Hacker News new | past | comments | ask | show | jobs | submit | howdydoo's comments login

Ideally our critical infrastructure would have a better security track record


yeah and maybe companies will start paying for open source software, but I’m not holding my breath


The difference is that it is bad for business reputation when some of the largest companies on planet are regularly leaking data through exploits. Testing will become an economic requirement over time.


For zero-crossings my first thought would be either bullet (•), to not break the visual flow; or multiply (×), since it's at least vertically centered


OMG, I thought I was already using ×, but that was a different project. Good call!


In C++, any concurrent filesystem access is undefined behavior (which seems pretty crazy to me)

https://en.cppreference.com/w/cpp/filesystem

> The behavior is undefined if the calls to functions in this library introduce a file system race, that is, when multiple threads, processes, or computers interleave access and modification to the same object in a file system.

---

Golang also seems vulnerable to the same issue

https://github.com/golang/go/blob/d15481b8c7f5f73a8b987a0c1d...

Line 78 checks that the path isn't a symlink (time-of-check). Then line 97 calls openFdAt which on line 174 opens the path by name, without NOFOLLOW (time-of-use).

I bet this is a pretty common vulnerability.


We spent our lives searching for the Creator, and in the end all we found was GitHub Copilot


If you think "→" misrepresents the meaning of "->", then certainly "->" also misrepresents the meaning of a semantic arrow "→". The set of symbols in 7-bit ASCII is somewhat arbitrary after all.

Let's say "→" misrepresents the meaning of "->" even as much as 0.1% of the time. Would you rather your risk of error be 99.9%, or 0.1%?

I'm sick of anti-ligature people telling everyone else not to enjoy their fonts, on every single post about a font. Ligatures have caught on for a reason.


> I'm sick of anti-ligature people telling everyone else not to enjoy their fonts

Who is doing that? Certainly not the author. It sounds to me like you're taking the author's opinions as a personal affront, which seems... weird.


If you say it is a "terrible idea" that kind of implies that anyone who has the idea to add them to their font or use a font that supports it has made a terrible choice. At least, that's how I interpret it.

It's certainly not the most neutral phrasing.


The only thing that is annoying with -> as two characters is the misalignment of the horizontal center. If the ligature had always centered the - to the middle of the >, I’m not sure so many people would be pushing towards having a single arrow.


Ligatures caught on because users like 'clean' designs where 'clean' means 'the removal of affordances which are not needed by frequent users but are useful to new users'. Your example doesn't make any sense because while the dash arrow attempts to mimic an actual arrow it's not ambiguous that it's two characters and will be understood by a compiler as such. A reading of source code either on a blog or shoulder surfing with this font does have that ambiguity, which is the problem.


I don't think "→" necessarily misrepresents the meaning of "->" (though see the objections throughout the thread re: differing ways that languages notate "not equal to.")

The point is that programming isn't just an exercise in semantics. But it is deterministic symbolically.


The issue is that people also share screenshots, and ligatures are not universally shaped or styled, unlike ASCII.


Screenshots are a suboptimal way to share code in general, and should be avoided. If you are trying to copy code from a screenshot something has gone horribly wrong in your process. If you are having trouble reading ligatures, that may be a learning curve issue you can adapt to with more use. (Arguably, most ligatures should be obvious with enough familiarity with the programming language without needing to look them up or learn them.)

Most other ways of code sharing you just copy and paste into a non-ligature font if you need to.

Aside: "ASCII" symbols are neither universally shaped or styled either. The easiest and obvious example to mind is the plain 0, dotted 0, slashed 0 choice and confusion with nearby symbols such as O and o and θ (Theta, not far away in "Extended ASCII"). Similarly all the variations of lower-case L (versus 1 and i). Those choices vary considerably between fonts and are another huge reason some people prefer certain monospace fonts over others and the debate over "best" will likely be an ever ongoing one. You may not think these issues compare to ligature use, but it's exactly the same sort of style debates.


Works great until some jerk uses `→` as a variable name...


> We learned that the key to a post reaching the front page was the content itself.

Well that's good news, at least


I am torn between joy and depression that this is a notable finding. Nice that they noticed and followed the logical conclusion, at least:)


Well their observation is completely wrong. Timing is the most important factor which matters. I have seen thousands of extremely good non-political, neutral, tech related articles not getting a single upvote if it is submitted at times most of US/Western Europe is sleeping.


Your point about timing is a good one (and was also something Dan mentioned in his presentation yesterday) so I created an MR to add it to the page: https://gitlab.com/gitlab-com/www-gitlab-com/-/merge_request...


Mind to share if there's a video or something of the presentation? Would love to see it, thanks.


And clickbaiting works for sure: https://news.ycombinator.com/item?id=15845419

I initially named the post "Mercurial being rewritten in Rust" and that's how it made it to the front page, if I recall correctly, close to the first spot, even.

As soon as mods renamed it, it dropped like a rock.


Kind of makes you wonder what they learned was key on other channels.


They Found Out What Worked On Other Platforms And The Answer Will Astonish You.


What works on other platforms: Safe or Scam?


Presumably there would be a similar page in the Gitlab Handbook if they had findings



I predict we start seeing "Login with 1Password" buttons on random websites next to the google and facebook buttons. I also predict it never catches on.


Hmmm.... I read the headline here and was a little perturbed. WTF does a password manager need THAT much money for.

However, after reading your comment, I hope this is the direction they go. I actually really like the future where I can have instant accounts attached to a more anonymous backend than my social media. I'm sick of things as mundane as my local gym asking for access to my fucking friends list.

Sign-up hurdles are a real thing too. I recently read that it was a major factor to Microsoft's video gaming stream service never taking off.


Based on https://www.future.1password.com/ I'm guessing it will be closer to LastPass's auto-login. It still uses the existing username/password form, but autofills and submits for you.

So a 1- or 0-click login once you hit the login form, as opposed to the current 3-click system (see login list, click to fill, click to submit). And looks like it also might handle the 2fa portion (which essentially makes it 1fa).


How do you expect to choose which account to get in if there isn't a list to choose from?

Currently in Lastpass If you have one account it's auto filled making it a single click.


I would assume it only works if you have a single account. That's the most common situation, though.

LastPass has the option to autofill and auto-submit. 1Password doesn't, but that's my guess for what's coming.


I'm guessing this isn't what you meant, but a password manager that integrates with the Credential Management API[1] would be amazing. Would simplify password management a lot if it got widespread adoption, and provide an easier upgrade path to strong public-key authentication using WebAuthn.

[1]: https://developer.mozilla.org/en-US/docs/Web/API/PasswordCre...


That's certainly an eyecatching idea! I'd hate to be engineer in charge of that idea, though... how would you even begin to drive webmaster adoption? Even with the leverage of their massive userbases, Google/Facebook logins are far from ubiquitous.


> how would you even begin to drive webmaster adoption?

"If your users use 1password, they won't keep forgetting their passwords (causing frustration and support burden) and won't use weak passwords that result in account takeovers (support and eng burden). Plus, you and your users won't be beholden to the whims of fb or Google".

Just one idea.


The natural next step is adding ELIZA-like chat responses to your bots


"Tell me about want to kick my ass."


GPT-3 would be interesting, especially once multiple bots start chatting to each other.


I know that PioSolver is not a "poker AI" per se, but the article seems to say it can tell you what to do based on the table situation. Has anyone tried pitting pro players against PioSolver?


PioSolver requires putting in the hand range of the opponent, so the quality of PioSolver's solution is largely down to how accurate the guess at that hand range is. But if a pro knows he is playing against PioSolver configured with a certain hand range he can just change his strategy to adapt. In theory though if PioSolver knows the correct hand range then it shouldn't be possible to any better than tie given enough hands.


Or even better, turn on autovacuum (buy a roomba)


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: