News for hackers. Stuff that matters.

raggi

The city should start charging them rent for the pole space.
Re:A/SIDE – Private photo sharing and encrypted messages on Saturday October 31, 2026 @02:13PM (#50318487)
If did:web gets a rooting solution that isn’t dnssec maybe, until then nope.
Everyone who’s read the patch.

Want a big name? RedHat.

mptpcp usage is not a prerequisite
Historically that was rejected.

Tides have shifted somewhat, but I suspect this may still be rejected.

Unfortunately a lot of people’s experience with such proposals was also historically getting gaslit by a brigade, so a lot of folks moved on and won’t bother trying again.

The end state of inappropriate use of garbage collected languages.

Go/GC are mostly fine for medium frequency medium scale mid stack problems.

It’s bad for high frequency computing. It’s bad for very small targets, for very large targets, and by association software that lives at the very bottom of the stack.

Go is a high efficiency framework for writing mid sized servers, not a systems language. The runtimes hard opinions and closed interface are the reason for this enclosing definition and the GC is one part of that.

Re:Tailscale SSH: Investigation and remediation update on Tuesday October 27, 2026 @05:43PM (#50266271)
we'd love to hear about it at [email protected], we're happy to work from & with and credit early ideas as well.
Re:Tailworm – Tailscale Vulnerabilities on Saturday October 24, 2026 @09:38PM (#50227392)
(tailscalar here): it's been a long day working on this, and we will have more details to follow. quickly though, on this point about enumeration, some of this may be a difference in headscale. the tailscale control plane performs what we colloquially refer to as "netmap trimming" - if node a has no acls that allow it to do anything with node b, then neither a or b would see each other in their netmap.
Re:/dev/null: social network for developers on Friday October 16, 2026 @09:45PM (#50127061)
It’s actually changed for the worse. Now everyone wants their slop to be the winning protocol, so the competing standards problem has become far broader
Re:FTL: A new operating system for clouds on Saturday October 03, 2026 @01:56PM (#49946318)
parts of the kernel design remind me of zircon (handle oriented objects, vmo's, and so on), but then various lines are cut in different places (kernel knows of threads but not processes, maybe handles slightly higher level networking)
Re:One month coding with GLM 5.3 Flash on Friday October 02, 2026 @05:17PM (#49938702)
Some vague commentary about performance with what appears to be assumptions about GPU availability, but no clarity about which inference provider is being used. If ZAI is assumed, I believe they aren't subject to the assumptions in the post based on what they've said publicly, but if they were using some other provider, perhaps.

The second reason appeared to be simply "because we chose not to". The post seems to be pretty much content-less in any practical sense. I clicked on it because I do quite like this models average performance and I was hoping to see some kind of review content.

Re:Rune is now open source on Friday September 11, 2026 @04:31PM (#49664923)
Similar reflection, I ran `kitten __benchmark__ --render` in rune, the CPU time spent was 1:55. I ran the same in a libghostty based terminal emulator and spent 0:44 on CPU.

I say this only because yes you can do engineering to meet the benchmark without dropping to deeper systems layers, but closing the gap on efficiency is hard. I'm not saying this to be a downer on your project - an IDE and VTE in Go are a fun project to have around, but the blog post makes implied claims of equivalence with moderate investment - but I think that's limited to single benchmark chasing. I say this as a polyglot who's day job is a Go based program that would be far easier to optimize in a systems language.

Re:Rune is now open source on Friday September 11, 2026 @04:20PM (#49664777)
The build time claim in the blog post is dubious, part of the problem is CGO isn't fast, but also if build time was really a motivator the null build path is entirely unoptimized for objects with long build times:

cached null (no changes) build:

        ~github/unstablebuild/rune % make
        pre-commit not installed; skipping git hook setup
        cd cmd/buildstamp && CGO_ENABLED=1 go build  -ldflags="-X unstable.build/rune/internal/debug.Tag=$(git describe --tags) -X unstable.build/rune/internal/debug.Commit=$(git rev-parse --short HEAD) -X unstable.build/rune/internal/debug.BuildDate=2026-09-11T20:16:22Z  -X unstable.build/rune/internal/debug.Package=six" -o ../../bin/buildstamp
        cd cmd/extension_chaos && CGO_ENABLED=1 go build  -ldflags="-X unstable.build/rune/internal/debug.Tag=$(git describe --tags) -X unstable.build/rune/internal/debug.Commit=$(git rev-parse --short HEAD) -X unstable.build/rune/internal/debug.BuildDate=2026-09-11T20:16:22Z  -X unstable.build/rune/internal/debug.Package=six" -o ../../bin/extension_chaos
        cd cmd/extension_color_palette && CGO_ENABLED=1 go build  -ldflags="-X unstable.build/rune/internal/debug.Tag=$(git describe --tags) -X unstable.build/rune/internal/debug.Commit=$(git rev-parse --short HEAD) -X unstable.build/rune/internal/debug.BuildDate=2026-09-11T20:16:22Z  -X unstable.build/rune/internal/debug.Package=six" -o ../../bin/extension_color_palette
        cd cmd/extension_fuzzy_search && CGO_ENABLED=1 go build  -ldflags="-X unstable.build/rune/internal/debug.Tag=$(git describe --tags) -X unstable.build/rune/internal/debug.Commit=$(git rev-parse --short HEAD) -X unstable.build/rune/internal/debug.BuildDate=2026-09-11T20:16:22Z  -X unstable.build/rune/internal/debug.Package=six" -o ../../bin/extension_fuzzy_search
        cd cmd/extension_go && CGO_ENABLED=1 go build  -ldflags="-X unstable.build/rune/internal/debug.Tag=$(git describe --tags) -X unstable.build/rune/internal/debug.Commit=$(git rev-parse --short HEAD) -X unstable.build/rune/internal/debug.BuildDate=2026-09-11T20:16:22Z  -X unstable.build/rune/internal/debug.Package=six" -o ../../bin/extension_go
        cd cmd/extension_python && CGO_ENABLED=1 go build  -ldflags="-X unstable.build/rune/internal/debug.Tag=$(git describe --tags) -X unstable.build/rune/internal/debug.Commit=$(git rev-parse --short HEAD) -X unstable.build/rune/internal/debug.BuildDate=2026-09-11T20:16:22Z  -X unstable.build/rune/internal/debug.Package=six" -o ../../bin/extension_python
        cd cmd/extension_rtc && CGO_ENABLED=1 go build  -ldflags="-X unstable.build/rune/internal/debug.Tag=$(git describe --tags) -X unstable.build/rune/internal/debug.Commit=$(git rev-parse --short HEAD) -X unstable.build/rune/internal/debug.BuildDate=2026-09-11T20:16:22Z  -X unstable.build/rune/internal/debug.Package=six" -o ../../bin/extension_rtc
        cd cmd/extension_rust && CGO_ENABLED=1 go build  -ldflags="-X unstable.build/rune/internal/debug.Tag=$(git describe --tags) -X unstable.build/rune/internal/debug.Commit=$(git rev-parse --short HEAD) -X unstable.build/rune/internal/debug.BuildDate=2026-09-11T20:16:22Z  -X unstable.build/rune/internal/debug.Package=six" -o ../../bin/extension_rust
        cd cmd/extension_zig && CGO_ENABLED=1 go build  -ldflags="-X unstable.build/rune/internal/debug.Tag=$(git describe --tags) -X unstable.build/rune/internal/debug.Commit=$(git rev-parse --short HEAD) -X unstable.build/rune/internal/debug.BuildDate=2026-09-11T20:16:22Z  -X unstable.build/rune/internal/debug.Package=six" -o ../../bin/extension_zig
        cd cmd/runefox && CGO_ENABLED=1 go build  -ldflags="-X unstable.build/rune/internal/debug.Tag=$(git describe --tags) -X unstable.build/rune/internal/debug.Commit=$(git rev-parse --short HEAD) -X unstable.build/rune/internal/debug.BuildDate=2026-09-11T20:16:22Z  -X unstable.build/rune/internal/debug.Package=six" -o ../../bin/runefox
        cd cmd/sshshop && CGO_ENABLED=1 go build  -ldflags="-X unstable.build/rune/internal/debug.Tag=$(git describe --tags) -X unstable.build/rune/internal/debug.Commit=$(git rev-parse --short HEAD) -X unstable.build/rune/internal/debug.BuildDate=2026-09-11T20:16:22Z  -X unstable.build/rune/internal/debug.Package=six" -o ../../bin/sshshop
        cd cmd/walkbench && CGO_ENABLED=1 go build  -ldflags="-X unstable.build/rune/internal/debug.Tag=$(git describe --tags) -X unstable.build/rune/internal/debug.Commit=$(git rev-parse --short HEAD) -X unstable.build/rune/internal/debug.BuildDate=2026-09-11T20:16:22Z  -X unstable.build/rune/internal/debug.Package=six" -o ../../bin/walkbench
        make  35.90s user 5.88s system 191% cpu 21.846 total 1975848 rss
vs. cached non-null (changed) build:

    ~github/zed-industries/zed % touch crates/zed/src/zed.rs
    ~github/zed-industries/zed % cargo build
       Compiling zed v1.18.0 (/home/raggi/src/github.com/zed-industries/zed/crates/zed)
       Finished `dev` profile [unoptimized + debuginfo] target(s) in 8.42s
    cargo build  10.15s user 9.34s system 228% cpu 8.531 total 7930312 rss

Build times are a valid thing to care about and talk about, but the claims implied don't stand up to scrutiny.
Re:Matrox: Graphics for Professionals on Monday August 31, 2026 @02:46AM (#49506387)
I have a friend whose wife has strong sight challenges. He once swapped a much newer and more powerful card with me for my last matrox card, iirc it was a millennium ii. The matrox utilities included with the drivers had one of the best desktop zoom systems ever delivered on windows and this was worth more to them than anything else.
Re:Tailcat – Like netcat, but over Tailscale’s data plane on Wednesday August 26, 2026 @03:56PM (#49454925)
always have! our darwin and windows clients are closed source, but they wrap the oss implementation in github.com/tailscale/tailscale and you can see and even use all the same hooks yourself.

the control plane is closed source, but headscale is an open source alternative that we embrace and encourage people to use if it meets their needs/desires

Re:XWayland 26.1-rc1 Released Two Years After the Last Release on Wednesday August 19, 2026 @09:59PM (#49369591)
> But, at the same time. A design that requires everyone to implement their own protocols and everyone to refix the same bugs in their own compositor is inherintly bad.

Consider that if every DE wrote their own Xorg implementation the story would be the same.

A key question is why everyone is writing their own compositor, this is not about the protocol design, it's about the state of collaboration.

I spent some time in the last week fixing lowdpi font rendering in cosmic, enabling me to switch to it. I then discovered that cosmic-comp's VRR had a terrible feedback path causing conformant applications to stutter badly, so I have large patch stack rewiring full screen feedback, tranche compatibility, fence timing and so on (it's fucking buttery now though, which is nice). That then showed up some input processing bugs becoming visible via playing videos in firefox, leading further to me discovering that cross-plane locking was causing frame drops too. Now I've got a giant stack of shit I need to cleanup and upstream - but the end result (along with the freetype render patches I got into Firefox a while back) is a better DE than I've had on Linux in decades. Maybe if upstreaming goes well I'll do MPO for an encore.

> In X, if the WM crashes, X is still running, and you can just restart the WM. In Wayland, if you hit a bug it takes everything down with it.

See above, the WM did not need to embed the compositor. That's not a protocol requirement, it's and implementer choice. I actually really wish it didn't. Of all the aforementioned patches only two are in Smithay. As I was actually fixing compositing for the workflow I just had to suffer through I would have had to restart pretty much the whole session anyway - though in fact the later stages of my workflow I was only directly killing cosmic-comp and cosmic-session was automatically restarting it all. No really good way to recover the surfaces though, so apps still need to restart.

This is not unlike the _another_ bug stream I tracked down this evening, where cosmic-applets would fail to display tray icons on both displays correctly - that turned out to be a bug where one icon provider was unresponsive to part of the protocol, coupled with a synchronous dispatch from the event handle into that blocking return call. Perhaps more interestingly though that manifest during diagnosis something I've seen a lot in other DE chains where tray icons for auto-started electron apps were highly sketchy - well a common electron wrapper gives up entirely on the first whiff of an error with the dbus interface and doesn't retry.

Years ago I gave up on Linux DE's because reconfiguring xft, gnome, etc was too much of a time sink. How far I've come, now I'm back :'(

Re:XWayland 26.1-rc1 Released Two Years After the Last Release on Wednesday August 19, 2026 @09:07PM (#49369259)
Nice. XWayland has been a key transitional piece we'll still need for a while.
https://www.jeremykun.com/2024/05/04/fhe-overview/#the-highe...

> Fourth, there is a bandwidth concern. FHE encryption schemes generally increase the size of the data being encrypted, and the user must send the server a special set of encryption keys to enable the computation, which are relatively large as well. The special keys need only be generated and sent once and can be used for all future computations, but they can easily be gigabytes in size. In one example FHE scheme with lightweight keys, a ciphertext encrypting a single integer is on the order of 25 KB, and the special keys are about 0.5 GB. In others, 16,000 or more integers are packed into a single ciphertext of similar size, but the keys can be 10s of GiBs.

SQLite has an online backup API as well, but it is slower and requires a significant additional page cache cost.

The team chose SQLite early on (there are some blog posts about this) and then we vertically scaled against the SQLite architecture. There are subtle ways you come to depend on the proximity/latency when you scale with local storage that mean switching requires a lot of non-obvious work - it’s probably the largest hazard for embracing SQLite in a growing saas - but at the same time you can push the vertical scale pretty far, which has great margins.

Had we scaled a different architecture of database there’s little reason to believe it would have been plain sailing as seems to be implied here.

We have very good reasons for our checkpointing model, related to our backup + disaster recover strategy, along with resource cost. It might be worth writing about one day, so I'll not give away all the details, but in very short form, we organize a backup strategy that has minimal pause time, avoids doubling the page cache cost of the database, and enables extremely fast byte-copy restores in disaster recovery.
One of the strongest teams I worked with, working on an extremely large and ambitious project used to answer a lot of product/executive type questions regarding missing areas that we knew how to author and could safely assume general design consensus “it’s just typing”.

It was a very useful contraction in the right senior circles where there was a pretty good understanding of the meaning and decently reliable assumed consensus.

I eventually stoped using the phrase because it had started leaking deeper into the team and the impact on earlier career or less confident programmers was often no longer positive, it could be misinterpreted in lots of different ways but the most harmful was when it would further decimate confidence and discourage requests for help when something wasn’t obvious to the ultimate author.

As with almost every attempt to generalize in software engineering the repetition or extrapolation beyond the context in which it was intended can have negative side effects, it doesn’t matter if it’s a simple notion like “dry”, or a comment like “code was never the hard part”. None of these phrases survive context loss and still retain efficacy at general receivers.

Re:Show HN: ssh ssh.place on Wednesday August 05, 2026 @06:03PM (#49189650)
So really the trend I'm talking about here is people turning SSH into a browser, hosting apps behind SSH that expect a much higher volume of TOFU happening, which is a departure from the "first time i setup my vps" kind of case.

Honestly at this point I'd be kind of happy if we could just use an x.509 cert from a webpki acme provider in the sshd and be done with it, for the host identity part.

Re:Show HN: ssh ssh.place on Wednesday August 05, 2026 @06:02PM (#49189633)
i've seen it, so the answer is non-zero
Next step the ads become increasingly sophisticated prompt injection to ensure they make it to the user, but the prices plummet in the meantime because the ads have low efficacy. They get purchased mostly by the scammers and by the time they start showing up in user chats they’ll be full on LLM assisted interactive user manipulation campaigns with far worse outcomes than the worst of YouTube and social media ads.
Re:Show HN: ssh ssh.place on Tuesday August 04, 2026 @10:39PM (#49177952)
When you see people advertising a coffee shop at a conference and people TOFU'ing on conference wifi then plugging in credit card numbers, the picture gets a little more clear.
Re:Show HN: ssh ssh.place on Tuesday August 04, 2026 @12:26PM (#49171138)
Fair!

When I last harassed Crawshaw about this and we discussed bits, he submitted https://github.com/C2SP/C2SP/blob/main/well-known-ssh-hosts....

Unfortunately neither of us has taken time (AFAIK) to go back and implement it anywhere.

Re:Show HN: ssh ssh.place on Monday August 03, 2026 @03:06AM (#49152213)
sshfp is not PKI. It's an option and it is off by default in ssh(1). In practice no one actually deploys it, exe.dev, terminal.shop, jobs.{whoever.com}, etc. I've yet to see an in the wild deployment. The aforementioned sites let you perform electronic payment transactions over ssh without it, which is probably a PCI violation tbh, but auditors aren't good enough.

webpki is on by default.

Re:Show HN: ssh ssh.place on Monday August 03, 2026 @03:00AM (#49152152)
here, less than most, but look for ssh agents

on terminal.shop, steal credit cards on jobs endpoints, perform identity theft on exe.dev, whatever you put on there

Re:Show HN: ssh ssh.place on Sunday August 02, 2026 @11:50PM (#49151021)
Time for your regular reminder that ssh has no PKI and is trivial to mitm during tofu.

Older »