Recent submissions

Comment · 10 days ago
Cloudflare's blog post announcing its updated WAF rules directly implies the existence of in-the-wild exploits: https://blog.cloudflare.com/php-vulnerabilities-waf-protecti...

"Cloudflare successfully deployed multiple mitigations for all its customers while the vulnerability was leaked before the official release date and we observed attack traffic targeting our customers."

If that's not an in-the-wild exploit, it literally couldn't have been further away than one or two more iterations.

Comment · 10 days ago
I dunno, the post is awfully critical of Chainguard for leaking a fixed binary 6 hours early, but it was the research firm "partner" that "mistakenly" posted the dancing anime POC video over 24 hours early that created the mass panic (not to mention spawning millions of agents crawling the php codebase and trying to brute force a POC and probably using more energy than a lot of countries in the process).
Comment · 14 days ago
> I built
Comment · 19 days ago
I don't think the post was written by AI.

It has headers like AI blogposts, and features a lot of parallel structure like AI blogposts ("there's no <blank>. you <blank>"), but if you actually read it none of it reads like slop. To me anyway.

Comment · 20 days ago
I totally disagree? It seems quite human-written on the contrary; I don't see any strained metaphors, weird word usage or other AI hallmarks.
Comment · 22 days ago
The page crashes instantly in Safari on iOS on an iPhone 13.
Comment · 1 month ago
iTunes Match (these days it's just under the umbrella of 'iCloud Music Library', I believe) is probably the greatest value Apple offers.

I have a local collection of over 30,000 mp3s, about half of which is not 'matched', and a sizable chunk of which is not available on streaming anywhere, and I have it on all my devices seamlessly, included with the price of an Apple Music subscription. (which I also use for convenience for listening to things I don't have my own copy of yet).

Comment · 1 month ago
> You also can’t play RTS games on consoles.

Pikmin.

Comment · 1 month ago
I think the article starts out correct, but as soon as it recommends letting through `*.go` it becomes mistaken.

I'd say the correct approach is to include all your top level files (i.e. CMakeLists.txt, .gitignore, etc.) but also your top-level *directories*, i.e. `/renderer`, `/UI`, `/tools`, whatever.

Then, crucially, your build system must also prohibit in-source builds and require a dedicated build directory.

This way, it's presumed that everything in your source tree is pristine and correct, and can host a variety of file types depending on your needs (realistically, source trees can contain lots of things; data, json, images, text, etc.) while you also shouldn't have to worry about polluting it accidentally.

Comment · 3 months ago
IIRC, part of the order was for stuff like Steam achievements, upgraded assets, modern resolution support, other platform conveniences, plus other required changes to the game due to licensing agreements shifting, all of which made slapping it in a VM a poor fit.
Comment · 3 months ago
I know from people who actually worked on this that the process of actually getting the game running and following modern platform conventions was somewhat insane and tortuous, but interesting. Too technical for the Times to go into though I guess.

But yeah, essentially the whole port is done with binary patches to the original executable.

Comment · 5 months ago
I think the only way to interpret a one million line LLM-generated diff with no proper reviews as an employee of Anthropic is that my company no longer has an interest in understanding, or even looking at, its own code.

I'd be concerned that by jumping onboard with this sort of development process I'd lose touch with how to engineer software in a detail-oriented or remotely rigorous way.

It also makes me question what sort of value the entire Bun project ever had if a drop-in replacement can just be thrown in here like it's nothing. Why do we need all these JS runtimes again?

The AI bubble is so large that we've also forgotten how useless and dumb a lot of software engineering labor was even before LLMs came along. We were already in a bubble.

All that is to say, I think it's useful to reframe some conversations about AI as, "if AI can accomplish this task, was it ever actually valuable?" I think for some specific things, the answer will be yes, but the tech industry has been huffing its own farts for so long I really don't think anyone has sight anymore of what's economically valuable in a ground truth sense. Much like LLMs themselves, this confusion pollutes the entire well of discourse about their economic utility.

Comment · 5 months ago
A lot of the conclusions they're drawing in this post about the "agentic era" seem quite misguided and some don't really seem to make sense.

I have no doubt GitLab has too many employees and can benefit from being a more focused company, but it's tiring reading these layoff posts so chock full of buzzwords. I guess they're desperately hoping if they prognosticate about AI enough it will placate the investors.

Comment · 6 months ago
But can it play BlockDude?
Comment · 6 months ago
The most important thing is probably to use native UI controls, either AppKit or SwiftUI, rather than Qt or other frameworks, even those that espouse the use of native controls. That will get you a lot of things for free, generally.

Don't install invasive "helpers" or login items in weird locations; don't ask for huge amounts of system permissions without an appropriate introductory flow for your application, explaining what it needs to do before trying to install or get permission for something.

Bundle your dependencies appropriately; don't go fetch weird stuff post-install, the application should be designed so that everything is already there in the bundle.

Put application data in the idiomatic locations; ~/Library/Application Support, ~/Library/Preferences, etc.

Carefully consider what keyboard shortcuts your application uses; if you use the Escape key for something, or modifier keys, make sure it does something that makes sense on the platform and doesn't conflict with other shortcuts.

Don't bundle Chromium.

Generally: Respect the user as much as possible. Things should "just work." If there's a situation where it doesn't or something feels "odd", you should do whatever you reasonably can to fix that.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton