avaq

Joined 10 years ago

Karma
86
Submissions
16
Member since
Nov 7
Functional JavaScript programmer;

[ my public key: https://keybase.io/avaq; my proof: https://keybase.io/avaq/sigs/7MkuxNuiCZFESUNepusZTXSGyaOzFBvwy6tAWMnAYSs ]

View on Hacker News

Recent submissions

Comment · 4 months ago
Imagine a feature in git, where when you merge, you get a single new commit on the main branch like you want, where the message could describe the changes in summary, like you want. But also: the commit contains a reference to the source branch so you can easily find it back, break it down, bisect into it, all without having to leave git or rely on data stored at 3d parties. That would be pretty neat! It's like, the best of both worlds, but all inside git!

Well. That's what a merge commit is.

Your approach is nearly identical to creating a merge commit, except the pointer to the second parent (the "original branch") is indirectly recorded via the PR link, instead of directly inside git.

If you create merge commits, then you have your "clean main branch" (via git log --first-parent), as well as the extended history with all the source commits (via git log). And as a bonus, merge commits are supported by every git host, and they work the same in all of them.

I think the whole "squash merge vs merge commit" discussions would be a lot less prevalent if --first-parent would be how git and git hosts displayed commit histories by default. :(

Comment · 5 months ago
The point is to dissuade mass token revocations.

Let's say the attack becomes hugely succesful and the worm spreads to thousands of devices. GitHub/NPM could just revoke all compromised tokens (assuming they have a way to query) stopping the worm in its tracks. But because of the Dead Mans Switch, they'd know that in doing so, they'd be bricking thousands of their user's devices. So it effectively moves the responsibility to revoke compromised tokens from a central authority that could do it en-masse, to each individual who got compromised, greatly improving the worm's chances of survival.

Comment · 1 year ago
> I wouldn't even be against requiring a professional certification organization for developers before they're allowed to publish software to the masses

Is Google that organization? Because they themselves have decided that they are. I think what people are worried about is that Google is positioning itself to be the judge, jury, and executioner within such a licensing framework, not necessarily the licensing itself.

> This is just to address malicious code.

Yes, and if Google had shown that it's capable of identifying and rejecting malicious code distributed via its own app store, then maybe their proposed expansion of that security program to the entirety of the Android app ecosystem would carry some weight. But as it stands, their Play Store is full of user-hostile and often malicious apps[1].

> If you publish software for a private group of people, there should be no restrictions. If you're publishing it on a platform that would expose your software to billions of people, get a license after id verification

But that's exactly the opposite of what Google is doing, here, and why people are mad. Google isn't adding a new policy to their app distribution platform (the play store that grants exposure to billions of users), but rather they are forcing ID verification on any form of app distribution: If you want any regular user to be able to install your code, no matter how small the audience, you'll need to first give your identity to Google, and obtain a (paid[1]?) license. So the restrictions do apply to "a private group of people" too.

The crux, and what has people up in arms I think, is the overreach of Google's peoposed licensing policy to cover not only their own app distribution ecosystem, but all others targeting Android.

Many technical users of Android consider it to be a general purpose computing platform, and they want to retain the freedom to install and run whatever software they trust.

Google should focus their supposed concerns about regular user's safety on the user-hostile apps that they allow to exist in their own app store, rather than grasping for broader control that they'll "probably use at some point but only for good things like user security".

1: https://f-droid.org/en/2025/09/29/google-developer-registrat...

Comment · 1 year ago
Uhm, don't do it, then. That's like arguing that the addition of the ternary operator is a bad one because not all if/else blocks look better when translated into it.

The goal is to linearlize unary function application, not to make all code look better.

Comment · 1 year ago
They can't implement function application without tanking performance? I find that hard to believe. Especially considering that function application is already a commonly used (and, dare I say: essential) feature in the language, eg: `Math.sqrt(2)`.

All we're asking for is the ability to rewrite that as `2 |> Math.sqrt`.

What they're afraid of, my understanding goes, is that people hypothetically, may start leaning more on closures, which themselves perform worse than classes.

However I'm of the opinion that the engine implementors shouldn't really concern themselves to that extent with how people write their code. People can always write slow code, and that's their own responsibility. So I don't know about "silly", but I don't agree with it.

Unless I misunderstood and somehow doing function application a little different is actually a really hard problem. Who knows.

Comment · 1 year ago
Comment · 2 years ago
Comment · 2 years ago

  Location: Rotterdam, the Netherlands
  Remote: Yes
  Willing to relocate: Unlikely
  Technologies: Functional Programming, React, Node.js, Linux, NixOS, JavaScript, TypeScript, Haskell, fp-ts, io-ts, effect-ts, rxjs, Deno, Docker, Git, CouchDB, MySQL, PostgreSQL, ElasticSearch, Fluture, Sanctuary, Ramda
  GitHub: https://github.com/Avaq/
  Résumé/CV: https://altshift.win/
  Email: aldwin/at/altshift.win
Functional programming expert looking for freelance opportunities. Over 13 years of full-time experience plus years of hobby and open source coding. My website has all the details.
Comment · 2 years ago
Comment · 3 years ago
Suggestion: NoTelly
Comment · 4 years ago
> I envisioned a plot, with a steep curve: x is time, but what’s on y?

This question really got me thinking, because I've always envisioned a plot as well, but the phrase always made sense to me.

I realized that I think of x being "mastery" and y being "knowledge required". On such a plot, you'd see a steep curve if one needs a relatively large amount of knowledge to progress to the next level of mastery.

I've never thought of it differently, and so never realized that the phrase is ambiguous until reading the article. Upon reflection, it makes much more sense plotting time on x and mastery on y when talking about learning.

Comment · 5 years ago
Yeah, I've heard about some of those cases. It's surprising how far copyright can be stretched sometimes.

What's more surprising is to see copyleft advocates positioned so strongly in favour of giving copyright that kind of reach. I think that in a different context, some of the cases you refer to would be used by these same copyleft supporters as examples of why copyright needs to be more weakly enforced, not more strongly.

Comment · 5 years ago
The way I see it, if you would use Copilot to completely (or largely) reproduce an existing work (software), then you would be infringing copyright. This is similar to using an AI to largely replicate a piece of music.

If you are using it to mix a snippet of code (from a sufficiently large code base) into a large code base of your own, then you are just remixing. That is not infringement. In music, there are entire genres based on remixing. You could even take it a step further and ask yourself: what is not a remix?

Comment · 8 years ago
Comment · 9 years ago
Thank you!

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton