AlbertoGP

Joined 13 years ago

Karma
2,095
Submissions
658
Member since
Dec 8
Personal:

  http://matracas.org
  [email protected]
Work:

  http://sentido-labs.com
[ my public key: https://keybase.io/albertogp; my proof: https://keybase.io/albertogp/sigs/FC3caIoRcNTC8tURVvHe_2MUkalyvcJ97B4QIkUp2Zo ]
View on Hacker News

Recent submissions

Comment · 11 days ago
> Looking at the PHP bug tracker the specific bugs were fixed. So my best guess is that the LLM was able to find alternative variants that still worked?

In the link from the comment to which you replied, buried deep below the comic strips and all that, there is this explanation which seems to confirm your guess:

> Right. We should explain from the start. My first step of finding if any long-lost siblings of Stefan's 2004 bug were still lingering in the codebase was to look for ways to exceed the memory_limit that allows us to throw a controllable fatal. I asked my LLM companion for help.

> The first useful finding was a way to bypass the smaller post_max_size barrier that normally prevents a request from delivering enough memory pressure to reach memory_limit. PHP compares post_max_size with the declared Content-Length before automatic POST parsing begins, but it does not enforce the same limit against the bytes it actually consumes. Apache can therefore pass a chunked HTTP/1.1 or lengthless HTTP/2 multipart request with no meaningful declared length. A configured input-decompression filter creates the same mismatch between the compressed length and the decoded stream.

> The second useful finding was a way to exhaust memory_limit with a multipart request that remains below post_max_size. An RFC1867 file-upload part with filename="" contains no file data, and PHP does not count it toward max_file_uploads. PHP still creates all six corresponding $_FILES entries: name, full_path, type, tmp_name, error, and size.

> https://calif.io/php2shell/#you-said-oom-fatal

Comment · 25 days ago
The article notes that it was written by an LLM from a conversation, and indeed it would benefit greatly from a good copy editor, but I still find it an interesting way of looking at the effects of LLM use now that the token-maXXing wave is receding:

> The term Demulsification describes the physical separation of a stable emulsion into its distinct chemical constituents. In software labor economics, high enterprise salaries acted as an artificial emulsifier, suspending supernumerary application bloat alongside core systems craft within the same engineering organizations.

> As AI tools collapse the cost of generating high-level glue code, this corporate emulsion is rapidly breaking apart:

Comment · 1 month ago
First I thought this post was someone looking for a job, then seeing that it was only a link to a company's About page and that your user name matches its co-founder's name it seemed as if you were offering a job and the question mark got lost somehow.

But then I do not see any indication in your website that you are expanding and given the current situation it sounds more likely that the link is meant as a portfolio to show what you have done lately.

Then again, the lack of a jobs/careers listing might be a way to prevent a flood of automated applications.

I would suggest to clarify it in any case.

Comment · 1 month ago
> After all that work, and the expense of getting an original Zytek interface, giving it away for free seems almost as socialist as Britain’s NHS. But the potential market is limited to fewer than 400 owners. “You don’t have to be a mathematician to understand the very limited upside of trying to sell something like this,” Radom explained. “The better approach is to increase the value of the car itself by giving away the technology.”

I learnt about the XJ220 from the Amiga game and many years later got to see a real one at the Technikmuseum in Speyer, Germany. What a beautiful machine!

Comment · 1 month ago
Comment · 1 month ago
Comment · 1 month ago
Comment · 1 month ago
Thank you for the clarification.
Comment · 2 months ago
The article does not promote it on security grounds:

> This article however will focus on the technical reasons why I won't be installing Omarchy yet. It boils down to what I call the security sweet spot.

> ... Most of the improvements I read about seem to focus on the desktop and UX, but I wish this humble list gives some food for thought about deeper OS architecture in terms of security and privacy.

Comment · 2 months ago
> The person who used to edit things for me has not been replaced,

I assume you meant "now" instead of "not": "The person who used to edit things for me has now been replaced,"

Comment · 2 months ago
Might be your ISP's DNS censoring the domain name, it happens to me for different ones depending on whether I am in Spain or in Germany at the moment when I click the link.

It might work if you manually change the TLD part of the URL.

What I did was get the IP address when it worked and add it to "/etc/hosts" so it works when on another network.

Comment · 3 months ago
> A town, street name or postcode were omitted, but a highlighted note – presumably written by a postie – chirpily added ‘Royal Mail, we never fail!’ to the front of the letter.

I think the note was written by the sender because the handwriting looks the same as in the vague "woman in Cornwall shed" address.

My guess is that it was intended to motivate Royal Mail to figure it out by quoting what might have been their slogan at some point. Now the highlight could have been added by a post office worker as a way of saying "indeed we never fail". The sender's style of higlighting things seems rather to be adding asterisks.

Comment · 4 months ago
Which one of the Markdowns should each browser support?
Comment · 7 months ago
Alright but where is the link? Can you put in a comment?
Comment · 7 months ago

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton