user5994461

> I'm a bit confused by these claims about the GIL? The expensive IO operations release the GIL.

FYI: The extraction of files is largely python code that doesn't release the GIL. (cf. the zipfile class from the python interpreter has large layers of abstraction with a massive overhead in python code).

Regardless, python packages are thousands of tiny files, so pip never gets to release the GIL for any meaningful duration.

If you were writing an app that only extracted large GB files, you could take advantage of some I/O operations and some zlib operations freeing the GIL for a bit. Unfortunately pip is the opposite use case, lots of tiny files.

> Interesting, I would be very surprised if this made a significant difference? but I'll take a look.

Optimizing empty files was actually quite worthwhile for pip, because about 10% of python packages are empty init files.

This might not give the same result for uv though. pip is fully linear, every single open/read/write/stat operation we removed was a direct performance gain. uv does parallel async IO, you could very well remove 10% of filesystem calls and barely affect the overall duration. :D

Also as a pip contributor. The only advantage of uv is to have support for parallel async extraction. If pip extracted multiple files/wheels in parallel without being blocked by the GIL, pip could easily match or outcompete uv.

I'm personally not looking forward to any deduplication/hardlink in pip. Hardlinks are very dangerous and system dependent.

It's very dangerous for empty files (init.py, empty.log yet not written). When the user edits one file, all files are modified simultaneously, all venv ever created by the user can be broken by editing one file, which is quite catastrophic.

It's also dangerous for small files with repeated content, for example random settings files that would contain a "1" or "true". Again, when the user edits one file, all files are edited and they were supposed to be different!

Hypothetically, a simple deduplication of binary files (.dll .so) should achieve 50% of the savings without significant drawbacks

I'd venture to say that pip extraction is more optimized than uv in at least one way. We have optimization for empty files (0 bytes) because there is nothing to write and checksum. uv doesn't seem to have the same optimizations, though I could be wrong, I just had a cursory look and my rust is not great. uv should probably review their treatment of empty files, it's counter productive to do any file system operation open/read/write because there is no content, it might be counterproductive to use any cache/comparison/hardlink if it takes more operations than doing nothing.

That's the one. Funny thing, it's not actually clickbait.

The bug made it to the kernel mailing list where some Intel people looked into it and confirmed there is a bug. There is a problem where is the kernel allocation logic was capped to 8 cores, which leaves a few percent of performance off the table as the number of cores increase and the allocation is less and less optimal.

It's classic tragedy of the commons. CPU have got so complicated, there may only be a handful of people in the world who could work and comprehend a bug like this.

If you're not aware, Intel has released a lineup of laptops, with some models having the GPU made by them and some having the same GPU made by TSMC. That makes the comparison very direct. TSMC can deliver nearly 3 times the power/performance.

GPU and CPU manufacturing is the same thing, same node, same result. GPU is always maximizing perf/power ratio because it's embarrassingly parallel, leaving no room to game the benchmark. CPU can be gamed by having a single fast core, that drops performance in half as soon as you use another core.

> I wonder whether the next bottleneck becomes software scheduling rather than silicon

Yep, the scheduling has been a problem for a while. There was an amazing article few years ago about how the Linux kernel was accidentally hardcoded to 8 cores, you can probably google and find it.

IMO the most interesting problem right now is the cache, you get a cache miss every time a task is moving core. Problem, with thousands of threads switching between hundreds of cores every few milliseconds, we're dangerously approaching the point where all the time is spent trashing and reloading the CPU cache.

> These sorts of core-density increases are how I win cloud debates in an org.

The core density is bullshit when each core is so slow that it can't do any meaningful work. The reality is that Intel is 3 times behind AMD/TSMC on performance vs power consumption ratio.

People would be better off having a look at the high frequency models (9xx5F models like the 9575F), that was the first generation of CPU server to reach ~5 GHz and sustain it on 32+ cores.

Not competitive at all. It's easily visible on the laptop lines, where the same GPU manufactured on TSMC has 3 times the power/performance ratio compared to the Intel one.

Putting more cores is just another desperate move to play the benchmark. Power is roughly quadratic with frequency, every time you fall behind competition, you can double the number of cores and reduce the frequency by 1.414 to compensate.

Repeat a few times and you get CPU with hundreds of cores, but each core is so slow it can hardly do any work.

Worthwhile to point out: The Cat5 cable required for gigabit Ethernet is merely twisted pairs with no insulation, which is pretty much a dumb basic cable (with 8 wires). That's why any cable can work in practice.

I don't know how possible it is to find a really bad cable (untwisted) and it might work on a short length anyway. (Your 1980s office cabling must have been 8 wires if you were able to get gigabit later, so it was far beyond basic phone wires or Cat1 from the time).

> Does anyone actually know why they don't offer a symmetric product like the niche fibre ISPs?

Short version: The UK regulator OFCOM defines ultrafast internet as 30 Mbps download speed. That's why UK internet providers (openreach and related) have deals starting as low as 30 Mbps and they can't be arsed to provide a faster speed (unless you pay £££).

> I believe that I have noticed that smaller games (~a few hundred MB or maybe a GB or two) will download quite a bit slower than large games, but I'm not very confident in that observation.

You can see that on the HellDivers screenshot, it takes 20 seconds to reach 500 Mbps, because TCP takes a while to adjust the bandwidth and is very conservative. TCP and home computers are not designed to make use of gigabit connections.

Old houses should have 1 extra socket in the master bedroom at the very least, because the master of the house was expected to plug a phone in there, back in the days. (my parents and grandparents all have one).

Incidentally, this is likely to be the furthest room on the furthest floor, so it can be a good place to add a wifi access point for coverage.

> the cables don't have a little chip or anything saying "I'm not suitable for high speed" the card will figure out whether this looks plausible and just do it.

You're actually wrong on all of that ^^

The cables actually have a rating to say what they are suitable to. See the markings on the cable: category Cat5/Cat5e/Cat6 + frequency range 100/250 Mhz + insulation UTP/FTP/STP/mix.

Ethernet cards don't negotiate, they typically only check whether the pairs can transmit any signal. You could end up in a situation where they go for gigabit and it doesn't work well.

Fortunately, the main issue for signal transmission is loss over distance. Ethernet is designed to work over 100m every time in a noisy industrial environment. You've got a pretty good chance for it to work on a short run, even with poor cables.

The alternatives being discussed ADSL/VDSL/G.hn actually detect the capability of the medium and adjust the transmission rates and frequency to give the maximum possible speed. IMO they are much more advanced technologically and much more interesting. (Ethernet is doing exactly 250 Mbps on one pair, G.hn can do up to 1700 Mbps on the same pair, automatically adjusted, the article is getting 1300 Mbps which is insane!)

It's a setup seen in a lot of new builds flat from the 2000s and 2010s, which is a very large amount of the housing stock in London for flats (There has been so many constructions!).

It might have detected the wrong country/city for you. Check Settings -> Downloads -> Region

Otherwise it's just your WiFi being patchy. I think Steam is doing "friendly" bulk download, it slows down before the connection is saturated, to avoid disconnecting your wife/mum/siblings watching Youtube or on a videoconference.

A view from the the debugging tools since you asked https://thehftguy.com/wp-content/uploads/2026/01/screenshot_...

I don't think there is anything too fancy compared to a DSLAM. It's just that DSLAM are low-frequency long-range by design.

Numbers for nerds, on top of my head:

* ADSL1 is 1Mhz 8Mbps (2 kilometer)

* ADSL2 is 2Mhz 20Mbps (1 kilometer)

* VSDL1 is 15Mhz 150Mbps (less than 1 kilometer)

* Gigabit Ethernet is 100Mhz over four pairs (100 meters). It either works or it doesn't.

* The G.hn device here is up to 200 MHz. It automatically detects what can be done on the medium.

> most of the people technical enough to set this up are also going to be technical enough to pull new cables.

It's really not that simple when you realize that the average UK flat has 3+ sockets and the average house has 5+ sockets (speaking from my own experience). Some daisy chained and some direct.

Besides, a lot of people are renting and cannot touch their wire.

Full quote. The problem is the price.

> One peculiar thing from the UK: Internet providers don’t truly offer gigabit internet. They have a range of deals like 30 Mbps – 75 Mbps – 150 Mbps – 300 Mbps – 500 Mbps – 900 Mbps, each one costing a few more pounds per month than the last.

Gigabit is so much more expensive (obviously it's gone down a lot). In London 2016, I had ADSL broadband at 16 Mbps for £12/month. That building didn't have fiber at the time. When fiber finally happened... it started as 30 Mbps fiber for so much more money.

> It's DMCA abuse because that process is only legal to use in case of actual copyright infringement, not just any content you might have a moral claim over.

I will reply to this comment because it's the easier to address, you're really hitting on the main misconception :D

It is incorrect to think that the DMCA form is only valid for copyright.

You need to contact the other party to start a legal dispute, you can do so by any available communication channels. The website is hidden behind cloudflare which purposefully hides the identity of the author and prevents any contact, except via a DMCA form. Burger King filled the DMCA form to get in touch with the author. It's merely a mean to legally contact the author and start a dispute, in the absence of better options.

It worked, cloudflare forwarded the form to the author (and the author decided to take down the article on their own). I really can't think of any reason why it would not be considered a reasonable and legitimate use of the form. All the better because it's an official legal form.

> Why do security researchers privately inform companies of vulnerabilities and wait for them to patch before public disclosure? Are they afraid of liability?

You don't publish because you don't want to cause harm and you don't want to be liable for it.

You need to realize that vulnerabilities don't exist in a vacuum. They grant access to computer systems that control the life of people (millions of people) including their personal information, passwords, passport photos, card numbers, jobs, paychecks, transportation, food, etc... which is very likely to cover yourself, your mom, your family, your friends as you deal with larger companies.

When you publish a vulnerability, it will immediately be used by bad actors that intend to cause harm to all these people, including employees and customers.

If you're wondering about that one from few weeks ago. One person from Intel noticed the article and confirmed the kernel bug, they ran some of the kernel benchmarks on their 24 core CPU and found up to 15% improvements when fixed (most difference on scheduler fifo benchmark, though 0% difference on most benchmarks).

I've ran the same on my computer at home and I also got double digit percent difference on a 32 cores AMD.

Sorry about that. It's a wordpress website on the official wordpress.com hosting, it's actually wordpress that is doing all this tracking out-of-the-box.

I will check if there are options to reduce that.

I would expect MSFT to process official legal requests they receive for themselves and their subsidiaries.

EDIT: After more digging, I found the contact, the terms of services here https://docs.github.com/en/site-policy/github-terms/github-t... are linking to this legal section here https://docs.github.com/en/site-policy/other-site-policies/g... that contains address and email for legal requests. This is incorrectly put in a page "Guidelines for Legal Requests of User Data" but it's not about data request, it's for all legal requests.

I've been trying to find a legal page with legal contact for GitHub since the topic was opened, with no success.

The only contact information I can find is this email for privacy requests, which should be good enough, they have to process legal requests they receive privacy@github.com

For Microsoft there is this Page https://www.microsoft.com/en-us/legal/policies AskCELA@microsoft.com

It's not clear from your messages whether you are a subscriber or your organization is a subscriber or both or neither. This affects how to access support and escalate and what claims you may have (your company should have a contract with access to enterprise support if they are customers).

It's not reasonable for GitHub to ban you with no justification and no recourse and make you lose your job.

Get a lawyer yourself. Or get your company to escalate through their support channel or legal.

Warning: We only have one side of the story. If you were posting abusive messages to Github in your name and/or in the company name, on company time. The company may review the messages and may find them abusive too and may fire you.

Your example of 10^8 combination, a 8 digit passcode on an iPhone 4, means a policeman would have to sit on a desk and try combinations for hundreds of years. This is likely to be determined as unbreakable protection by a court.

The document in page 11-12 goes into what may constitute cryptographic conventions.

It considers all recent iPhone and Android phones to be. It considers all systems for unlocking a mobile phone to be, as there is no other ways to access data on the phone otherwise, given normal technical knowledge and no specific software or hardware.

It can be, under the article 434-15-2 that is about that. The decision today is an explanation to French courts about how to interpret and apply this law. The context is a person formally arrested for drug possession and trafficking, who was formally requested under this law to unlock their phones (allegedly used for drug trafficking) and refused.

Rough quick translation: "Is punished by 3 years of prison and 270 000 euros fine, the action, for whoever has the knowledge of the secret means to decrypt cryptographic means likely to have been used to prepare, facilitate or carry out a crime, to refuse to submit said ways to authorities or apply them, upon official request under II and III of criminal code. If refused, and providing or applying said means would have allowed to prevent a crime or reduce harm, punishment is increased to 5 years and 450 000 euro fines".

French: "Est puni de trois ans d'emprisonnement et de 270 000 € d'amende le fait, pour quiconque ayant connaissance de la convention secrète de déchiffrement d’un moyen de cryptologie susceptible d'avoir été utilisé pour préparer, faciliter ou commettre un crime ou un délit, de refuser de remettre ladite convention aux autorités judiciaires ou de la mettre en oeuvre, sur les réquisitions de ces autorités délivrées en application des titres II et III du livre Ier du code de procédure pénale. Si le refus est opposé alors que la remise ou la mise en oeuvre de la convention aurait permis d'éviter la commission d'un crime ou d'un délit ou d'en limiter les effets, la peine est portée à cinq ans d'emprisonnement et à 450 000 € d'amende."

It seems to me this English article does not reflect the actual decision of the court in French.

See judgment here and attached PDF (in French) https://www.courdecassation.fr/toutes-les-actualites/2022/11...

The case was a person who was arrested for drug possession and trafficking, they were requested to give their passcode to unlock 2 phones allegedly used for trafficking, they refused then were further charged for not giving their password.

1) 15th May 2018 - First court ruled on drug trafficking but rejected the charges for not giving the passcode to unlock the phone, considering that a screen passcode is not a cryptographic mean to make the data on the phone unreadable or inaccessible.

2) 11th July 2019 - Escalated to the court of Appeal, same result.

3) 13th October 2020 - Escalated to the cour de cassation, who ruled that the law was incorrectly applied and sent back the case to the court. The cour de cassation doesn't rule cases, it only rules on whether a specific law was correctly applied by the court. (A decision of the court de cassation, like this one, explains how a law is meant to be interpreted and applied by the courts).

4) 20th April 2021 - The court of Appeal, repeated the initial result (home screen passcode is not a cryptographic mean to protect data) and dismissed the charges AGAIN.

5) Yesterday - Escalated to the cour de cassation AGAIN, who ruled that the law was incorrectly applied AGAIN, and sent back the case to the court AGAIN.

6) Future - This is pending another trial, from the court of appeal.

My understanding of the cour de cassation explanations, the home screen may or may not constitute a cryptographic mean to make the data unreadable or inaccessible, that depends on the phone. The court needs to rule on whether it is for that specific phone in that specific case.

For the HN audience who is technical and some of you actually make the phones. Most modern phones including all Apple and most Android have cryptographic means to protect all the data on the phone, it's effectively not possible to access contacts, messages, photos, storage, etc without having the home screen password. (Please consider that historically, it was often possible to take out the sim card or the storage SD card or use other tools to read the content of the phone, but not anymore)

My understanding is that the next ruling will have to consider whether these technical protections render the data inaccessible to the police. If yes and the data is deemed required for a criminal investigation, the suspect is required by law to disclose their passcode, or risk up to 3 year of prison and 270 000 euros.

Hello,

I was the first employee of HRT in London in my niche skills. The company never granted holidays to UK employees. The issue has escalated to impossible levels with the company terminating me and openly threatening me and my family to cover up.

There is no recourse. I am in the UK, the company is a billion dollar company in the US. It's not playing by the same rules. The only option I have left is to make a public disclosure.

I found my first job in the UK thanks to Hacker News. This is my blog, you can see my history and comments for half a decade. It's real.

P.S. Don't expect further comments from me, I am relying on British law to make an official public disclosure, I don't think it allows to engage in open discussions.

I am gonna join this opinion.

It's quite likely that one of the products takes over. Maybe one product had more traction with customers, or maybe one product is losing customers. Maybe the entire sales or development team will leave within a year, leaving one product in shambles. It's quite possible that one organization will be torn apart, who knows the terms of the acquisition.

Rent in London is high but little compared to the other international cities. My experience working for international companies is that a flat that goes for £2000 for me in London can go for $5000 for a coworker in NYC (maybe less now after the pandemic).

A factor of 7 is entirely believable for England (non London) and most of the EU.

Windows has the desktop.ini file to support some similar functionalities.