don-code

I'm not seeing CVE-2026-98432 included in the changelog for any of the new kernels on the 28th.

My read is that a lot of content - specifically of the infinite-scroll variety - is very intentionally not designed to be printed.

There are a number of Slack and Discord conversations I'd have liked to export off to PDF, for instance (where a solid 90% of my "prints" go). I'm reminded that one of Slack's boot messages used to be, "Consider the environment before printing this Slack."

Indeed! If they'd reached out and said "I need 128GB of RAM to do this work" (which, for reasons I won't get into, was the case), we'd have figured out a more tenable solution.

Unfortunately, that conversation never happened.

I self-host e-mail, because I am stubborn - I have done it for 20 years. I would not recommend anyone do it if they aren't already, or if they well-and-truly want to be on call for their homelab.

So as not to reiterate, here's an HN comment where I described the most recent trial I endured with it: https://news.ycombinator.com/item?id=46297991

In the last 20 years, I've also run into problems like:

* My brand-new ISP wouldn't allow TCP port 25 inbound, and wouldn't relent. I had to go back to the old ISP.

* SPF became mandatory at Gmail, but I didn't get the memo, and Google started bouncing my mail one random day.

* My residential IP ended up on a "policy blacklist", one it could never get off because it's blacklisted by virtue of being a residential IP, not that it did something bad.

There was a point where a coworker came to my team, complaining that our policies had erased an entire week's worth of high-priority work on him.

We asked where this happened. He had done his work on an EC2 instance named `temp-worker-5`.

We asked where the files on that EC2 instance were; maybe we could cleverly get them back off the disk. They were in `/tmp`. We had it mounted on tmpfs (in memory), and we were running tmpreaper to clean out `/tmp` every Sunday.

When presented with the sheer absurdity of doing work on an instance called `temp`, out of a directory called `/tmp`, he backed down...

I fear that we wouldn't be so lenient (or rational) on my team had an AI agent done this - we'd have to enable the AI, after all.

Obviously experiences will vary, but I have now had three organizations express concern (though not to the point of telling me I must stop) that I use third-party Firefox derivatives. This started with Pale Moon and then continued with LibreWolf.

The concern is that they "aren't authorized apps". As I've read it, this is a proxy for "we aren't certain these apps can be trusted, but nobody ever got fired for pointing the finger at Mozilla or Google when something goes wrong, but would be fired if they pointed it at this one random guy in the Netherlands".

As a NoScript user, I see a lot of similar content served via websites as well.

The ideal case is that a website gracefully degrades with JS disabled. That's largely a pipe dream with React usage being what it is, but some sites manage it. Github is one who still does this well.

The nonideal case is that I'm presented with a misrendered site, but I can still see some semantic information that may, or may not, be what I was looking for. Gitlab's an example of this.

The worst case comes where the site white-screens and doesn't load _anything_ of use. Reddit is an example where it loads nothing but a loading image. My worst pet peeve is the Stack Overflow-style failure mode, though, which explicit says: "Enable JavaScript and cookies to continue.", rather than making any attempt to show any content at all, which is most similar to what the author here is describing.

I was briefly involved with WITR during my undergrad. Loved what they were doing, but at that time the station definitely bought into the hipster attitude, music you've never heard of and will never hear again.

The only band I can remember hearing on WITR, then hearing anywhere else, is Neon Indian. They also sponsored a concert with Viva Brother, which briefly got some airplay on other stations, in spite of never (to my knowledge) having played them.

Well, sort of. My radio presets back in the 2000s were 101.7 WFNX, 104.1 WBCN, 107.3 WAAF, 100.7 WZLX, and 92.9 WBOS. Of those stations, only WZLX remains.

The greats - in my opinion, WBCN and WFNX - are long off the air. They were powerhouses of culture, both local and national. WFNX was the first to play Nirvana's Nevermind; Bono of U2 once said that "...without BCN, we'd all be (expletive)'d, let's face it."

Oedipus, a well-known Boston DJ since the 70s (who got started at 88.1 WMBR, MIT's station) and program director at WBCN, said of it: "The Telecommunications Act of 1996 destroyed radio... Corporations were now allowed to own multiple stations in the same market and across the country. Stations were no longer programmed locally."

Meanwhile, WAAF went online-only in 2020. WBOS got delegated to an HD2 subchannel in 2004. Likewise, The Boston Globe picked up many of the radio personalities for the online-only RadioBDC, now Indie617, but that seemed dead by the mid-2010s. I hear the former WFNX DJs Henry Santoro and Julie Kramer may still have some limited presence on 89.7 WGBH.

I was recently happy to find Adam 12 (formerly of WFNX (formerly of WBCN)) still DJing on 105.7 WROR.

88.9 WERS (Emerson College's station) is doing a great job of carrying the helm of Boston music culture. Occasionally I'll also tune into 90.3 WZBC (Boston College's station), which is a more "traditional" and less "commercial" college radio station.

Just outside Boston are likewise some public and community stations with good programming - 88.3 WRPS (Rockland's public radio station) and 101.3 WFNX (Scituate's community station - love that they picked up the WFNX callsign!) are pretty good, if you're in range.

Let's hypothesize this is true.

I worked at a startup that had _money_ - a lot of it - flowing in. Stakeholders wanted to see growth, which meant features. They did not want to see us making platform improvements; those didn't show well to clients. Best throw money at the problem, rather than sacrifice the all-important features.

We had a number of architectural quirks that reflected this. One was that we ran our databases in AWS on ephemeral instance store. Yes, the kind that doesn't persist when you stop or lose the instance. The kind that you should never run a database on. We did it so that we could join them eight of them together in RAID 0 on the biggest instance types, and pull 400,000 IOPS to the disk that way. We paired this with hot spares of each shard, as well as hourly backups.

We did this to support a Rails / ActiveRecord data model, for data that should never have been part of a Rails data model. We had exactly one person working part-time on query optimization.

The maintenance burden was immense. The AWS bill, even more so. But again, we are hypothesizing that we could host all of this data on a laptop.

To an extent, maybe up until our thousandth customer or so, I actually think we could have. But we wouldn't have spent most of our time working on _features_ - we'd have instead spent most of our time trying to performance optimize. That would've meant the investors wouldn't have seen growth, which in turn would've highly impacted our success. We had a well defined domain, and optimizing the queries for performance was not it.

Morse code has some interesting properties that make it an ideal way to communicate when all else fails:

1. It can be transmitted by simple means through many mediums - radio waves (amateur radio, as in the article), light (turning a light on and off), sound (I once used a boat horn to communicate with another boat)... technically I could even tap it on someone's shoulder.

2. It's self-clocking; you don't need a way to synchronize between two operators. One of the amateur radio clubs within range of me, K1USN (https://www.k1usn.com/sst) runs a contest that's limited to 20wpm so that new operators can get used to interpreting Morse on the fly.

3. It's fairly easy to recover after a fault - much easier than, say, ASCII. I might lose a few characters, but much like a smudge on a written page, I can figure out where intelligible letters start again without much difficulty.

I agree with you in regard to paying attention while driving, but the perception issue was actually around "you can't be bothered to be at your desk for meetings, so we perceive you as lazy", not "you're a risk to those around you, so we perceive you as irresponsible".

I find driving to be one of the most useless ways of spending my time, and if it's for more than half an hour, I do try to figure out some way to increase the value of that time.

I have a weekly commitment that leaves me driving home (~40min) at 9pm, and I usually eat dinner (just a sandwich) while I drive. That also has the advantage of making it so that I'm not eating an hour before bed.

If I know that I need to call someone, I'll usually try to schedule that call while I'm driving. I used to take meetings while driving as well, though I stopped because it was perceived poorly by others.

What's sort of sad is that I can take public transit to all of my regular commitments, and that lets me keep doing something (reading, working, whatever). The schedules are poor, though, and they blow my commute times completely out of the water. For example, I've got a 5-7pm commitment that is a 15-minute drive one way, but if I wanted to go by bus, I'd have to leave at 3:30pm (latest it comes before I need to be there), and get back on it at 8pm (the earliest it comes after I'm done).

I agree with the author's premise - that one feedback loop optimizes for speed, and the other for scale - but I don't think the market is bearing the conclusion - that AI should be utilized to enable more rapid experimentation, where we better scale what works.

Many vendors seem to be learning (or not learning, but just throwing their weight against it anyway) that adding hastily-generated AI features are causing customer dissatisfaction, as more people brand the features "slop".

In the best case, the users give the company more chances. Infinitely more chances.

In a worse case, the users assume the new feature will always be bad, given their first impression. It's hard for a vendor to make people reconsider a first impression.

The absolute worst case is that AI enables a new market, but the first attempts are so poor that the first movers make people write that market off as a dead end, leading to a lost opportunity.

There was a point where two friends and I each lived alone in an apartment, and I was the only one who had a (2-door) car. We still occasionally did Costco runs.

We'd go in and walk the store - the whole store - aisle by aisle.

