thehappyfellow

I'll take that.

They are amazingly good at creating hype (non-derogatory) and getting users.

Their docs say "Omarchy takes security very seriously" - I think that's straight up incorrect.

Saying "go and use it, wanting: its prototype quality and likely to have many security bugs" would be fair game.

That's not what they're doing.

I dont just complain. I making the world a better place in ways which I believe are worth it.

Improving Omarchy seems like a waste of time to me. Letting people know how insecure it likely is, given how little time it took, is much better bang for buck.

Or, in colourful analogy: if people on the streets are hitting themselves on the head with frying pans repeatedly, I want them to stop, not to help them recover from the pain quicker so that they can hit themselves more.

Appreciate it! Editorialised is fine but the post is mostly about the development practices leading to bugs & the lack of awareness of how dangerous that is, not about the current absolute number of security holes if that makes sense.

Why would I do that? It's a crazy non-sequitur.

My opinion is that the way Omarchy is developed leads to gigantic security holes. I wanted people to be aware of it.

In my opinion, there are much better choices both for me and I'd imagine for other people as well. I don't want to help Omarchy succeed, I don't care about them.

Aww, thank you!

How is my title a rage bait?

The current submission title is terrible, "Omarchy development practices lead to predictable security issues" would be much closer.

It wasn't supposed to be, I found it amusing. Also, the current title is not what I wanted people to take away from the post.

> What kind of blogging is this?

Happy to explain: it's personal blogging, for writing down what's on my mind.

The fact that it was addressed swiftly doesn't affect the claims in the post at all: I'm worried about development practices which produce code like that.

Also, the "full of security holes" is not my framing, someone else choose this submission title.

Yo, why is my blog post title editorialised? It should've said "Merchants of Insecurity". Rude!

They point to two separate issues, what are you about?

There's a difference between a few small bugs because software is new and a half dozen eval(untrusted_input) in version 4.0.

Maybe this can get fixed, security teams won't make it worse. I worry they're mopping the floor and not fixing the leak: the development practices which lead to the quantity, seriousness and banality of their security issues is the part which needs fixing.

That's what I had in mind! The whole post is a claim that evaluating knowledge work got more expensive because cheaper measures stopped correlating well with quality.

If someone was already evaluating the work output using a metric closer to the underlying quality then it might not have been a big shift for them (other than having much more work to evaluate).

Which means you can't select all on text which isn't editable - insane!

My blog is at https://blog.happyfellow.dev if you'd like to read it.

I'm also the Head of The Institute for Type-Safe Memetic Research which website is https://typememetics.institute/

Author here.

I wonder about that as well!

Of course practitioners shouldn't expect to understand the bleeding edge without investing a lot in learning the subject.

However providing people with software engineering background an easier on ramp for understanding PLT would be nice, wouldn't it?

It's closely related to another truth:

Unconstrained curiosity is a vice, not virtue.

Thank you, this makes much more sense and it's a classic issue Matt Levine's readers will be familiar with.

Allegedly being investigated is also quite far from "been manipulating markets", I appreciate the clarification.

source?

You’re right, there are downsides like turbine you mention! We mitigate it by running a hot backup we can switch to in seconds and a box in which we test restoring backups every 24h, that’s necessary! But it requires 3x the number of big expensive boxes.

I still think it’s the right tradeoff for us, operating a distributed system is also very expensive in terms of dev and ops time, costs are more unpredictable etc.

It’s all tradeoffs, isn’t it?

It’s incredible how much Postgres can handle.

At $WORK, we write ~100M rows per day and keep years of history, all in a single database. Sure, the box is big, but I have beautiful transactional workloads and no distributed systems to worry about!

It really makes me happy to know that my writing struck a chord for at least one person - thank you!

Yeah, I was angry when I was writing it, not denying it.

Author here. I did not expect to see my post on HN!

It was a rant, I was venting, it’s not supposed to be an objective statement about the state of tech. It’s shouting into the void about the things I find unfair and unbearable, I don’t think it’s a great HN material.

I made up parts of the story because it didn’t happen to me and I didn’t want to share details of somebody else’s situation.