News for hackers. Stuff that matters.

vfaronov

Re:Details of yesterday's Bunny CDN outage on Thursday June 24, 2021 @01:57AM (#27614420)
But doesn’t this apply to “normal” panics as well? When unwinding the stack of a panicking goroutine, any deferred call might panic again, in which case Go keeps walking up the stack with the new panic. In a typical server situation, it will eventually reach some generic “log and don’t crash” function, which is unlikely to panic or overflow.

Perhaps one difference is that, while panics are always avoidable in a recovery function, stack overflows are not (if it happens to be deep enough already). Does the argument go “even a seemingly safe recovery function can’t be guaranteed to succeed, so prevent the illusion of safety”?

(To be clear: I’m not arguing, just trying to understand.)

Re:Details of yesterday's Bunny CDN outage on Wednesday June 23, 2021 @12:53PM (#27606701)
> While that sounds like a strange implementation detail, the philosophy of the .Net team has always been "how do you reasonably recover from an stack overflow?"

Can you expand on this or link to any further reading? I just realized that this affects my platform (Go) as well, but I don't understand the reasoning. Why can't stack overflow be treated just like any other exception, unwinding the stack up to the nearest frame that has catch/recover in place (if any)?

Re:Moving Beyond Types (2017) on Tuesday October 29, 2019 @07:32AM (#21385951)
The title of this HN post is completely out of context, and the discussion here is unrelated to the article. The author is not at all arguing against types or Haskell, nor is he bashing QuickCheck (he’s developed a QuickCheck-like framework for Python). He’s merely complaining about some details of QuickCheck’s design.
Re:Why We Love QUIC and HTTP/3 on Sunday March 24, 2019 @10:33AM (#19476542)
How much of this applies to 1~100KB responses?
Re:REST and long-running jobs (2014) on Saturday December 01, 2018 @04:02PM (#18578906)
HTTP is an inherently complex protocol, which has over time accrued many idiosyncratic, non-orthogonal features to support various use cases of the growing Web. Just consider that there exists an entire class, entire design space of libraries known as “HTTP routers” which boil down to extracting arguments from the first line of an HTTP request.

If you want simplicity, and you fully control both sides, and you don’t care about the systemic advantages that REST purports to provide, then your best bet is to avoid HTTP altogether (which in practical terms may of course mean tunneling through it) and stick to a simple, modern RPC protocol.

Re:REST and long-running jobs (2014) on Saturday December 01, 2018 @03:55PM (#18578867)
Case in point: CacheControl [1]. Plug it in and you get flexible caching — interoperable with NGINX, the browser, and everybody else — for very little. But it relies on the protocol. If you respond to GET /stars/98765 with 200 (OK) and an “under construction” placeholder, it’s going to get confused.

[1] https://github.com/ionrock/cachecontrol

Re:REST and long-running jobs (2014) on Saturday December 01, 2018 @08:33AM (#18576702)
RFC 7540 also defines an optional way for the client to signal whether it wishes the request to be processed asynchronously: https://tools.ietf.org/html/rfc7240#section-4.1
Re:REST and long-running jobs (2014) on Saturday December 01, 2018 @08:30AM (#18576695)
https://tools.ietf.org/html/rfc7231#section-6.5.9

> It is not necessary to mark all permanently unavailable resources as "gone" or to keep the mark for any length of time -- that is left to the discretion of the server owner.

Re:Publishing JSON-LD for Developers on Tuesday May 08, 2018 @06:46PM (#17026005)
Outstanding explanation. I would like to emphasize one point:

> If you have multiple systems with data, and you want to merge the data together into a unified whole for some reason

This isn’t just about “big data” or “data warehousing” or such OLAPy concerns. It’s really about the bread and butter of modern information systems.

“Get some ID from service A, use it to query service B.” Does that sound familiar? That’s data integration for you. That’s what RDF / Linked Data is about.

Re:Publishing JSON-LD for Developers on Tuesday May 08, 2018 @06:07PM (#17025690)
This article does not have a valid argument against using JSON-LD.

It may be read as an argument against making namespaces a ubiquitous part of JSON, in the same way as they are ubiquitous in XML (even though not part of the base XML spec). It’s a valid argument against getting to the point where namespaces pop up in every JSON tutorial, and every JSON serializer takes a namespace map, and every user of JSON has to deal with them.

But JSON-LD (as RDF) uses namespaces to solve a particular problem (merging data from disparate sources). Solutions involve costs, that’s normal. You might weigh this cost against the expected payoff and decide it’s not worth it for you — but the article doesn’t do that.

Re:Publishing JSON-LD for Developers on Tuesday May 08, 2018 @05:12PM (#17025159)
RDF was not designed for arbitrary graphs. It was specifically designed for resource descriptions on the Semantic Web.

> reliance on the web infrastructure (IRI, DNS, web servers, ...)

This is the whole point of RDF. It is what enables Linked Data.

> I read the history of JSON-LD by one of its main author [1], and it does not originated in the RDF community.

Not sure what you mean exactly, but here’s from http://manu.sporny.org/2014/json-ld-origins/:

> JSON-LD started around late 2008 as the work on RDFa 1.0 was wrapping up. We were under pressure [...] to come up with a good way of programming against RDFa data.

JSON-LD definitely was always an RDF serialization, created by people intimately familiar with RDF and the Semantic Web.

> async/await are a step ahead to give you the best of both worlds here: You can write your programs as if your requests block

Are you thinking of “green”/M:N threading (as found e.g. in Go)?

Async/await (as found e.g. in Python) is precisely what hinders the style you describe: If your brand new I/O routine is “async colored” to take advantage of non-blocking syscalls, you can’t easily call it from your regular “sync colored” code without “spilling the color” all around, i.e. considerable refactoring.

Re:Subscription Hell on Monday May 07, 2018 @03:32AM (#17010971)
The article isn’t merely arguing that users prefer rich content, other things being equal. It is arguing that users prefer paywalled rich content to free plain content. This is not the kind of thing typically measured by A/B testing.
Re:LLVM patch to fix half of Spectre attack on Thursday January 04, 2018 @10:06AM (#16070790)
Not to worry, it’s “just” 5–10% for “well tuned servers using all of [performance-saving] techniques”.
Re:LLVM patch to fix half of Spectre attack on Thursday January 04, 2018 @10:02AM (#16070745)
I have a hunch that the era of side-channel attacks is only now dawning, and that we should expect many more painful exploits and cumbersome mitigations in the coming years.

What do people more knowledgeable in the field think about this?

Re:Reserve the 418 status code on Monday August 14, 2017 @10:29AM (#15008771)
> In most cases it is clearer to simply adopt a payload format that includes application specific error codes

Absolutely. This is a common practice and there’s even a proposed standard for it (RFC 7807). But such a payload need not be sent with 200 (OK). It can refine the status code instead of overriding it.

Re:Reserve the 418 status code on Monday August 14, 2017 @10:06AM (#15008630)
Here’s the standard for 422: https://tools.ietf.org/html/rfc4918#section-11.2. It’s not a WebDAV-specific error condition. People are right to see the similarity and reuse the status code. This is not “overloading”.
Re:Reserve the 418 status code on Monday August 14, 2017 @09:57AM (#15008563)
> WebDAV spec, which is not HTTP

HTTP is not a closed protocol. There will never be a single document defining all HTTP methods, status codes and such. Nothing in the definition of status code 422 makes it inapplicable to non-WebDAV applications. It is as much standard HTTP as status code 400 is (both are “proposed standards” in IETF terms).

Re:Linux Load Averages: Solving the Mystery on Wednesday August 09, 2017 @06:46AM (#14967285)
Worth remembering that essentially the same issue exists at a lower level: the “%Cpu” number as shown by top includes not just the share of time spent actually executing your instructions, but also the share of time waiting on memory access.

As explained by the same author: http://www.brendangregg.com/blog/2017-05-09/cpu-utilization-...

Re:Introducing the Keybase filesystem on Friday August 04, 2017 @07:41AM (#14927946)
> No option to disable automatic updates, or even reduce the check's frequency. Currently, it runs every hour, even though they can go weeks without a release!

Why is this a problem? Is the check heavy somehow? An hour between quick checks sounds like a reasonable interval for a security-sensitive app.

Re:Stack Overflow Sunsetting Documentation on Thursday August 03, 2017 @08:02AM (#14918786)
I don’t think they are for “open ended discussion” though? From https://softwareengineering.stackexchange.com/help/dont-ask:

> You should only ask practical, answerable questions based on actual problems that you face. Chatty, open-ended questions diminish the usefulness of our site and push other questions off the front page.

This is sort of the fundamental limit of the format they chose.

Re:Status update from the Reproducible Builds project on Monday July 24, 2017 @07:53AM (#14837667)
Or just seed the PRNG with some digest of the relevant source code (perhaps as simple as the version number). Doesn’t solve the problem that your tests can suddenly break on unrelated changes, but does solve the problem that your tests can break without any changes.
Are you familiar with modern electronic dance music? There’s definitely no “authentic voice of another human being” in regular trance music, for example. It’s hours upon hours of repetitive structural patterns overlaid on similar timbres. Now, I’m not a very big fan of trance music, but it would be something, and I feel like the gap between that and more interesting music like IDM should be quantitative (more code to produce more complex patterns over more varied timbres), not qualitative.
The actual software seems to be https://github.com/alan-luo/planetprocedural

On a related note, I’m quietly amazed why there isn’t yet a working generator of electronic music. I mean something that I can download, run, and it would stream believable IDM/techno/trance into my earphones. It sounds like it should be so possible, if not outright easy — yet it’s still humans who are toiling away at their Abletons weeding through that search space. I wonder what crucial problem I’m not seeing.

https://www.browserling.com/#pricing says “Internet Explorer 9 only”, “Windows Vista only” — must be out of date?
Re:A Guide to HTTP/2 Server Push on Monday April 10, 2017 @05:38PM (#14082788)
> Required TLS would also increase security.

TLS is not inherently required for HTTP/2 on the backend.

TLS is sort of required on the frontend mainly because browser vendors don’t want to deal with broken middleware that expects all traffic on TCP port 80 to be HTTP/1.x.

This is less of a concern on the backend, and there are practical implementations of cleartext HTTP/2 today, including nginx and Apache on the server side, libcurl on the client side, and others.

Re:Web Development in Go on Monday April 10, 2017 @02:20PM (#14081158)
“Your own web server” here doesn’t mean “your own program that reads from sockets and parses HTTP” — that is taken care of by Go’s standard library.

“Your own web server” here means “your own program that serves HTTP requests”, and yes, people write programs like that all the time.

Re:Web Development in Go on Monday April 10, 2017 @02:15PM (#14081118)
Looking at Linux’s sendfile [1], it should be possible to use it like that in principle (but not with the standard http.FileServer, I guess).

[1] http://man7.org/linux/man-pages/man2/sendfile.2.html

> So what are the servers behind nginx? 9 times out of 10 it is Apache httpd, and numerous instances of it at that.

Can you cite a source for this?

In my practice, the servers behind nginx are usually platform-specific application servers, such as Gunicorn or uWSGI for Python.

Re:A Guide to HTTP/2 Server Push on Monday April 10, 2017 @11:10AM (#14079148)
Server push sends responses to requests, only these requests are “promised” by the server. So, for every event pushed, the server would have to send at least three frames: promise (the synthesized request), response headers, and response data.

Also, you would still need something else for HTTP/1.x. Even an HTTP/2 client does not have to support server push, and can even ask the server to disable it.

Why do you think server-sent events are not HTTP-y? I found them as elegant as modern Web technology gets.

Older »