News for hackers. Stuff that matters.

dantiberian

Re:Railway Blocked by Google Cloud on Wednesday May 20, 2026 @12:20AM (#48203046)
I wrote about the UniSuper issue at the time: https://danielcompton.net/google-cloud-unisuper. It was a pretty nasty bug where their VMWare environment was created with a one-year expiry date, but was one "resource" from the perspective of Google Cloud.
Re:CISA Admin Leaked AWS GovCloud Keys on GitHub on Tuesday May 19, 2026 @08:58PM (#48201725)
GitHub has automatic secret scanning on all public repositories which notifies AWS if access keys are pushed. I would have expected these tokens to be immediately revoked by AWS. Is there something different about GovCloud access keys so they weren't detected?
Re:The Codex App on Tuesday February 03, 2026 @09:40PM (#46880769)
Could you please pass on feedback to the team that the git diff view is very hard to read for red/green colourblind users like myself? Colour scheme like GitUp.co is very readable for me.
Re:People who know the formula for WD-40 on Monday January 26, 2026 @04:42PM (#46771963)
I'd be very interested to know how they produce it if the formula is so tightly held. At some point people need to be purchasing the ingredients and mixing them together.
From the article:

The intention of OrioleDB is not to compete with Postgres, but to make Postgres better. We believe the right long-term home for OrioleDB is inside Postgres itself. Our north star is to upstream what’s necessary so that OrioleDB can eventually be part of the Postgres source tree, developed and maintained in the open alongside the rest of Postgres.

Re:Happy 10k Day on Tuesday March 11, 2025 @11:58PM (#43339839)
Looks like it, based on this video driving on the left side of the road in what looks to be Australia: https://www.youtube.com/watch?v=Fkh3s6WHJz8
Re:Electric (Postgres sync engine) BETA release on Tuesday December 10, 2024 @11:12PM (#42384720)
I listened to https://www.localfirst.fm/18 recently from Electric-SQL. One of the things James mentioned was that Electric lets you use commodity CDNs for distributing sync data, which takes the load off your main Postgres and servers.

This seems like a good pattern, but of lower value for a SaaS app with many customers storing private data in your service. This is because the cache hit-rate for any particular company's data would be low. Is this an accurate assessment, or did I misunderstand something?

Re:Introducing The Model Context Protocol on Monday November 25, 2024 @05:45PM (#42240915)
Will this be partially available from the Claude website for connections to other web services? E.g. could the GitHub server be called from https://claude.ai?
https://where.durableobjects.live is a good website that shows you where they live. Only about 10-11% of Cloudflare PoPs host durable objects. Requests to another PoP to create a DO will get forward to one of the nearby PoPs which do host them.
The issue here is that if company.com does not use Google Workspace and hasn't claimed company.com, then any employee can sign up for a "consumer" Google account using [email protected].

There are legitimate reasons for this, e.g. imagine an employee at a company that uses Office365 needing to set up an account for Google Adwords.

Re:Starbase: SQLite on the Edge on Sunday October 06, 2024 @03:48PM (#41759711)
I don't really understand what this is offering beyond Cloudflare's recent release of running SQLite in durable objects: https://blog.cloudflare.com/sqlite-in-durable-objects/. Is it about providing an external interface to Cloudflare's SQLite databases?
Could you explain more why you were you not able to sign the URLs at request time? Creating an HMAC is very fast.
Re:All of Microsoft's MacBook Air-beating benchmarks on Thursday May 30, 2024 @11:56PM (#40531335)
The Surface Laptop scored 1,745 on the Procyon AI Score, while the MacBook Air managed 889. Qualcomm’s Snapdragon X Elite has 45 TOPS of AI acceleration performance, much more than the 18 TOPS found on the M3.

TOPS (Trillion Operations Per Second) is a meaningless score without including the precision. Are they INT4, INT8, INT16 or FP16? Microsoft's qualifications for a Copilot+ laptop require 40 TOPS at INT8: https://www.theregister.com/2024/05/21/qualcomm_windows_micr.... The new Snapdragon X Elite can do 45 TOPS at INT8.

Apple's M3 has 18 TOPS, and their M4 has 38 TOPS, but the M3 was measured at INT16 and the M4 at INT8: https://www.anandtech.com/show/21387/apple-announces-m4-soc-.... Cutting the precision in half lets you do ~twice the amount of work.

The Snapdragon is very impressive, but it's silly to see TOPS claims from companies repeated by journalists without adding some context.

Re:What went wrong with UniSuper and Google Cloud? on Wednesday May 15, 2024 @12:29PM (#40369083)
Thanks for pointing that out. I had a look at the Terraform provider but missed that delayHours was hardcoded to 0. I’ll update the article.
Re:Australia to Ban Engineered Stone on Thursday December 14, 2023 @02:45AM (#38638852)
From the report (page 56):

Exposure to RCS from engineered stone causes silicosis typified by a faster onset and more rapid progression than that caused by RCS [Respirable crystalline silica] from other sources, including natural stone.

When engineered stone is processed, the dust generated contains higher levels of RCS, and that RCS has different physical and chemical properties that likely contribute to the more rapid and severe disease. There is also evidence to suggest that other components of engineered stone may contribute to the toxic effects of engineered stone dust, either alone or by exacerbating the effects of RCS.

...

The increased risks posed by RCS from engineered stone, increased rate of silicosis diagnosis amongst engineered stone workers, and the faster and more severe disease progression amongst this group, combined with a multi-faceted failure of this industry to comply with the model WHS laws means that continued work with engineered stone poses an unacceptable risk to workers. The use of all engineered stone should be prohibited.

https://www.safeworkaustralia.gov.au/sites/default/files/202...

Re:Australia to Ban Engineered Stone on Thursday December 14, 2023 @02:43AM (#38638836)
From the report:

> A total of 12 successful prosecutions have been reported since 2021, with many related to the uncontrolled processing (dry cutting) of engineered stone materials

https://www.safeworkaustralia.gov.au/sites/default/files/202...

Re:Bear Does Analytics with CSS on Wednesday November 01, 2023 @01:31PM (#38101712)
You should add this as a reply to the top comment as well.
Re:I think GCP is better than AWS – by Fernando Villalba on Thursday October 26, 2023 @12:49PM (#38028278)
A general issue I have with GCP docs is that they are overly implicit. Often the interaction of two features is implied but not specified. Another issue I have is when implementation details are waved away rather than explained. It adds up to an experience where I am trying to read between the lines of the GCP docs for a feature to understand what is really happening.

AWS docs are the opposite. They are often very long and verbose, but once you read the whole manual, you can be guaranteed to have a good understanding of the service.

My advice for the Google team would be that if you are ever writing documentation and ask yourself “does the customer really need to know about this?”, the answer should always be yes.

Presumably GitHub/GitLab support is coming, but this is quite a limited product at the moment. It doesn’t even support their own Cloud Source Repositories.

You can version the Terraform configuration, either in a public Git repository or in a Cloud Storage bucket. Use Object Versioning to version configurations in a storage bucket.

https://cloud.google.com/infrastructure-manager/docs/overvie...

Re:Clojurists Together – Firefox 116 release on Friday August 11, 2023 @07:34PM (#37095316)
Co-founder of Clojurists Together here, I’m really proud of what the Clojure community was able to fund here.

Now, all Firefox users will be able to use custom formatters.

This is all based on the authors' estimations, not actual measurements or observations.

The scholars first estimated the cumulative weight of New York’s buildings to be 1.68 trillion pounds, and then calculated the downward pressure these buildings exert on the mixture of clay, sand, and slit that make up most of the ground beneath the city’s streets.

Based on their model, New York experiences a “subsidence rate” (the technical term for sinking) of about one to two millimeters per year on average, though Lower Manhattan, as well as particular areas of Brooklyn and Queens, show a propensity for greater subsidence risk.

Re:How Discord Stores Trillions of Messages on Monday March 06, 2023 @10:18PM (#35051129)
How much of the latency reduction was due to the data services layer with request coalescing and how much was from ScyllaDB? Did the schema and other factors stay the same when migrating to ScyllaDB?
The GitHub public events API is delayed by 5 minutes, presumably to give secret scanning partners time to react before commits are made public.

https://github.blog/changelog/2018-08-01-new-delay-public-ev...

Disclosure: I'm an ex-GitHub employee but was not involved in the secret scanning API.

Re:Pipefail: A missing shell option slowed Cloudflare down on Tuesday April 05, 2022 @08:51PM (#30927069)
One other thing which could have prevented the shell failure is checking shell scripts with https://www.shellcheck.net/. It helps catch common errors and places where shell errors can fail either silently (like here), or catastrophically (`rm -rf $abc/` where $abc is undefined)

Perhaps that was also part of Cloudflare’s mitigations here too but not mentioned.

Google doesn't use shared building wifi in their corporate campuses

> For both wired and wireless access, Google uses RADIUS servers to assign devices to an appropriate network, based on 802.1x authentication. We use dynamic, rather than static, VLAN assignment. This approach means that rather than relying on the switch/port static configuration, we use the RADIUS servers to inform the switch of the appropriate VLAN assignment for the authenticated device. Managed devices provide their certificate as part of this 802.1x handshake and are assigned to the unprivileged network, while unrecognized and unmanaged devices on the corporate network are assigned to a remediation or guest network. - https://static.googleusercontent.com/media/research.google.c...

Yes BeyondCorp does allow access to corporate resources outside of the intranet, but as part of a managed device + identity + network evaluation.

Older »