ygjb

Oh shit.

Damn. I don't have grandkids yet but ok.

I didn't come to HN to confront my own mortality and age ;P

Those aren't museum artefacts, it's just retro.

Get off my lawn.

1. See a vuln domain reported, clone the site. 2. Wait for it to expire and snag it. 3. Republish the site with malware 4. Watch people dither about domain names and stuff instead of taking time to fix things.

GitHub.io domains, workers.dev domains, etc are all free domains.

Clever use and abuse of some startups can get you a free domain with a signup package that you can subsequently transfer out, but those are harder to find these days.

Seriously, the bad guys figure this out all the time.

The answer to Why is Congress concerned with details like this? is that the Supreme Court of the United States made it their concern by rejecting an established practice of deferring to expert regulators instead of electable people who probably lack the relevant knowledge and experience.

Turning off automatic software updates requires that you actively stay on top of what's installed and what's running, including patching with discipline to make sure your computer doesn't remain vulnerable. On the other hand, automatic updates is seen as writ large by software developers to install what they want without a clear and meaningful choice by users by bundling new features. See Google's integration of Gemini Nano in 2024 as an example.

I wonder what could possibly go wrong by setting the precedent for the state to execute people by firing squad on national news.

For me, boilerplate isn't scaffolding out getters and setters, or deferring to templated code generation; using refactoring tools that have been baked into IDEs or third party tools have been available for about 20 years deal with all of those nicely.

On the other hand, the "boilerplate" to stand up a secure web service with appropriate monitoring and scaling capabilities is a fair bit of work when you know that the immediate first users are enterprise businesses.

Building a service that meets or exceeds industry compliance requirements (internal or otherwise) is a lot of work! My harness, skills, and SOPs are set up such that if I spin up a new web-dev project, it gets all of the accessibility, internationalization, observability, authentication and authorization capabilities I would expect, appropriate to the tier. There is a lot of work done to build and implement those at the front end of a project, which I could skip over for experimentation, but for actual, deliverable work, it is a huge accellerator. In addition, by having that scaffolding and boilerplate in place, and a few skills and SOPs to support future feature growth, the agentic coding tools build with them in mind, and wire everything up as they go.

It doesn't replace the need to do the testing and validation, but it sure does break me out of the cycle of "fuck it ship" that takes over when I have my developer hat on, and the "holy shit, burn it all down and start over" that takes over when I put my security engineer hat back on.

shrug YMMV.