early/mid 20th century, purchasable DRM-free for $1-2 each (for anywhere from 300 to 1500 pages). (Not associated with them, but am a long-time happy customer.)

sgbeal··on A new gene therapy is giving people born deaf the chance to hear
> So likely not helping with tinnitus.

Not directly, no, but here's hoping that it leads to something in the adjacent field of Tinnitus.

sgbeal··on What does Open Source mean?
FWIW: as someone who's been doing this since before the term "Open Source" was coined, i find this article to be both enlightening and insightful, cataloguing a wide range of diverse definitions/connotations of the term.
sgbeal··on A new gene therapy is giving people born deaf the chance to hear
Holy moley. Let's hope this leads to treatments for Tinnitus.
sgbeal··on 12,000 AI-generated blog posts added in a single commit
> I have to imagine that one quality post worth reading ...

As the Berliners say:

"Die Hoffnung stirbt zuletzt"

or:

"Hope is the last thing to die" (or "hope dies last" if one prefers a literal translation)

sgbeal··on Embarrassingly simple self-distillation improves code generation
> Give coding agents access to intellisense and syntax highlighting.

i once asked an LLM if it could ingest code from an interactive session more easily if it were in appropriately-typed markdown fences and it said absolutely yes, and that the syntax highlighting fed to it that way helps it immensely. i was downright shocked that syntax highlighting was anything more than noise for them.

sgbeal··on SQLite in Production: Lessons from Running a Store on a Single File
> json_extract returns native types. json_extract(data, '$.id') returns an integer if the value was stored as a number. Comparing it to a string silently fails. Always CAST(json_extract(...) AS TEXT) when you need string comparison.

More simply:

    sqlite> select typeof('{a:1}'->>'a') ;
    ╭──────────────────────╮
    │ typeof('{a:1}'->>... │
    ╞══════════════════════╡
    │ integer              │
    ╰──────────────────────╯
vs:

    sqlite> select typeof('{a:1}'->'a') ;
    ╭──────────────────────╮
    │ typeof('{a:1}'->'a') │
    ╞══════════════════════╡
    │ text                 │
    ╰──────────────────────╯
sgbeal··on Tell HN: YouTube history setting privacy implications
> One has to manually ... delete Your Likes and Dislikes on YouTube and

Is that really surprising? Does it even make sense to time-limit likes/dislikes?

Similarly for comments: in what use cases (disregarding malicious ones) does it make sense to automatically delete them after a timeout?

Consider what HN would look like if peoples' votes and comments disappeared every 3 months.

sgbeal··on Protecting Your Host from Malicious Dependencies
> Recommend you run "npm install" on your host then instead.

npm doesn't get run on any of my systems :-P.

sgbeal··on Ask HN: Which CLI tools do you use daily?
According to:

    $ history | awk '{print $2}' | sort -u
Slightly edited:

bash, bc, convert, cp, df, du, fossil, grep, less, tail, make, man, mc, mkdir, mv, ps, rm, ssh, scp, sudo, tar, gzip, unzip

sgbeal··on TDF ejects its core developers
> I read that as they’re ejecting all but 30 people.

i had to re-read the original sentence several times to figure out how you came to that conclusion but can see it now: "all people over/above/beyond [a limit of] 30..."

sgbeal··on The Document Foundation ejects its core developers
Please help me understand where the missing comma is supposed to be in:

> their Membership Committee has decided to eject from membership all Collabora staff and partners over thirty people who ...

Is it:

1) "eject from membership all Collabora staff and partners, over thirty people ..."

2) "eject from membership all Collabora staff and partners over thirty, people who ..."

:-?

Edit: that's from the article this post leads to: <https://www.collaboraonline.com/blog/tdf-ejects-its-core-dev...>

(Downvoted for asking for legitimate clarification? Seriously? Age discrimination _is_ a real thing, so there's no way of knowing, for lack of a comma, which interpretation was intended.)

sgbeal··on Modern SQLite: Features You Didn't Know It Had
> STRICT should be the default.

Somewhat ironically[^1], if STRICT were suddenly made the default, countless applications which work today would fail to work right after that update. SQLite is on billions upon billions of devices, frequently with many installations on any given device, and even a 0.001% regression rate adds up to many, many clients.

One of the reasons people trust SQLite is because, as a project policy, it does not pull the rug out from under them by changing long-held defaults.

[^1]: it's ironic because proponents of Strict tables frequently say that it improves app stability and robustness, whereas activation of Strict tables in apps not designed to handle it will, in fact, make them more fragile. Spoiler alert: most SQLite apps are not designed for Strict tables.

sgbeal··on Protecting Your Host from Malicious Dependencies
> Guessing you meant "python" rather than "docker", as docker is not subject to the same type of attack.

No, i meant docker. _All_ systems which pull dependencies from remote sources are subject to attack via malicious dependencies (and a docker image is one big mega-dependency made up of an arbitrary number of other (remote) dependencies).

Docker is not immune to container-escaping attacks, but they have proven to be relatively rare, thus the aforementioned blast-radius reduction compared to npm compromises.

(Edit: for that matter, all dependencies, remote or not, can be malicious, but remote dependencies are a particularly rich target for attackers.)

sgbeal··on Post-mortem of the EU Europa breach: A masterclass in IAM misconfiguration
> This looks like an LLM...

The word "masterclass" in the title is another clue in that direction. In the past 20 years i have only ever heard it used (frequently/habitually) by LLMs and many recent (LLM-era) articles.

Edit: or maybe i live an ultra-secluded life and don't see people using that word all the time. Gemini, in any cases, loves using that word and humans (in my experience) rarely use it.

sgbeal··on Modern SQLite: Features You Didn't Know It Had
> Write-ahead logging and concurrency PRAGMAs have been a given for a decade now.

All of the listed features except for strict tables and generated columns have been in SQLite for 10+ years, and those two are certainly not new. The JSON APIs were not made part of the standard distribution until 3.38 (2022-02) but were added in 3.9 (2015-10) and widely used long before they were upgraded from an optional extension to a core feature.

- Generated columns: 3.31 (2020-01)

- Strict tables: 3.37 (2021-11)

sgbeal··on Protecting Your Host from Malicious Dependencies
> To that end, I wrote a python script which isolates npm inside short-lived docker containers.

Somewhat ironically, docker is just as subject to this type of attack as npm, the main difference being that it (usually) has a narrower blast radius.

sgbeal··on TinyCard Text Game Maker
Then we have different definitions of PS/2 keyboard. For me PS/2 keyboard means one with the round plugs named for IBM's PS/2 keyboard slots (as distinct from USB slots). In later models the plugs were color-coded light green.
← PreviousPage 3 of 24Next →