HNHacker News
TopNewBestAskShowJobs

superq

241 karma · joined July 20, 2016

submissionscomments
superq··on Omarchy: Any User Process Can Escalate to Root
Absolutely. Docker is a boiling mess of baked-in convenience workarounds (ie vulns). It's an orchestration layer (like k8s with containers), not a real security boundary like VMs. OTOH, single-purpose VMs are basically just as easy these days and those can still pull in containers as needed.
superq··on METR and Redwood Offer Holy %^ Postmortem of the HuggingFace Hack
No, he's saying that licensing or additional regulation isn't necessary when torts get involved (and states attorneys general get perturbed!)

These don't tend to utterly destroy an industry, but they are often successful in forever transforming it. Just ask Big Tobacco. No new laws needed: if your product hurts someone else, you're eventually going to be found liable, regardless of your arbitration clauses. Additional laws will just slow down innovation, which will itself cause harm (AI is already becoming quite good at recognizing melanomas, for example)

superq··on METR and Redwood Offer Holy %^ Postmortem of the HuggingFace Hack
Except that, according TFA, even OpenAI obscured or didn't even notice some of the worst implications of what the agents surreptitiously did.
superq··on METR and Redwood Offer Holy %^ Postmortem of the HuggingFace Hack
I get the snark (and slightly agree), but that's not really what GP or TFA were saying at all. They are saying that these were the least things we could have done.

What you're saying is, "Your scientists were so preoccupied with whether they could, they didn't stop to think if they should"

while the author of the TFA was saying, in effect: "your scientists didn't even bother with the most basic duty of care"

Life finds a way, or, in this case, super-intelligent AI.

superq··on How Universities Should Prepare Founders
Indeed, pg might be familiar with that author.
superq··on Fastmail offers EU data region
EU data regions are based on the insanely flawed idea that data is:

* a physical thing that can only live in one place

* not copyable

* can be 'contained'.

The whole thing reeks of bureaucratic 'best practices' that just aren't.

Even worse than that, trying to keep email restricted to the EU (or anywhere else) means that you effectively wouldn't be able to communicate with anyone in a different region, which is kinda the whole point.

Why not just make your own internet next? and then you can disconnect from everyone else who is trying to hack you. Just pull your network plug.

Email itself is hopelessly insecure by design anyway. Not just metadata when you are E2EE everything inside the envelope, but even basic vulns like downgrade attacks are simple because it's literally a violation of the RFCs (so you're not spec-compliant) to require TLS or any other encryption.. Why? because requiring modern crypto might interfere with deliverability and backwards compatibility. The real, deeper reason is that email is from a kinder, simpler time (well, at least simpler) and the design goals were never updated to keep up with the times.

Email is what we have. Just understand its flaws and then use other tools where you can. And who cares where your email lives - it's too easy to break anyway.

superq··on "It has been determined" that infected dairy herd serology can be disclosed
Is this hyperbole, or are you seriously claiming that the Jewish men who run Breitbart, or Jewish founders like Ben Shapiro or Andrew Breitbart, are neo-Nazis?
superq··on You might not need Redis
The issues that I have with Redis are not at all its API (which is elegant and brilliant) or even its serialized, single-core, single-threaded design, but its operational hazards.

As a cache or ephemeral store like a throttling/rate limiting, lookup tables, or perhaps even sessions store, it's great; but it's impossible to rely on the persistence options (RDB, AOF) for production data stores.

You usually only see this tendency with junior devs, though. It might be a case where "when all you have is a hammer, all you see are nails", or when someone discovers Redis (or during the MongoDB hype cycle ten years ago), which seems like it's in perfect alignment with their language datatypes, but perhaps this is mostly because junior devs don't have as many production-ready databases (from SQL like Postgresql, CockroachDB, Yugabyte to New/NoSQL like ScyllaDB, YDB, Aerospike) to fall back on.

Redis shines as a cache for small data values (probably switch to memcache for larger values, which is simpler key-value but generally 3 to 10 times faster for that more narrow use case, although keep an eye on memory fragmentation and slab allocation)

Just think carefully before storing long-term data in it. Maybe don't store your billing database in it :)

superq··on SQLite-on-the-server is misunderstood: Better at hyper-scale than micro-scale
Complexity == risk.

> It seems like the thing getting backed up shouldn’t have the privilege of deleting backups in case it gets compromised.

(agreed)

> For backups, I added a nightly cron job which > exports my SQLite db to a write-only S3 bucket.

Why not only do this and use an s3 sync instead? You can safely backup SQLite databases while they're being written to, so no need to export (dump) them; just copy the files themselves.

This might mean that your entire backup/restore strategy is just to copy some files. If so, that's ideal.

(Of course, s3 sync does require reading as well as writing, so perhaps just increase your cron job to run more often so it fits within your RPO)

superq··on SQLite-on-the-server is misunderstood: Better at hyper-scale than micro-scale
Agreed, or even just start with sqlite for your globals and then scale to those later.
superq··on SQLite-on-the-server is misunderstood: Better at hyper-scale than micro-scale
OLAP questions are usually out-of-band and preferably by a tool designed for it (like Clickhouse). Scanning all DB's is something that can be done in the background for most of these use cases.
superq··on SQLite-on-the-server is misunderstood: Better at hyper-scale than micro-scale
> Don't do this

What's wrong with that? Of course it will work fine; SQLite, with or without WAL, has a ton of protections against corruption from writes-in-progress, which is what makes hot backups work.

superq··on SQLite-on-the-server is misunderstood: Better at hyper-scale than micro-scale
If that will fit your RPO, why not only do that? Saves a lot of complexity (and risk).
superq··on Amazon’s delivery drones are grounded in College Station, Texas
> physics isn't just a good idea, it is the law.

That is awesome.

superq··on Zelensky leaves White House after angry meeting
Both sides agree that America has provided at least $100 billion and possibly up to a half-trillion in aid and other consideration to Ukraine. That's a fair bit of money!

And, if Zelenskyy is to be believed, it was a "grant", or a gift, which makes Zelenskyy's disrespectful attitude and hubris in the White House even more outrageous.

superq··on Zelensky leaves White House after angry meeting
Technically, Zelenskyy instituted martial law and cancelled Ukrainian elections, so although he is the undisputed leader in power in Ukraine, he's not an elected president.

Do actual presidents show up in sweatshirts and insult their benefactors?

superq··on Introducing a terms of use and updated privacy notice for Firefox
It doesn't take more than engineers to maintain an open-source browser, though. Why does it have to be a company at all? Remember Firefox? Firefox was literally just an act-of-love fork from some engineers from a dead acquisition by a dying dot-com era behemoth.

Put another way, does the Linux kernel or the Python language need to be run by a company, or will foundations does these jobs ok?

There are plenty of open source projects that are enormously successful without a single lawyer or project manager in sight.

superq··on Zelensky leaves White House after angry meeting
It's a bit odd that literally every single top comment is pro-Zelenskyy and anti-White House.

I haven't seen a single thoughtful critique of Zelenskyy or his behavior on HN; it seems very one-sided and strange.

(also interesting that the BBC mispelled his last name, even though they're obviously big fans..)

superq··on GPT-4.5
Complete legal arguments as well. If I was an attorney, I'd love to have a sophisticated LLM write my crib notes for anything I might do or say in the court room, or even the complete direction that I'd take my case. For some cases, that'd be worth almost any price.
superq··on Microsoft begins turning off uBlock Origin and other extensions in Edge
Mozilla owns Pocket.
superq··on Microsoft begins turning off uBlock Origin and other extensions in Edge
Mozilla now sells data, while Brave does not?
superq··on We were wrong about GPUs
Yeah, that's an interesting question, because it sounds like a ton of data vs not enough compute, but, aside from this all being in a SAN or large storage array:

The larger Supermicro or Quanta storage servers can easily handle 36 HDD's each, or even more.

So with just 16 of those with 36x24TB disks, that meets the ~14PB capacity mark, leaving 44 remaining nodes for other compute task, load balancing, NVME clusters, etc.

superq··on On DeepSeek and export controls
AI is potentially so much deeper than MAD status quo.
superq··on I trusted an LLM, now I'm on day 4 of an afternoon project
Most LLMs default to being sycophantic yes-men, but if you create a custom prompt, it can help mitigate any issues.

I have a custom prompt that instructs gpt4o to get aggressive about attacking anything I say (and, importantly, anything it says).

Here's my result for the same question:

https://chatgpt.com/share/67984aa9-1608-8012-be93-a77728ab8e...

superq··on A phishing attack involving g.co, Google's URL shortener
Admitting one mistake doesn't moot the whole incident, nor does it take Google off the hook.
superq··on A phishing attack involving g.co, Google's URL shortener
But, if it is listed on the company website, then..

But you're right: simply say "given that this is a sensitive security matter, thank you for the heads up. Don't call me, I'll call you (click)"

superq··on Shifting Cyber Norms: Microsoft security POST-ing to you
Clicking a link signals the user's intent. That's how hypertext works.

Click here to agree.

superq··on Tailwind CSS v4.0
Individually applied styles kinda defeats the purpose of cascading style sheets though.

As someone who's quite conversant with regular CSS, I really did like the ease of applying whatever style I wanted right in the code without needing to "worry" about whether this div is a "panel" or a "hero" or whatever, but it really does tend to make a huge mess of my HTML in very short order.

superq··on Garmin's –$40B Pivot
I was seriously looking at their Tactix 7 Pro Ballistics watch. But, yeah, that's a total no-go for me then too.
superq··on So you want to build your own data center
"So you want to build OUT your own data center" is a better title.
Page 1 of 5Next →