HN user
World's Smallest Photon.
Similar to how us vim users keep updating/rewriting our config.
What (or why) are those frequent config changes?
I use neovim and I can say I've migrated[1] to vim packages (from Pathogen) years ago, and I also git-clone a repo once every few years if I want LSP support for a language I haven't used before.
But I wouldn't call this "keep updating/rewriting".
[1]: By removing a line from my config, and then running `mv` once.
As far as I understand, everything ends up centralized to USA anyway (ICANN), who then tells everyone what TLDs are allowed or not.
The equivalent would be if I got carded every time I stepped out of my house just in case I might decide to buy alcohol later.
More like requiring ID verification in fridges just to be able to open them, because they might contain alcohol (probably followed by RFID stuff or something).
For one role we got ~70 applications and all CVs looked obviously AI-written.
Were those ~70 applications all of them, or were those ~70 applications the result of an AI filtering from a larger amount?
If the latter, are you sure your AI is not filtering out the hand-written CVs and giving you the ones that have been AI-assisted or AI-written (with or without "the usual AI signs")?
Don't forget:
* No relative imports.
* The `require` directives from the `go.mod` files of your dependencies are always ignored.
Those two combined, mean that there's no easy way to fork a dependency. It's doable, but some of the maintenance overhead could have been avoided.
We don't even get a `go mod tidy` flag that lets us say, "yes, I understand the risks, just copy any `replace` directives that you find in my dependencies". With a flag like that, even if the `replace` directive is still copied everywhere, at least it's automatically copied during a routine `go mod tidy` invocation.
They already have `// indirect` comments, so those could have a `// indirect, replaced by X` comment or something like that.
My recommendation for DNS - on servers - would be to install unbound locally and use that.
At least on Ubuntu 26.04, you can't easily bind Unbound on a WireGuard interface because of services dependency order, so the Unbound service errors during system boot because the WireGuard interface doesn't exist yet. And IIRC neither `ip-transparent` nor `interface-automatic` fixed it.
On Alpine Linux all this just works.
And when you don't need the Steam Deck for gaming anymore, it is still useful as a home server.
I don't know, if I didn't know Mullvad or GrapheneOS, and saw ad on TV, I'd probably check it out.
Or an ad about an ISP with IPv6 support, at the very least it would make me check if my current ISP finally added support, and consider options otherwise.
Or one about some new colocation service that happens to open near my location, you bet I'd check out their website and maybe even pay them a visit.
(I don't watch TV, but my point stands.)
I am sure ads can work on me, and the HN crowd, if I was targeted.
EU-based cloud, 100% sovereignty, AGPL code, colocation services included. Prepaid balance and SEPA direct debit supported.
[Read more]
If `docker` is already there, why even bother with `sudo` when you can just:
docker run --rm -it -v '/:/mnt' -u 'root' 'alpine' '/bin/sh' '-l'
If it helps, I didn't find anything wrong with your comment.
I appreciate the link and the info :)
Humans must not anthropomorphise AI systems.
Can someone explain why this is a bad thing, while at the same time it's a good thing to say stuff like "put a computer to sleep", "hibernate", "killing" processes, processes having "child" processes, "reaping", "what does the error say?", "touch", etc?
To me that's just language, and humans just using casual language.
A text input field for entering your command line(s), with a text log for the output, does indeed seem to be the crabs of software. Usually with some abstractions that allow you to write longer scripts[1] and just refer to them by a short name or alias, and compose those scripts together from your command prompt.
You could say it's the terminal[2] user interface.
1. Go, when I first saw code I wrote almost a decade ago still compiles and runs in Go, I decided to use Go for everything. There were some initial troubles when I started using it a decade ago, but now it's painless.
And fewer dependencies, and fewer vulnerabilities (if any at all, depending on your few dependencies).
Go is "only" a pain when you want to use your own copy of packages (because `replace` directives are always ignored everywhere except on the "root" package), and whenever you want to work with private Git repositories outside of the forges that have hardcoded config in the Go code (like GitHub) (because Go assumes there's an HTTPS server, and the only way to force it to use only SSH is with ugly workarounds AFAIK).
But despite this I still prefer it for personal projects because I can come back after not touching it for years, and the most I need to do is maybe update `golang.org/x/net` or something like that.
I'm also not impressed with a carrot disclosure that looks like this. Running a python script to compromise a locally hosted instance? Bruh, you have physical hardware and host shell access. That python script could be doing anything including running as root.
Show us the exploit hitting a remote server.