If I saw something like a 2-pound bag of tortellini, but thought two pounds was too big a quantity for me, I'd ask, "does anybody want to split two pounds or tortellini?" One might say yes, so we'd throw the tortellini in the shopping cart.

At the end, one person (the membership holder) would pay, and we'd divvy up the result of our haul into reusable containers, in the parking lot. One of us would then take point on itemizing the receipt, and we'd pay back the person with the membership.

In hindsight, I think we did this more to socialize than to save money, but we definitely did save money. Even as a single apartment-dweller, I bought my fair share of 24-packs of yogurt and 5-pound bags of frozen vegetables.

My experience has been that it's easy to say, "oh, it's just me", but much harder to subject someone you care about to the same standard that you would yourself. I'm in a similar position with the thermostat, even though something we initially bonded over was that we both kept our thermostats at a low temperature that was outside the window of being socially acceptable.

I had the Treo until 2012; the Android headwinds were blowing full speed at that point.

Before the Treo, I had a VisorPhone. Wonderful device, and fit a specific need (no phones allowed in school - great, I can slide the phone out of the back, and continue to use it as a PDA). The thing that killed the VisorPhone for me was PalmOS 3.5's lack of memory protection, combined with a bug in the SMS app. Anybody sending me an MMS message instantly crashed it, requiring me to pull the batteries. Sometimes I hadn't realized it happened for hours, and missed phone calls. MMS messages (group texts, etc) only became more and more common, and when this became a multiple-times-weekly occurrence, I made a move.

I'm sort of curious where the law stands on this (I am not a lawyer).

Since it has a license plate on it, it in theory displays some ownership info. Is that enough for me to say, "it's clearly not mine now"? If it didn't, does that give me any right to take something off a public roadway?

Obviously, I know that the letter of the law, and what actually will be enforced, are two different things. Taking something that belongs to CBP would almost definitely be prosecuted in this case, regardless of whether it's legally fair game to do so.

It appears that I can't direct-link to it, but look up case 19S-CR-00528 on public.courts.in.gov - this was a case in which the Supreme Court of Indiana overturned an earlier ruling that removing a GPS monitoring device from your own car, when you weren't aware it was there, was theft.

This is one of the reasons I hung onto my Treo for so long. It was so much faster to do... well, basically anything that the device was capable of. With the physical keyboard, you actually didn't need to take the stylus out very often, either.

Calling Mark: (power on) (phone key) M-A (send) - hitting the phone key automatically brought up the dialer, which did double duty as contact search.

Adding a new event to the calendar: (power on) (calendar key) (enter) - and just start typing; you could navigate the fields with the up and down arrows.

Opening the calculator: (power on) (home key) C-A (enter) - the launcher was filterable with the keyboard.

There was an article a few years ago here on HN about "can't be evil" business models, which used Costco as an example. As soon as Costco turns evil, it stops working. https://www.bryanlehrer.com/entries/costco/

Has the site actually been running all this time? I notice that the generator tag says "FrontPage 12" (post-2003), and site has a TLS certificate, which in 1996 it most certainly would not have had.

> Why don't cloud providers have a nice way for tools like TF to query the current state of the infra? Maybe they do and I'm doing IaC wrong?

This is technically how Ansible works. Here's an extensive list of modules that deploy resources in various public clouds: https://docs.ansible.com/projects/ansible/2.9/modules/list_o...

That said, it looks like Ansible has deprecated those modules, and that seems fair - I haven't actually heard of anyone deploying infrastructure in a public cloud with Ansible in years. It found its niche is image generation and systems management. Almost all modern tools like Terraform, Pulumi, and even CloudFormation (albeit under the hood) keep a state file.

Being familiar with the hijinks that Steve Wozniak pulled with the switched mode power supply in the Apple II (1977), I was curious about how the author solved for this piece:

> It also needed three supply voltages; +5v, +12v, and -5v. That made it tough to power it from a single-voltage power supply or battery.

According to https://www.allaboutcircuits.com/news/mc34063-the-switching-..., the solution - the MC34063 - isn't _exactly_ a design that's contemporary with the Altair or other 1970s micros, but was introduced in the early 1980s. That would put it closer in age to the Commodore 64 which, in spite of its much smaller size, still indeed does not fit in an Altoids tin.

Very cool project nonetheless!

A few months ago I spoke with the frontman of a local Boston band from the 1980s, who recently re-released a single with the help of AI. The source material was a compact cassette tape from a demo, found in a drawer. He used AI to isolate what would've been individual tracks from the recording, then cleaned them up individually, without AI's help.

