Unlurker|Replay|About
US Democrats Win Enough Seats Nationwide to End Presidential Electoral College (newrepublic.com)
•
For those getting excited: The Electoral College is established by the US Constitution, and abolishing it would require a constitutional amendment.
•
The National Popular Vote Interstate Compact does not abolish the Electoral College.
•
Yes, which is why National Popular Voting says that states send a rep to vote for whomever won the national popular vote. The states get to determine who they send by means of their choice, and if they want to send reps for the actually popular candidate, I think it would be mighty awful for the federal government to contravene that freedom of the states.
•
Maybe, maybe not. Presumably the courts would decide that: https://en.wikipedia.org/wiki/Constitutionality_of_the_National_Popular_Vote_Interstate_Compact
•
FTA: “ even without a near-impossible constitutional amendment.”
Want to get excited about this but I’m old enough to know they’ll probably revert to their fetish for watered down bi-partisan legislation and “taking the high road”. I’m willing to lose the pessimism if there’s a major change in leadership but not super hopeful about it.
•
Yeah that watered down boring giving people SNAP benefits, bringing insurance exchanges that helped millions, not going to the supreme court and making it the law of the land that people can be pulled over simply for their race. Ensuring women have the right to choose. Stopping government agencies from being like ICE and murdering people on the streets. Just that stuff. But both sides the same/Dems do nothing. Schumer recruited Talarico to run for the Senate. What leadership person are you promoting who has both grown talent and demonstrated actively herding cats like the Dem leadership does every day within the big tent party?
Image of Our Satellite-Choked Night Skies (kottke.org)
•
I want to thank those little guys up there for google maps, internet, tv, weather, rescues, whatever else they do. Put up some more.
•
ouch more dishes than a tapas bar
•
I remember when this was more of a theoretical problem :( https://news.ycombinator.com/item?id=24128726 compare when i made that comment in 2020 https://satellitemap.space/s/8Tu9xcHa with now https://satellitemap.space/s/R4YUwDQn
It is a bit ridiculous these days and it's only going to get worse with basically every major country needing to do a version of this for defence purposes. Go out tonight and just look at the sky for 5 mins and I'll guarantee you'll see a couple of satellites flying past. As with a lot of other technologies, the genie is out of the bottle and I don't think we're putting him back there again, this is the future.
•
What makes it "ridiculous"? I can go outside and look at the sky for five minutes and see airplanes flying past, does that mean our air traffic is also ridiculous? Of all the things to be outraged over... satellites provide extremely valuable services and are pretty near harmless. There's the pollution from the launches, some uncertain concern over putting materials into the upper atmosphere when they reenter, and that's about it. The thing people complain about most is that they get in the way of photographs of the starts. Which is annoying, but also seems to be easily worked around, and is pretty small potatoes compared to planet-wide communications. Your neighbor operating a leaf blower with a dirty two-stroke engine is harming you more than these satellites are.
A lot of people are going to look at that manually edited image, think it's a traditional long-exposure photo, and conclude that satellites are much more of a problem for astronomy than they really are. The photographer made a really neat picture, but Kottke is presenting it a headline that suggests its something else and generally without enough context.
•
Ironically, the same technique used to remove the stars and isolate the satellites could have been used to remove the satellites and isolate the stars. It would take 100X less effort to remove the satellites.
•
Why any less effort? Masking the stars out and masking them in should take the same amount of time and effort.
•
From the article: > Much of the time was spent painstakingly erasing stars, to reveal the satellites. Many more stars than satellites in every frame. Erasing a couple satellites at most is quick. Erasing every star in the sky and keeping a couple satellites is not.
•
Its parameters are very well described and the result is beautiful (visually), interesting, and provocative. Yes, people will misinterpret all sorts of things like this, but I don't know what else the author could have done besides not create it at all, for fear of... these accusations?
•
Photographer made a cool photo. Headline writer, a different person, used it to create misleading headlines.
•
"Photographer made a cool image" There I fixed it for you. This isn't a photo in any traditional sense.
it seems fairly evenly distributed besides the aggregation in the middle, what orbit would that be? why are there so many satellites there?
•
Most satellites in low orbit are Starlink, and most Starlink satellites are at either 43° or 53° inclinations, so it's probably those. These inclinations cover most of the population in the most efficient manner. Low inclinations don't cover people at higher latitudes. (Inclination is equal to the highest latitude that the satellite will reach, and then coverage extends a little further since they have some slant range.) Higher inclinations waste more time over unpopulated regions.
It looks like low earth orbit is a limited resource. Is it? If so, do Starlink and others pay rent? Should they (to ensure efficient use of the resource)?
•
LEO will be worthless soon enough. https://outerspaceinstitute.ca/crashclock/
•
Technically it is a limited resource, since there is only a finite volume. But we're nowhere near close to any notion of it being "full." Efficient rent would be approximately zero.
The hard part came next. Larsen spent about 45 hours layering the individual photos – each of which contained about 25 satellites – over one another, using Adobe Photoshop. Much of the time was spent painstakingly erasing stars, to reveal the satellites. This is less an "image of our satellite-choked night skies" and more "a completely mendacious image produced using Photoshop".
•
The photographer was completely transparent about how the image was produced and what it means.. how you manage to color this as dishonest is beyond me.
You are being uncharitable. There is nothing misleading about this, or any other, nightsky timeseries image. It claims to show the paths of satellites over 2 hours, and that's what it does. You have to edit things like this to reveal the signal and keep relatively constant elements from overwhelming the result. Astronomers do this exact same thing (erasing things that obscure the subject over time). Even if I were to be as charitable as possible to your interpretation, "mendacious" is way too strong a word, and implies an unreasonable bitterness.
•
No it is correct. I dabble in astrophotography. The purpose of stacking hundreds of photos is to get rid of noise and unwanted trails like this. The effort involved here is to do the opposite, specifically make sure things that are in a single exposure show up in the stack.
•
If you do the exact opposite then? You take a very long exposure and you mask away the satellite trails and post the image as "image of how the satellites don't pollute the sky".. that's the exact same thing in reverse. Both can't be non-misleading right?
•
The image itself is interesting, but the context in which it’s presented in this article is dishonest. The headline is the worst offender, saying that the skies are “choked” with satellites. The headline is misleading. The photo alone is interesting with the right context.
•
The guy who actually made the image seems to just think it's cool: "I knew if I carried on it would look even better and more impressive in terms of satellite numbers." But the framing from others is terrible. "Who gave anyone permission do this?" Um, every single satellite ever launched has gone through government approvals. Sorry if you didn't start paying attention to the world of space flight until it ruined your attempt at photography, but that's on you.
•
lol what. Regular citizens don’t get a say on satellites and many would prefer we didn’t put so many up. “National Security” will trump any citizen concerns every time.
•
Not sure how you saw "government" and read it as "regular citizens," but do go back and read it again.
•
To be fair, the majority of satellites now seems to exist because "money" will trump any citizen concerns every time.
The point of the image is to make a point. Art is provocative. Our skies are choked as anyone who makes Astro images will tell you.
•
> Art is provocative The misleading part is that readers don’t see that it’s provocative art until you carefully read the details. It’s presented like documentary evidence of what the problem looks like. The photographer might not have intended it this way, but the writers of this post took advantage of that.
•
The first sentence literally says it’s a multi image composite so…
I really like the photo and what it represents. We're growing as a civilization and I think that's beautiful.
•
Meanwhile I’d like to be able to enjoy the stars without Elon’s shit in my face. Can’t wait for the Coca Cola advertisements some day.
•
The rest of us enjoy having high speed internet globally.
An astronomer would presumably not erase the stars .
•
Why not? Stars are boring, the cool things are galaxies.
September in Servo: <progress>, rounded rectangles, and more (servo.org)
•
One of the things I find really helpful about servo (as a casual user) is the breadth of pre-built releases they have. It makes it much more feasible to actually use on a day-to-day basis, especially on android
•
wow! they already have android apk? Awesome!
•
login form on HN does not work, but servo is working! :D
•
I want servo the succeed
MCP Explained (mcp-explained.com)
•
MCP is that kind of thing a manager comes up to you with and says "ARE WE USING MCP? it's the latest thing" and you roll your eyes, hunch over, stare at your screen and say to yourself "no, we're using strings, just strings." as you watch them drift to their next prey, you see scrawled up in their hands a note with crossed out acronyms. NFT. Web3. AMP. SOAP. IoT.
•
The best thing about MCP is its almost impossible to use for most people except developers. Therefore ensuring our existence. Don't believe me? Try connecting Blender to Codex.
•
MCP honestly seems like something thrown in there to keep devs relevant. Just like us to take something and limit it back to being useless until we implement the feature (tools). The real "race to market" winners will just throw the credentials into the SQL connector and let 'er rip like a real man.
Are MCP calls composable in e.g. codex yet? e.g. can a model pipe a jira MCP call to grep or sed, or at least into a file? Last I looked at MCP it was just a vastly worse version of curl, .netrc, and some short text files describing calls (which are themselves greppable). Is there anything useful beyond that that I'm missing?
•
pi harness composes them just fine if you're specific about what you want to do. "Find the latest prod JIRAs and analyze the related logs"
Depending on use case, would start with just solid HTTP APIs, then a simple CLI to consume them, then add MCP using the new spec. Build slowly only adding new access protocols as needed. Be surprised how far apps can get with just solid & well documented APIs. Modern agents are smart!
•
My suggestion is to just let the HTTP client itself be the MCP server. Then you don't need an MCP server per service anymore, you just need one and a whitelist of authorized services.
For coding agents I agree with you, but people are building for more than just developers now. The idea that a user facing service would give their agents shell access is kind of horrifying, as you then make it possible for prompt injection to mean a system take over. MCP has its place. It should not be the default for many use cases, but if you need to expose specific tools in a secure way to agents that are not trusted to run shell commands then MCP is great. Developers need to think beyond their own use cases and consider architecture patterns if they're going to build, not just consume, AI systems.
•
I do agree with you and was not aware of those reasons before, thanks for clarifying.
It's literally JSON-RPC I'm not sure why you say it's a REST API. It's not even close to a REST API.
•
In this context/application I see a lot of similarities. They both provide stateless RPC methods and human readable metadata that makes them easy to route. You could ask why json-rpc was even necessary for 2.0. I think mostly just for stdio and backwards compatibility.
I wish tech companies knew more about me (rakhim.exotext.com)
This! I don't mind tech companies knowing things about me. If I don't want them to know, I browse in Safari's anonymous mode. But I hate it when they suggest things that I don't want.. show me stuff I have already bought.... show me things I already decided against... show me stuff that is not in my price range. That's annoying. I don't mind a good, paid recommendation. I just don't like all the bad recommendations.
•
The issue of you already buying something is interesting to me. It’s so obvious that they’d fix it if it cause revenue loss. My guess is that conversion for any ad is so low that you’re indeed more likely to buy a lot of products twice rather than buying something totally different.
You want them to advertise things you won’t buy; that’s far less bad than them advertising things you shouldn’t buy but might if pushed, which is the ultimate goal of the corporate mind control machine.
•
You think of it as the corporate mind control machine. I think of it as "oh, I am looking for a new car and completely forgot Subaru is also making cars that fit my profile - I should test drive them as well".
This happens on places like amazon too, that know I bought a toaster, then show me sponsored results for 50 more toasters.
•
[delayed]
i worked at google for 18 years. they certainly "know" you don't like ads, and they definitely don't care. they may also "know" your consumer account is a safe place to dump all the non-converting impressions they need to burn somewhere, but even if you could prove that, they wouldn't care. tbh, whenever somebody comes at me with tin foil hat assertions i point to this exact hilarious scenario as why i do not believe they are actually surveillance-oriented business a la the palantirs of the world. i think their ideal state is 100 trillion anonymous bank accounts they can pull from, not 8 billion unique human profiles to care about.
•
Google's culture is to just burn ungodly amounts of disk space as a kind of flex for how important a team's project is. So every Google service is collecting as much as it can, all the time, with legal counsel and some "oh we value your privacy" sophistry going on. If you still work for Google I recommend reading privacy design docs for random large scale services if you're able. It's very telling what the priorities are. And I agree that they mostly don't want to be Palantir-like. They mostly don't care about people. They care about advertisers . Any new targeting mechanism they can offer advertisers they absolutely will. The problem is they sit on a gold mine of very, very sensitive personal data (most of it "anonymized"). Most of it can be de-anonymized with little work. Worse, they will absolutely cough it up to the government when required. They also have a lot of motivated engineers thinking of ways to try to use said data to "improve products". Like the whole saga of doing activity inference for Android users. You don't even want to know about how stupid and creepy that is/was.
Loved that little rant. You had me at "I skip every single electronic track with vocals".
•
Same... I had a moment of "wait, did I write this??"
Targeted advertising will never feel good, and it's not due to lack of information. Consider the following: - People who know you very well (friends, family, spouse) often buy you bad gifts you need to pretend to be happy to receive. - Ultimately, advertisers aren't _merely_ trying to find things you want. They're trying to get you to buy _their_ things. So someone selling (let's say) hamburgers might be savvy enough to avoid vegetarians, but after that how would they possibly narrow it down? Not everyone wants to try out a new burger place, or even cares about advertising when it comes to restaurant suggestions. ie, they're trying to coerce you into wanting their products, and no amount of targeting can really fix that problem. Also, targeting is difficult.
•
Whatever Meta is doing on Instagram is next level advertising. It's almost like rather than identify who I am, they identified the social niche stereotype I identify with, and then pull ads from that reservoir. So while Google is trying to get me to buy discrete transistors and push cart tires (work related stuff), Meta is trying to get me to buy bespoke Icelandic wool socks, artisan gummy edibles, and hand made ceramic table ware.
•
> ie, they're trying to coerce you into wanting their products Im not sure if you mean “coerce” literally but if so this is overkill. Maybe “persuade” or to be more critical, “manipulate”?
That's true for the advertising companies, but Google or whatever advertiser have a big stake in showing you the ad from the millions they serve that you're most likely to click/buy/complete. So there's no fault on McDonald's part, but if you're a vegetarian, arguably Google is doing McDonalds a disservice as their advertiser by showing you the ad (and won't be doing the user any useful service either). That said, these algorithms are simple presumably because they work "well enough". Fortunately or unfortunately, depending on your perspective, there isn't really a lot of meaningful competition in the ad space driving superior targeting. It's more about having the killer network, the list of effective channels (search, youtube, instagram whatever) that is the big players advantage rather than their targeting skills.
•
>That said, these algorithms are simple presumably because they work "well enough". Agreed wholeheartedly, and this is an important point: advertisers don't really lose much by showing you ads you don't want, so it's unlikely the system would ever become ultra-precise.
Discord is ditching Electron and its new app uses less RAM (theverge.com)
•
With the browser sandbox gone, it will be a good test of faith. Here's to an RCE-free port
•
Someone should do this for Slack
•
RIP ripcord.
How come it's presented as paid software when the binaries are available on GitHub? Also naming your company "__slop" is a bold move!
•
It's open source! Just if you want to pay for it, i'd like to continue working on it and throwing tokens at it but I don't really expect to make much from it. Theres links to the download page at the bottom too: https://diffy.run/downloads/ Thanks haha hitslop, it means "a property used to increase the interactive touch area of a component beyond its visible layout boundaries", which I thought was so funny when I came across it. Owned the domain since 2020, knew it would come in handy eventually!
I had trouble reading more than the opening volley of the article due to popups. Am a Discord user, and rust application programmer: What GUI framework are they using? EGUI? GPUI? Something custom? GPUI from comments? I meant to try GPUI, but backed off after an announcement pending its maintenance would be in question (?) a few months ago, and Zed broadly ending up being a false messiah, for my uses. (Not on the tier of JetBrains IDEs, a bug with a long thread they closed which (still I believe?) causes it to open cached versions of files, then clobber edits made since the cache, e.g. by other programs. I.e. the sort of bug which renders software too dangerous to use. I will not switch to a GUI framework from a group that ignores bugs of that severity reported by many people)
•
The Verge is paywalled now but the article really doesn't have much content other than "they're working on a Rust client and someone showed an early build using 290MB of RAM"
They use GPUI. Says so on X. " (And it's not Tauri, it's GPUI, so good guess everyone.) "
•
Which I believe GPUI is the same framework that Zed (the editor)[0] is using [0]: http://zed.dev/
Electron being bad is a bit of a junior- to mid-level engineer tell in my eyes, the sort of thing you'd say if you've just learned that some apps use more RAM than others, maybe built a small Rust TUI and are now wondering why not everything is using Rust. Something you'd believe just before you learn what engineering trade-offs are. So, yeah, enjoy rebuilding complete browsers, I guess? I'm sure they'll run more efficiently than the rendering engines that have been refined and tweaked over the course of now multiple decades. Well, unless you leave out the annoying stuff, like a11y, IME, RTL, but who needs those things anyway, am I right. Then you find out that iterating on a fully Rust-based app is sloooow, so you add a scripting layer, maybe integrate a little Lua VM or something that lets you execute JavaScript? Congratulations. You've built a browser, just with fewer features, more bugs, and probably higher RAM usage. Good job.
•
Could you please link to some GUI applications you've built in rust, and/or describe why you added those abstractions and built a browser? This doesn't match my experience.
•
I don't understand this question. GPUI's unstable to non-existing a11y, IME, RTL etc. support is well documented.
> Then you find out that iterating on a fully Rust-based app is sloooow Maybe not anymore. I don't work on any Chrome-sized Rust codebases so I don't know, but iterating on anything is so much faster that it might work out fine.
•
Eh, it’s still pretty annoying. I have a small voice chat app, and it easily takes a couple of minutes to build releases for all three platforms (MacOS, Linux, Windows) on a MBP.
I'm very interested in (and a total novice in) cross platform GUI application development. Hadn't heard of GPUI, though I had heard of Tauri. I looked at the GPUI front page and saw this mess of almost-CSS method chaining... Surely there's a better way? This seems horrible to me. > div() .flex() .flex_col() .gap_3() .bg(rgb(0x505050)) .size(px(500.0)) .justify_center() .items_center() .shadow_lg() .border_1() .border_color(rgb(0x0000ff)) .text_xl() .text_color(rgb(0xffffff)) .child(format!("Hello, {}!", &self.text)) .child( div() .flex() .gap_2() .child(div().size_8().bg(gpui::red())) .child(div().size_8().bg(gpui::green())) .child(div().size_8().bg(gpui::blue())) .child(div().size_8().bg(gpui::yellow())) .child(div().size_8().bg(gpui::black())) .child(div().size_8().bg(gpui::white())), )
•
> Surely there's a better way? I'd like to know it. I don't think that it can be substantially better. You have to compromise between the amount of customization you are allowed to do and the amount of options you have to pick values for. I can't vouch for GPUI, I don't know how good its compromise is, but it bears enough similarities to other modern UI-toolkits. I don't think there is a better way, but if you know one, I'd like to know about it. And, well, don't forget, it is a front-page example, that is not necessarily an example how one should compose their code, it demonstrates what you can do with GPUI. In real life code you'd probably move those children's construction into separate named functions, maybe you'd use some predefined styles to apply to individual elements, instead of picking fg/bg/text-colors, maybe sizes and some other attributes for each one explicitly, and maybe some other tricks.
Asking in good faith: In the agentic age why use abstractions like Electron at all? Shouldn't we write apps in lower-level system languages like Rust like Discord has done?
•
Consistent UI and control. I re-wrote my electron app in Swift. Its great. But... some of the UI is weird at times; weird patterns; weird behavior. And Apple's UI framework is one of the better ones. Even for AI, each platform will have its own quirks and just _finding_ them takes real users to expose. We take it for granted how flexible and powerful browser UI is, because there's so much baggage and performance related factors. But many UI frameworks are worse, and historically always were. I think what we're seeing here - and likely to continue to see - is new versions of web UI that eschew a lot of the historical baggage given they don't need to support older websites. And possibly something more powerful. So I guess re-writes or partial ports that take only the parts we need. Presumably a bunch of people will try and hopefully, a few succeed.
I am not a developer, but using this type of frameworks and toolkits means that a lot of useful (and sometimes "boring") things are already thought through and taken care of. This is probably most important for smaller projects and teams, but some of it probably applies to Discord scale operations as well :) While you _should_ put some effort into tuning and fixing these things for your specific project, you will "mostly" get things like cross-platform support for all major desktop operating systems, some support for accessibility-tools like screen readers and voice over, devtools and debuggers, application installers, (push) notifications, caching, some aspects of security and cryptography, log handling, and file handling for free, or at least get a reasonable push in the right direction, with Electron. The alternative is either getting each of these things from a different third party source, or making them all in-house. With a popular abstraction layer like Electron + a web stack, you will to some extent encounter the same problems, mysterious log messages, design considerations and other issues as everyone else. This means that you can find documentation, stack overflow questions, new hires, consultants, blogs, LLMs, etc. that have the skills and knowledge you need, instead of researching and solving everything in-house.
•
> [...] using this type of frameworks and toolkits means that a lot of useful (and sometimes "boring") things are already thought through and taken care of. You're falling in the trap of the cross-platform dream. Electron takes insane decisions about how your app is going to achieve cross-compatibility in the name of allowing web devs to do the work. It is simply the wrong tool for the AI age, since a versatile web dev can turn to an AI to help them achieve the work.
DO TEAMS NEXT
•
Nah, ease of running it in the browser is a saving grace for us on Linux. MS does not offer an official Linux client.
"To continue reading *blah blah* *barfs* Verge subscription" WTF??? 15 years reading the verge without subscription. What happened?
•
I assure you that you haven't missed anything: > It’s not clear when Discord will make the full switch over to Rust, but Vishnevskiy says the company “hope to get it into testing with users soon.” soon™ And yeah, The Verge was one of my favorite resources earlier too but I've stopped visiting it due to subscription requirement on most articles.
Your post is absolute nonsense. Plenty of people know exactly how everything on a plane or car works, or a CPU. I've worked with tons of people who do. The fear of deskilling is very valid and is already messing things up.
•
Your post is absolute nonsense. Even the people you are referring to do not know how everything works. Does your airplane engineer know the exact tensile strength of the tire as it hits the landing strip?
Maybe the good thing to come out of the RAM crisis is that engineers will care about memory usage again lol.
•
I always cared with ZRAM under GNU/Linux (I own an n270 netbook with 1GB of RAM and a NUC with 8GB but a Pentium Silver CPU, nothing fancy). Thus, Waterfox with their new Rust based ad blocking engine was a beast, even more with WebGPU enabled and NoScript, just enabling JS for the essential, if any. On top of that, the tab suspending extension. As I program in Rust I need every bit of RAM, even if I disable most debugging options at ~/.config/cargo.toml and I set the build jobs to 1 with "-j1 ". On the netbook, well.. CWM, UXterm, Dillo, CLI/TUI mail, usenet, IRC and so on clients, groff, nsxiv, mpv, MuPDF... it runs snappier than the NUC for what it does. Programming? Golang for networking stuff -security, not like Rust, but far better than C-, simple C99 for small software, or S9/JimTCL. Otter Browser for emergencies (JS pages from public institutions/govts in my country).
•
About time, I'm tired of fighting. Free the RAM!
•
Also even without the RAM crisis, the main limitations (time) to optimizing software are gone. If you want to do something impactful, but don't have any good ideas: Take an existing website or application and build an optimized version of it. If you aren't sure where to start, build an isolated workflow out of an existing app or site you like, have the LLM benchmark it, then ask it to make it use 10x less ram / run 10x faster. Ask about what tools it can use to measure, what benchmarks it can come up with to repeatedly test it, how it can automate workflows in a measurable way. Then turn those into tools or specs you can share along with your work.
The good thing is AI enabling web developers to write native apps.
•
Is the average web developer benefitting from vibing languages they are not at all fluent with? A bit like a translator who doesnt speak the language but has Google translate and a few beers in them right? For example, is there still a massive .clone() problem in LLM generated Rust?
•
I re-wrote one of my apps in Swift. I don't know Swift. It's been fun. When it gets stuck I look at the code; I have it teach me via analogy to the e.g. mobx/react concepts I do know. In some cases I've improved the LLMs code after learning how something works. In others I work it more like an informed PM - ok the sidebar opening is slow but... its about 10x faster in my electron version. How is the sidebar "mounted" or rendered? I dump tricks I know from web dev and ask how analogues; sometimes that breaks its anti-patterns. Other times I throw constraints I don't know much about - "This is a native version, can we aim to make it 3x faster to start-up? How". Personally I was surprised how quickly I surpassed my original code, feature wise. Will it stand the test of time? Too early to tell - need to see if I'm still using the native version of the app in a year. But its been more fun and informative - and fast - than I'd expected.
•
This is the way. I don't know why it's hard for other people to figure out this process.
...so just don't use Claude?
•
I thought Claude was the tool for the AI script kiddies?
Download your favourite YouTube videos (criminallyvulgar.dev)
•
Most of my YouTube playlists say something like "15 unavailable videos are hidden", or about ~10% for a 5 years old playlist. The same ratio holds true for most bookmarks of YouTube videos I have. There's videos from ~15 years ago, lost to the great copyright apocalypse, that I consider gone for good, having been unable to find them anywhere on the today's internet.
•
I regret not archiving all the videos from the youtuber Myles Power (pseudoscience-debunker). He was one of my more favorite YouTubers but a few years ago he nuked his entire channel and all the videos on it (I suspect because his employer didn't like him arguing with people on the internet). I wanted to rewatch some of his videos recently and as far as I can tell most of his videos are now lost media. I should have downloaded them when I had the chance.
Is this another yt-dlp wrapper?
•
yes
One of the things I wish I could solve better, was a way to search for and show decent search results that you could then pipe into `yt-dlp`. Every method of doing this I've seen is basically a "hack" and often breaks or doesn't work at all. Anyone have a better solution to this that lets you basically build a frontend/proxy to Youtube or lets you Search, Show results and Download what you want to see lateR?
•
i use freetube to search. i can select videos that i want to watch with a single click into a playlist and then export that playlist and feed it to yt-dlp. since my internet is often slow, that is the main way i watch videos. i don't even open them directly in freetube, but wait until yt-dlp is done downloading.
•
Due to the nature of youtube updating so often all methods utilizing youtube's search would break often, but in the age of coding agents I don't think it matters as much anymore. Tell that to claude code and it will do it in 15 minutes. Being annoyed with youtube's search interface regressions I've basically built something similar by having an alternative frontend to better sort by date ranges, view count etc. It has already broken twice in last 6 months but fixing it is trivial by pointing a coding agent at it. The way it works is by piping the search query to automated playwright browser which returns the parsed search results and thumbnails. Also dabbled with Youtube's API in the past which sometimes shows results that don't show up on its regular search.
•
> and often breaks That's kinda the nature of YouTube downloaders/scrapers including yt-dlp. It's not exactly a public API that YouTube's offering to support.
Do you know if this requires a GCP/Google account or can be it be used freely, but rate-limited to a reasonable rate for personal use?
•
Answering my own question. No. > API key not valid. Please pass a valid API key.
Freetube but if you want HD you have to separate out the video and audio downloads then combine them after. A little annoying but it does have download right there in the client
•
freetube removed the download feature a while ago. see my other comment above on how i use freetube to download videos.
•
Dang really? Guess I just haven’t needed it in a while
Every time you watch a youtube video you are downloading the youtube video to disk. It is just to prevent the lawyers from exploding that we all pretend that deleting it afterword means it never was downloaded. But yes, everyone should be not deleting the videos they've downloaded.
•
to the layman download means the whole video is stored in its entirety on my disk. and possibly to lawyers too. that is not happening with streaming videos. youtube videos in particular most likely never hit the disk. not even the cache. when i am watching youtube then i am not deleting the video after it is done. the "downloaded" segments disappear automatically as i watch. so there is no delete step that i could skip in order to keep the file. rather, actually downloading a video requires an entirely different operation.
•
"to the layman download means the whole video is stored in its entirety on my disk." Yes, that's exactly what it means.
Vivaldi 8.3 for Desktop: make bad ads sad (vivaldi.com)
•
I'm still on 8.0 for the time being since it's the last version that still supports MV2 extensions.
•
As a Libre Wolf user I feel like the battle against ads is a losing one, but I'm glad there are folks out there working on this.
For those interested in a GPL-licensed browser from Norway: https://nordstjernen.org/index.html
•
Is it just me or is it a bit sad that even GPL'd software has websites that are full of Claudisms these days? Like have some pride when showing off your project. Write a few sentences. Why should I give a shit about your project when you don't even care enough to describe it in your own words?
I’ve had a really good experience with Vivaldi as a replacement for the Arc browser. It really is nice to have a browser from a company whose incentives seem to be for the actual users.
•
How does it hold up with many tabs opened VS chrome?
I have a question. My ISP, allegedly, knows what websites I go to. So why can't I pay my ISP an optional $20 a month that gets evenly distributed directly to those websites, in exchange for an ad-free web experience? Surely I'm not creating much more than $20 in ad revenue in total per month, right? Can't we just cut out the middleman and all walk away happy?
•
This[1] claims the average American is worth about $1605/year in ad revenue. It's a model, so it's certainly possible it is significantly off. That said if there was a credible system like this, I'd happily pay for even the right partial offering. [1] https://proton.me/blog/what-is-your-data-worth-to-google
People have been trying stuff like this for almost 20 years now. The core problem is that while people hold up that ads are the problem, the actual problem is that people like free stuff with no strings attached, i.e. have your cake (the content) and eat it too (nothing traded for it). So when you present people an alternate way to compensate creators directly, they overwhelmingly just stick with ad blocking. There is a long case file of fools taking the internet at their word that "I want to give but the ads are so bad I can't!". They don't want to give lol
•
The problem is I don't want surveillance and I don't want to incentivize trying to distract me (the "attention economy"). "Creators" just don't want to acknowledge that much of their "content" has zero or negative value to most people, and instead claim that everyone just wants free stuff. No, I want most of these "creators" to stop creating.
•
The problem is that the choice isn't seeing ads v.s. paying for the content. Instead, the choice is seeing ads v.s. overpaying for the content, then seeing ads anyway when the service decides to indroduce ads back to the paid subscription. By overpaying, I mean compared to what the service itself values its content at when it serves it for free with ads. How many people would sign up for a 15$ per month subscription to read one article with no ads? How many would pay 1¢ once to read the article with no ads? How many would sign up for one 15$ per month subscription to see no ads anywhere? I realize we don't have the infrastructure to make high volume 1¢ payments, and probably not for lack of trying, but I just don't think the core problem is that people only want stuff for 0¢ and not almost 0¢.
•
> free stuff with no strings attached I'm aware I'm preaching to the choir here on HN, but boy are there strings...
How many websites do you go to a month? Hundreds? Thousands? And you want the ISP to handle the payment processing out to them? Many probably international? And each ISP doing this on their own?
•
Spotify figured it out.
Sure, why not? They're billion dollar corporations, they can handle some basic payment processing. If it creates a genuinely better user experience, it will increase customer loyalty and make them money in the long run.
•
I'd rather my ISP and ad networks have harsh criminal penalties with prison time for management, engineers, and everyone else involved for tracking what sites I visit. That would be a genuinely better experience.
Sshole (sshhole.com)
•
The whole story is a bit worse than this. Musl already worked around this type of failure . See the second-to-last line here: https://git.musl-libc.org/cgit/musl/tree/src/crypt/crypt_des.c (hey, this workaround is wrong if the salt is "x"!) but they forgot to work around it here: https://git.musl-libc.org/cgit/musl/tree/src/crypt/crypt_sha512.c#n369 The vulnerable path in musl is only a little bit vulnerable, because " " is not actually a sha256* encrypted configuration and should not reach this code: musl's crypt(..., " ") will not call that code! Turns out that sshd detects that the password hash is too short and does not forward the salt ! https://github.com/openssh/openssh-portable/blob/master/auth-passwd.c#L223 Look, no else statement! If that if doesn't get taken, then salt remains NULL. And the sshd code is really quite messy and doesn't keep track of the fact that this code path is inappropriate for validating an existing password hash. A workaround in the sha256 path in musl wouldn't even have prevented the bug! I'm going to give some credit to musl for unwisely using " " and some credit to OpenSSH for having nonsensical control and data flow.
•
This one feels negligent. How does this go uncaught for 10 years? How did it make it into production period? We need to re-think EVERY assumption about security.
•
It would be nice if the passwd crypt functions didn't have timing dependence on password length. Then there'd never need to be hacky workarounds like what musl did, and various tricks to avoid exposing whether users exist on systems. No idea if it's likely to happen though.
•
Nice web site. However, I've got a server with 14 alpine-based docker containers in production. Among them 13 are widely distributed images (like web server, databases, etc.) and one is a custom build image. Only one of them have an SSH server publicly exposed, Forgejo, but it's its own internal SSH server which only accept public keys and Git commands. On the internal network, only 3 of respond to SSH. I haven't tweaked their default SSH config. None were vulnerable to this attack.
I’m a smart person and none of this makes any sense to me. It’s like purposefully written poorly.
•
Agreed. Much better explained here: https://news.ycombinator.com/item?id=50379342
Am I missing something or is this written up to seem a lot worse than it actually is? It starts with a bold claim: "ssh accounts that should not accept a password will accept any password between 256 and 1024 characters". But then it keeps adding qualifiers: - sshd compiled with musl - not using PAM - password logins enabled - at least one account with '*' as the password "hash" - at least one OTHER account with a valid password - server is aligned with 2 ley lines - hacker is wearing a blue t-shirt and green socks Ok, the last two are an exaggeration, but still. The conditions are all ANDed, miss a single one and you're fine. On top of that, as someone else in these comments reminded, the target account needs to have a valid login shell or other exploitable program assigned to it, and these passwordless accounts tend to have nologin or something similar. To me this seems to fall on the "technically possible, practically very unlikely" bucket, kinda like the PHP vulnerability from the other day. Maybe this has gone unnoticed for so long because it just doesn't happen.
•
only 1) is a narrowing filter. the rest is basically the majority.
•
Most linux distros use PAM, so 2 is also a narrowing filter. Debian, Ubuntu, Fedora, Arch, etc all use PAM.
•
Alpine Linux (which uses musl) images are popularly deployed by those who use docker, and apparently the issue is there on the default install. Not sure whether the PHP vulnerability actually had been exploited, but I'm pretty sure there are literally thousands of machines out there affected by this ssh issue right now as we speak. This isn't going to end well. --- Addendum (which may or may not be related to the above) -- Everyone has heard of the tale of the boy who cried wolf. The main moral of the story is not to troll your fellow townsfolks so they don't distrust you. But everyone with a sane mind gets that. The (IMHO) under-appreciated lesson is actually: don't be those villagers. Believe stories you are given, even if you might look like a fool for believing in them. Don't assume what happens is the same as what happened in the past. Look at the facts yourself. Trust and verify.
•
You don't typically run sshd in containers, instead you only run whatever single service you set up your container for. Sure there are native Alpine installs too, but that is far less common of a use case.
•
Who's out there running sshd inside a docker container? It's almost MORE work than exec-ing into the container.
•
Alpine in containers is usually not affected. Most images/containers haven't ssh/sshd installed at all. Remote access is usually done from the host system.
There are a lot of systems that meet those requirements. > - sshd compiled with musl So alpine as well as a bunch of other embedded Linuxes. Huge install base. > - not using PAM What you get if you try to have a minimal setup. Default sshd config if you install from source. > - password logins enabled The default. Super common. > - at least one account with '*' as the password "hash" Almost every Linux system. > - at least one OTHER account with a valid password Almost every Linux system. So sure, there are caveats, but they cover a massive install base. This is a super bad bug
•
> > - password logins enabled > The default. Super common. This always seems bonkers to me. I think SSHD should give you ONE password free connection of setup to copy your key over and then it just shuts the door behind it.
•
I think it has to be a time limited FREE offer. (like, seriously, what if the user doesn't take the offer?) It might actually a good idea, but I would likely avoid it since my built-in Bayesian filter would just mark it as spam.
•
How many alpine installs are running sshd? Most containers using it as a base image aren't. Embedded Linux is unlikely to be running it, too. And if one IS running sshd, how often is it with unchanged defaults? I don't buy the inference here. I'll concede that embedded linux might be my blindspot here. Maybe cheap web hosting, too, but that seems much less likely to be using musl.
•
A lot of embedded systems use musl and no PAM. Some of them might use Alpine, but the distribution doesn't matter that much.
•
And ssh? I'd assume most would use proprietary or industry-specific standard for data IO, or just https, for domestic IoT stuff
•
And also ssh in many cases.
•
Embedded linux is your blindspot here.
•
Yes
OK, I think I see what’s going on with this, in this configuration. The goal from an attacker’s perspective is to get this to be true: `$ret = crypt($pw, $hash); $ret == $hash` when called by OpenSSH’s sshd. This is how sshd validates that the user logging in knew the account password. The `$hash` is the “settings” to the crypt call and will normally look like “$6$--gibberish” for users with passwords set, but could look like “*” or “!” for users not intended to be able to login. The bug is from the intersection of all of these things: 1. musl can return “*” for errors, rather than leave the return value NULL. Other libc have adopted something like this too, but seem to use a different result “*0”. 2. musl can also return “+” for errors, but only does so if $hash starts with “*”. This is intended to eliminate the possibility of an error causing `$ret == $hash` to be true, however it assumes that applications calling `crypt()` will set $pw and $hash to values corresponding to the `$ret == $hash` comparison to be made immediately afterwards. 3. OpenSSH can be convinced to pass the hash of a different user if the hash is “*” or “!” to avoid timing attacks that can enumerate the user list, so it will set $pw and $hash to correspond to different users. $hash will be a real “$6$--gibberish” style hash in this case, and OpenSSH expects `crypt()` to either return NULL or return a hash string. But now there’s two hashes OpenSSH uses. It does: `$ret = crypt($pw, $hash2); $ret == $hash1`; 4. This should normally not be a problem because OpenSSH will pass in valid $pw and $hash2 that should not lead to errors in hashing, so the $ret that musl generates should be a real hash that cannot match the “*” or “!” $hash1 for the login-disabled user. However as a DDoS mitigation, musl will return error if the password is too long when using SHA-2-based hashes (the default, it seems). 5. This error will result in a non-NULL result of “*” or “+”. Since OpenSSH passed in a real hash ($hash2), musl will return “*”, which compares equal to the actual user hash $hash1 for the disabled-login user. The OpenSSL adjustment ensures a minimum hash length for the user before logging them in, even if crypt() succeeds somehow.
•
I think the conclusion that can be drawn from this is that the behavior of crypt() is howling-at-the-moon insane, and it should no longer be considered for any system built in this century, at least not without extensive wrappers that correct and normalize all these edge cases.
Because Claude wrote the linked page. Claude is impressively bad at communicating these days. with gpt-5.6+ approaching Claude level like 30% of time and Gemini much clearer but also the most annoying 7 year old ever, it’s a pretty lame environment especially for people who r new to everything
•
Until Opus 5.0 I'd have agreed with you, but Opus 5.5 is honestly one of the best I've ever sparred with, vastly better than the rest, including Astra imho. Especially so when prompting for clear top-down, first-principles communication.
•
Opus 5.5 is much better, but IME I always have to force it to review its writing (Opus 5.5) to get it to put the most important facts first (and not bury the lede). It loves to park the main point far away after intermediate clauses. It always writes “premise, so consequence.” It takes a prompt asking to review against rules in context for it to fix it. The ‘concise’ output style setting is bad with Opus 5.5, as it will often spit out a cryptic (is this really English?!), allergic-to-commas concise response, which takes more time to parse.
Such solutions always felt like swapping one risk for another. With good separation (running the VPN on a separate host from the SSH login, otherwise a bug in the VPN solution still might result in a shell on the box), at best you'd need two vulnerabilities before someone gets in, but it's not fundamentally different unless you find a way simpler protocol where you can be more certain that it's secure than ssh is (for all its scrutiny and track record of no pre-auth bugs for decades) Putting services behind ssh forwarding was the way to secure something you're worried about rather than the other way around, but Wireguard actually makes a good argument nowadays. Iirc they did proofs for the cryptography and it has good design in terms of attack surface, and it's old/mature enough now that I'll say it's probably better than exposing SSH. On the other hand, when this thing running in your kernel gets compromised, you're slightly worse off than with someone logging into a passwordless service account as in the current bug
•
[delayed]
> Can we please now normalize AI usage in development? 1. It is already normalized outside of a tiny, but very vocal bubble that lives mostly on Bluesky (sometimes also on Reddit/HN/Mastodon). 2. I don't think that even the most staunch AI hater would object to using AI for security research as long as all the artifacts (code, docs) that were produced based on the research are human-written. "Yes, there is a bug in my program, but I refuse to fix it, because I know that you found it using AI" would be a pretty weird position. Not sure, how would you defend it.
•
I feel like there is a lot of pushback from delusional engineers, that won't accept their coding skills have been rendered useless - so they come up with tons of reasons to avoid AI, because it just has to be bad. Anything to hold up the ilusion you are an well-paid white-collar worker that can pick employers anytime. And I say this myself coding since the late 90s and making a living off it - it is a painful pill to swallow, but the genie does not go back in the box so just accept it and move on.
Also how many times do we have to learn that letting badly programmed software die when unexpected things happen is the better option because it means people actually notice that there's a problem. Silent compatibility hacks are the worst, they guarantee problems never get fixed and the stack of hacks never gets smaller. Microsoft has historically been one of the leaders on the wrong side of this one, but they have also demonstrated how effective it is to call out badly behaved software and make it annoy the users with UAC. When Vista came out, so many applications needed elevated privileges to run because they were badly designed to write user data in system locations, but now their application was more annoying to use and came with a scary dialog about it making changes to your computer that other better-designed software didn't get. More often than not if a program didn't actually intend to change system settings it was just a matter of badly chosen default paths which are pretty trivial to fix, but so many vendors just would not do it despite years of complaints from NT admins wanting to not have to spend hours with Process Explorer figuring out specific permissions to grant limited users enough access. Once their failures were put front and center, calling their application out as the one getting things wrong every time the user ran it, they suddenly had motivation to fix it.
•
Agreed. I feel like this attitude has been holding Python back, too. It's one thing to criticize "move fast and break things", but it's also not good to ignore already existing breakage just because the pieces still fit together neatly, and it's not good to refuse to move at all.
•
Now everything installs to a user local folder, runs as the user, there are no UAC prompts, and malware can just freely tamper with other applications, act as the user, and harvest all data the user has access to. Hey, but at least it can’t touch the System32 folder. Great job guys.
> if you're not writing security-oriented software It's hard to define what's security oriented and what is not. For example, is this HN web app security oriented? Not in the way of sshd but it must keep our accounts data separated and it must not let people exfiltrate data from the db, where for example it is storing the emails of some of us.
•
It depends on the time. Twenty or thirty years most software was not security-oriented. Nowadays, everything is online and therefore everything needs to be vigilant about security.
PSA: you can typically declare different types of string so that your type system objects to mixing data of different types even though deep down we know they're both strings.
•
If you mean type aliases, that's a good idea within a single codebase, but the distinction between different types of strings doesn't survive serialization so it wouldn't have prevented this error. What they need is a way to signal errors out-of-band, like Result<T> or exceptions.
•
At least in python there's a difference between type aliases and typing.NewType (the difference described here: https://gist.github.com/simonwhitaker/3a24d669b26b4f373690c6eb113c3ae7 ) That's what I was thinking of. I assume something similar exists in other languages, though perhaps not in C.
This is a side-effect of Unix-y "it's all plain text" design that leans extremely heavily upon in-band signalling (among other design decisions). If /etc/shadow was a JSON (or XML, even, although that would make me feel gross), this bug would have been much easier to see, because a field that reads '"hash": " "' sticks out a lot* more than a custom microformat that you don't understand. With data structures, there's never "plain text" - it's all structured. The question is whether you want to use existing formats and tools, or create a new one for every tool and literally make footguns like this.
•
Returning “*” instead of NULL to signal failure is the real footgun. Don’t blame the format. For historical reasons, we could’ve ended up JSON as “hash”: “*” just the same. The /etc/shadow format lets you skip values completely, like “::”, so your argument doesn’t hold. Terminating an app because of a NULL dereference is the other footgun. Sadly, we still have “panic” in modern languages like Go and Rust.
A few years back I un-bashed my life as much as possible in favor of nushell (though it's not the only shell to encourage structure). I feel like it has really helped me notice a lot of this-needs-more-structure type problems outside of my shell that I otherwise wouldn't have. The elegance of the unix-y approach is actually that it's all bits. You can just join things together and shove the bits through, that's a wild simplification compared with having vendor-specific kinds of plugs. But we could have that kind of compatibility while also benefiting from structure. So I encourage everybody to give a shell with structured output a try, let it rewire your brain, and then ask yourself: how is the OS holding this back from being everything it could be? Because if we build that OS, it won't encourage these problems. When I imagine it, it would probe either side of a pipe to see if they support negotiation. If not, send the bits through in the same old unixy way. If so, use the newest schema for structured data that is supported by both sides.
•
At Amazon we had RecordStream which implemented most of the standard Unix tools on structured streams. It was pretty easy to write filters, aggregators, and formatted output in something not much more complicated than sed/awk/cut/join/sort pipelines. There was a convenient structured log format for services that was often used as input. https://github.com/benbernard/RecordStream
Citation needed.
•
https://commandline.microsoft.com/agentic-software-engineering-large-scale-code-migration-language-modernization-spec-driven-development/
Doesn't it also need a user to be added with a password entry? I only ever see Alpine Linux used for containers which don't need accounts with interactive user logins, which is not to say it doesn't exist, just that it doesn't seem like Alpine comes with all preconditions met out of the box
•
Isn't it the opposite, accounts which have no password and hence had * instead of a hash? I.e. the bug is: > accounts that should never take a password at all (root, your key-only deploy user, ldap users, the default user on alpine's aws and azure images) take any password longer than 256 characters. But the correct behavior was supposed to be: > a * isn't a hash, so no password can match it. unix still does this today' > and if the field is just *? there's nothing to match. type whatever you want, it's never getting you in But yeah, Alpine for persistant installs isn't unheard of - just not as popular as the container use case. They offer official VM, Xen, Pi, and bare metal images users deploy as well. I actually had a fleet of VMs to update!
You must be new here. While I applauded the idea of musl when it first came out (coincidentally, glibc wasn't having the best time in its development then), the developer's arguments why <some behavior drastically different from every libc under the sun> was akchyually correct, which was why you had to fix a program that hadn't been broken for 30 years and now suddenly was, made me put him under the "clowns" category and never look at musl seriously again. When later it turned out that musl's procrustian stack size made Python not really runnable under it, it cemented my resolve to not go near musl. And now we have this.
•
[delayed]
Nope. Because in fact all the changes were about changing the function signatures. The function signature is enforced by the linker. The semantic of strings that go through isn't. Returning 2 values is possible in C (via pointers input parameters). The main issue here is that libc is a strong API contract based on C function signatures, that nobody can change, only augment with new symbols. Such strong API compatibility constraints happen in any programming language, and workaround to fit new behaviours in old APIs happens everywhere.
•
I don't think nh2 is saying that this is how the "issue" should've been solved here, but that it's a fatal flaw of C itself (yes I know, unions, but no one uses them). But also, its not like there were many alternative languages when the POSIX standards were designed so it's fair that it works like this.
Where are you going with those goal posts?
•
Nowhere. It's the same argument as upthread. A language that forces downstream consumers of an API to correctly deal with all possible outcomes would have prevented this.
I think everyone is over fixated on AI finding complex bugs beyond a typical person's understanding either to locate or exploit. I think for any one of those bugs there might simply be half a dozen footguns or bugs that once it's spelled out you wonder how anyone let it slide. I think that's the case where LLMs might indentify most. It's challenging though as the current AI audits produce so many false positives it's hard to know when it's being pedantic or when it's genuinely caught a human being a bone head
•
This one might be hard to find using the author’s approach of throwing everything at various builds of ssh. It is not really that hard to find in the wild if you had a device built this way, when overflowing buffers on embedded devices is a standard attack vector. It might be hard to root cause, but it would not be that hard to find.
*sshole, the * is the star of the show You can use \ to escape formatting.
•
Ugh! HN got me, too
Awesome repositories are no longer awesome (erikgahner.github.io)
•
> You are in most cases better off simply asking a decent AI model for inspiration or the material you need. I wonder where AI model get their lists from...
That highlights a bigger point. In the age anyone can create and publish their own software, including people without the most basic knowledge about it, how is one supposed to distinguish good from bad and avoid drowning in a sea of crap? Also, this has another angle, let's say I've created some tools I've invested quite a bit of time in but what is the point of publishing it, if anyone that needs it can simply make it for themselves (spending a week or two of time and some tokens)? Not only it has became essentially impossible to find if a given thing is quality (for example I recently looked for a pi plugin that does tool use classification for AI that I could extend with my ideas. I found one, then I discovered the author copied leaked cloude code source and "released it under MIT license" - which made my work on top of it basically useless and I had to throw it all out and start from scratch, as I wanted to publish the result- the final thing is called adaptive-acl). And second, is there any point in publishing code? In the "old days" when software was worth something the motivation to publish open source, in addition to feel good factor, was that people would send you patches with functionality you may find useful. Both that and the feel good time has ended. I still publish some of my stuff that I think may be useful to someone at some point, but I'm not sure there is any actual point in this. In a way AI has made each of us much more self sufficient. A computer with a good local model and half a dozen GPUs, few TB of software and one can have all of their computing needs fulfilled forever. No Internet or other people required. There is certain power in this. My young pre-internet self would have felt like living in a star trek universe with this :-) But something is definitely being lost in the process as well.
•
Same as always: you distinguish good from bad by trying it out for your needs. There's always been plenty of bad software.
In the age of unlimited and very fast content production (for any media, code, images, music, text, or otherwise), I think content curation like this may be more desired than ever. Maybe I'm too optimistic, but personally it would lower the burden on me so much to have a curated list of *awesome* projects. The fact that another person has taken from their time, so the hundreds or thousands of people reading this list don't have to do the same amount of investigation to figure out if a project is truly awesome, is in itself awesome.
•
Exactly good awesome lists have always been and will be the "goldmine" of curated resources. Not only these, I see all slow paced thoughtfully put in content as such. Like take StackOverflow for example. But it's really unfortunate to see people give up.
> Agent doesn't care about the checklist at all and re-writing the PR body with bunch of nonsense that we maintainers need to read, understand, and evaluate If it can’t follow a simple checklist, it shouldn’t be a problem, because you don’t even see the PR, because it should be auto-closed. > How on earth a 6h old repository with zero user is considered "awesome" It’s not, and you can write a bot that auto-closes such PRs (and any PR from an obviously AI account, and I wish pangram was cheaper, but any PR that is obviously AI text).
•
He didn't ask if a 6h old repo is awesome or not. Of course it's not. Ok, repo age being one of hundreds of red flags. Each of these can be auto-detected. But each auto-detection rule will be known and can be gamed afterwards.
> Yes, there's always an alternative: stop maintaining these lists. Or use your own AI judge agent to filter out the submissions that clearly don't align with the intention of the list.
•
No. Judgment is the thing AI lacks the most. Sure, you can try to give it guidelines, but it sucks at interpreting them because it has no taste and no common sense. It is trivially influenced by bullshit submissions because it overindexes on text it sees and has no theory of the mind or sense of intent. It is like a naive and prodigious intern with incredible intelligence and factual knowledge, but no sense of how the world works or what will actually fly with human stakeholders.
•
That assumes one has the money to maintain an AI service/subscription, resources to run the prompt from, and the time to fine-tune the AI to be dependable with a high rate of accuracy in your criteria. Maybe someone who has a lot of free time and high enthusiasm for AI might consider this to be worth chasing after, but anyone who has dealt with these whack-a-mole scenarios is going to admit the easiest thing to do is just not maintain the resource anymore. There are less-draining projects and endeavors to turn towards instead.
> When AI was new Depending on what "generation of developers" you belong to, this could differ by decades :) Are you talking about LLMs probably? At that point, "awesome" lists were already mostly used for spam and marketing, none of the original "curated list" concept remained at this point. I think I noticed awesome-lists changing from "Here is a curated list of AWESOME software" to "Here is a list of every software ever built, related in any way" somewhere around 2015 (thanks IM logs!), which must have been pretty shortly after the concept was introduced even, but can't remember when that was.
•
yup, remember seeing the same around that time. It used to be incredibly curated and limited, every list since then is just like the top 400 "related" repos
The problem is digital things don't decay in the same way as physical objects. AI can shit out a webpage for an institute that doesn't really exist and make it sound awesome until you realize there's nothing there. A webpage with a vibrant community behind it that is actively maintained looks, at first glance, the same as a page that's been put out to the pasture. A physical store that's out of business will accumulate cruft, broken windows, vines everywhere. There's not really an equivalent for bitrot. Sure, my website from 1996 looks dated because I used frames and we don't do that no more, but eBay and Yahoo and Myspace are still around. Link rot does set in though. Links to pages that no longer exist because the person running it has passed. Archive.org has such a good purpose. Thing is though, for software, sometimes things can just be done. If a perfectly good piece of software hasn't been updated in years because it hasn't needed to be updated , then let it sit, ensconced in stone. The problem is it's hard to tell the difference between that, and something that needs maintaining but hasn't been.
•
> The problem is digital things don't decay in the same way as physical objects. I'm not so sure of that. Ask anyone who's ever used VBScript, ActiveX, Flash, <blink>, <marquee>, or (soon) XSLT. The web likes to portray itself as championing backwards-compatibility, but for better or worse, it is quick to drop technologies perceived as harmful or merely wasteful. If you're unfortunate enough to jump on the wrong bandwagon, you can easily be left behind, and any older pages left untouched can quickly become non-functional.
The problem is, how do you know what does not need maintaing? how do you know what's going to bite you in the future? And migrating might be a huge effort. So, the instict becomes to not pick something that is already giving you an negative signal. I'm not saying that I fully agree with that logic, but I think it's a pretty understandable behaviour.
•
well when it comes to github a great window into an non-updated repository is just looking at the github issues. That will signal to you if theres maintenance to be done being ignored or if the software is of quality and maintenance isn't needed yet.
OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability (hachyderm.io)
Well, OpenSSH contributes to this by mixing hashes from the shadow file. The musl code would be correct if OpenSSH passed in the hash from the user account that is being logged-in. They instead pass in a different user’s hash (to avoid timing attacks) but end up comparing the result from musl against the actual user account, defeating musl’s simplistic safeguard to avoid this very issue. I’d probably still call this a musl thing. Errors should result in a NULL return even if the application crashes from there, but at the very least a return value intended to not match any actual hash in /etc/shadow should be a random string or predefined UUID or something other than *.
•
Randomly using a different users's hash seems so wrong to me, but maybe I've just been too deep in PII stuff for too long.
Maybe I'm misunderstanding, but u/tonnydourado pointed out on another thread https://news.ycombinator.com/item?id=50378228#50380029 "It starts with a bold claim: "ssh accounts that should not accept a password will accept any password between 256 and 1024 characters". But then it keeps adding qualifiers: - sshd compiled with musl - not using PAM - password logins enabled - at least one account with '*' as the password "hash" - at least one OTHER account with a valid password The conditions are all ANDed, miss a single one and you're fine." This doesn't seem to be nearly as big as an issue as they're making it out to be
•
No, no don't let all of that distract you. We gotta hype this. This is the new SSH2SHELL dude. Have we registered the domain yet? I'm scheduled on Fox News tomorrow.
•
Alpine matches the first. Disabling PAM has been "generally good security advice" for decades; I remember suggestions to not use it in the 2000s. Password logins are often enabled, especially on multi-user and default setups. If alpine uses the * feature, it's going to be pretty common. Gentoo has it, as does Ubuntu. If password logins are enabled, you're almost guaranteed to have at least one user with a password (root on all my boxes has one, even if I never use it and it's random garbage). So the cheese lines up pretty well, this affects quite a bit. If password logins are enabled, someone almost certainly has a password.
•
So it's essentially one of the 'recommended configurations'? I'm seeing people I generally trust in the scene memeing on twitter, while others are freaking out. Its hard for me to tell how fucked we are, I guess
Who does PasswordAuthentication=yes in this day and age anyway.
•
Don't most cloud providers default to that? I know I had to force some to deploy with a key and even then PasswordAuth was often on and had to be disabled.
When I set up a client sftp drop I had the luxury of saying "key based access only" Then it was a surprisingly customer service intensive process to get the keys from the customers. I never did manage to automate it fully. Weird enterprise systems I have never heard of with strange key formats. ssh1 keys, email mangling them. Their internal processes requiring a password. And way to many "I am sorry but that was the private key you sent me, That key is now compromised and you will need to remove it and generate new keys anywhere it was used" I almost regret not allowing passwords, almost, despite the headaches key based is still much better.
•
About to say, users just drop the key on their desktop and then download random exe's from the internet and run them. Still safter in general, but not bulletproof.
musl only, the quick fix: PasswordAuthentication=no Which is a good advice in general.
•
I was always uncomfortable that it's on by default and surprised anyone uses it it. It's also more cumbersome compared to just using a key. I feel like using keys is the password manager analogue for SSH.
Why is wireguards auth better than openssh auth?
•
Wireguard allows effectively no configuration around auth, and so it's more likely that it is configured in a secure manner. Openssh allows: password auth with weak passwords, PAM with potentially insecure PAM modules, gssappi, configurable ciphers, etc. Wireguard has none of those. Each of those auth methods adds more possible vulnerable code paths and accidentally insecure configurations. It's very reasonable to believe that wireguard auth, since it has far fewer moving parts and configuration knobs, is will have fewer ways it can be insecure.
Layered security is better (as long as their weaknesses don't overlap).
•
Not only that, wireguard doesn't even reply if they don't have the right key, while SSH does so the attacker knows there is at least a target.
Baidu released ERNIE 5.5 Flash Base (ernie.baidu.com)
The license seems really restrictive for something intended to be built on. Entire countries are forbidden to use it at all (European Union, the United Kingdom and South Korea), and you are responsible for making sure no one in those places uses your derivative.
•
The restriction exists to wash their hands of legal complexities of dealing with those countries’ AI laws. Same situation as websites that blocked EU visitors when the GDPR first came out and everyone was still trying to interpret the rules. There were ambiguities in the GDPR that made it risky to operate in those countries so the easy solution was to opt out. I doubt they care what you do with the model in those regions. It’s an escape clause to show they don’t encourage it if some regulator gets itchy trigger fingers and tries to go after them.
why are you surprised? dealing with EU is not worth the regulation cost and litigation cost
•
Does the publisher of open model weights have any exposure to compliance requirements if it’s someone else using the software, and they aren’t distributing or operating there?
Anyone aware why this restriction was added? Is it a legal issue in those territories or more a competitor restriction issue? If it's the latter, you would think the US would be somewhere to exclude too
•
The EU AI Act, as an example, has a bunch of restrictions that they may not have wanted to deal with, and open weight models are only partially exempted. It seems they don't plan on meeting all of those requirements, and so the model can't legally be used there.
BERT models are still amazing for what they do. Even the latest JEV/KEV/SEV/BEV/REV/TREV models can't beat a well-trained BERT.
•
hehe, so much in a name... just today I told Claude off for recommending me a BERT model for voice identification and it told me it was actually SOTA 2025! https://arxiv.org/html/2510.04213v1
 Top