greengreengrass

That's just how SSH works

I know that. Just because SSH automatically sends my local $USER doesn't mean they have to report the value received in the SSH username automatically on the game platform to other users, without first having prompted me "your username has been reported as <greengreengrass>. Is it okay to show this?".

A simple flag in my user profile in the platform to say whether I've said that's okay or not.

Or instructions to advise people to choose their username /before/ first connect. These are reasonable, privacy-preserving things to call out in a good and user-friendly design.

I would prefer the connection instructions made clear that the default SSH username would be used to set up my username on the platform and display that to other users without initially seeking my consent. On $machine[work], I don't get to pick that $USER is my full name.

If this affects you, make sure you connect with `ssh [pseudonymous name]@late.sh`.

Umm, just no. "Law" =/= statute.

I see this also purports to link to secondary regulation, but there's a reason lawyers pay huge chunks of cash to professional firms that ingest court decisions and other sources of applicable regulation. Meh, there's a reason _lawyers_ are paid huge chunks of cash to be kept on retainer and give their opinions to begin with.

It's harder to solve some of these problems than prompting an LLM to vibe a solution. I wish we'd stop.

> Or inspect their SOC2 documents?

SOC2, ISO27001 and all that shit is not the same thing.

Hard agree. SOC2/ISO27001 are a thing that might be useful, but are mostly a framework dreamt up by auditors and other people who like wearing suits (and making lots of money).

They have some normative controls. But a SOC2 audit is not going to survive contact with an engineer who can push code and whose job depends on the company they work for making money. Where they have to ship product features, and don't have weeks to justify every line of code they write.

A SOC2 audit is not going to survive contact with a script kiddie in their bedroom (or, a nation-state APT) who has plenty of time and an LLM to help them find vulnerabilities or weird edge cases they can compose to attack a system.

These frameworks might serve a purpose, but corporate 'compliance' departments have been lulled into a false sense of security that a satisfactory SOC2 audit means the product is secure and obviates them from asking more technical details or for a fuller audit. It's not. That doesn't matter in a lot of cases, but probably does for a network security solution - I would absolutely be asking deeper questions if I was deploying any of these products en masse.

But then again, the insurers probably asked for a SOC2 certificate, so I guess like most things in life, it's not about whether the systems are secure - it's about whose insurance is ultimately covering the loss.

(not top poster)

Isn't Headscale server-side only ?

Yes. You're still running the native Tailscale client code on the hosts, which this evidence reveals can't be as trusted as Tailscale would like us to believe.

I also wouldn't trust Headscale fully. It had a critical defect at some point that, IIRC, would allow an attacker to rotate the key of a registered node without auth to a value chosen by the attacker. And its primary maintainer is a member of the Tailscale team, apparently maintained with full approval of their employer and with reasonable transparency between the projects, but nonetheless the overlap is a little close for comfort.

Frankly, as you've said, I don't trust any of these solutions to be anything more than a convenient way to jump onto a bastion or another host of minimal consequence to get into the network and jump onwards.

Exactly this. Most of my time writing code is now not necessarily spent writing the said code, but going through whatever Claude or some other agentic process produced and tidying the comments to be less temporally sensitive to the conversation that produced it.

The problem is that process of not writing the code, but just editing what the LLM produced – and somewhat mindless editing at that (I'm editing comments, not LoC!) – leads to a loss of focus and all the perils of human procrastination that entails (hello, writing comments on HN).

I've tried to prompt Claude et al. not to do this - but whatever I've tried so far, even meta-prompting it to ask why it ignored my instructions, it doesn't work, doesn't stick, and I can't find a good way to stop it.

Seeing the level of thought that went into user experience design, research, and arguing for the _right_ page to redirect to is such a delight.

Engineering (as with so many professions) is about so much more than just shipping features as quickly as possible, and it pleases me when I see fellow engineers taking care and showing thorough consideration over the potential impact of their design decisions on people from all walks of life and circumstances.

Completely agree. I use randomness for all of these now – plausible randomness if it’s possible I’ll have to give it over a phone.

My first name can be shortened, and I go by either. When I first signed up to Claude, I thought we were entering the world of artificial “intelligence”, so I told it my name was “<long form> or <short form>”.

Well, it hardcodes that field rather than running it through the model, but I’ve kept it so I get an evil chuckle to myself (or perhaps pyrrhic reassurance) at its lack of smarts and a reminder that it’s still a somewhat subservient product experience that isn’t all that smart after all.

Thanks! Oh I have every confidence we are still studying this, and that it's a thriving field – forgive me for implying that it wasn't.

I was (badly) getting at the fact that back then, as a function of the totality of knowledge we had, discovering a new knot could be quite transformational – whereas now it's just one of many professional fields of modern research. Not implying it was then, or now, merely a hobby.