Does that constitute "wholly or in substantial part"? Would the track have existed were it not for having that easy route into re-mastering?

I understand what Bandcamp's trying to do here, and I generally am in support of removing what we'd recognize as "fully AI-generated music", but there are legitimate creative uses of AI that might come to wholly or substantially encompass the output. It's difficult to draw any lines line on a creative work, by just by nature of the work being creative.

(For those interested - check out O Positive's "With You" on the WERS Live at 75 album!)

One of the neater aspects of HP-UX is that, given the breadth of pre-2000s HP, HP-UX ran on a number of different devices. You can almost (_almost_ - it's a stretch) think of it as a precursor to how Linux proliferated on routers and smartphones.

While you'd _expect_ to find HP-UX racked in a datacenter, you can also find it on workstations, where its proprietary VUE desktop environment eventually morphed into CDE (which, ironically, I've only ever used on Solaris).

It powered at least one early, pre-laptop-form-factor portable PC, the HP Integral. And you can also find it running on oscilloscopes, logic analyzers, and other test equipment from the 80s and 90s.

Doing connected work from the subway has gotten much, much easier in the last few years. I attribute that to three things:

1. Cell service has become low-latency. This is very different from "fast", which it has also become! When I started working from the train (on HSPA+), pings in the hundreds of milliseconds were the norm. My first step was usually to SSH to a remote machine, and let just the text lag on me. Nowadays, I can run a Web browser locally without issue.

2. Cell service has, at the same time, become ubiquitous in subway tunnels. When I started, there were some areas that dropped down to EDGE (unusable), and some areas that had no service at all. Now, there is exactly one place on the Boston transit system - Back Bay Station - where I lose cell service.

3. Noise cancelling tech has gotten better. It's not just about noise cancelling headphones: both of my laptops (a 2024 MBP and a ThinkPad P14s) have microphones that can filter out screeching wheels and noisy teenagers quite well. That means I can take meetings without making them miserable for the people on the other end.

These, honestly, are a huge game-changer for me. The ability to take a 30 minute meeting while commuting, where otherwise I would've had to get in early or stay late at work, actually does wonders for my ability to have a life outside of work.

Sadly, you don't even need to engage directly with these companies to be affected. Case in point: e-mail.

I host my own e-mail. Valid SPF, not on any spam blacklists, good reputation score on my static IP.

At the beginning of November, I lost the ability to send e-mail to Gmail - it was all rejected as, quote, "possibly spammy". Double checked SPF and DMARC... Double checked documentation... Spent time setting up DKIM on my mail server, even though I sent nowhere near enough mail to merit it. Nothing got through for two weeks.

Google Postmaster Tools were totally unhelpful, telling me _that_ I was being blocked, but not _why_ I was being blocked. There is a community support forum where I posted - it hasn't seen a response since I posted in November. There was also a support portal where I could, in theory, contact a human. I sent something in there, and am still awaiting a reply.

Now remember, Gmail isn't just for @gmail.com addresses. Gmail hosts my accountant's domain. Gmail hosts the domain for a club that I'm part of. Gmail hosts friends who also have their own domains. Gmail hosts... well, probably a solid half of the Internet's e-mail.

My only way out of this nightmare was to reach out to a contact at Google, who - having an @google.com e-mail - was also unable to receive e-mail from me, and made the case to the right folks internally that I couldn't send important messages to him. A few days later, I could magically send e-mail to Google again.

Do I have any idea what I did? No. Do I have any idea what they resolved? Also no. Can I prevent it in the future? Who knows!

> All if, else if constructs will contain either a final else clause or a comment indicating why a final else clause is not necessary.

I actually do this as well, but in addition I log out a message like, "value was neither found nor not found. This should never happen."

This is incredibly useful for debugging. When code is running at scale, nonzero probability events happen all the time, and being able to immediately understand what happened - even if I don't understand why - has been very valuable to me.

I likewise have a circa 1997 LaserJet that I refuse to give up. Both the printer and scanner still function flawlessly, every time I need them to - something that few printers today seem capable of.

I switched to 64-bit Windows in 2006. The printer supports PCL drivers, but there are no 64-bit drivers for the scanner. Luckily, I was able to keep it going by running 32-bit Windows in a VM, and passing the parallel port through.

I switched to a laptop without a parallel port in 2019 (thank you, Lenovo, for keeping the parallel port on docks as long as you did). At that point, I bought a JetDirect that supports both printing and scanning over the network. CUPS and SANE both support it out of the box.