Watch out, their script works on HN too, as a proof here's me logging in to YOUR computer's root account (a bit more redacted for obvious reasons):
$ python3 ./poc/chain_alpha.py --target dangus > out.txt
$ grep Backdoor out.txt | sed -r 's@[^:]+$@ [REDACTED]@g'
[+] Backdoor admin created: [REDACTED]
$ grep IP out.txt | sed -r 's@[^:]+$@ [REDACTED]@g'
[+] IPv4 address for dangus: [REDACTED]
$ grep 'debug2: shell' out.txt
[+] debug2: shell request accepted on channel 0
$ tail -n12 out.txt
================================================================
[+] COMMAND EXECUTION CONFIRMED!
================================================================
Server-side output (received via SSH, with `set -x`):
+ id -u
0
+ id -g
0
================================================================
$ sha256 ./poc/chain_alpha.py
c10d28a5ff74646683953874b035ca6ba56742db2f95198b54e561523e1880d7 ./poc/chain_alpha.pyOut of curiosity, do you have (and want to share) stats about requests per second? It's always nice to know these things for future reference.
No worries if not :)
I think there was an SMBC comic about this topic, but I don't think I can find it, and the site doesn't exactly make it easy. I don't even remember if it was pre-2020 or not.
It was about how people would get a thing (a robot?) that would repeat whatever they said but in a more fancy way (or something along those lines), to make them sound smarter. Then the people would start depending on these robots to communicate at all, to the point their speech degrades and they start making unintelligible noises that the robots still translate into actual speech.
EDIT: Found it, from 2014: https://smbc-comics.com/index.php?id=3576
Years later: "The current measures are a step in the right direction, but we have found them insufficient. We are now requiring the use of this specific proprietary binary blob for any action related to the verification process. It will conveniently run as a daemon so its exposed API will be accessible to any application that needs to query it, and it will automatically update itself so you don't have to worry about it, just set it up once and forget about it."
It might also include some additional text like "we have decided to collaborate with systemd to integrate this proprietary binary blob, to maximize the reach and eliminating any pains in the setup process caused by the vibrant ecosystem of package managers, while at the same time avoiding disrupting the development process of the Linux kernel".
If I had to use AI with neovim I'd probably use https://github.com/ThePrimeagen/99 or one with a similar workflow.
Except instead of sending through post offices, it'd probably be through "runners" like on Mirror's Edge.
And even then, getting interviews is one thing, but getting offers is something completely different.
And there's also the advantage of having a current job, instead of an increasingly larger jobless gap that not only decreases your chances over time, but also contributes to the cycle of "less chance -> wider gap -> increased anxiety -> less chance".
Fumble the first few months due to a combination of a lack of interviewing practice, and of job postings that never intended to hire anyway or that are looking for someone that checks literally all their shopping list of boxes, all while still dragging you for a 4-8 journey, and suddenly your position is not that good anymore.
Not exactly a "news" site, but this is still an example site that you'd expect would have a feed:
Language is filled with those types of phrases, the one which bugs me once it was pointed out (even though I use it myself) is "to be honest...", which could carry the implication anything said without that qualifier may be dishonest.
Supernatural highlights this on S1E08, at 27:28. Dean was talking with someone and starts saying "the truth is" but the other person instantly cuts him off saying "you know who starts their sentences with 'the truth is'? Liars".
Thank you, I was going to say something like this. I've been reading all the comments here and thinking, "do ChatGPT/LeChat/etc even allow running CLIs from their web or mobile interfaces?".
I'll add one that's very common in HN: "Don't let perfect be the enemy of good."
Instantly closes the door to any thoughtful discussion.
Same.
Also I tend to do the "Don't recommend -> I don't like this video" for those that have the thumbnails with "that face" (you know, the YouTube Thumbnail Clickbait Face, I don't even know if there's an actual term for it).
When I actually enter a video, you have my attention by default and you'll get an instant dislike for:
- "Don't forget to like and subscribe."
- Showing those like and/or subscribe buttons on screen.
- If I get suspicious that you're padding video length, talking just for the sake of stalling.
And how do you get those residential IP addresses?
Well, you just need people to install your browser extension. Or your proprietary web browser. Or your mobile app. Or your nice MCP. Maybe get them to add your PPA repository so they automatically install your sneakily-overriden package the next time they upgrade their system.
Anything goes as long as your software has access to outgoing TCP port 443, which almost nobody blocks, so even if it's being run from within a Docker container or a VM it probably doesn't affect you.
Questions. I want to get into coding agents, so, out of curiosity: which one(s) did you use and how much money has it costed you? (Any metric is fine)
I wouldn't say without fear, since you're one typo away from executing a typo-squatted malicious package.
I do use it on CI/CD pipelines, but I wouldn't dare type uvx commands myself on a daily basis.
I'm just wondering if this strong hate applies to Google as well, is all.