billyhoffman

Joined 16 years ago

Karma
3,831
Submissions
643
Member since
Jun 10
Field CTO at a security startup. Previously: Senior Principal something-or-other at public tech company. CTO of web performance SaaS company (acquired 2020). Founder of web performance startup (acquired 2015). Former web security researcher/public speaker.

I'm pretty findable.

View on Hacker News

Recent submissions

Comment · 7 days ago
Comment · 1 month ago
I mean I'm all for smaller CSS and faster web performance, but comparing the size / information density of the binary data of a 36 year old video game console with the verbose human readable text of a DSL used to control presentation is a bit unfair.
Comment · 6 months ago
Comment · 6 months ago
Sincere advice: Consider engaging with a community before trying to use it to promote your work.

You account is not even 3 months old. In that time you made 6 submissions, all of them appears to be to your own work. You have only commented 9 times, with almost all of them being comments about your work.

Comment · 7 months ago
I mean it's cool your created a new CMS and all, but beyond the look of the admin interface and publishing flow, I don't see how this is a "Spirtual Successor" to WordPress at all.

Its a CMS, designed from scratch, for a serverless world. It has a stricter, well defined API that plugins are forced to use instead of directly calling/overriding core functionality like in WP. But that benefit comes with a CMS that's built on top of, and seems to prefer, a ton of CF proprietary capabilities (D1 Databases, R2 for image/media storage, their workers for running things).

The web need less consolidation on CF, not more.

Comment · 7 months ago
For plugins, no.

1- EmDash plugins are written in TypeScript, not PHP

2- EmDash plugins have a specific permissions model, where they need to explicitly request access to certain things.

3- WordPress plugins just invoke things. EmDash plugins have a defined API you use to talk to different capabilitites

4- Those capabilities are totally different, and at a different abstraction, than what WordPress provides.

Beyond the look of the admin interface and publishing flow, I don't see how this is a "Spirtual Successor" to WordPress at all. Its a CMS, designed from scratch, for a serverless world, using CF proprietary capabilities (D1 Databases, R2 for image/media storage, their workers for running things).

Comment · 8 months ago
There's a nice graph in this Six Colors article:

https://sixcolors.com/post/2026/03/apple-introduces-colorful...

Single Core performance: the A18 Pro is faster than an M3!

Multi Core performance: The A18 Pro is essentially the same as an M1.

This balance seems right for the target market of a $599 laptop.

Comment · 8 months ago
For years Apple has been selling an M1 Apple MacBook Air for $649 via Walmart. It was still using the old wedge case design and is literally unchanged from fall of 2020 when it came out. It was the base model with 256 GB storage and 8 GB of RAM model, no upgrade options, no colors.

The price point was designed to get customers who would not pay for a $1000 computer into using a Mac. Sourcing those 2020 era M1 components, screens, etc, let alone M1's, was probably becoming a problem in 2026.

The Macbook Neo is a modern way to meet that price point. The video ad is more instructional about what macOS is, and how it would work with an iphone the customer may already have.

It does very basic Apple Intelligence (they show the photo editing in the video), but this is not for running models locally (they even show the ChatGPT native app and say "runs all your favorite AI apps")

People complaining about the 8 GB limit are missing who the target market is for this machine. Its a Mac, for $599!

Comment · 8 months ago
Minor suggestion. I found this because the UI looked cool and I wanted to see a more zoomed in view of it. But right now the "Take control of your network today" is the only place with a really readable view of the UI. Perhaps add a gallery of screen shots, showing off different features?
Comment · 8 months ago
Comment · 9 months ago
There are real problems with the Torrent files for collections. They are automatically created when a collection is first created and uploaded, and so they only include the files of the initial upload. For very large collections (100+ GB) it is common for a creator to add/upload files into a collection in batches, but the torrent file is never regenerated, so download with the torrent results in just a small subset of the entire collection.

https://www.reddit.com/r/torrents/comments/vc0v08/question_a...

The solution is to use one of the several IA downloader script on GitHub, which download content via the collection's file list. I don't like directly downloading since I know that is most cost to IA, but torrents really are an option for some collections.

Turns out, there are a lot of 500BG-2TB collections for ROMs/ISOs for video game consoles through the 7th and 8th generation, available on the IA...

Comment · 11 months ago
I built and run a search engine and a "Wayback Machine" for Gemini:

gemini://kennedy.gemi.dev

There are ~4K hosts and ~1M documents/images/files which make for nice playground with experimenting with crawlers, indexers, and more. Its a nice hobby. Lots of primarily static sites, and CGI is used to add some interactivity:

gemini://gemi.dev/cgi-bin/moon.py

Comment · 1 year ago
In the early to mid 2000s I would believe this. But for a major e-commerce provider in 2012? That seems vanishing improbable.

PCI DSS is the data security standard required by credit card processors for you to be able to accept credit card payments online. Since version 1.0 came out in 2004, Requirement 4.1 has been there, requiring encrypted connections when transmitting card holder information.

There’s certainly was a time when you had two parts of a commerce website: one site all of the product stuff and catalogs and categories and descriptions which are all served over HTTP (www.shop.com) and then usually an entirely separate domain (secure.shop.com) where are the actual checkout process started that used SSL/TLS. This was due to the overhead of SSL in the early 2000s and the cost of certificates. This largely went away once Intel processors got hardware accelerated instructions for things like AES, certificates became more cost-effective, and then let’s encrypt made it simple.

Occasionally during the 2000s and 2010s you might see HTML form that were served over HTTP and the target was an HTTPS URL but even that was rare simply because it was a lot of work to make it that complex instead of having the checkout button just take you to an entirely different site

Comment · 1 year ago
> Their response was better than 98% of other companies when it comes to reporting vulnerabilities. Very welcoming and most of all they showed interest and addressed the issues

This was the opposite of a professional response:

* Official communication coming from a Gmail. (Is this even an employee or some random contractor?)

* Asked no clarifying questions

* Gave no timelines for expected fixes, no expectations on when the next communication should be

* No discussion about process to disclose the issues publicly

* Mixing unrelated business discussions within a security discussion. While not an outright offer of a bribe, ANY adjacent comments about creating a business relationship like a sponsorship is wildly inappropriate in this context.

These folks are total clown shoes on the security side, and the efficacy of their "fix", and then their lack of communication, further proves that.

Comment · 1 year ago
During my last semester at Georgia Tech, I had one remaining 3000-level English credit I needed to graduate. During the last week to register, I quickly found an open class titled "Modern Authors" and signed up.

But when I attended the first day, I learned that Gatech's online registration system had truncated the class title. The full title was "Modern Authors: James Joyce", and I was the only engineering student in a semester long class about James Joyce, which I had to take it and pass in order to graduate.

It was... pretty good actually.

Portrait of an Artist as a Young Man was enjoyable, as were his short stories. His style was unlike anything I had read before and it was musical in a way. However, I found Ulysses impenetrable: It rambled, and was difficult to understand what was even being described in the text, let alone the significance of it. Mostly it was just strange. Thankfully the majority of your grade was based participating in class discussion. Talking about it, seeing how confused everyone else was, and trying to make sense of it all together was a fun way to spend an afternoon in Skiles.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton