HNHacker News
TopNewBestAskShowJobs

sorbits

625 karma · joined July 25, 2009

submissionscomments
sorbits··on GitHub investigating crypto-mining campaign abusing its server infrastructure
Do I understand correctly that the attacker forks a repository with GitHub Actions enabled, modifies the action, submits a PR, which makes GitHub run the altered action?

If so, I wonder if there is a legit need for running modified GitHub actions from non-collaborators?

Could also subject modified actions coming in via pull requests (from non-collaborators) to heavy resources constraints and timeouts.

sorbits··on Numi – Calculator app for Mac
On the Commodore 64 the OS was a REPL and ? was shorthand for PRINT, therefore you could type `? 2+2` and you would get the result printed.

This felt so intuitive to me that ever since, I’ve ensured my machines had ? do calculations in the shell (by aliasing it to whatever could do math).

sorbits··on Honda's now selling the first production car with level 3 self-driving
Another point is that there is a psychological difference between sitting behind the wheel in a vehicle knowing that around 10 in 100,000 people get themselves killed each year, and then sitting in a machine that kills 10 out of 100,000 people each year.

In the first situation, you feel in control, and at least think that you can do what is necessary to avoid that you end up in the statistics.

Personally I would be very skeptical about trusting my life to a machine that has a non-zero chance of getting me killed, even if the machine, on average, performs better than a human, because most of us think that we are better than the average driver.

sorbits··on Apple Card Disabled My iCloud, App Store, and Apple ID Accounts
Apple’s reputation system seems limited to iMessages, not regular text messages.

At least I only get the option to “report as junk” for iMessages (that are sent by people not in my contacts).

sorbits··on Apple Card Disabled My iCloud, App Store, and Apple ID Accounts
As you can only report messages you receive, and you probably need to report them many times before it has an effect, you are limited to hurting people you are in frequent contact with.

So seems a little self destructive.

sorbits··on Demoscene the Amiga Years Volume 1
> Is there anything today that feels like a underground scene that's "happening", that is acting as a technological vanguard, that is full of mystique, but that hasn't gone mainstream yet? The demo scene felt like absolute magic to me as a kid in 80s.

I think it is very hard to get the same feeling today with the internet.

The difference is that pre-internet, obtaining knowledge was a quest and often required a mentor or even a network, because a lot of knowledge was passed on by word of mouth, getting to talk with the people you admired from the demos you had watched, was a (long) journey (from being an observer to a participant), physical meetups were necessary for collaboration, etc.

I vividly recall my own journey, the people I met who taught me things, introduced me to other people, and of course the myths, like the first time I saw a demo with splines, and someone knew somebody who was at the university who could obtain a paper about splines…

sorbits··on A 10-second video clip sold for $6.6M
> So you own it, and assumedly have exclusive rights to sell it, but it's also very easy to copy and distribute

And this is also questionable. I mean, anyone can make a perfect copy and sell it. They cannot get that sale recorded on some blockchain, but who cares? There are no legal ramifications, because the legal system does not recognize some random blockchain as authoritative regarding ownership, instead most jurisdictions have their own (central) database about registered/copyrighted works.

sorbits··on MasterCard to open up network to cryptocurrencies
> BTC might still be a terrible system for international transactions but it's still 168 times faster than the one that exists now.

It is 168 times faster than what you currently use.

There are services like TransferWise who specialize in fast international money transfers.

I could imagine that part of your delay is because the bank your family use (in Croatia) does not themselves handle international transfers, so they go through an intermediary bank, only adding delays.

I have often done ~12 hours international wires from Wells Fargo (U.S.) to Asia, and here the delay could simply have been due to the time zone.

Within the European Monetary Zone I often see money arrive in 10-30 minutes (crossing borders).

sorbits··on MasterCard to open up network to cryptocurrencies
> And settlement happens in seconds to a couple minutes

That is incorrect. On average it takes 10 minutes to mine a block, but you have to submit the transaction to be included in the block, so > 10 minutes before it appears on the blockchain.

However, there are actually many block chains, as miners creates block in parallel, it’s the longest one that is the “official”, but the minute you see your transaction in a block, you do not know if this block will stay in the longest chain, so in general you want at least 5 new blocks, after your block, before it is considered “safe”.

So now we are talking about one hour to do a transaction, and that assumes that the network is not overloaded, because there is also a cap on number of transactions that can be included in a block.

All in all, it is a terrible system for fast transactions.

sorbits··on MasterCard to open up network to cryptocurrencies
Normally the government leverages its power to keep its currency stable. If a country fails at that, the residents tend to switch to another country’s currency, for example USD is widely accepted in countries with unstable currencies, and this makes sense, since a lot of commodity prices are set in USD.

What we have seen with crypto currencies are extreme volatility, not useful to base a country’s economy on, and because it is decentralized, no-one can really intervene to control this volatility, by e.g. changing the interest rate, and nothing is priced in crypto currencies, to sort of keep it tied to something.

The only metric for what a coin should cost seems to be the electricity/leasing of computers required to mine one. But even this metric is not good, as it is proportional to the size of the network, which is not a constant, and is likely to grow, as the price goes up.

sorbits··on Brad Cox has died
> All this in an application that has no exported functions

This is not strictly true: On macOS/iOS the OS/frameworks/plug-ins may call your methods, likewise with support for services, input managers, distributed objects, etc.

The responder chain is a good example of this dynamism: The input manager (responsible for interpreting key strokes) translate the user’s input into a message, e.g. “copy” or “insert A” and then finds the first object in the chain of objects that responds to this message.

This chain of objects may consist of standard framework objects (like a text view) or it may be your custom objects (like a view controller subclass).

In most other environments, you would have to create special interfaces for stuff you want to make public, this means only that stuff suffers the performance overhead, but you generally pay the cost in code complexity, see e.g. Window’s Component Object Model.

sorbits··on Simple Bank Is Closing
> That Splitwise entry isn't a bank transaction until maybe weeks later when I get a Venmo payment from a roommate covering several Splitwise requests, and for my budget I want to match up the $100 charge at the grocery store with the $50 Splitwise request with the $250 Venmo payment that was only partially for the $50 owed on groceries... not an easy problem to solve in a general way that makes lots of users happy.

When you spend $100 at the grocery store you make an entry with $100 subtracted from assets:bank, $50 added to expenses:groceries, and $50 added to assets:receivables.

Once your friend pays you $250 for your outlay, you add them to assets:bank and subtract them from assets:receivables.

It’s a little tedious in a spreadsheet, because each transaction results in at least two new rows, so it can feel redundant, but this is basically double entry accounting that can handle this and many other situations.

sorbits··on Simple Bank Is Closing
> Does your operating system have all its files directly placed in "/"?

The various directories all share the same disk storage. I would argue that creating multiple accounts in your bank is akin to creating multiple disk volumes.

If one volume runs out of storage, you have to resize it, and requires decreasing the size of another volume.

Just like if one bank account runs out of money, you have to move money from another account.

Though I am unfamiliar with the products mentioned, so perhaps these are virtual accounts that all draw on the same underlying “physical” account, and thus can have a negative balance without incurring overdraft fees.

In which case this would basically be a (simple) accounting app provided by your bank.

I could certainly see some value in simplified accounting added to a banking app, if however you are after “proper” view of your finances, a real double entry accounting system should be used, where you would be able to also track assets outside of the bank (like cash on hand), liabilities (debt), etc.

Personally though I do see value in having a secondary (bank) account for fixed expenses, but that is only because I am too lazy to do “real” accounting, so having this separate account makes it easy to view a history of all fixed expenses (for next year’s budget).

sorbits··on UPI: India's Unified Payments Interface
> I tell about UPI to my friends in Western countries, When they tell how easy and seamless Apple Pay has made their payments, they're often surprised that such system exists here […]

Western countries in your statement is probably mainly USA, as most of Europe has been using contactless payment via NFC for many years.

Apple Pay is effectively just using the phone’s NFC chip instead of that embedded in the debit/credit card, although it does bring one advantage: Because the iPhone has its own authentication system, you’re never asked for PIN code when paying with your phone, whereas paying with a debit/credit card will ask for PIN if the amount is above a certain threshold, or if it hasn’t asked for a long time.

I have been using payment apps in Asia, not India, but Apple Pay is definitely more seamless (or NFC enabled cards), as these only require you to hold them near the terminal, whereas a payment app require first being launched, and then either scanning a QR code and confirming, or bringing up your QR code to have the cashier scan it.

