smw

I think most people wouldn't call Go a systems language? Generally garbage collection lack of explicit memory access would put a language outside the category? Hard to write a device driver, for instance.

Thanks, Mark!

I think this is the answer. PHP stayed relevant for so long because deployment was simple and the per-page-load performance hit was reasonably low.

It's very fast and has a lot of work to show correctness.

I'm told modern Java (loom?) does. But I think that might be an exhaustive list, sadly.

Strangely, if you create multiple 'instances', they're actually all running as "containers" in the same vm with the same kernel. You can see this by running `wsl --system` and noticing that ps will show you processes from all running wsl distros.

Let's see your dcss stats [0] link if it's that easy?

[0] https://dcss-stats.com/

It's a _much_ better game now. You should try again!

Maybe you haven't used Wikipedia? It very definitely cites its sources. Material that doesn't have a cited source is removed regularly.

RIP Richard Stevens! I owe most of my early career to APUE

Google had only been founded a month before, I don't think they had vast lobbying powers yet!

Internet drug dealer doesn't really concern me, but he tried to have someone killed!

What are the costs like on those scanners? They look amazing!

The article is by Bernie Sanders, who's an American politician, no?

Any chance you might write a post or two about how to develop those relationships?

Hell, claude even makes that part of the standard workflow, with /compact; cleverly using the llm itself to summarize the previous context

or impeachment?

Or, you know, we could handle homelessness. I lived in Amsterdam for the last two years and despite walking everywhere and intentionally exploring, I never saw a person sleeping on the street, and the only time I was asked for money was an obvious tourist.

I don't think the NL government is remotely perfect, and they definitely are struggling to build enough housing, but their 'housing first' strategy towards homelessness seems to mostly work?

They don't reload them from scratch, for the most part. They force the app developers to design the app to serialize to disk at any point, and then rehydrate when needed. It actually makes developing for iOS much more of a pain in the ass, but it's great for users.

You can't really backup hardware tokens, either? It's quite possible to use something like bitwarden/vaultwarden/1password as a password manager, and you can "backup" tokens quite easily without being tied to a particular mobile/desktop ecosystem.

Parent is exactly right! For critical infrastructure an un-phishable 2fa mechanism like passkeys or hardware token (FIDO2/yubikey) should be required! It would remove this category of attack completely.

And passkeys or hardware tokens (FIDO/yubikeys) make it impossible

"2) mandatory 2FA (with the option for things like passkeys with hardware tokens)."

No, with the _requirement_ for passkeys or hardware tokens!

This seems to be a common misunderstanding.

The major difference between passkeys and hardware 2fa (FIDO2/yubikeys) and TOTP/SMS/Email solutions is that the passkey/yubikey _also_ securely validates the site it's communicating with before sending validation, making traditional phishing attacks all but impossible.

This is the way! Passkeys or FIDO2 (yubikey) should be required for supply chain critical missions like this.

"I mean, sure. So what does the solution look like? From my perspective it looks like a tool that is able to update your dependencies so that you can easily pick up bug fixes in your dependencies, which sounds an awful lot like a package manager."

Exactly! Who has the time or the discipline to do that manually?

"When using Go for example, you don’t need any third-party libraries to make a web server, Go has it all there and you are done."

Fine, now what if you need to connect to a database, or parse a PDF, or talk to a grpc backend. What a hilariously short-sighted example.

To me, this whole article just screams inexperience.

Or just golang?

Better idea, use something that is able to authenticate the server and disallows fishing, like yubikeys or passkeys! Much less challenging to secure than showing something on the screen.

It's generally fine if you force push a branch that you're the only one working on. In many projects, there's an expectation that the 'PR Branch' you create in order to make a github pull request is owned by you, and can be rebased/edited/force-pushed at will. It's very common to do things like `git commit --amend --no-edit` to fix a typo or lint issue and then force push to update the last commit.

This has it's problems, and there's a reason things like Geritt are popular in some more sophisticated shops, as they make it much easier to review changes to PRs in response to reviews, as an example.