News for hackers. Stuff that matters.

__david__

Re:MacBook Pro with PROLED XDR Display and Touch on Wednesday October 28, 2026 @07:27PM (#50282396)
The first iteration of the touch bar didn't have a physical escape key. I'm not even a VI user but that was my main complaint. I barely use function keys so I was ok with them being virtual (they showed up when I was in the terminal). But I did love adding a custom screenshot button to it and I loved the way the volume and brightness controls worked.
Re:Apple and a Hacker's Future on Monday October 05, 2026 @11:56AM (#49966570)
He port forwarded 5900 to his Mac.
Re:Gravity Seems Holographic. What Does That Mean for Reality? on Saturday September 26, 2026 @12:56PM (#49858365)
Does that mean that all the black holes of a particular volume have the same interior? Or does it mean that the black hole state is the case where you can’t tell what the interior is?
Re:UTF-8000: Unlimited UTF-8 on Monday September 21, 2026 @12:10AM (#49782960)
I don’t think there’s harm is speccing out the arbitrary encoding and then having a different spec that references that spec but puts hard limits on it. Many rfcs are like that.
Re:English: A vs. An on Sunday September 20, 2026 @04:37PM (#49779837)
I do too, but with an exception—if I’m going to emphasize the word “actual” I’ll say “thuh ACTual” but with a full stop after the “the” so that I can really chew on that first syllable for the emphasis.
Re:English: A vs. An on Sunday September 20, 2026 @02:30AM (#49773035)
I would transcribe the first sound of “unicorn” as “yoo“. It’s almost ee oo but the ee isn’t voiced—it starts right at the transition between those which is what the Y sound is.
Re:Introducing Ad Blocker for Firefox on iOS on Tuesday September 01, 2026 @01:02PM (#49524743)
I just tried AdGuard with safari and got YouTube ads. Do you have to configure something special?
I never suggested that you shouldn’t check the commit before merging!
Or just pull the pr into your local git, git amend --reset-author, and then push it to master yourself.
Re:Malicious Rust crate Arrayref runs a build-time payload on Thursday August 20, 2026 @04:25PM (#49379768)
Perhaps, but I think it depends on where the Go devs are coming from. In my experience the lack of proper dependency management in older versions of Go didn't really lessen dependencies, it just made teams have to deal with annoying $GOSRC issues. But then I worked at a place where the devs used PHP (w/composer) and node before Go was introduced.

Personally I came from a C background so I tended to use deps more sparingly.

In the end it's a bit of a balancing act—lots of dependencies is a larger opportunity for these kind of supply chain attacks to affect you. Copying stuff into your repo protects you from that, but it also makes it way more likely that you'll miss security fixes, unless you're actively looking for them. Re-implementing what you need is also viable but it slows down the dev process.

Re:Malicious Rust crate Arrayref runs a build-time payload on Thursday August 20, 2026 @03:45PM (#49379251)
I also wish that it would be the default. Integration tests are fine, but they aren't compile time. Elevating them to compile time and using an LSP enabled editor makes it just underline SQL errors before I've even had a chance to run a manual compile let alone a test...
Re:Malicious Rust crate Arrayref runs a build-time payload on Thursday August 20, 2026 @03:07PM (#49378784)
sqlx at least has the (optional) offline mode, where you "cargo sqlx prepare" once (which wants access to a db) and then you can build in offline mode which typechecks your queries against local files.

Although I suppose that's still doing a lot of shenanigans at compile time. It could be sandboxed pretty well (theoretically). I'd hate to give it up completely though, getting a compile time error when SELECT query params or return values have type mismatches is extremely nice.

Re:Malicious Rust crate Arrayref runs a build-time payload on Thursday August 20, 2026 @02:47PM (#49378541)
I think Go ends up with fewer dependencies mostly because there is more friction in finding them. With rust (and npm) you just "cargo search xxx", then "cargo add xxx". Go makes you web search and poke around github looking for something. It's not onerous or anything, but just that extra step slows things down just a bit. C projects tend to have the least because it's even more annoying to add them and you have to create build commands that deal with slightly different distributions (and learn makefile+pkg-config or cmake, or autoconf).

Certainly having a larger stdlib helps Go projects keep their deps down, but I don't think it's the real reason.

I liked it, but it felt like 1/10th of a game. On the other hand they only charged about 1/10th of a game ($5). I played it for about 10 hours so I feel like I easily got my monies worth.
Re:All memory manufactured in 2027 has been sold out on Friday August 07, 2026 @11:03PM (#49218552)
They obviously did not mean not literal USB, just a standardized connector across DRAM versions/speeds.
Only if your personal projects make you money. I have a million hobby projects but none generate income.
Re:Moving beyond fork() + exec() on Saturday June 06, 2026 @12:42PM (#48426640)
Having fd 4 mean something specific is no weirder than having fds 0,1, and 2 mean something specific, which is probably never going to change. At some point you just gotta embrace the Unix.
Re:Moving beyond fork() + exec() on Saturday June 06, 2026 @12:37PM (#48426590)
I agree. I think the current way is very nice to use (in c). I think the best way would be to have something similar to vfork() but not bound by posix rules. Then make the normal posix apis (close, setuid, etc.) act like the Rust “builder” pattern. Possibly giving them a prefix for explicitness. That way the “fill out a giant structure” people could have their wish and the people that just want a faster posix experience don’t have to learn an entirely new concept and api surface. It would be future extensible that way, too (just add more prefixed calls to the builder).
Re:Squillions – two books about money-laundering on Wednesday June 03, 2026 @08:03AM (#48382875)
That’s only fairly recently at my Costco. For years and years it was only American Express and debit.
Re:I'm Tired of Talking to AI on Wednesday May 27, 2026 @11:52AM (#48296117)
No one is saying to pretend you memorized everything. They’re saying they’d rather have an “I don’t know” than a half-assed ai response (or stack overflow cut and paste).

Or, if you get nerd-sniped by the question and spend some time figuring it out, that’s fine too.

But if you want to be helpful but don’t want to take the time to figure it out yourself, don’t just forward the question to AI or send me a link to the first result in Google because I could have done that myself(and may have done it already). Just say you don’t know, which is a paradoxically more useful response.

From his 2006 speech/routine at the White House Correspondents' Dinner, speaking to then president George Bush:

> Now, I know there are some polls out there saying this man has a 32 percent approval rating. But guys like us, we don't pay attention to the polls. We know that polls are just a collection of statistics that reflect what people are thinking in reality. And reality has a well-known liberal bias...

His whole thing was phenomenal: https://www.youtube.com/watch?v=IJ-a2KeyCAY

Re:Chemistry behind the Garden Grove chemical tank on Tuesday May 26, 2026 @08:10PM (#48287747)
On the plus side, it's a chemical that was discovered more than a century ago so scientists have accumulated a lot of knowledge about it. So far no studies were able to link it to cancer. It also doesn't significantly build up in the body over time (like heavy metals do). It's 3x heavier than air so it shouldn't spread too far away. The main issue is they want to try to keep it from getting into storm drains or into the ground water.

I've heard from others that it's readily absorbed by water. That's bad in the ground water case, but it seems it might be a positive when trying to clean up a (contained) spill.

It appears to me to have a relatively high lethal dosage (my back of the napkin calculations are saying a 200 pound human would have to orally ingest almost a liter of it to reach the LD50 dosage--but again don't quote me on that number because I am not an expert and could have very easily messed up the math or the concept of a lethal dose).

So, while I agree there might be unknown long term issues, it does appear to be a relatively low probability of that since it seems to be on the less pernicious side.

Re:Chemistry behind the Garden Grove chemical tank on Tuesday May 26, 2026 @07:40PM (#48287501)
> What a disaster and complete failure on the local government in the way they handled this situation.

Can you expand on that? It seems like there wasn't a lot they could do once the tank started leaking.

I understand what you’re saying but in this case notice they don’t even mention terminal or command lines. You have to already understand enough context to know what they mean and at that point you should be able to interpret the command itself.
In addition to possible ignition through the sparks, it's apparently stored under high pressure, so you can't make a hole without completely compromising the structural integrity which is pretty much guaranteed to kill the driller.
Re:Postmortem: TanStack npm supply-chain compromise on Tuesday May 12, 2026 @01:12AM (#48104439)
is not bad for that. Not precise, but in the ballpark.
Re:Running Out of Disk Space in Production on Tuesday April 07, 2026 @12:51PM (#47678146)
That’s also not great if you’re trying to make a 10 gigabyte file. In that case, use bs=1M and count=SizeInMB.
Re:Music for Programming on Sunday April 05, 2026 @11:51PM (#47656794)
I discovered long ago that psytrance/goa was perfect for me. It works almost as well as caffeine and I can work for hours and hours as long as it’s blaring.
Re:Your sign-up form is a weapon on Thursday April 02, 2026 @05:09AM (#47611879)
> But from a UX standpoint its a nonstarter

Disagree. The UX would be pretty similar. Click a mailto link which opens the email client with to, subject and body precomposed. Click send. Server receives mail and the web page continues/finishes the sign up process. No need for an email reply. It’s different, but it’s not crazy.

Re:Your sign-up form is a weapon on Thursday April 02, 2026 @03:51AM (#47611298)
> how do you "be careful" with spoofed email?

You actually verify DKIM and SPF—you know, that “dmarc stuff”. That’s enough to tell you the mail is not spoofed.

Older »