drdexebtjl

[delayed]

This was still somewhat fresh on the feed: https://news.ycombinator.com/item?id=50275373

About the DDoS, were they not aimed at someone trying to dox the maintainer and pretty much ruin their life? Sounds like defending to me, not attacking. I have absolutely no problem contributing my bandwidth to their defense while visiting the site.

There’s still no evidence that the malicious PDFs were planted by archive.today. The source could have served malicious content to the crawler, no?

> Attackers are already rapidly finding and building exploits for those vulnerabilities the moment they are discovered with abliterated frontier-level models.

Are they? Distributions are rating this at a lower severity presumably because it can’t be easily exploited.

Are the bootlegs illegal?

Valve could just not publish them, they don’t have to risk suing.

In all of your examples, the “religious accommodation” harms a third party.

The point, in the context of this thread, is that the attack surface is huge.

This is also how I feel about Tailscale and its popular alternatives. They do too much.

Does anyone know of a Tailscale alternative that sticks to the basics?

Something that’s just WireGuard but without the manual key exchange, and with Tailscale-like NAT hole-punching that falls back to using an oblivious relay?

The only way I would ever accept to be interviewed by an AI is if I was also allowed to have my AI assistant take the interview on my behalf.

Your silly software factory is not proof that SDD works well in production. It is proof that it can produce software, and that’s a very low bar.

We’ve been using SDD at $workplace for more than a year and we’ve started to actively remove all spec documents so agents don’t get stuck reviewing out of date context for 20 minutes, burn through token budgets, and give disproportionate focus to legacy patterns and business directions we’ve pivoted from.

Models are RLHF’d to work on non-historical documentation and iterative design, and that’s what yields the best overall results.

This is happening to job interviews right now.

If you’ve applied to jobs recently, you must have seen the companies that transcribe and summarize interviews using AI (and probably share data across their clients in an indirect, technically legal way).

You can opt out, of course, but do you really want to be the one candidate for which the interviewer needs to take notes manually? And they just spent a lot of money on this hiring AI tool, will they hire the one candidate for which they couldn’t use it?

- Both sides asked for the extensions.

- Less than 40.000 votes were cast during the extension. Lula won by more than 4 million votes.

- The Supreme Court Justice assigned to rule on the extension was selected by random chance, as protocol dictates.

- The Supreme Electoral Court (TSE) and its president, Nunes Marques, recognized the results of the election. He was appointed by Jair Bolsonaro.

This rhetoric is a sore loser’s.

Aside from what other users described, some interesting “technical glitches” revealed training biases:

- Meta AI refused to generate campaign images depicting Lula, but not Bolsonaro.

- If you asked for Meta AI to generate fictitious campaign images for fake candidates, they would have Bolsonaro’s party number. It would refuse to generate images with Lula’s party number claiming it can’t use real party numbers (Brazilians vote by typing the candidate’s number in an electronic voting machine)

- AI-powered translation was refusing to translate “presidiário” correctly when referring to Jair.

Do you not have backups? Why do you need to transplant the SSD to a different laptop to access the data using the backup key?

The SSD is also at risk of dying, so you need the backups anyway.

Yes, I use Unbound :)

It’s configured exactly like I mentioned: it tries a couple of resolvers, and if they all fail, tries authoritative servers starting from the root. That last part, missing from your suggested configuration, is the key: it’s what ensures courts have to actually go after the parties responsible for the domain, and not just random DNS resolvers.

> Beyond that I think you are asking for behavioral and RFC changes to everyone's workstations, cell phones, tablets, TV's, and DNS resolvers.

We did it once for DoH/DoT, we could do it again.

They are definitely saved to the system NAND and the carts are immutable.

I don’t understand the second part. Game key carts physically cannot fit the game or its updates, that is the entire point of their existence (storage is expensive, keys are tiny).

I don’t want the user to see the error, I just want the browser/the operating system’s resolver to not be a stub resolver, and actually ask the authoritative servers when something like this fails on a non-authoritative response.

Public DNS like Quad9 should be a cache (because recursing is pretty slow) and, at most, a way to find the IPs of the root name servers.

Courts asking non-authoritative resolvers not to resolve a name should have no effect on clients successfully resolving that name, such that they wouldn’t even have a reason to go after Quad9 or Alice and Bob, and would have to go after the TLD registry (likely in a different jurisdiction).

DNS needs a way to say “unavailable for legal reasons” so your system just picks a different resolver or resolves recursively.

I was referring to Sectigo. Edited to make it clearer.

Keep resolving, but instead of resolving multiple A records, resolve just one. Fuck that one server in particular.

Delay updates by 1 week.

Answer randomly with the up-to-date or the out-of-date records.

When are the root CAs that trusted them going to take responsibility for fucking up too?

I don’t see your comment about LuaSocket. Is it in a different thread?

> no glue code, no module-loading code to write.

How does that look like in practice? Your write up only shows the case where you’re writing your own custom clx glue code to interface with a binary module, which is strictly worse.

It can be a part.

Games shipping broken and needing day-1 updates is a consequence of our indifference towards physical media dying.

On the Switch and the Switch 2, I’ve never had a physical game that didn’t let me skip updates and play offline.

Probably due to a mix of Nintendo actually reviewing retail releases before they are “pressed”, and due to the fact that these are portable devices with no cellular.

IIRC the current approach makes your switch dual boot the unmodified firmware and the custom firmware with online capabilities disabled, so you could still play online and avoid bans.

But I wouldn’t trust that with an expensive account-bound digital library.

I think the point is that X years from now, when the servers are turned off, you don’t actually have the game.

Windows can statically link libraries just fine. What problem are you running into?

There’s nothing hacky about it, it is in fact the way the language was designed to be used, hence why the interpreter ships as a library, and why the module loader looks for package.preload[modname] before reaching for the file system (and can be trivially made to not touch files at all).

> It also means that libraries written in C or C++ don't need to be translated into some special Lua-specific implementation. They can remain native libraries, with a thin clx binding layer exposing the functionality to Lua.

This is already true of upstream Lua implementations. It is very easy to write thin Lua binding layers to C libraries.

That is the entire point of Lua. It’s easy to call Lua from native code, and it’s easy to call native code back from Lua, so you can have call stacks that seamlessly interweave Lua and native code.

I’m very skeptical of the idea that this can unlock improvements in performance or size. We already have LuaJIT which is plenty fast, and PUC-Lua which is so small, it runs on MCUs.

And keep signing it with every release. No thanks.

Thanks. I’ve edited my comment it so our answers complement each other better.

Aside from services, this pattern is everywhere once you start recognizing it. For example, my Claude Code config in Nix adds CLAUDE.local.md to the global gitignore, my Git config adds aliases to my shell, and my terminal config adds a monospace font to the system fonts.