Hacker News new | past | comments | ask | show | jobs | submit | cormacrelf's comments login

Maybe it’s better selfhosted, but GitLab is almost unbearably slow. I booted up a Gerrit instance to compare and simply rendering a MR page is maybe 10 seconds vs zero. GitHub is still 10x faster. GitLab manages to be almost that slow for cached pages, making you wait, then realise it’s outdated, and load again, totalling maybe 20 seconds just to “go back to the MR list”. Its awful.

Whatever it is you think you might like about GitLab in theory, it’s much worse when this is your reality. When it takes that long to render a single MR, you do not want to be creating more of them than you have to, and you certainly don’t want to make yourself and the rest of your team navigate between MRs to do code review.


At least not directly, as of the 2022 disclosure form. https://www.scotusblog.com/wp-content/uploads/2023/06/Robert...


Sadly it looks like Supreme Court financial disclosure forms aren't particularly accurate representations of their conflicts of interest: https://www.propublica.org/series/supreme-court-scotus


Sure, wasn’t sure that even needed to be said at this point, but even so, this form was probably produced by a broker. Even if it does not cover things like this https://www.businessinsider.com/jane-roberts-chief-justice-w..., I think it was likely accurate as to his holdings in publicly traded stocks and index funds.


Some people may enjoy going through an enormous learning curve to do configuration like that, but the benefits there are pretty abstract and personal, and the pressure to make the onboarding any easier is very low. It's partly because these kinds of users are willing to (a) suffer through a lot in the name of learning and feel good about having done that, and (b) read and write what appears to be a dozen book-length tomes of documentation, that it doesn't get any easier for beginners. I know because I was also one of them in 2015-16 or thereabouts.

Nix doesn't need any more home-manager tutorials, because it doesn't need any more small-time tinkerers. It would benefit more from becoming essential to a bunch of businesses who will become invested in making their own developer experience acceptable at scale, and who will have to improve Nix to that end.

Pretty soon a bunch of people are going to realise they actually do need the exact same version of every tool in every toolchain on every machine in a team, to make use of the transformative caching abilities of tools like Bazel and Buck2. And if that catches on, I would not be surprised to see an alternative Nix frontend configured in Starlark, like every other tool in that arena. There's already a buck2-nix that generates dhall under the hood.


Car and aircraft bodies generally fall under the “useful articles” exception, so they are not copyrightable. Otherwise they would be sculptures.

There is a separate regime that covers useful articles: design patents, which have a much shorter term. The design patents can AFAIK cover things like toys, I don’t know about game assets. You might have to look at the actual grant of patent rights to see what is claimed. I don’t get the impression that the big aircraft manufacturers care about games for plane nerds.


I would be a little surprised if design patents can protect against portrayals in media like games/movies.


You can say the same thing about something as simple as "shared memory" -- normal multiprocessing computers have had shared memory since time immemorial, but browsers literally disabled SharedArrayBuffer from 2018 to 2020 and anyone using them to communicate with Web Workers had to find another way. Browsers run a 24/7 onslaught of extremely untrustworthy code, whereas games only run themselves.

Firefox has not enabled WebGPU via wgpu for the same reasons Chrome Security has done an in-depth review of Dawn. It is a component that must be hardened. For anyone out there trying it out by enabling config flags, remember to disable it once you are done. It will be ready in time.


> whereas games only run themselves.

Until you run multiplayer and are suddenly dealing with hostile players, servers and possible mods.


I would love to hear about an implementation of multiplayer that receives code from hostile opponents and executes it, but I do not anticipate you'll find many examples.


Ever heard of a game called "Call of Duty"?

> SV_SteamAuthClient in various Activision Infinity Ward Call of Duty games before 2015-08-11 is missing a size check when reading authBlob data into a buffer, which allows one to execute code on the remote target machine when sending a steam authentication request. This affects Call of Duty: Modern Warfare 2, Call of Duty: Modern Warfare 3, Call of Duty: Ghosts, Call of Duty: Advanced Warfare, Call of Duty: Black Ops 1, and Call of Duty: Black Ops 2.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-2081...


In case this needs to be pointed out, an RCE in a game is an accident, not the way they designed their multiplayer to work. I was describing why the Firefox team might wait for a feature to be security-hardened before releasing it. The answer remains the same -- they design and market the thing to be secure even when it executes untrusted code. Activision does not advertise their games as able to "securely execute RCE gadgets from maliciously crafted steam authentication packets". This part may be surprising: the Chrome and Firefox teams do, in fact, try to ensure that when someone gains RCE, that they execute it securely and it can't get very far.

I am not attempting to claim that games do not have security issues or cannot experience remote code execution, just that this is not a normal pattern of behaviour that they plan for, so it is normal that a game author would deploy wgpu long before Firefox does (while Firefox spends a lot of effort on fuzzing, etc). If anything a terrible CVE that Activision has expended apparently zero resources fixing is a very good example of what I'm talking about.


Understood. I should not have been snarky; I'm sorry. I think the CoD CVE is worth noting in this thread though.


No need to apologise! You got me pretty good.


With the amount of visible bugs that every game is released with nowadays, there are easily as many security bugs.

Depending on the game, it downloads maps, skins, etc. from the server... File parsing code is highly suspectible to security bugs.


“A a a a a very good song” to the rescue. https://music.apple.com/au/album/a-a-a-a-a-very-good-song-si...

Also available on iTunes for a dollar, search for Samir Mezrahi (the blessed soul who made this).


That's hilarious. Actually Apple support have just removed U2 permanently from my account. Feeling mildly victorious.


You can do all of this with https://materialize.com, and you don’t need to write it in Java. Just connect it to a Postgres instance and start creating materialised views using SQL. These views then auto update. So much so, that you can create a view for the top 10 of something, and let it sit there as the list updates. Otherwise just use normal select statements from your views using any Postgres client.


If it’s talking about x86, then yes the eax register is 32 bits wide. The low 16 bits of the same register are called “ax”.


No, this is a timing attack. https://en.wikipedia.org/wiki/Timing_attack. See also https://en.wikipedia.org/wiki/Side-channel_attack for more general usage of "timing attack" beyond cryptography.


Life’s short. Don’t waste it configuring nix-darwin.


As someone who has nix-darwin on their daily driver machine I can confidently say that I spent very little time configuring it and my config is almost in full shared between both NixOS and nix-darwin


Upfront payment figuring out Nix is amortized, and is less than a lifetime of payments of dealing with flakey machines, assuming you have a decent amount of lifespan left.


Consider applying for YC's W25 batch! Applications are open till Nov 12.

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: