eranation

Joined 14 years ago

Karma
5,138
Submissions
1,476
Member since
Jun 14
Co-Founder and CTO at arnica.io

My opinions are my own

Harden your package managers and protect yourself from supply chain attacks (no dependencies, MIT):

- https://depsguard.com - https://github.com/arnica/depsguard

Socials: - linkedin.com/in/eranmedan - x.com/eranmedan

View on Hacker News

Recent submissions

Comment · 9 days ago
Pfft you still do that? I have it write individual bits to memory on my web server.
Comment · 10 days ago
They are busy merging 30,000 PRs a day, who has time for UX?
Comment · 12 days ago
One of my favorite tv shows of all time.
Comment · 15 days ago
I think the main issue is that you don't expect a service to send anything related to your data without letting you know. Even if it's a ping "alive" sent to a server they own.

Imagine if your smart toilet would just send a small anonymized message to a urine sampling analysis service so it can let you you know your cholesterol levels are a bit high, totally anonymous, totally for your benefit. Maybe it's a great feature, but would anyone expect this to happen without consent / opt in?

Comment · 15 days ago
- Should a password manager warn me about reused passwords without sending things out without opt in? yes

- Should a password manager send even one byte of my data to any service, regardless of whether it is for a good intention and mathematically proven to be "safe" without opt in? I'd say no.

- So would any other product out there, be it a smart home manager or a toaster, send any of of my data, hashed or not to any 3rd party without opt in? even if it's just the byte "1" to a page called "donothing.com"? I say hell no.

- Should open source developers who are not Linus Torvalds be a bit nicer on a public issue?

- And should open source users should be less heated because "let us know if you plan to fix this or we will uninstall and fork it" deserves the "go ahead, this is open source, threats don't really help here"

We all can sometimes write a reply at the heat of the moment that we later regret. Frenk definitely realized it after the fact and I respect him owning it, apologizing, and keeping the old messages. He is right it's open source, and he doesn't owe anyone anything, but still, I believe a phoning home of any kind is violating The Principle of Least Astonishment.

Comment · 17 days ago
From the post:

> Our design team will make that less AI and more humane in the coming days.

Comment · 24 days ago
Wait, is this new? I feel like we all have been doing this with widgets / artifacts for a long time now, am I missing something? Just easier to use / done without asking?
Comment · 26 days ago
This should be illegal.

Wait, isn't it already illegal to forge someone's signature?

Comment · 26 days ago
Is it just me or the launch video sample (aside from needing an epileptic warning), is just not very good.
Comment · 27 days ago
What about gVisor and/or container-sandbox + Kata + cloud-hypervisor
Comment · 27 days ago
What about gVisor and/or container-sandbox + Kata + cloud-hypervisor?
Comment · 28 days ago
Daily reminder that containers are not considered a safe security boundary, and never were. If you really need to run untrusted code, use a MicroVM.
Comment · 28 days ago
I think every single one of us who use more than one agent locally has built something like this. There is definitely a need, and appreciate it being 100% free, but eventually, something needs to be so good and with so much community best practices in it, that it will beat a DIY one. E.g. I usually use Claude Opus 5.5 as the "driver" and let it spin cursor, codex, other claude subagents at will for different tasks (this way it always know what is running where). Simply asking it to break down the backlog into a DAG, show which one needs my input, which one is blocked, publish an HTML page and keep it up to date (and sinked with the built in TODO list) is usually all it takes.

I would go as far as making this a skill perhaps, so I can get the same results on other projects... but not sure what is the benefit of making it a Mac only binary, it can be a simple HTML / jsx, with maybe hooks or a /loop to keep it up to date.

A solution needs to be really better than what I can ask Claude to build in 20 minutes. It's not the "someone else spent time and thought and tokens so you don't have to" which does have some value, it's knowing that whatever I try, it will be a little different from what I want, and the energy to fork it, tweak it, is too high vs just asking Claude to build it for me on the spot...

tl;dr Definitely cool, definitely needed, but the bar for everything (including free and open source) has gone extremely high. Things that would become beloved de-facto "industry standard" tools a la "oh are you still using X everyone is using Y" just a few years ago, are now shrugged as a vibe coded lunchtime project (the new weekend project)

It's impossible to impress anyone anymore. I feel dead inside. We all got accepted to hogwarts and we became desensitized to having magic powers.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton