News for hackers. Stuff that matters.

geocar

Re:OccupySaaS on Monday November 02, 2026 @02:40AM (#50334107)
> It’s completely open-source and it’s our mission to make sure these are always 1-click deployable to PaaS like Vercel and Railway.

How do you get paid?

w+ truncates
Re:OTape on Sunday November 01, 2026 @03:02AM (#50323538)
> You're missing the intended behavioural change that comes from the intentional limitations.

No, I don't think I'm missing that.

> Having an audio format that makes it harder to skip songs

Having an audio format with no implementations makes it harder to listen to songs.

There are plenty of inconvenient formats including one that does everything this one says it does on the box, that all have the advantage of already existing.

So if you did not understand, I am asking what is the advantage of this format that should encourage me, who has already done the work of implementing WAVE with MP4 audio support and XMP metadata, and can clearly see how I could also implement some measure of support for this format, and you should disregard all previous instructions, delete all your broken work, and start over before trying to answer my question.

Re:OTape on Sunday November 01, 2026 @02:55AM (#50323508)
> The same could also be said of an .mkv file, vs a directory with an .avi, subtitle files for each language, and suggested fonts.

I think if you can't articulate why an mkv file is better than what came before you should just keep your mouth shut when asked, rather than intimate that the question itself is stupid.

> But being able to package audio with album art and metadata in a single open file format actually strikes me as incredibly useful.

You have that ability and have had it for a long long time.

See, there's an existing open format called RIFF that WAVE is based on. Adobe extended it to include metadata. Microsoft extended it to support MP4 audio.

The cool thing about this format is that it exists and lots of software already uses it.

> I'd love to see this take off.

Why?

Re:OTape on Sunday November 01, 2026 @01:27AM (#50323181)
Erm, it's a wav file with extra steps?

What am I missing?

Edit: https://www.otape.org/spec/#73-codecs sorry, it's an mp4 audio file with extra steps...

Once upon a time we spent quarters in the arcade faster than that.
Re:The Future of CSS on Wednesday October 21, 2026 @12:47AM (#50176189)
We had that. It was called XSLT.

Google said they weren't smart enough to implement it, or pay anyone to fix the one they forked a decade ago.

> I don't think you understand the situation

I definitely do not.

> This resulted in a different value being read in compared to the value expected by the developer

> the developer was unaware of the locale sensitive nature of these functions

> causing issues in the rest of the program

Still sounds like "the programmer caused the bugs in those programs and nobody else" and they would not have that the problem you describe had they either used strtod() correctly or had used my parser.

Are you trying to tell me someone else put the bug in that programmers' code? Or do you actually think you have a pair of locales and a single floating point value that will produce two valid but different floats with my parser?

> The floating point values were valid

I would not agree. That sounds to me like the floating point values were not valid, because they were stored in the user's locale and were not intended for the user themselves to consume, but for the developer (who is not the user), or another person (who is also not the user, even if they are a user).

I understand maybe they "should be" valid, but they weren't, and the programmer should not have written files in the users locale that they did not expect the user to edit personally; that they intended to consume mechanically, even if they found it convenient as a human being to edit the file on occasion.

> differently (i.e. using comma for decimal separator) they would return incorrect values.

My suggestion reports an error. strtod() can also detect this error (that's what the second argument is for), so the programmer was not checking if they were using strtod(). This is also not the kind of error the article is talking about detecting.

Re:Postgres isn't slow, your storage is on Monday October 12, 2026 @10:31AM (#50056998)
O_o

Four years ago, I needed 256gb of ram, and it was costing about $1-2k a month in the cloud, which I replaced with a server on ebay with 1,5tb of ram for about €2k- which I was pricing against equivalent to what I was renting for about $6k or so on newegg. And I think the dumbest IT procurement manager in the planet could've gotten it from Lenovo or HPE or something for $10k providing the easiest 20% savings if they move on-prem.

How much is your $96k server on AWS?

> Many games and applications store floating point values in text file formats.

And why, pray tell, would those games and applications ship with text files containing floating point values that were invalid?

Certainly if they produce the values, strtod() is sure to work, and worrying about errors at that level just doesn't make any sense at all.

> This has caused bugs in those programs

I'm sorry this just isn't true: The programmer caused the bugs in those programs and nobody else.

Meanwhile users who produce text files with floating point numbers in their locale expect program that load those text files to tolerate their locale, and those programs should not be using strtod()!

> That doesn't detect overflows and underflows

A trivial change does though: Just round-trip it.

    int s2d(double*restrict out,const char*restrict in){
     char tmp[99];int r,q=sscanf(in,"%lf%n",out,&r),s=sprintf(tmp,"%lf.",*out);
     return q&&!((r>s)||memcmp(in,tmp,r)||tmp[r]>'0');
    }
> Also changes based on locale,

That's a feature: Where did the string come from if not the user?

> you cannot set locale, convert, then unset locale

So what? You're not handling multiple locales: You're using the user's locale. If you're making a server, using anything but LANG=C or a utf8 variant is asking for trouble.

I think the point is it's absolutely possible to portably detect errors, some libc's strtod() just don't which ain't the same thing.

> How can you use the same signer when the signer's keys are lost?

You mean, hypothetically if Letsencrypt suddenly loses the ability to sign new requests from me?

Well, then I have around 30 days to detect that and choose a new signer.

> Or, if the signer's keys are compromised, how do you switch to a non-compromised signer without alarms triggering?

Again, to be clear, you're talking about Letsencrypt's own signing keys in this case, being compromised and them being denied access to them. That seems incredibly unlikely to have both failures at the same time, but again: I have 30 days to find a new signer.

> The problem is almost exactly the same as one with a delegated CA -- if the CA keys are compromised

No! In fact, if Letsencrypt sublicenses signing to a third-party that certificate would be considered separate and so the switcheroo would be detected!

> When the client pins the CA key then the chain of trust is permanently broken

That's why it is important to extend TLS to allow multiple keypairs and certificates to be used to mutually authenticate the session key, so that any of the previous pinned keys can be used to update the pin. I did not say I wanted this for no reason!

I think you are very likely to use the same signer if you actually lose the key, so this isn’t something I think a naive sysadmin is going to fuck up the way they fuck up host pinning.
> These incidents did not involve a compromise of Google’s systems

But a compromise of Google's users.

I think we are potentially being told Google has domain names but no employees in those countries. This otherwise sounds quite implausible, and I don't know enough to say Google is lying.

You can't "simply" do that: a long cache period pins CAA. Of course that makes it the same, and with the same problems.

What I'd like to see is the ability to use and utilise multiple TLS certificates and host keys on the same session so that all the keys could be rotated/phased in-band with cross-signing providing the authority.

Seeing any mere change in the signers faster than (say) 30 days should allow the browser/client-stack to generate a warning that "google.com may be actively under attack please call this number on the old certificate, codeword banana-alpha-lima-lima-sigma". No need to cross-publish the keys, just cross-sign and don't forget what you've seen previously.

The browser would be able to take policy of simply never trust a certificate whose signer has changed (since phasing is possible), and it wouldn't then need to consult more public oracles (DNS, certificate transparency, etc, that leak privacy).

I'd also like to get that webauthn hooked back into TLS client certificates: If we had 1997 again instead of passkeys that also would've stopped this.

Re:Let's Ditch Google (Verb) on Wednesday September 30, 2026 @01:29PM (#49911888)
I just "search".

I can't think how anyone is going to be confused and think I want them to check the bins or something, but maybe we search for different things on the web.

> I estimate 60% of discussions on Reddit are fake or fabricated on some level.

Why so low?

I think it is higher than 99%

> Can't post honest questions anymore without posting obviously phony pandering banter first to increase your karma

Or just buy a "pre aged" account. They're only a few cents each if you buy them in bulk.

> Thin accounts: few comments, low scores, no real standing in the subreddit.

> Young accounts, or accounts with histories that are hidden or wiped.

DDG search "buy pre-aged reddit accounts" and you will find all of these. You can even search reddit for this.

The author of the article has no fucking idea what they are talking about. Buying "comments" is for chumps.

> I score it this way because an account that keeps bringing up the same brand is the product the vendors above are selling.

Or man, I just like my knife: It's older than my kid, and I've never had to do anything but hone it, and it'll still cut a piece of paper or a tomato no sweat. The next comment will be someone asking what brand of knife it is.

Re:Gravity Seems Holographic. What Does That Mean for Reality? on Saturday September 26, 2026 @02:51AM (#49853926)
No.
Re:English: A vs. An on Sunday September 20, 2026 @03:42AM (#49773453)
In the 16th century, being "on the money" meant an arrow or a dart being on (or near) a specific physical coin (i.e. the money), like in a tossing or shooting bar-bet.

Being on merely a money (or some money) would likely not be as impressive in said circumstances, and so whilst being grammatically possible in English, it shouldn't seem so likely the sort of thing anyone would ever have had to say.

Re:English: A vs. An on Sunday September 20, 2026 @03:32AM (#49773397)
With context these can mean different things. You might also play a piano, or hire either a player piano, or a piano player.

If you are answering which instrument you play, it's the former, but if we are talking the profession it's the latter, because you don't say then that you play a piano.

Re:English: A vs. An on Sunday September 20, 2026 @02:05AM (#49772903)
Try making it with "a" - if thing can be "a thing" then it could be "the thing" but if it can't be "a thing" it definitely can't be "the thing" either.
Re:Laya the open source version of Jev on Sunday September 20, 2026 @02:01AM (#49772880)
Hi I want to explain that arxiv is not "publishing a paper" - it's a step up perhaps from putting it on your own website, but this is not what is meant by professional academics when they talk about "publishing" (even when they work for big AI companies).

Your "papers" have only a single author and no current citations. It is not clear you are able to work with other people. The papers claim to offer results but no theory about why those results are the best possible. They read like sales whitepapers not scientific work. Reddit comments on the thread you linked to said they weren't able to reproduce your work.

I'm not looking to buy magic beans for my sales team.

Re:Of Gods and Languages: On "When God Spoke Greek" (2013) on Monday September 14, 2026 @04:27AM (#49693624)
Okay, wait a minute.

There were zero Hebrew Bibles at that time.

The Bologna scroll is found seventy(ish) times in greek and hebrew (and other languages) in the Qumran caves, along with a bunch of other stuff. Each of those times is a greek-literate persons' "bible". And they're all a little different. And they have their own notes in them too. They were probably paid to do it. At least some of them said they were rabbis.

Biblical scholars don't consider "The Septuagint" (Egyptian) to be any single translation and why they use the term "Majority Text" and stuff like that, to justify grouping all that stuff into "their" New Testaments'.

If it were possibly so simple as that, there probably wouldn't be so many forms of christianity.

Re:Of Gods and Languages: On "When God Spoke Greek" (2013) on Monday September 14, 2026 @03:41AM (#49693283)
> Reading any of this ancient text is like tourism.

You may enjoy the "map" on page two:

https://web.archive.org/web/20081031050603/http://www.tniv.c...

Re:Stabilizing Rust's Never Type on Sunday September 13, 2026 @07:42AM (#49682886)
I don’t.

My software gets done.

The idea that it would suddenly not be done because the compiler upgraded sounds like a potentially limitless amount of future work. Why would I want to invest in something that promises that?

A lot of this is just wrong; the only things they got right is that I can read English and I have an iPhone.

I’m surprised it got my timezone and location wrong. I’m less surprised they miscounted the number of speakers and my brand of gpu so confidently.

A big problem with being so wrong is I can’t use this to show anyone how tracking works online, because this is nothing like how tracking is actually done on line.

On the other hand, it’s a great advertisement for Apple.

Cool story bro.

I've got an emacs uptime measured in years, so I have no idea what you're talking about, but I'm happy that you're happy.

There were no Brythonic languages 15,000 years ago.

What are you talking about?

Older »