HN user

andrewaylett

4,134 karma

I'm a Software Engineer, living in Edinburgh, UK. Website at http://www.aylett.co.uk/.

If you want to email, my email address reads like my name.

Posts33
Comments1,383
View on HN
www.aylett.co.uk 6mo ago

Asking Questions Internally

andrewaylett
1pts1
developer.mozilla.org 7mo ago

Using – JavaScript

andrewaylett
2pts1
www.newsweek.com 1y ago

Human corpses keep moving for over a year after death, scientist says (2019)

andrewaylett
101pts72
www.newsweek.com 6y ago

Human corpses keep moving for over a year after death, scientist says (2019)

andrewaylett
2pts0
www.blackhillsinfosec.com 6y ago

Google Calendar Event Injection with MailSniper (2017)

andrewaylett
117pts70
messages.android.com 8y ago

Text on your computer with (Android) Messages for web

andrewaylett
3pts1
www.hotosm.org 8y ago

Humanitarian OpenStreetMap Team

andrewaylett
4pts1
datproject.org 8y ago

Dat: powerful data sharing from your desktop

andrewaylett
1pts1
www.theguardian.com 9y ago

Publisher wins rights to Voynich manuscript, a book no one can read

andrewaylett
2pts1
www.fastcodesign.com 10y ago

Microsoft's Radical Bet on a New Type of Design Thinking

andrewaylett
2pts0
www.cambus.net 10y ago

Decommissioning a free public API

andrewaylett
170pts59
code.google.com 10y ago

Avast: Sandbox/Autosandbox Message Filtering Vulnerable to MS13-005

andrewaylett
2pts0
blog.statuspage.io 10y ago

How to Write a Good Status Update

andrewaylett
1pts0
medium.com 10y ago

How We Handle Do Not Track Requests on Medium

andrewaylett
1pts0
www.bbc.co.uk 10y ago

London – centric

andrewaylett
2pts0
01.org 11y ago

Intel Kernel Guard Technology

andrewaylett
36pts10
simonsapin.github.io 11y ago

The WTF-8 encoding

andrewaylett
235pts104
rsos.royalsocietypublishing.org 11y ago

The false discovery rate and misinterpretation of p-values (2014)

andrewaylett
2pts0
www.agwa.name 11y ago

How to Responsibly Publish a Misissued SSL Certificate

andrewaylett
1pts0
blog.chromium.org 11y ago

Chromium Blog: Freezing Chrome for Ice Cream Sandwich

andrewaylett
1pts0
lucumr.pocoo.org 11y ago

Why I Don't Hate Git: Hidden Consistency

andrewaylett
2pts1
jacquesmattheij.com 11y ago

Saving a Project and a Company

andrewaylett
425pts130
www.bbc.co.uk 11y ago

Scotland's Decision

andrewaylett
118pts127
stormyscorner.com 12y ago

“Are you ok?” in 2014

andrewaylett
1pts0
blog.gerv.net 12y ago

Microsoft ‘Mortally Wounds’ SHA-1

andrewaylett
105pts67
blog.whitehatsec.com 13y ago

Password Cracking AES-256 DMGs and Epic Self-Pwnage

andrewaylett
1pts0
www.bbc.co.uk 13y ago

North Korea ends peace pacts with South

andrewaylett
2pts1
www.bbc.co.uk 13y ago

Internet porn: Automatic block rejected (UK)

andrewaylett
20pts39
ares.aylett.co.uk 13y ago

XKCD: Click to Drag, full-screen with cursor control

andrewaylett
1pts1
www.wired.com 13y ago

Reverse-Engineered Irises Look So Real, They Fool Eye-Scanners

andrewaylett
9pts5

It requires a positive action from the application developer to include GrapheneOS's keys as well as Google's keys. So this is a deliberate positive step, rather than a default.

The value of a business isn't its wages or its immediate profits: it (over-simplified) represents a claim on the future profits.

Equity grants (and especially options) aren't particularly controversial in tech, and I'm not saying they're the answer to the problem at hand. But they're a mechanism for allowing workers to share in the gain from their investment. All the problems (especially with US tax treatment of options) notwithstanding.

On the other side: without the workers, those large capital investments are useless lumps of metal.

Both Capital and Labour invest in the company, in different ways. It's not at all clear to me that the optimal arrangement is that Capital reaps the bulk of the return from those investments.

I've got quite a lot of historical data, yes. I don't back up `media` or `share`, but I do back up everything else using the automatic backup feature. Automatic backups are around 11GB each. That includes all the "apps", which includes a whole load of data that's not really related to HA :).

The SQLite backup script is part of my separate backup routine that predates HA's backups, and eventually makes it into a Borg backup hosted on rsync.net. Belt and braces.

I seem to recall having trouble with the read only flag and the backup API, but it's quite likely the problem was mine rather than with SQLite.

Anyway, the sync-friendly output is the really important part for me, because it means I can point borg at the zstd-compressed file and it'll only need to store what's changed.

I run my backups like this:

    OUT="${i}.sql.zst"
    PART="${OUT}.part"
    sqlite3 -readonly "${i}" .dump | zstd --fast --rsyncable -v -o "${PART}" -
    mv "${PART}" "${OUT}"
That doesn't block writers (when the writer uses WAL), and gives me a dump that's compressed well while also being easy to sync. My Home Assistant DB is 1.8GB, my dump is 286MB compressed, and I'd guess 90% of that is consistent from one day to the next.

There's a trade-off to be made, and it's not necessarily clear where the trade-off sits for any particular company, or even team within the company.

One product person described it as eating vs breathing. Availability is like breathing: if you stop being available (including, but not limited to, because your software is a big ball of mud) then you're going to die pretty quickly. Product is like eating: you might not die so quickly but if no-one's buying what you're selling then you're still not going to survive.

The team I'm part of is a platform team, so we're closer to being lungs than being stomach. We can (and I appreciate being able to) focus more on stability than feature development.

The thing is: I could produce 2-3 times as much code as before _without_ an LLM, if I didn't care about my colleagues' ability to review my output properly.

Lines of code are a liability, not an asset. You want as few of them as you can get away with, without compromising the actual asset: the functionality.

A huge part of the job of Software Engineering is producing the right amount of code at the right time.

I have a Pixel Watch 2, it seems that only certain carriers (typically not MVNOs) can set it up with an eSIM that will present as having the same number, but any MVNO that provides eSIM setup via QR code should work to provision via the connected phone.

I can imagine Apple being less inclined to allow arbitrary eSIMs on their watches, preferring to only support the case where the eSIM is guaranteed to support the "correct" presentation.

Restricting users to "approved" devices seems to be a US thing? I'm fairly sure that anything that's capable of connecting with the right frequencies and protocols can connect to any UK network.

One might imagine a world, which would have to be populated by non-humans, in which we do price discovery for every transaction. Scalpers wouldn't exist: each batch of goods would be sold via Dutch auction.

I do wonder whether such a scheme might work for console launches — you put in the price you'd be willing to pay a scalper, and the batch you're allocated to is the first batch where the auction price is lower than your bid. Then you pay the auction price for that batch.

Faithlife do something with a converse price discovery function for book digitisation: you enter the amount you're willing to pay for the result, and if N people are willing to pay at least $COST/N, they do the work. No point in scalping that: it's a digital product, the question is availability rather than quantity.

In a world populated by humans, and with a mass-market good with restricted availability, there's a societal pressure to avoid enabling scalpers. Whether you act by yourself running some kind of auction, or by attempting to limit the ability of scalpers to buy in bulk, or by ignoring the pressure (and possibly running your own scalping operation to front-run the third-party scalpers), is up to you.

Deno Desktop 1 month ago

That appears to be the default, CEF is available if required (hint: it shouldn't be).

The people requiring adherence to a specific standard are not the people who then need to pay to see what they're supposed to be adhering to :(.

Strictly, just because the standard costs money doesn't mean that the information within it is otherwise unavailable. The C++ spec is an amusing example of this: the actual spec costs $$$, but the final draft is freely available. I can't imagine they sell many copies. I know that back when I was employed to work on a C++ compiler I only had access to the draft.

If demonstrating conformance is important, I suspect that the cost of access to specifications is only going to be a small fraction of the cost of certification. And as I understand things, it's certification that's the target of charging for specifications.

I'll second the recommendation for `mise`, and add: I typically use Homebrew for things I want everywhere, and if I want something everywhere then the latest version is _probably_ OK. I typically use mise en place for versions which are project-specific.

So I have a system Python (largely unused), a Homebrew python (pulled in as a dependency, I won't use it), and as many different mise/uv Pythons as I need for different projects. Similarly NodeJS and Java. I'd given up on nvm a while back, no longer use pyenv, and mise and uv work together really nicely.

Fair -- but I was more meaning that when I browse an arbitrary untrusted website I almost always allow the site owner to run arbitrary untrusted code on my machine. They might not send me any JS, but if they do then my browser will happily execute it.

Running arbitrary untrusted code safely is pretty easy nowadays, so long as the code is written in Javascript and you want to run it in a browser. It's only a little harder if the code is written in another language but targets WASM and browser APIs, or if you want to run your WASM inside of NodeJS, and there's even good support for running Python in a browser or Node.

Once you get away from running in a JS environment or away from code that's written with the intention of running in a WASM sandbox, if you don't want to have to modify the code for your environment then you're going to start having problems. This looks like a good step for anyone wanting to run arbitrary Python outside of a browser environment.

DaVinci Resolve 21 2 months ago

That's still nondeterminism as an implementation choice, rather than as a fundamental limitation of the technology.

The Unifi range is quite definitely optional cloud. Don't turn it on (and don't use a cloud-based controller!), and it won't have any mechanism for control.

You can even use the mobile apps over direct connection, with local auth and no cloudy relay required.

This does depend somewhat on your risk profile. For many folk it's pretty decent: you need to guard against online attacks, so keeping your passwords offline gives them excellent security. If you need to protect yourself against family members, it's not so good — and it also doesn't provide the level of phishing protection that an online password manager offers.

One of types of services Cloudflare provides goes by the name "Warp". Calling it a VPN is only wrong in ways that don't really matter — it has the effect of causing client traffic to appear to originate from a different IP address to the one they're notionally connected to the Internet via.

I have a pre-facelift MB A-class, and I think it's the best car I've driven for controls. You don't have to touch the screen ever if you don't want to: there's a trackpad on the centre console that just works even (most of the time) with Android Auto (and the back/home/map/media/phone buttons will still save you even if Android Auto won't always let you move the cursor to the back arrow in YouTube Music). The steering wheel has two touch-sensitive buttons, one for each screen (duplicating the trackpad, which itself duplicates the media touchscreen). I can't even easily reach either screen when driving, so I don't.

Driving controls are all available on the stalks and wheel, volume is adjustable from the wheel or the centre console, all physical buttons, levers, or scroll inputs, unless you need to change a setting using the trackpad. The only thing that's missing is wheel control for skipping tracks :P.