HN user

MzHN

1,258 karma
Posts84
Comments138
View on HN
tryquiet.org 5mo ago

Quiet – Private messaging. No servers

MzHN
2pts0
old.reddit.com 7mo ago

Props for Web Components

MzHN
2pts2
www.modos.tech 11mo ago

The Modos Developer Kit

MzHN
2pts0
survey.devographics.com 12mo ago

State of HTML 2025

MzHN
1pts0
lea.verou.me 1y ago

State of HTML 2025 now open

MzHN
3pts0
github.com 1y ago

Home Assistant Core Copilot and Claude Instructions

MzHN
2pts0
stopkillinggamestracker.pages.dev 1y ago

Stop Killing Games Tracker

MzHN
3pts0
www.loopwerk.io 1y ago

Django REST Framework versus Django Ninja (2024)

MzHN
2pts0
lea.verou.me 1y ago

Style-observer: JavaScript to observe CSS property changes, for reals

MzHN
2pts0
godotengine.org 1y ago

Godot Editor on the Meta Horizon Store

MzHN
2pts0
godotengine.org 1y ago

About Official Console Ports

MzHN
2pts0
www.bloomberg.com 2y ago

Netflix Adds 8M Customers, Extending Lead over Rivals

MzHN
2pts0
hackaday.com 2y ago

Bats Can No Longer Haunt Apple VR Headsets via Web Exploit

MzHN
2pts0
github.com 2y ago

Boolbase – two functions: one that returns true, one that returns false

MzHN
3pts0
mastodon.social 2y ago

Mozilla's Original Sin

MzHN
23pts25
meetmeoffline.substack.com 2y ago

A preview of Offline's mission and positioning

MzHN
1pts0
lea.verou.me 2y ago

Inline Conditionals in CSS

MzHN
2pts0
computerengineeringforbabies.com 2y ago

I won't run an Indiegogo campaign

MzHN
2pts0
lea.verou.me 2y ago

State of HTML 2023 now open

MzHN
140pts79
mastodon.social 2y ago

Our listing is not giving us what we are paying for

MzHN
1pts2
lea.verou.me 3y ago

Going Lean

MzHN
2pts0
friendlycaptcha.com 3y ago

Controlling Variance in Proof-of-Work Algorithms

MzHN
2pts0
erinkissane.com 3y ago

Blue Skies over Mastodon

MzHN
5pts1
denovo.substack.com 3y ago

Money Money Money

MzHN
1pts0
godotengine.org 3y ago

Direct3D 12: Adventures in Shaderland

MzHN
2pts0
news.ycombinator.com 3y ago

Ask HN: Are you afraid to use the Android contacts?

MzHN
8pts5
www.europarl.europa.eu 3y ago

Gender pay gap: Parliament adopts new rules on binding pay-transparency measures

MzHN
1pts0
openai.com 3y ago

GPTs are GPTs: An early look at the labor market impact potential of LLMs

MzHN
2pts1
twitter.com 3y ago

OpenAI was created as an open source non-profit, as a counterweight to Google

MzHN
4pts3
topdown.substack.com 3y ago

Read the News with a Map

MzHN
1pts0

I worried that there might be a lot of iterations where one or two of the options would be things that the person didn't understand, or didn't care about.

I won't disagree here, it would be tedious.

picking what they understand and don't dislike, then the 'vs' system is there for helping determine the order of those items

Sounds promising to me.

Carriage returns in bash scripts are cursed

Also the full story here seemed to be

1. Person installs git on Windows with autocrlf enabled, automatically converting all LF to CRLF (very cursed in itself in my opinion).

2. Does their thing with git on the Windows' side (clone, checkout, whatever).

3. Then runs the checked out (and now broken due to autocrlf) code on Linux instead of Windows via WSL.

The biggest footgun here is autocrlf but I don't see how this is whole situation is the problem of any Linux tooling.

I desperately want to like Bruno, since I think it might not do the same rugpull as Postman and Insomnia.

But the UX is just terrible (for me) or at least has been every time I've tried to start using it more.

I mean, come on, the most basic use of creating a request goes like this:

1. Sorry, can't let you create a request before you create a collection.

2. Sorry, can't let you create a collection before you make a decision on in which path you will be storing all your collections.

3. Sorry, can't let you create a request before you think of a good name for it.

etc.

Like what the heck? This should be just one click to create a new untitled request then fill in the URL and send.

At first I thought this might be growing pains since it was new but every year I try it and it hasn't improved.

Not an expert on how this will affect the results but since the list is so long, would it be better to show visitors two random-ish features at a time and have them pick the one they care more about? Or at least offer that kind of UI as an option or the default, and the current list for those who want more control.

`git reparent origin/main -n 3` sounds a lot like `git rebase --onto origin/main HEAD~3` and `git move-branch from to` sounds like `git branch -f from to`.

I love backup branches as much as anyone but I'd also recommend getting used to `git reflog` or perhaps `git log --all --oneline --graph --reflog` if you're worried about losing commits.

There is one* footgun in git that you can't just reflog your way out of and it's stashes because they piggyback off of the reflog, so dropping stashes will also remove them from the reflog. In those cases you can still visualize them with `git fsck --connectivity-only | grep 'dangling commit' | awk '{print $3}' | xargs git log --oneline --graph --all --reflog`.

*(as long as you've committed your changes, if not then there are way more)

First of all, your donations to Mozilla don't go to funding the browser.

This is exactly my point. They should establish direct Firefox donations. I agree that it won't change anything overnight, but they need to start somewhere.

Thunderbird is fully funded by donations[1]

Of course Thunderbird's budget is in a different magnitude than Firefox but I'd guess the amount of users is also in a different magnitude.

As far as I know there has never been an attempt to fund Firefox by donations. You can _only_ donate to Mozilla, which does not go to Firefox development.

People keep saying it wouldn't work but it has also never been attempted so we do not know for sure.

[1] https://blog.thunderbird.net/2023/05/thunderbird-is-thriving...

My masochist anti-tracking set up:

- uBlock Origin with "Disable JavaScript" checked in the settings. Only enable for specific sites.

- Temporary Containers with "Automatic Mode" checked in the settings. Also MMB and Ctrl + LMB always open links in new temporary container. This provides full session isolation for all tabs. There are permanent named containers for logged-in services like email that are only used for email. Outbound links from email for example open in a new temporary container.

All browsing by default happens in a clean isolated session with JS disabled unless explicitly allowed.

I also have Behind The Overlay Revival for when I'm too lazy to zap elements with uBO.

People don’t want to pay for browsers, you can’t rely on the donations of people preferring to ad-block YouTube instead of paying for Premium.

Firefox has never tried it so we don't know it for sure. I think they should at least provide it as an option.

You can donate directly to Thunderbird development for example https://www.thunderbird.net/donate/

But you can not donate directly to Firefox development, only to Mozilla, which I'm sure most are less enthusiastic about than supporting Firefox development.

If this was any other language than JS I would agree but my personal experience with JS is the opposite.

In my experience almost everything in the JS world is already async. User interactions are async, requests are async, almost all NodeJS APIs are async. To me having to add more async in JS is a tiny barrier compared to what I'm facing in other languages that feel more synchronous to me.

Since there is already so much async I also feel like debugging, profiling and error handling are all pleasantly solved problems in JS.

Offloading to workers is also async so while there are many valid benefits to be gained, avoiding async does not seem like one of them to me.

It seems I do the opposite of many commenters.

I do not run Docker in production at all but I also do not develop any serious projects outside of Docker.

Installed on the host machine are only VSCode, Docker and Git.

You work on a project by cloning it, opening in VSCode and clicking on "Reopen in container".

This will spin up generic services like databases and then the actual app container as a VSCode Remote Container, with all the development tooling inside the container.

Does not matter if tooling changes between projects, any project can be worked on with a single click of "Reopen in container".

Host machine stays clean.

Sometimes I have trouble listening without my thoughts drifting elsewhere. I found out that playing a Tetris clone that never increases in speed and never ends is a good way to keep a clear focus on listening. After changing phones recently my perfect Tetris clone stopped working as it was 32bit and the support was dropped. I've been looking for an alternative and finally found one in a 2048 clone with an Undo button. I thank you for that. It has saved me a lot of trouble staying focused!

For just hosting something as long as possible I would highlight two options stolen blatantly from previous threads:

If you can throw enough money at the problem and are in the US, set up a trust to host your content for as long as the funds last.

If not you could bet on The Internet Archive to outlive you (and maybe donate to them).

But I think the bigger issue than hosting is discoverability. How will your great grandchildren find your content even if it was still available?

To cover both issues the best bet is to focus on somehow convincing your offspring on keeping your content and memory alive in what ever way they see fit, enough so that they pass it on. I have no ideas for exact details here, maybe someone else does?

While we're throwing ideas, someone please implement this:

An as simple as possible Android app that lists any discovered Chromecast devices and when you tap on one it attempts to cast your screen to that one.

Why? Because screen casting isn't an AOSP feature. It is really difficult to get it to work on GrapheneOS if it works at all.

But VLC can stream video to Chromecast on AOSP without issues.

So my thought is: Take a look at the VLC Android source. It's mostly a wrapper using the VLC bindings as an API. Look at how it uses VLC to discover Chromecasts[1] and how it uses them as output[2].

Then somehow pipe the createScreenCaptureIntent API into it.

GrapheneOS users will be thankful.

[1] https://code.videolan.org/videolan/vlc-android/-/blob/master...

[2] https://code.videolan.org/videolan/vlc-android/-/blob/c773c2...

I appreciate that it is a free service and thank you for the time it worked for me.

At the same time I am a bit sad to see my use cases break. I often resort to more advanced code search when I have really obscure problems, for which the answers might be some old GitHub (or GitLab) repositories. I'm less interested in up-to-date information for those, so a stale index is better than no index for me.

But I can also feel the pain of working with GitHub and GitLab and their rate limits and such.

They also recently(?) silently destroyed[1] their public search index at sourcegraph.com/search. Since GitHub only recently got a working search and even that is behind login, I used to search a lot using Sourcegraph. It even supported searching GitLab.

Now it seems that all GitLab repos are gone from the index and a huge number of GitHub repos as well. If I can't trust the search I'll just have no choice but to fall back to GitHub.

It's a shame since their index was at some point even better than GitHub's own, although GitHub seems to have caught up.

[1] https://community.sourcegraph.com/t/most-public-repos-no-lon...

Against Names 2 years ago

I'm more on the extreme end of you can never name too much, as long as the names add more signal than noise, so I may be biased.

But I feel like the two examples given don't really support the case against.

In git, branches are close to meaningless. You can use git without branch names quite well, it's just not as nice of an experience as jj. The only thing you can not do in git without having a named branch (or rather a ref of some kind, does not have to be a branch) is moving commits between local and remote repository.

In git, branches are only meaningful – briefly – when communicating with other people, in which case naming them really matters! For your own temporary use, sure, don't name then. For me that's more of a flaw of git. In most git workflows you're meant to destroy history, so it doesn't matter that the branches are also destroyed, which again results in their names being meaningless. For things that are not throwaway I'll stand by putting as much effort into naming them as is needed.

Utility CSS classes are names. They're an API. Although I understand the reasoning, Tailwind is actually a perfect example of terrible naming. Everything has a single letter name or a name composed of initials. As a beginner you have absolutely no idea what you're reading, until you learn all the cryptic names. I'll restate that I understand why it is this way, but again for me it's a flaw of Tailwind and maybe utility classes in general.

Then there's the final example of lambda functions, where supposedly everyone accepts that naming isn't important. I think this one is the best example of why naming is important. If each step here had a proper name, you wouldn't have to write out what the function does, the code itself would explain it. If I don't trust it I can verify that the code the name is given to matches the name. Once I've verified it I can forget the code and substitute it with the idea of what it's supposed to do. Or if I don't want to verify it I can just trust the name and still understand what it's supposed to do.

Good naming helps readability tremendously for me. I don't have to spend any brain processing power on parsing that `.filter(|i| *i % 2 == 0)` means `filter even numbers`, I can just read it.

PS. Actually there are already two good names there: `into_iter()` and `sum()`. I don't need to know how they're implemented to understand what they're meant to do there. It's the lambda that's the problem and shows why naming is important.

Can you give some pointers or what to search for regarding OIDC and 3rd party cookies?

I've implemented both OIDC SSO and SLO between a lot of varying services and identity providers and have never needed 3rd party cookies so I'm curious.

Only place I've seen it are some really old SAML implementations and even those could be reworked to not use 3rd party cookies.

This may eventually come to life via Isolated Web Apps https://github.com/WICG/isolated-web-apps/issues/1 or for example via webpackage https://github.com/WICG/webpackage/issues/576

The first step along the way though is making actually secure web apps possible.

Aren't secure web apps already possible? Well, Signal among others thinks otherwise. See the Isolated Web Apps explainer for a full explanation https://github.com/WICG/isolated-web-apps

I tried reading the article with the GP's comment in mind. For most of the sections it didn't feel like there was anything that would flag it as LLM generated for me.

But when I got to "How to Start Self-Hosting?", which is the section I was most interested in, I got a strong sense of déjà vu.

Reading this section felt exactly like I feel when I hit a bad prompt on ChatGPT. I feel I'm being given a huge dump of keywords but nothing that lets me make any progress. Reading it I felt the same frustration I do with ChatGPT as I have to prompt it again with "Can you elaborate on bullet point 6" to get anything useful out of it.

With ChatGPT the reason is usually a prompt that was either too broad/open-ended or a difficult topic for ChatGPT to answer. And it has a tight limit on how long the answer can be, which is understandable. For an article though it feels a bit jarring and there is no immediate way to ask for details.

I think the rest of the article is fine really. Sure the word of caution is exactly what LLMs do but unlike LLMs, which usually state the obvious, it has a lot of useful information.

First-party tracking has been increasing in the last couple years or so I've been told.

When I first heard about it I decided from now on I'll run uBlock Origin in default JavaScript off mode. It's a checkbox in the settings.

I only re-enable on a per-site basis if I have no other choice.

I prefer this over NoScript, since it's one click and I still get all the uBlock filters even after enabling JS.

I've been using web like this for over a year now, and while it's painful, it's also enlightening.

Monetization and abuse has been mentioned a bunch as things to consider as you gain more users, but I'll add a couple more I think are relevant, at least once the service is big enough.

Your payment processor. Payment processors might get triggered by the fact that adult content is pretty much explicitly allowed. They might also just generally deem you "high risk" and kick you out. I think this is one of the biggest risks you run. For example Stripe, according to their legal docs, prohibit "Cyberlockers, regardless of whether they host adult content", whatever that means, but it sounds a lot like file sharing in general is a prohibited business.

Ever-tightening think-of-the-children laws. You may not want to implement expensive and privacy invasive scanning (note that even local scanning may be privacy invasive[1]), but you might be forced or face a fine. You could always do like Google and budget it in as an expense, love that "fines" line in their reports. This may also be relevant to the previous one, since payment processors might deem you higher risk if you have no scanning.

Getting blacklisted for hosting malware. Specifically the support for non-media files. You could end up being blocked by browsers, search engines and whatnot. See for example Google Safe Browsing.

[1] https://rys.io/en/173.html

Until possession and distribution of such apps becomes a crime in itself.

That's the only way to enforce it and there is history for it in cryptography export laws and anti-circumvention laws.