News for hackers. Stuff that matters.

ryanisnan

Re:Railway Security Disclosure on Thursday October 22, 2026 @12:53PM (#50197975)
Honest question, what do you use to manage your containers that you durably trust to stay online?
Re:Railway Security Disclosure on Wednesday October 21, 2026 @11:35PM (#50190887)
They're actively firefighting an incident, and are likely going to make some mistakes along the way. In this case, they've erred on the side of security over availability, which in some cases is the better outcome. I know not in all, but some.
Re:The Tao of Backup on Tuesday October 06, 2026 @01:36PM (#49981642)
Woops, missed that!
Re:Norway Eyes Partial Ban of Smart Glasses on Monday October 05, 2026 @04:29PM (#49970234)
Pun intended?

Laws will seldom work 100% of the time, but I profoundly disagree with your implied attitude. "They don't cover this future case, so we shouldn't do anything now".

Re:The Tao of Backup on Monday October 05, 2026 @02:09PM (#49968298)
It's 2026. Use TLS everywhere.
Re:Our AI Midwife on Saturday October 03, 2026 @05:35PM (#49948014)
You don't understand. They were only able to feed in information that they obtained with their human medical team. So the AI was heavily constrained in what it knew.
Re:Our AI Midwife on Saturday October 03, 2026 @05:33PM (#49948002)
> AI can create some efficiencies, but it almost certainly solves fewer healthcare or education problems than most AI maximalists believe.

Do you have any information to back this claim up?

Re:Pi 1.0 on Thursday October 01, 2026 @04:44PM (#49926869)
Human judgement is a thing.
Money influencing politics again exposes flaws in our democracies. Shocking.
Re:I don't like passkeys on Friday September 18, 2026 @03:38PM (#49759146)
I haven't articulated my thoughts about passkeys nearly as eloquently, but you did an amazing job here. This really sums up a latent problem I've had with passkeys.

Do you have a blog?

Re:North Korean nuclear test sets off years of earthquakes on Friday September 18, 2026 @12:57PM (#49757092)
Yeah, I mean, I understand the words you wrote. I don't think it's a good analogy.

It is entirely feasible that the same amount of potential energy, delivered either in small, successive amounts, but spaced out, proves to be tolerable, while a single large amount would be fatal.

Re:North Korean nuclear test sets off years of earthquakes on Friday September 18, 2026 @12:37PM (#49756834)
I don’t think this is a good analogy.
Re:Stallman: Thousands Dead, Millions Deprived of Liberties (2001) on Thursday September 17, 2026 @04:06PM (#49745826)
> “Given that the human face recognition performed by the check-in agents did not keep the hijackers out, there is no reason to think that computer face recognition would help.”

Even though I agree with the premise of the essay, this is absurdly false today. Computers are really good at this type of thing now, scarily so.

Re:How Climate Resilient Are the Largest Cities? on Tuesday September 08, 2026 @12:41PM (#49612792)
This is far outside of my wheelhouse, but I have some serious questions about the methodology here.

I dug into what they call a "resiliency checklist", which is what looks to be a set of questions that have qualitative answers which are subjective at best. This information looks like it is fed into the CRRI, the data set that substantiates the city-wide scores used to power this report.

I am very skeptical that these 2 things happened:

  - They captured a representative set of key assets that go into making a "city"
  - The answers they received are calibrated or are meaningful enough to make these large conclusions
Awesome - thank you for the detailed response.
Re:Htmx 4.0.0 has been released on Friday August 28, 2026 @02:13PM (#49482393)
Sure but it's a spectrum. Surely some choices will age much more poorly than others.
Re:Htmx 4.0.0 has been released on Friday August 28, 2026 @12:41PM (#49481100)
Congratulations on the release!

I have enjoyed working with htmx very much.

I'm still skeptical of htmx being the foundation for a 100-year web service, but I think this is a really worthwhile goal. I'll add that aside from static HTML, I don't have a better option.

Reminds me of the Taumoeba escaping the Xenonite enclosures.
What about container registries do robotics companies need that are different from other industries?
I like the idea behind the site, but I have some nits.

First, when you list something like a financial figure, you must also include the relevant time period. E.g. you say 16.0B in taxes collected by Canada from American exporters. But you don't list the time period.

Second, you say 313 are taxed today. What is this in reference to? Goods? People? Companies? Percentage?

The labels need some serious love.

Re:The August 17 outage, and the work ahead on Thursday August 20, 2026 @06:27PM (#49381142)
Interesting - There's a couple of things that I disagree with here, but I do think this resonates: "We all agree with the diagnosis and strategy: stop building new things, bring stability."

Where I have a problem with the positioning of their GitHub profile is, he's the CTO of GitHub, arguably the defacto standard for open-source version control systems. His GitHub profile is linked to as the author for the post, and his GitHub profile simply tells me: "this guy doesn't code."

I don't care if this guy doesn't work on GitHub itself, I hardly would expect that, but IMO, any CTO of a company like GitHub should eat, breathe, and sleep code. He might, but his profile, which is being published as if it means anything, tells me he doesn't.

Re:The August 17 outage, and the work ahead on Thursday August 20, 2026 @05:20PM (#49380424)
Don't contributions to private repositories simply show as: "N contributions in private repositories"?

Here's me: https://github.com/ryanisnan

In other words, I think his private contributions should still manifest on the contribution graph. And for being the CTO of an organization like GitHub, with no open-source contributions... Not a great look.

Re:The August 17 outage, and the work ahead on Thursday August 20, 2026 @05:16PM (#49380384)
Here's Vladimir Fedorov's GitHub contribution graph, as linked to as the author of this post:

https://imgur.com/a/zIbT0Gi

It shows zero contributions in the past year, on this account. This is a huge, huge red flag.

Re:Show HN: Huzzah – a novel approach to coding with AI on Thursday August 20, 2026 @05:11PM (#49380325)
I like the direction of capturing the human intent as a durable artifact, but I dislike how you've gotten there.

Let's look at your fizzbuzz example. Unfortunately, if you wanted to have the agent implement fizzbuzz for you, it looks like, in your example, you would have to already know how to effectively write fizzbuzz. Specifically, you call out the use of the modulo.

In your prompt, for the traditional agentic development path, you already declared the intent. There is some imperative language in there, sure, "Create a function that ...", but also there is the declarative state, that doesn't require knowledge of specific programming syntax or semantics.

What I've relied on is a more formal location/syntax for acceptance criteria are in code. These are then used to generate tests, and implementations. It isn't perfect, and more investment is needed, but it starts getting at the root of the problem.

Yeah, this is so off-base. Or, OP has only ever worked at terribly bad companies.
What a weird line to draw. Data centres do a lot more than what you report. E.g. they might host your electronic health records. They might host census data, or weather data, or your kid's school learning management system.
As the creator of mediaden.ca[1] I’ve thought about this. Client side scanning is maybe marginally better than server side scanning, but both paths lead to privacy rot.

Governments need to catch criminals, but they shouldn’t do it at everyone else’s expense.

1. https://mediaden.ca

Re:Show HN: One More Letter on Thursday July 16, 2026 @01:43AM (#48930759)
Fun, but I don't like trivia.
Uh, I don't think people typically associate downloading a repository, and viewing the source, as being synonymous with activating a malicious payload. That is the bit that's concerning.

I'm also so tired of people groaning about AI writing, yes, it's annoying, but attack the message, not the messenger.

Older »