Recent submissions

Comment · 8 days ago
Yeah, that was my original point.
Comment · 8 days ago
IANAL.

Here's a random example from the Skyrim EULA:

   [You may] use one copy of the Software for your personal, non-commercial use on a single home or portable console or computer.
   ...
   [You agree not to] use or install the Software (or permit others to do same) on a network, for on-line use
   ...
   Installation on a network server is strictly prohibited, and this Agreement shall not serve as a network license in any manner.
Comment · 9 days ago
Some independent developers have stated they don't like that the experience is degraded on GeForce now (because of latency, control bugs, etc). They prefer that users are running the game in a way that they've tested themselves.
Comment · 9 days ago
This is somewhat incorrect.

It's a bit of a grey area, and it's not true that Nvidia needs to have a licensing deal. It's definitely against the license terms you get when you purchase a game through steam to run it on arbitrary hardware, but most (at least EU) courts would probably hold that if you own a game, you can run it on any hardware you have access to.

What happened was that when Nvidia just got started, they had an opt-out framework (for developers) instead of opt-in. At the time, some game developers felt like Nvidia was profiting off of their work unfairly, and posted publicly about it, and there was a decent-sized backlash.

However, in the meantime, other competing streaming platforms have gone with opt-out and there hasn't been much of an issue around it. I think most developers have come around to the idea that it increases game sales.

Comment · 9 days ago
I debated putting this editorializing in the title, but:

At $work we've been refreshing the Bun release page for days, wondering when they would push the fix. The PR with the change merged over 72 hours ago: https://github.com/oven-sh/bun/commit/ea6a2c7b7c98862627760d...

I'm not a security expert, but package managers seem uniquely vulnerable to MITM attacks.

I don't really see the point of spending $MM in tokens to create a software factory if you can't push security releases out in a timely fashion.

Comment · 9 days ago
Lots of positive stuff in this thread which I won't bother repeating. Instead, I'll add a few ambivalent points:

- Today, a lot of functionality still in Docker has been upstreamed into the (Linux) kernel, so containers can be much simpler (and rootless). Docker is still carrying around some of that cruft, which is what makes it slower and heavier than Podman.

- As a devex technology, Docker/containers have been massively successful, but not as infrastructure. Containers never became secure enough to run multitenant workloads without some other form of isolation, so they ended up being redundant with KVM (or gVisor, or a similar second layer) in production a lot of the time.

That second contradiction led to lots of inefficiency. For example, on Google App Engine, for years when you ran a deploy it would create a VM just to run a single container.

Comment · 10 days ago
Comment · 10 days ago
TL;DR:

The very urgent uv/certifi/etc releases (and yet-to-be-done bun release) are about removing the compromised CAs as described here:

https://emudhra.we-have-a-problem.com/

In other words, that software bundled the compromised certs into the binary, so upgrading it is the only way to remove them.

This is about Go proactively blocking intermediates. Which shouldn't strictly be necessary as long as your OS has removed or distrusted the CAs (on my laptop, macOS has done that, although it seems like it did so in a way not all tools have access to; for example, rustls-platform-verifier respects it, but rustls-webpki still loads the bad CAs from the system trust store).

edit: forgot I can't use code blocks on HN

Comment · 10 days ago
The eMudhra CA compromises had nothing to do with LLMs? But I love the vibes.
Comment · 18 days ago
Thank you for engaging with my point! I agree, actually. I think if good design patterns could simply be copied out of a book, LLMs might be better at software engineering.

My point is more about up-front investment paying dividends. To speculate, it seems like the reward hacking is not there for long-term thinking.

Comment · 18 days ago
Good interface design allows extending or changing component X without having to step on the toes of your colleague working on component Y downstream. It's absolutely essential.

Interface design is one of the things Claude is worst at in my experience (using it every day for the past year).

Comment · 18 days ago
Code quality - and its best friend, interface design - pay dividends in large codebases. The fastest moving and most effective organizations I've worked at are ones that focused on code quality from the beginning.

All software is broken, but LLMs seem to make the wrong compromises consistently when working in large codebases.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton