News for hackers. Stuff that matters.

andrewaylett

In the interests of accuracy, the law (the Metropolitan Police Act 1839) actually states

""" 54 Prohibition of nuisances by persons in the thoroughfares.

Every person shall be liable to a penalty not more than level 2 on the standard scale, who, within the limits of the metropolitan police district, shall in any thoroughfare or public place, commit any of the following offences; (that is to say,)

...

8. Every person who shall roll or carry any cask, tub, hoop, or wheel, or any ladder, plank, pole, showboard, or placard, upon any footway, except for the purpose of loading or unloading any cart or carriage, or of crossing the footway:

... """ https://www.legislation.gov.uk/ukpga/Vict/2-3/47/section/54

The plank of wood is one element in a much broader statute, rather than an example of hyper-specificity. And it might have been strictly applied at the time, but that doesn't mean you're definitely going to get into trouble nowadays.

In a similar vein, the UK *does* have laws that affect big tech. UK GDPR places requirements on processing of personal data:

""" Personal data shall be:

(a)processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’); """ https://www.legislation.gov.uk/eur/2016/679/article/5

Whether that's properly enforced is (as with the plank) a completely different matter.

In the UK, at least, we don't need new regulations, we need to more effectively apply the regulations we already have in place. But there is also a balance to be made between enforcement through fines and enforcement through changing behaviour: it's much better to work with companies to bring them into compliance than it is to just fine them and without actually changing anything.

There are vendors who supply this service as a product -- Wiz, who were one of the groups to independently discover the vulnerability, is one such vendor, there are plenty of others.

I'm not overly keen on the tooling: as far as I can tell the whole industry is prone to flagging false positives as "vulnerabilities" rather than "potential vulnerabilities" and it's a bit too easy to turn those reports into a tick-box "you must update now because the tool says so". But they also do flag true vulnerabilities. And they pay for teams of security researchers to find and fix issues, not least because that's good marketing.

Re:JPEG XL vs. AVIF for web use-cases on Friday October 16, 2026 @06:53PM (#50125858)
I'm glad Jake's run the numbers — but do make sure you validate your own use-case rather than just following them. My personal experience has been somewhat different, but also my use-case appears to be pretty different so that's OK.

That said, I last benchmarked over a year ago, maybe I should re-evaluate. My experience was that AVIF was too slow for on-the-fly encoding, while JXL was absolutely fine and JPEGLI was also pretty useful.

Re:Deno Is Joining Cloudflare on Friday October 09, 2026 @05:33PM (#50026810)
https://github.com/import-js/eslint-plugin-import/blob/HEAD/...

It's not built in to ESLint, but it's fairly widely used in my experience and helps ensure that you've got a sensible split between production and non-production.

Re:Shipping JPEG XL in Chrome on Wednesday October 07, 2026 @01:23PM (#49995912)
In my experience, it's competitive on output size but not on compression speed. If you're not compressing online then that's fine, but we're running a service that resizes and recompresses on the fly. We serve JXL if the client indicates support for it, JPEG using JXL's jpegli, WebP, or PNG, depending on various factors.
Re:Surely you have ultra-wideband radios on your bins too? on Sunday October 04, 2026 @08:40AM (#49953418)
In Scotland, building regulations now mandate sealed-in lithium batteries (and interlinking) on fire alarms. Which is annoying, given most smart systems still have replaceable batteries.
Right. But riffing off a response that's a cousin of this one — what are you actually trying to achieve with your writing? And I should also note that I agree with you, in substance if not in style.

I'd suggest that Google aren't your primary audience for this kind of post: it's folk like me, who are quite keen on the idea of GrapheneOS but don't actually use it yet (I actually bought a second-hand spare phone last week with the ulterior motive of trying GrapheneOS on it, we'll see...). What do you want your average reader to think about you, from reading what you've written?

I should add that this post (that I'm directly replying to) comes across to me as very much more appropriate than the original blog post, even as it's in many ways a lot harsher. It's putting Google's behaviour in context, rather than drawing comparisons between your own abilities and their poor performance.

You don't need to drag Google down in order to look good; there are many reasons why what Google (and especially their management) have done is bad for society (and not just for you) and also many reasons why what you're doing is excellent on its own merits, not merely compared to Google.

Re:We want you to build the next Git platform on Cloudflare on Saturday October 03, 2026 @05:27PM (#49947964)
I'll be honest: I saw the prize was a trip to SF and — while I was vanishingly unlikely to enter anyway — that was enough to kill any idea of entering. It's been over 20 years since I was last in the USA, and I have no intention of visiting again any time soon.
No, we shouldn't treat Google like an individual, because it's not. But we can (and should) be mindful of the individuals who make up the various teams within Google.

That's part of the motivation behind HugOps: the people working on fixing a thing are only rarely the people who are responsible for the system that caused the breakage.

Look to "HugOps" as inspiration: when someone else is having a bad day, offer them a hug rather than running them down.

The article uses phrases like "completely broken", "awful", and "<delay> wouldn't be a surprise". Which might be true but it's not helping.

Re:Great Dirhombicosidodecahedron ("Miller's Monster") on Wednesday September 30, 2026 @06:15PM (#49915180)
I want one!

Should probably start slightly less ambitiously though :P.

Re:EDG C++ front-end goes public on Wednesday September 30, 2026 @06:11PM (#49915153)
I have fond memories of working on an embedded systems compiler that used the EDG front-end — that would be almost 20 years ago now.

We certainly held it in high regard. It was rare that a compiler bug was in their code rather than ours :).

Re:Sonnet 5.5 on Monday September 28, 2026 @05:54PM (#49884962)
A human can produce far more code than a human can understand, too, but pre-LLM we always viewed someone overwhelming their colleagues like that as being bad at their job.
Re:Claude Cowork and chat are now one Claude on Saturday September 19, 2026 @05:59AM (#49765029)
That's "chaotic" rather than "non-deterministic".
Re:You can run Git on object storage if you re-make packfiles on Saturday September 19, 2026 @05:31AM (#49764866)
`git update-server-info` is your friend; it generates the auxiliary files needed to allow clients to make range requests against packs.

For example: https://andrewaylett.github.io/rgitweb/ is a repository viewer that runs against a static git repo. It doesn't care what you're storing the pack in, just that the data is there to make the right range requests.

Re:Claude Cowork and chat are now one Claude on Wednesday September 16, 2026 @04:30PM (#49732561)
LLMs are inherently deterministic. The way everyone deploys LLMs leads to non-deterministic results, but there's nothing† stopping providers from offering deterministic evaluation if they choose.

All the sources of randomness are under the control of the provider, even if today's deployment structures mean providers introduce extra randomness due to the concurrent nature of the evaluation. Serialise the computation, feed it from a pRNG, and you have a fully deterministic result. But providers don't want to offer a deterministic result, and especially not one as fragile, expensive, and inefficient as a full serialisation would be.

†: For variants of "nothing" that include cost and deployment challenges.

Re:Open Source Durable Objects for Postgres on Friday September 11, 2026 @06:50PM (#49666500)
In my mind, slop is when the output is longer than the context provided by the user -- there's text, but there's no content.

Where LLMs can be really actually quite useful, is situations where you have a lot of context and want to distil it. That's what I think happened here: the author has a lot of information to convey, and the LLM-generated output is relatively information-dense.

Unfortunately there's no objective measure for information density of an arbitrary piece of text.

Re:Open Source Durable Objects for Postgres on Thursday September 10, 2026 @08:15AM (#49642489)
AI, but I'm not sure about "slop". There is actual content in there, for all it's written by an LLM.
Re:Lake Ontario ("Lake America") on Tuesday September 01, 2026 @08:20AM (#49520977)
It seems that there are 363,123 `official_name:` tags in OSM [1], and the discussion thread hints that at least some* of them are due to naming disputes. Given (according to the thread) no-one actually renders the tag on their maps, using that tag in this case seems like a good policy.

[1]: https://taginfo.openstreetmap.org/keys/official_name#overvie...

Re:Creepy Crawlies on Monday August 31, 2026 @06:34AM (#49508046)
Now deployed here: https://andrewaylett.github.io/rgitweb/ with a copy of its own repository to explore.
Re:Creepy Crawlies on Sunday August 30, 2026 @07:04PM (#49503708)
Just for fun, because I could, I vibed up a `cgit` replacement that runs entirely in the browser -- point it at a git repo where you've run `git update-server-info` and it'll load files as if it's starting to clone the repo, using range requests and browser caching to avoid actually loading more data than necessary for the view you've requested.

I'm certainly not saying you should use this code, but it's a proof of concept for avoiding the CPU overhead of cgit rendering by loading the data on the client.

It cost me £8.27 of Fable use (from the free credits I've been given) and 56% of my five hour quota on a $20/month Pro plan. There's no server logic, it's 1.3MB of minified JS and CSS and (while I'm absolutely not suggesting anyone try to use it) it basically works: https://github.com/andrewaylett/rgitweb

This is a one-shot, my prompt set the expectation that I'd be able to load resources using CORS but (not entirely unreasonably) the Git hosts I've tried don't set CORS headers.

Shared more because I was pleasantly surprised at how cheap and easy this was -- and with a repo link because talking about it without sharing the link would be a bit crass.

Which was, procedurally, the correct course of action: the referendum was non-binding, because the UK's constitution only allows for non-binding referendums. Parliament is sovereign, whether you and I like it or not (and I'm generally ambivalent about it).

Given one of the major themes of the leave campaign was "restoring parliamentary sovereignty", it's darkly ironic that leave also campaigned against parliament actually using that sovereignty, and indeed came closer than anyone else (including the EU) to restricting parliamentary sovereignty.

Re:Asus Bike Booster on Sunday August 16, 2026 @05:46PM (#49324038)
There's a big difference between an "ebike" and an electric motorbike.

Ebikes are pedal assist, power limited, and limited to only assist up to a certain speed. You can go as fast as you're able, but if you're above (commonly) 25km/h the motor won't help you. They're allowed anywhere you're allowed a non-assisted bicycle.

Electric motorbikes may be limited by the manufacturer in order to achieve a certain license class, but once you get past the low power classes, they're only as limited as their petrol cousins. They're only allowed on roads.

Any middle ground, including things that look like bicycles but don't require the rider to peddle, fall either into the "electric motorbike" category or into the "not roadworthy" category. Riding them without a proper license, insurance, and equipment is illegal.

Somewhat unfortunately, much of the press seems to want to class the non-roadworthy motorised vehicles as a special case of "ebike" rather than the general case of "motorbike".

(And to your first point: yes there are speed limits but it's fairly common for cars and motorbikes to be able to go much faster than the limit. In first gear, even, for motorbikes.)

Re:Stacked PRs are now live on GitHub on Friday July 31, 2026 @05:03PM (#49128487)
GitHub will now maintain approval if a rebase doesn't result in a changed diff. Small things :P.
If you're going to give an LLM a tool that lets it send emails, set it up so you can read the emails before releasing them.

It's not the LLM that spammed, it's the people who set up the LLM.

Re:Stacked PRs are now live on GitHub on Thursday July 30, 2026 @06:24PM (#49116653)
Indeed. But lots of people have never even heard of Gerrit :P.

And the implementation feels very much like it sits in the UI layer, rather than further down the stack.

I'm not trying to claim stacking PRs in this way is the best way (it's not). But it does add an extra affordance for those who want it without burdening those who don't with the need to understand why someone would prefer it.

And there are also plenty of ways that people have been working around GitHub's (and to a lesser extent, git's) lack of tooling for working on changes in this way. I'm sure they have customers clamouring for the feature; whether they'll be happy with what they get remains to be seen.

(Very happy jujutsu user here, my tooling makes it really easy to create stacked commits with a stable identifier that maps really easily to branches and then onwards to running `gh stack`, but what GitHub have delivered is definitely still lacking)

Re:Stacked PRs are now live on GitHub on Thursday July 30, 2026 @03:27PM (#49114547)
They don't. But reviewing individual commits in the GitHub UI is hard.

A set of stacked PRs is exactly the same as a line of commits. The only difference is the UI, but the UI is the important bit here because lack of UI is what's stopping folk from doing that today.

Even when I've developed my changes as a stack of commits, I'll feed them to my team one commit (and one PR) at a time so they're easier to review — and I discovered that GitHub had turned on stacked commits UI because for one particular project I'd manually created a set of PRs in advance (with the right bases) and GitHub offered to create a stack out of them.

Any claims are irrelevant to the inherent adversarial nature of the role, which comes from the authority they wield.

Edit: which also means you're not wrong, if you've got claims that trigger damage control then HR are even less your friend.

Even if the people working in HR genuinely want to do the right thing for the employees, and company policies support them doing that, interactions with HR are inherently adversarial.

The people within HR may be friendly, they've probably got friends :). It can be a very people-oriented role. But they are incapable of being your friend when you're interacting with them in their role as representative for the company.

I greatly appreciate my employer's HR folk, they're really lovely, very good at their jobs, and want to help. But if I have to have a formal meeting with them, I would definitely bring along my union rep.

Older »