Don’t get me wrong: I am very much a fan of the concept of UPI, I am commenting just to clarify that universal payment interface with third party apps is different than NFC enabled payments, where I think it is really the latter, that your friends in Western countries are describing as seamless.

sorbits··on Unsubscribe: The $0-budget movie that ‘topped the US box office’
To me it sounds like they basically just lied to the maintainers of the BoxOfficeMojo list, because it’s a list of revenue, and their movie did not create any revenue at all, even though they rented a cinema and did five screenings, nobody paid to see the movie.
sorbits··on Show HN: Jumpfiles – get more done with fewer keystrokes
But you already understand makefiles, so try using both

What is it that ok files can do that Makefiles don’t?

I don’t buy your complexity argument, a Makefile can be as simple as:

  1:
    ./build.sh
Now you can run “make 1” and you have the same as “ok 1”.

Although most people would name this “build” rather than “1”, so you “make build”.

And the equivalent ok file would be:

  build: ./build.sh
So the only syntactical difference is that make require a newline after the colon.
sorbits··on Show HN: Jumpfiles – get more done with fewer keystrokes
It’s lighter-weight. Not as cryptic. Can also hook it up to your makefile targets, make them easier to access.

The only additional “weight” in the Makefile would be the name of the target, where you leave it out and have it default to 1, 2, … n, which I would argue is more cryptic, as “make build” or “make deploy” is always doing that action, whereas “ok 2” could be deploy in one folder, and push in another.

As for easy access, most shells should offer you tab completion for the Makefile’s targets, and your development environment may also pick up the existence of the Makefile and offer a way to run the targets.

Additionally Makefiles allow to setup dependencies, for example in your ok file example you have ./build.sh and ./deploy.sh as two actions: Clearly build should be a dependency of deploy, so “make deploy” implies building, rather than having to always do “ok 1 && ok 2”.

Lastly there is the ability to do dry-runs with Makefiles, once you start to setup dependencies…

sorbits··on Show HN: Jumpfiles – get more done with fewer keystrokes
For the last one, worth mentioning CDPATH:

CDPATH The search path for the cd command. This is a colon-separated list of directories in which the shell looks for destination directories specified by the cd command. A sample value is ".:~:/usr".

This works with tab completion.

sorbits··on Monorepo is great if you're really good
> That's the theory yes, but I was asking about real life. Did those early microkernel systems actually deliver?

According to Wikipedia “[MINIX] can also withstand driver crashes. In many cases it can automatically restart drivers without affecting running processes. In this way, MINIX is self-healing and can be used in applications demanding high reliability”.

While this kernel was originally written to teach kernel design, all Intel chipsets post-2015 are running MINIX 3 internally as the software component of the Intel Management Engine.

Another widely deployed microkernel is L4, I assume this has similar capabilities, as it also puts most things in user space and is used for mission critical stuff.

> Also, for anything stateful, like a filesystem, simply relaunching it may not be sufficient.

True, but simply rebooting when the kernel process crashes due to buggy driver code won’t be sufficient either :)

FYI when Apple introduced extended attributes their AFP (network file system) did have a bug that made the kernel (and thus entire machine) crash for certain edge cases involving extended attributes.

In that case, had their AFP file system been a user space process, I may still have lost data, but it would have saved me from dozens of reboots.

sorbits··on Monorepo is great if you're really good
> […] showed greater reliability than competing commercial microkernels

What is your basis for this claim?

I am only aware of QNX as a commercial microkernel (and real-time OS) and that is widely used in cars, medical devices, etc. with a strong reputation for reliability.

But for many tasks, Linux is good enough and free, which is hard to beat. But that does not mean that Linus is automatically correct in his statements.

sorbits··on Monorepo is great if you're really good
> Did this advantage play out in practice? If your filesystem module goes down then every module that talks to the file system module needs to gracefully handle the failure or it will still effectively crash the system.

If the file system process crashes then in theory the OS would simply relaunch it.

But your core services should be stable, it’s more about extensions, for example you may want to have virtual file systems (ftp, sshfs, etc.), which until FUSE wasn’t possible in the non-microkernel world.

As for how it played out in practice: I think microkernels lost early on because of performance and things like FUSE were created to allow the most obvious extension mechanisms for the otherwise non-extendable monolithic kernels.

sorbits··on Monorepo is great if you're really good
The advantage of microkernels is that they can be extended with “untrusted” code like hardware drivers or file systems. This runs in user space and thus any bugs in such code will not crash the kernel process.

So I agree with you that Linus is presenting a straw man and your comment shouldn’t have been downvoted.

sorbits··on Creating a Faster Jekyll
The project lead seems to be about ensuring the community thrives and #2 on that list is about documentation.

As alluded to in my grandparent, what I was looking for was a venue to submit my open-ended thoughts about how to transition Jekyll to parallel builds and lazy evaluation, which would spark a longer discussion about the feasibility of this (e.g. how will it affect existing plugins, would it be OK for some of them to break in 4.0, at least those relying on undocumented API, etc.).

Many open source projects have a mailing list only about development which is great for discussing such things, and that is what I was looking for, as sending an unsolicited email to the project lead (who is tasked with ensuring the community thrives) is just not the same thing as starting a discussion on a development mailing list.

sorbits··on Creating a Faster Jekyll
Proposing my code be used as the basis of Jekyll 4.0 would be a bit controversial and require a long discussion about pros and cons, a possible migration strategy for problematic plugins etc.

Call me old fashioned, but opening an issue on GitHub is just not my idea of getting in touch with the development team to discuss such things.

sorbits··on Creating a Faster Jekyll
The Jekyll code base would need major refactoring to allow for the lazy evaluation when using `serve` (and it would break some plugins) and likewise for the parallel builds because this is done with `fork` (as Ruby doesn’t have proper concurrency with threads due to the global interpreter lock).

So rather than try to refactor Jekyll, it would probably be a better strategy to use my re-implementation as the basis for a Jekyll 4.0, I’d say it’s 95% feature compatible with Jekyll and only about 2,500 lines of code.

While writing it, I did want to reach out to the Jekyll maintainers to talk about this option, but it wasn’t clear to me how to actually get in touch with them (e.g. no jekyll-dev mailing list that I could find), and I didn’t want to open an issue about this.

sorbits··on Creating a Faster Jekyll
As I already had content with templates in liquid and custom plugins written in ruby, migrating to Hugo would definitely have taken longer than doing the initial proof-of-concept, and despite the performance, I am happier working with Jekyll than Hugo.
sorbits··on Upgrading GitHub from Rails 3.2 to 5.2
What tools are you talking about?

The “problem” with ruby is that you basically don’t know if code is valid unless you execute it, whereas a statically typed language will enforce a lot of things during compilation and simply not allow the program to compile, if API is used in the wrong way, this could be calling private functions, referencing undefined symbols (simple typos), wrong number of arguments, passing a string where integer is expected, etc.

Additionally access control is limited in Ruby, which makes it difficult to release a library and have the language enforce that people do not rely on things which are implementation details subject to change.

sorbits··on Keeping a plaintext “did” file
I use the following to maintain a journal: http://jrnl.sh/
sorbits··on Afraid of Makefiles? Don't be
Thanks for the clarifications.

As for #1, what I do not understand is how a `Walkfile` allows me to use a content hash change to trigger a rebuild.

Your documentation says that a file list should be returned for `deps`, so how does the `Walkfile` communicate that e.g. `main.o` should be updated if `sha1sum main.c` is different than on last invocation?

sorbits··on Afraid of Makefiles? Don't be
> As a shameless plug, I built a tool similar to Make and redo […] https://github.com/ejholmes/walk

Your README’s example show `parse.h` as output from `Walkfile deps parse.o`, I think that is a mistake.

As for your build system (and comment), I have some questions:

1. How do you achieve using a deterministic hash as condition (and aren’t all hash functions deterministic)?

2. Why would you not be able to use mtime as a dependency? The only case I have run into is when the build depend on data from remote machines, but in that case, I think the proper solution is to have an initial “configure” step where you retrieve the data your build depend on and/or a build rule to update this data.

3. Does your build system execute the Walkfile for every node in the graph on each walk? Because that sounds like a quite noticeable overhead for larger projects.

4. Am I right in thinking that the primary advantage with your system, over make, is that a shell command is executed to obtain a target’s dependencies?

← PreviousPage 2 of 9Next →