jka

Joined 18 years ago

Karma
4,390
Submissions
1,833
Member since
Jul 13
I've enjoyed a good fourteen years (wow, has it really been that long?) on Hacker News, but I think it's time to take a break.

This account's password has been randomized, so if you see it commenting/updating in future.. that probably wasn't me :)

So long, and thanks for all the fish!

View on Hacker News

Recent submissions

Comment · 4 years ago
Comment · 4 years ago
It's a shame that (if I remember correctly from the video?) the bug that allows this is restricted to single-player; if not, I suppose it'd be possible to start the "outer" map as a network game, and then use the second instance of the game to join the outer instance over the network (including the possibility to walk around and find the original player character).
Comment · 4 years ago
Comment · 4 years ago
Per-employee distribution might tell one story; per-manager distribution might tell another.
Comment · 4 years ago
Offering an opinion: the tech industry is invested in the success of PyPI -- perhaps not always in a literal monetary sense, you're right, but certainly in an ecosystem sense.
Comment · 4 years ago
Ok: you've provided two requirements that I agree with:

- It should be possible to compare between two releases (I'd personally like to see a code diff, ideally with a complete path of the commits involved)

- Providing a reputation visibility mechanism (for publishers? author(s)?) across a series of releases is important

Those don't require user accounts necessarily, though. And responding to the end of your message: identity assurances, yep, those seem necessary; access management, I'm not so sure.

Comment · 4 years ago
Odd but serious question: could there be ways to distribute versioned software that doesn't require management of developer accounts (and the associated time-and-effort costs related to account takeovers)?
Comment · 4 years ago
That's a very good point regarding operational cost of handling account takeovers.

I'm not sure I have much useful commentary to add, but it does occur to me that a sufficiently-sized pool of software users could inspect changes (either at individual-commit-time and/or at tagged-release-time) regardless of whether each changeset is by the same author or in fact a different person every time.

Comment · 4 years ago
Choosing to use FOSS software to build products/services has always involved an element of caveat emptor, and even with the best of intentions, mistakes and errors are introduced sometimes, as they can be into any commercial software.

The technology industry (as the typical consumer of FOSS) generally understands that and introduces appropriate measures (dependency reviews, hiring developers with relevant experience, requesting professional security audits, keeping backups, ...).

Despite all those (sometimes expensive) measures, industry continues to develop (and indeed thrive) using FOSS, implying the trade-off is worthwhile. My guess is that it is in fact massively worthwhile, especially when comparing the technology economics of today with years and decades past.

Therefore I think it's reasonable to ask questions any time that barriers are raised -- however small -- on the production-side of FOSS. That's not where the bulk of the revenues are accruing.

(I also have a vague sense that 2FA could later be misused as an attempt to strongly-attribute blame, which again feels potentially unfair/unbalanced. if your business risk is high when upgrading packages, then you should review those updates more carefully and keep a record of the financial efforts and rewards)

Comment · 4 years ago

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton