wofo

Could you elaborate on io_uring being a security disaster? The Redox article has the following to say:

> In its early days, io_uring did have a few security issues and memory leaks, but these have since been addressed

The article also links to a GitHub discussion where someone explains how io_uring is actually all right (see https://github.com/axboe/liburing/discussions/1047#discussio... ).

(I don't have a horse in this race, I just like being well informed and had reconciled myself with io_uring being secure as a consequence of the Redox article.)

> Given the severity and extent of the safety errors we found, and the process which produced them, Jepsen recommends users halt further deployment of ParticleDB and migrate to other databases as soon as possible. Consider checking and/or rebuilding database state from more reliable sources, if available.

I guess that's what happens when you vibecode a database...

People in this forum have... Opinions on Oracle / Larry Ellison. See e.g., https://news.ycombinator.com/item?id=15886728

What would be the point of Omarchy Server? I thought the desktop experience was the main selling point...

> We’re going to make the prophecy of The Year of Linux on the Desktop come true. All the pieces are now in place. Time to go all in!

Let's go :)

I'm curious, what would you be your translation?

Plenty of us who prefer working from home have a very rich social life. It's just not centered around being in the same building together with the people you happen to work with.

OP here. I didn't want to end the article in a preachy note, but an implicit point is that I'm doing quite well "despite" my policy of being honest. Monetary rewards are a poor substitute for living up to your values!

Besides... many players in the market actually seek people with "moral integrity" (or whatever the fashionable term is nowadays).

> especially in SV / startup circles

Lol, I'm increasingly wary of whatever SV / startup circles prefer nowadays... The shitload of BS is ever forthcoming.

Hahaha it could well be that people are merely hoarding newsletter emails. I hope readers derive _some_ value from the emails, but since I'm not doing it to drive up "engagement metrics" I don't really mind.

My blog used to be RSS only, because I thought email subscriptions were a plot of "content creators" and not something readers actually wanted... until one of my readers told me he really recommended adding email as an option. I did, and a surprising number of people subscribed since then.

Thanks a lot for the effort you've been putting into your comments! It's not often you come across someone on the internet who wants to have a honest conversation and at the same time has empathy with the real-world people at the other end of the cable. Keep it up!

> I’m not even Christian, and it’s plain to me that there’s massive variation even within one denomination’s congregants, let alone a Baptist vs a Lutheran

That's a fair point I agree with. Still, I've met many people who seemingly put all "flavors" of Christian faith in the same negative bucket (implicitly negating the diversity among Christians you call out in your comment). In light of that, my intention was to contribue to the conversation with the very same point you are making, backed by a data point from my own experience: that there are many Christian communities in which faith is practiced in a way that enriches your life, rather than shackling you to a cult.

> It seems like you extrapolated far beyond what he said.

Was it Andrew's intention to talk about Christianity in general? Now you mention it, he might indeed have been focusing only on people "raised by conservative Christian parents".

I liked the talk and was about to post a link to it in the $dayjob slack, but this threw me off as well. Still watched it to the end, and I still recommended it to a friend (along with the Youtube channel of the "Software should work" conf), but I'm saddened that the talk paints Christianity as something that is inflicted upon you and that you should strive to get rid of.

It's clear that he had a bad experience, and I'm nobody to tell him what to put on the slides and what to leave out, but my impression is that there are lots of believers out there who do cherish their faith, experience it as a very positive force in their lives, and draw from it the power to make the world a better place around them. Speaking for myself, I'd say faith has been a net positive so far in my life.

Here's some additional context on the phrase, for today's lucky ten thousand[0]: https://blog.codinghorror.com/falling-into-the-pit-of-succes...

[0]: https://xkcd.com/1053/

Rust is so powerful it rewrites your code to assembly on-demand every time you compile ;)

What a mess... It's sad that the community has to suffer the consequences of a company holding the trademark hostage.

The win in operating costs is impressive, bordering in the unbelievable (27x). Does anyone have a clue about where the win comes from?

Fun fact: some older articles were originally written using the term man-in-the-middle, but at some point were updated... except that the diagrams still use man-in-the-middle because search-and-replace doesn't work on images.

Controlling both the builder and the registry is super nice btw, because they can work together. If the builder knows some of the layers already exist in the registry, it merely has to create and push the remaining ones (without downloading any of the other layers, not even those from the base image). That gives you near-instant builds once the biggest layers are cached in the registry!

Since builds usually happen in CI, and pulls happen elsewhere (e.g., a kubernetes node), in the end layers are only downloaded when the resulting container image is actually used.

I can't comment on BuildKit, unfortunately, since I haven't used it. My experience comes from building bespoke systems (an image builder and a custom registry) fully from scratch, because we needed to have full control in order to achieve the performance we were aiming at.

I'd say the limitations are relative to your use case: `docker build` works well enough in most cases, but sometimes it's not the right tool for the job (e.g., you cannot use `docker build` inside an AWS Lambda, you can get way better performance from specialized tools in some cases [1], etc)

[1]: see my sibling comment at https://news.ycombinator.com/item?id=48301041

The idea is that, in many cases, you can create a layer "by hand" without running actual Linux programs. Layers don't need to be pre-existing, the only requirement is that they can be built programmatically (inside the browser, in this case). The demo actually does that: it "manually" creates a layer from the user-specified entrypoint script, then creates an image from the pre-existing base image's layers and the new entrypoint layer.

In a more real scenario, you can e.g., turn pip wheels into layers without actually using docker's RUN command. All it takes is to massage the data from one archive format into another, programmatically. This unlocks lots of potential (e.g., it becomes embarrassingly parallel to build a container image comprised of pip wheels). Combine that with a good layer caching strategy and a registry that takes advantage of it, and you can have near-instant container builds for arbitrary sets of pip dependencies.

I sometimes wonder why there aren't more bespoke container tools (like yours). Would people be willing to pay for stuff like what you have built, if someone took the time to "productionize" it? Or is there no market?

There are many ways to achieve this. If you are just copying artifacts, and not using RUN, then there is in principle no need to download the base image at all. Feel free to message me if you'd like to chat (email is in my profile).

Sounds like babysitting an LLM, with the alarming difference that this AI can kill you if you are not paying enough attention

Out of curiosity, is there a build setup you have seen in the past that you think could be a good replacement for this complex GitHub CI setup? Asking for a friend ;)

Update: now I've finished reading the article, my impression is that complexity is mostly inherent to this problem space. I'd be glad to be proven wrong, though!

Does this mean we should be migrating our SSH keys to post-quantum crypto right now?

Thanks! It's always scary when container technology fiddles with your network... I wonder how they can be at peace with such defaults. Another reason to stick with good old containerd units, I guess.

Surprised Teeworlds hasn't been mentioned yet (https://teeworlds.com/)