News for hackers. Stuff that matters.

mdaniel

Re:The $6.3B Binance Hack Was Pulled Off in Just 20 Minutes on Friday October 30, 2026 @11:42AM (#50305543)
Please exercise caution using archive.{whatever} style links, as they are apparently no longer trustworthy https://news.ycombinator.com/item?id=50275373
heh, their custom package manager wrote its own dulwich https://github.com/PlutoLang/apm/blob/aca3620553ed7090552dbd...
Re:Help Us Raise $200k to Free JavaScript from Oracle on Friday September 19, 2025 @10:46AM (#45302253)
> the biggest corporate users of both Java

I bet AWS would give them a good run for their money on that metric. I got the impression that Google was predominately a C++ shop, whereas the rumor mills tell me that most of the AWS control plane is in Java (I am pretty sure I've actually gotten a stack trace from an AWS API once or twice, but foolishly I didn't save it)

Re:Help Us Raise $200k to Free JavaScript from Oracle on Friday September 19, 2025 @10:44AM (#45302233)
Another bullet dodged, since saying Ellison 3 times in a row would cause a gaggle of lawyers to appear in the room
That was interesting, thank you. Other folks may also enjoy its sibling dashboard showing the used capacity https://telemetry-public.ceph.com/d/ZFYuv1qWz/telemetry?orgI...
GPLv2-or-later, in case you were wondering https://github.com/XTXMarkets/ternfs/blob/7a4e466ac655117d24...
Re:Launch HN: Cactus (YC S25) – AI inference on smartphones on Thursday September 18, 2025 @01:15PM (#45292300)
For fear of having dang show up and scold me, I'll just add the factual statement that I will never ever believe any open source claim in any Launch HN ever. I can now save myself the trouble of checking, because I can be certain it's untrue

I already knew to avoid "please share your thoughts," although I guess I am kind of violating that one by even commenting

Re:Java 25 Officially Released on Wednesday September 17, 2025 @10:56PM (#45284693)
Now available to even more audiences than before https://www.jetbrains.com/rider/#:~:text=free%20for%20non-co...
Also it REALLY jams me up that this is a thing, complicating discussions: https://github.com/triton-inference-server/server
Re:Java 25 Officially Released on Wednesday September 17, 2025 @03:53PM (#45280628)
The very idea of those 3 things being disjoint is a supremely Microsoftian thing to do and makes discussions horrific
> easy to tell or predict what terraform will do

predict is the operative word there, because Terraform is so disconnected from the underlying provider's mental model that it is the expression "no plan survives first contact with the enemy" made manifest

Now, I am one million percent open to the pushback that "well, that's a provider's problem" but I also can't easily tell if they are operating within the bounds of TF's mental model, or is it literally that every provider ever is just that lazy?

Spoken like someone who hasn't tried one or perhaps both of those projects

Kiro is collaborative, but SpecKit is a bunch of templates and then wishes you good luck in your journey. It honestly reminds me of those unified process templates, which I guess all of those are great if one needs some structure to organize ones thoughts

As an alternative, SpecKit is also 0.x release so maybe in 9 months it'll be useful - or overcome by whatever 'ooh, shiny!' follows it

Re:Self Propagating NPM Malware Compromises over 40 Packages on Wednesday September 17, 2025 @12:08AM (#45271553)
I wasn't trying to relate anything to the bigger conversation, I just meant to draw attention to the fact that GitHub is not golang's package manager

That said, I would guess the 'bigger conversation' is that it is much harder to tpyo <<import "github.com/DataaDog/datadog-api-client-go/v2/api/datadogV2">> than $(npm i dataadog) or similar in a "flat" package namespace (same for its $(uv pip install dataadog) friend)

None of those cited ones fix the dependency lineage issue, proving that release 1.1 was authored by the same chain of custody as release 1.0 of any given package. One can opt in to gpg verified dependencies in Maven, but it is opt-in. The .jar artifacts can also be cryptographically signed, but the risk that's trying to drive down is tamperproofing and not lineage, AFAIK

Re:Java 25 Officially Released on Tuesday September 16, 2025 @11:59PM (#45271507)
This must be satire
Re:Java 25 Officially Released on Tuesday September 16, 2025 @11:50PM (#45271461)
As a point of reference, JetBrains platform is on top of swing, and I'd guess that's a significant contributor to why they're able to deliver consistently across Linux, macOS, and Windows. Unlike Eclipse SWT which ships native code for all the platforms it targets
Re:Java 25 Officially Released on Tuesday September 16, 2025 @11:44PM (#45271423)

    $ cat Foo.java
    interface Foo {
        private String jimbo() {
            return "yup";
        }
    }

    $ javap -c -private Foo
    Compiled from "Foo.java"
    interface Foo {
      private java.lang.String jimbo();
        Code:
           0: ldc           #1                  // String yup
           2: areturn
    }
and

    interface Bar {
      default boolean isAwesome() {
        return true;
      }
    }
Re:Java 25 Officially Released on Tuesday September 16, 2025 @11:35PM (#45271352)
What's unexpected about that observation is that they have actually completely separated the presentation layer from the business logic because such a thing was required to have "Code with Me" and their "projector" project wherein one could use IJ from a browser https://jetbrains.github.io/projector-client/mkdocs/latest/a...

But, I am fully talking out of school because I don't know what the actual, no kidding, accessibility hurdles one faces when trying to do work in such a setup, nor what concessions VS Code has made to fix those problems

But I do know that YouTrack has a dedicated categorization for accessibility reports and I am sure they would welcome hearing about how they could win back those audiences https://youtrack.jetbrains.com/issues?q=%23%7BUI.%20Accessib...

Re:Java 25 Officially Released on Tuesday September 16, 2025 @11:29PM (#45271300)
I'm not them, but there are few things better for operational insight than the JVM. It has a boatload of tuneables, it has a very rich dynamic code load mechanism (Reflection, ClassLoaders, the new Modules system, and it used to have a strong sandboxing system but they killed that), and at the intersection of those two things is JMX, which is dynamically tuneable deployments via API. It's like having JVM-local feature-flags that one can twiddle without needing to bring down the JVM

And sure, it's not everyone's cup of tea, and/or plenty of people will chime in with "yes, but"s to defend golang or every other platform that isn't the JVM. I'm not yucking your yum! I'm just saying for me, the JVM is the bees knees

Re:Java 25 Officially Released on Tuesday September 16, 2025 @06:32PM (#45269113)
I don't think "was always" is an accurate statement

However, above and beyond free, it is also a collection of ECMA standards https://learn.microsoft.com/en-us/dotnet/fundamentals/standa...

Now, don't get me wrong: I have grave suspicions there is currently only one actual implementation of them (I don't count hobby, or abandonware, ones) but IMHO "actual standard" combined with "for real reference implementation" is way better than just reference implementation

---

since I'm still within the edit window, the MAUI referenced by the sibling comment is MIT licensed https://github.com/dotnet/maui

https://github.com/dotnet/blazor (Apache 2) is marked an archived, and points to https://github.com/dotnet/aspnetcore (MIT) but command-f blazor on its readme is nothing so :shrug:

Re:Things you can do with a Software Defined Radio (2024) on Tuesday September 16, 2025 @02:42PM (#45266146)
And its "last mile" friend of using the in-wall cable as Ethernet drops, too, e.g. https://www.tp-link.com/us/powerline/ (but I don't think it holds a candle to actually pulling cat 5 or 6, for clarity)
Re:Ask HN: Is Palantir Apollo just an AWS competitor? on Tuesday September 16, 2025 @11:17AM (#45263477)
It is a CD solution, there's no CI involved at all. However, it extends the 'delivery' portion of that phrase to also include so called "day 2" Kubernetes-centric functionality such as "how does my Secret content get populated?" and "how to I apply only certain values.yaml to certain Helm release versions?" Then, Mission Manager also gets into the game of "how do I ensure my cloud resources are present alongside the software?"

It also gets into the compliance side of things (arguably it's all about compliance) in that new releases, config changes, vulnerability mitigation, downtime windows, and a ton of other stuff are optionally gated by a review process. If you want to change the values.yaml for an existing release, you can choose whether that is a 4-eyes change

That latter bit also speaks to your question about "who is the target audience for this?" because, like many things Palantir, it's a lot of the defense industry and intelligence community, as they care a lot about having gates and controls in place. Apollo specifically also gets into "edge deployments," such as what software is running on a laptop that goes out into the field, comes back to base, and only then gets its updates pushed to it

I detest them with all my heart, but I'll be straight that Apollo does actually model the deployment concerns of software very well. Every place that I've been always hand-assembles their own CD story using off the shelf stuff, and so if one has compliance needs then Apollo allows to pay to have the "hand assembled" problem go away. That said, I have _absolutely no idea_ how much Apollo costs, so I'd also speculate that most organizations would be much happier just paying for a competent DevOps role to do the best they can to use off the shelf tools to hand assemble their own CD story, or use BigBang[1] which is at least open source and a standard (one may not like it, but it is at least consistent)

1: https://github.com/DoD-Platform-One/bigbang#readme

Re:Just Use HTML on Tuesday September 16, 2025 @11:06AM (#45263320)
relevant: Remove mentions of XSLT from the html spec - https://news.ycombinator.com/item?id=44952185 - Aug, 2025 (545 comments)
Re:Just Use HTML on Tuesday September 16, 2025 @11:03AM (#45263293)

  if (request.headers["user-agent"].Matches("Safari")) {
     // wheeeee
  else if (...Matches("Firefox")) {
     // those where good times
Re:Self Propagating NPM Malware Compromises over 40 Packages on Tuesday September 16, 2025 @10:48AM (#45263059)
As hair splitting, that's actually not true: Go's package manager is just version control of which GitHub is currently the most popular hosting. And it also allows redirecting to your own version control via `go mod edit -replace` which leaves the sourcecode reference to GitHub intact, but will install it from wherever you like
And a very cool CI toolkit https://github.com/dagger/dagger (Apache 2)

Link to the DI mentioned by the parent comment https://github.com/google/dagger (also Apache 2)

What are the criteria for $ interpolation? Is it everywhere?

  <div class="text">
        ${ winner ? 'Wins' : 'Draw' }!
  </div>
Re:Pgschema – Declarative schema migration for Postgres on Friday September 12, 2025 @09:32PM (#45228555)
> (the half baked password manager being one).

Or a very bizarre LLM offering: https://news.ycombinator.com/item?id=44657556

Older »