skydhash

48 ms·

841.
by skydhash 6mo ago
> The technique appears to be new: I haven't found a proper write-up of this, nor of any other provider-independent solution (but I'd welcome a correction). To be frank, anyone that serious about security would probably log in
842.
by skydhash 6mo ago
I quite like the OpenBSD approach to Go and Rust projects in ports. They store all the dependencies and their hashes in the build recipe, not trusting the project ones. And they’re more readable. Here is jujutsu’s list of dependencies[0] an
843.
by skydhash 6mo ago
> And Gnome 3 doesn't really have anything to do with Linux. There's a very hard push on getting Gnome 3 aligned to systemd. Gnome is actually my preferred DE on Linux when I choose to use one. But compatibility with Unix syste
844.
by skydhash 6mo ago
Why can't they? Upgrading and rebooting is kinda the standard response for most security issues. So I would expect something like Ansible's playbooks for this exact scenario. You might also have it setup as a staggered rollout.
845.
by skydhash 6mo ago
The only reason I recommend this paper is because I encounter so many people that have a very myopic view of the software that they’re building. They are focused on individual features and how to quickly made them happen regardless of what
846.
by skydhash 6mo ago
It may, but it still requires careful annotations. So you should hope that you have not made an error there and described the wrong structure for the code.
847.
by skydhash 6mo ago
> that has led to a 10X increase in the speed of software development . > AI is the silver bullet - my output is genuinely 10X what it was before claude code existed. Those are not the same. You can add 5 different features to a pr
848.
by skydhash 6mo ago
I've just checked the man page for ffmpeg and they have a `-report` flag to capture the log. There should be no need to redirect stderr.
849.
by skydhash 6mo ago
The thing is you can actually write quite good C code (see OpenBSD project). The power of C is that it's pragmatic. It lets you write code with you taking the full responsibility of being a responsible person. To err is human, but we d
850.
by skydhash 6mo ago
> it's still an enormous pain to use packages as libraries even with apt and friends. And once you get outside of apt, you're in an endless hellscape I strongly doubt that. Especially with tools like pkg-config that let you g
851.
by skydhash 6mo ago
Because the way npm works means that as soon as a developer key got stolen, a lot of people got pwned. The key is the only barrier. Compare that with the average distro. You would have to compromise the developer infrastructure (repo or web
852.
by skydhash 6mo ago
curl | sh is more prevalent in Linux where you can expect a stable ABI from the kernel and sometimes GNU libc. No such things in BSD land. Packages are built against a release always. They don't maintain binary compatibility.
853.
by skydhash 6mo ago
They stole the axios's npm keys and they uploaded malicious artifacts. They did not takeover the axios's repo. The issue is with packaging and distribution, not with code.
854.
by skydhash 6mo ago
Ruby gems and CPAN have build scripts that rebuild stuff on the user's device (and warn you if they can't find a dependency). But I believe one of the Python's tools that started the trend of downloading binaries instead of b
855.
by skydhash 6mo ago
Not really talking about upstream. Most supply attacks I’ve heard about are stolen secrets and artifacts uploading. They’re not about repositories or websites being taken over. As the packaging scripts are often in repos, you detect easily
856.
by skydhash 6mo ago
IMO, the most sustainable version is either the linux distros/bsd ports/homebrew models. You don't push new libraries to the public registry, instead you write a packaging script that gets reviewed for every new changes. Anot
857.
by skydhash 6mo ago
I would love to see an AI try to make sense of GTK API. I may be wrong, but it seems when people are talking about easy glue code, they’re talking about web services API, not OS API, not graphics or sound API, not file formats libraries,…
858.
by skydhash 6mo ago
> Why does that content get ranked highly? Search engines only show a snippet of the content and that always looks convincing. It's the whole content that is off and, unfortunately, a few seconds/minutes can pass before you rea
859.
by skydhash 6mo ago
Have you ever wonder how people do it without it being a tedium for them? For things that have a visual elements like UI and UX, you can start with sketches (analog or digital) and eliminate the bad ideas, refine the good ones with higher q
860.
by skydhash 6mo ago
My one question for you: What’s your level of editor fluency? Because I would really like to know if there’s a correlation between claiming these kind of time savings and not using advanced features in your editor. My time is spent more on
861.
by skydhash 6mo ago
Lol, I developed for entrepreneurs who mostly wanted a working proof of concept of their ideas. I guess now you can vibecode them with SaaS for core technical needs.
862.
by skydhash 6mo ago
I remember Laravel with Socialite [0]. Laravel is what I usually reach for Web SaaS MVP. You only need a VPS and a managed database for testing out the market and can scale a lot without increasing expenses that much.. [0]: https:/&#x
863.
by skydhash 6mo ago
Code is formal and there are basic axioms that grounds its semantic. You can build great constructs on top of those semantics, but you can’t strip away their formality without the whole thing being meaningless. And if you can formalize a st
864.
by skydhash 6mo ago
> However, the best engineers I know are usually among the quickest to open an editor or debugger and use it fluently to try something out The Pragmatic Programmer book has whole chapters about this. Ultimately, you either solve the prob
865.
by skydhash 6mo ago
> Unfortunately I have a hefty share of war stories where a tech lead's inability to draft a coherent and clear design resulted in project delays and systems riddled with accidental complexity required to patch the solution enough t
866.
by skydhash 6mo ago
Code will never go away. Code was there before computer hardware and it will always be there. Code is (almost?) all of computation theory so unless we throw computers away, we shall always use code.
867.
by skydhash 6mo ago
VS Code has two things that worked well for it. Web Tech and Money. Web tech makes it easy to write plugins (you already know the stack vs learning python for sublime). And I wonder how much traction it would get if not Microsoft paying dev
868.
by skydhash 6mo ago
> But yes, the speed can really help. You can prototype and trial and improve the feedback loop. Based on what I’ve seen, prototyping has been always easy. You don’t even have to build software for the first iteration. For UI stuff you c
869.
by skydhash 6mo ago
Unless the team are seriously bad developers, many times, it’s the manager fault. As a hired consultant, you often benefit many freedom that team is lacking. As someone that has been hired as a consultant, one of those are meetings and not
870.
by skydhash 6mo ago
Are those people in contact with the customer able to make decisions regarding the roadmap or feature design? It’s a miserable position to be in front of unhappy customers while having no power to solve anything (which is why I tend to be p

More ›