Agree with the other commenter - this is very charming! I find it a wonderfully romantic idea to contemplate that, at some point in human past, studying and developing new knots (or even stumbling upon new knots and sharing that idea) would have been a realistic endeavour that expanded the boundary of human knowledge and gave us newer or safer ways of building and achieving things.

Nice site, but I'm really missing any altitude reference for the satellites. It's hard to use any satellite tracker with any degree of utility other than as a toy website when it's exceedingly difficult to determine and compare basic altitude information across different satellites.

Possibly a separate concern, but I have some degree of confidence that the requirements and oversight of the CA/B forum (or whomever else determines which root certs go into bundles) are sufficiently strict, and issuers kept under sufficient scrutiny, that I tend to trust those more than I trust myself to secure my own root CA keys adequately. The ideal would be for people setting up their own PKI to ensure their root uses the Name Constraints extension, but the default “can sign anything for any host” I fear makes it easy for people to install their own self-pwn device, and probably left the private key lying around on a box exposed to the Internet.

* with some notable root certs that I have… questionable… trust and confidence are not simply controlled by certain state actors.

The article lets itself down when it reveals it's had some marketing "polish" added: "where certain resources (like an AI model instance) are stored"

They could have picked something far more concrete (for Cloudflare's business and the type of services they deploy) than "AI model" there, which is clearly picked just to make it seem 'current' and on-trend.

I’ve consciously not used Fable because I want some usage allowance to remain for the rest of the week. The 2x billing is just too aggressive for me when I tried it (max x20 plan user currently).

I believe some Tube stock uses wheel revolution counters to track where the train is and trigger announcements, although a lot of signalling will be going over to using balises to tell the trains where they are (if not already) and to provide supervision.

If trains were made cheaper, some of them would become extremely unpleasant to use.

Yes, it is a fact of modern life that one reason there's no political will to reduce ticket prices is that it's an effective pricing mechanism for limiting demand or pushing travellers to other modes of transport to avoid further overcrowding – as perverse as that sounds for a rail network.

This information is derived from open signalling data, which the signalling system _has_ to track to operate trains safely and identify their locations.

The reality is the illusion of pinpoint accuracy is a figment of this site's imagination; this site is using some creative license to guess the precise location of trains.

There's no way its input data is anywhere near adequate for the rate the position indicators refresh, so it's taking some base data and then just... guessing the rest.

Not affiliated with the site, but it's almost certainly just the Train Describer feed from Network Rail to observe headcodes stepping through berths, and then doing some proprietary interpolation within berths to guess where the trains are, probably using fairly coarse inputs like train class, rolling stock type and line speed. It's possible it's not even doing that, and they have just built a model that observes typical passage times between berths and they average that out.

TRUST (reporting system that describes train movements as they've happened) does accept updates by means other than the Train Describer, which might include GPS if the unit is equipped, and in many areas is dependent on signallers making manual reports (which may not be made immediately). They might also use TRUST as a data source, especially in non-Track Circuit Block areas. The rate of GPS updates is not going to be anywhere near as frequent as those train position indicators that appear to move here in "real time" across the map, so however they combine data sources, their site is trying to be clever in guessing train location.

It goes without saying: this sort of map is highly likely to be wildly inaccurate and isn't useful for anything safety-critical.

It's probably a static feed, and they've probably had to do some lifting to define the layout and map that to the raw data they get from Network Rail, and they've probably not updated it for newly opened stations. There is a station near me that's been open for many years that isn't shown there either.

There are many different alphabet-soup coding systems used across Network Rail, retailing systems, and the wider railway industry to identify locations on the network. Station names will often be different in different databases; look at any station with an apostrophe in and you'll find it inconsistently named in different places.

I wonder how far apart railway signals usually are

It varies substantially across the network, dependent on the mode of operation of the signalling, the desired headway, the maximum operating speed, the service braking distance of the rolling stock at line speed, factors in the layout that might influence safety (e.g. junctions), the number of colour lights used on signal heads (i.e. 2, 3 or 4 colour lights), signal sighting distance, whether signal visibility might be affected by sun glare, etc. And of course this assumes that the area is actually using line-side signals – most of the network does, but there's notable exceptions using in-cab signalling or computer-based train control.

suggests the data mostly comes from railway signalling information, plus a bit of "AI" in some way

I'm in no way affiliated with the website, but in areas that follow track circuit block principles (much of the heavily-used main GB railway network, excluding many more lightly-used outlying lines), the "signalling information" that article indicates the site derives from is almost certainly Network Rail's Train Describer (TD) feed. This feed reports the headcodes for signalling berths across the layout. The signalling system will normally step headcodes automatically as the train activates successive track circuits or operates axle counters in the track.

The Train Describer can only report headcodes in berths, and berths might be quite long! It certainly doesn't provide second-by-second train progress, so this site's mapping engine is likely doing some proprietary interpolation to make the train position indicators appear to "move" in real time to give the illusion of trains making progress. (Whatever the inputs to their algorithm/model are, their calling it "AI" loses all technical specificity.) This interpolation may be based on line speed, perhaps the observed average time a headcode normally remains in a given berth, allowing them to derive a typical 'average speed' for that berth or section.

If it was me designing this, I'd expect a mixture of the train class, the rolling stock and line speed to give a good estimator of the train's current position in block. You then have to make a product decision to decide what to do if you miscalculated train position – do you make staccato jumps of the train position indicators on the map if you got it wrong, or do you somehow try to smooth your error out over another period to avoid indicators suddenly moving?

In other areas of the country, train position may be reported by GPS on equipped units, or in some areas, the passage of trains is dependent on manual reports by the signaller, so the map may not have much real-time data to infer train position from. I find it highly unlikely that they're deriving much accurate data in real time from smartphone apps, but it could be a (noisy, incomplete) set of inputs to improve their model of how trains typically make progress through particular berths.

Thanks for following up! I had another play and I see what you mean about par, makes sense.

It would be great if the 4r perhaps isn't introduced until the game gets into the later stages of editing buffers – I think that would avoid repetitively introducing the same ideas before they can really be used.

Nice work though and nice idea.

Neat, but the (presumably AI-generated) provenance of this means it has regrettable gaps and errors:

On "There and back", it says par is 6 – it's solvable in 4.

On "Rush hour", it describes an invalid motion 'r': "type a number first to repeat a command, e.g. 3j or 4r"

It isn't clear why certain motions are being introduced where they aren't relevant, and therefore aren't going to be immediately practised at point of introduction – "Rush hour" introduces gg to go home, but then doesn't need it.

If I'm going to use something to practice and hone my vim motion, I'm going to need it to be an accurate resource. I closed it at this point.

Or the supermarkets who replaced checkouts with customer self-service under the guise of convenience, and now subject us to more surveillance capitalism to try to protect their losses given people don’t feel so bad about stealing from a machine than a human.

Yeah, they exist. I’ve also been to places where they take your order in the conventional way, but then allow you to scan a QR code to pay and go.

Sure, the process of asking for the bill and doing the dance where you check it, they come back with the card machine etc. can be mightily inconvenient especially if you’re in a rush. But I can just walk up to someone and pay there and then.

Whenever I’ve tried to use them, these QR code payment flows normally try to charge me, the patron, a service fee for the convenience, so I’ve never actually gone through with it.

engineers are focusing on the monetary value

A friend of mine passionately believes engineers need an equivalent of the Hippocratic Oath to guide our morals and principles about what we should and shouldn’t build.

At least in the UK, Sonder also wasn’t cheap and some of their properties left a bit to be desired. Plus there were often people (staff) sat in the reception anyway, so I don’t really understand what they were doing or there for, or where the supposed benefit of their no-reception model comes from.

I’d far rather speak to a real person and have some interaction when I’m travelling than mindlessly do everything through my phone and an app. I actively seek that. What we perceive as “the future” in terms of our phones as the interface undoes the basic social fabric that has developed over thousands of years. I’ve had some of the best conversations with random hotel receptionists - and isn’t it these secondary connections over the course of our days with people we’re unlikely to meet or socialise with again that can really help us feel better connected to society?

I thought parliamentary elections in UK worked like in most of Europe: you vote for a party, not a candidate.

They are. It's a parliamentary system, not a presidential system. Nobody votes directly for who will become PM, who is ultimately selected by the monarch as the person who can best command a majority of the House of Commons – normally the leader of the biggest party, of course, but not necessarily. Perpetuating this view is frustrating because it's not what the system is designed for, and I feel a common misconception among voters that they are "electing the PM".

With the increasing breaking of two-party politics, it would not surprise me if we see this precedent of the monarch choosing a PM who can command a majority tested in close outcomes in future GEs where no party gains an overall majority. I'll be particularly interested to see how the press describes such an outcome, if it occurs, especially if the result is that the party with the most votes doesn't go on to join such a coalition.

Nevertheless, it frustrates me when these changes are described as "undemocratic", as that's a common talking point perpetuated by a poor understanding of the constitutional basis of UK elections. If there is a desire that the PM should be directly elected, that would mean a substantial rewiring of the UK constitution more broadly.

Fascinating. Also fascinating to see the relative importance they attribute to wildly different geographic abstractions – US/Canada/Australia called out, meanwhile Europe and Asia bucketed together, despite those being the more instructive studies for how to operate mass transit given how well-developed it is in some of their major cities. I'd love to have seen more granular data for those two continents as I suspect it will reveal interesting trends and reasons for fare capture that this analysis doesn't identify.

His idea is to turn hub-and-spoke transit, in which most lines go downtown, into a grid so that people can get anywhere in the region with just one change of bus

Anyone who has played any simulation of building mass transit systems (e.g. see the game "Mini Metro") knows it's far more efficient if the system is designed such that any origin-destination pair can be reached with only a single change.