alexvitkov

il y a 11 moisdiscuss

API/SSH keys can easily be swapped, it's more hassle than it's worth. Be glad they didn't choose to spread the payload of one of the 100 ransomware groups with affiliate programs.

alexvitkov

il y a 11 moisdiscuss

Most language users will follow the "spirit" of the language - e.g. Bill is against package managers, people who use his language mostly agree with his ideas, and there's not a huge standard Odin package manager.

I rather appreciate that C and C++ don't have a default package manager that took over - yes, integrating libraries is a bit more difficult, but we also have a lot of small, self-contained libraries that just "do the thing" without pulling in a library that does colored text for logging, which pulls in tokio, which pulls in mio, which pulls in wasi, which pulls in serde, which is insane.

alexvitkov

il y a 11 moisdiscuss

"Vendoring step" You cannot make this shit up.

You're providing a library. That library has dependencies (although it shouldn't). You've written that library to work against a specific version of those dependencies. Vendoring these dependencies means shipping them with your library, and not relying on your user, or even worse, their package manager to provide said dependencies.

I don't know what industry you work in, who the regulatory body that certifies your code is, or what their procedures are, but if they're not certifying the "random library repos" that are part of your code, I pray I never have to interact with your code.

alexvitkov

il y a 11 moisdiscuss

No, I did not suggest that, in fact in the very comment you're replying to I said:

  My point was not that running all that on one computer is a great idea...

Regardless, if you want to strawman my passing remark, I'm happy to defend it.

Let's even say my numbers are wildly wrong, and they're processing 100x more transactions than what I claimed (which was already an overestimate). Tell me why you can't process 1600 transactions per second on one computer, especially for a country the size of the UK, where you would expect a ~15ms ping when talking to a server on the other side of the country.

alexvitkov

il y a 11 moisdiscuss

> If I am providing (lets say) a library that provides some high level features for a car ADAS system on top of a CAN network with a proprietary library as driver and interface.

If you're writing an ADAS system, and you have a "dependency tree" that needs to be "resolved" by a package manager, you should be fired immediately.

Any software that has lives riding on it, if it has dependencies, must be certified against a specific version of them, that should 100% of the time, without exceptions, must be vendored with the software.

> It is a guarantee of pain and ABI madness for anybody having to deal with the integration of your blob later on.

The exact opposite. Vendoring is the ONLY way to prevent the ABI madness of "v1.3.1 of libfoo exports libfoo_a but not libfoo_b, and v1.3.2 exports libfoo_b but not libfoo_c, and in 1.3.2 libfoo_b takes in a pointer to a struct that has a different layout."

If you MUST have libfoo (which you don't), you link your version of libfoo into your blob and you never expose any libfoo symbols in your library's blob.

alexvitkov

il y a 11 moisdiscuss

If you're doing 10 million transactions per week (which is likely way more than what they're pulling) that's about 16 transactions processed per second. You can add inventory management, payroll management, you can run the company's email server, write all that in JavaScript, and you'll still have room to run a Minecraft server on the same laptop.

My point was not that running all that on one computer is a great idea, just that 40,000 servers for a CRUD application is way past what should be considered reasonable.

But even that's fine. I like computers, you can have 40,000 of them if you want, even if the only reason they exist is some guy's job security. However, you're insane if the guy keeping them running doesn't work for you.

alexvitkov

il y a 11 moisdiscuss

You're making your customer's life miserable by having dependencies. You're a library, your customer is using you to solve a specific problem. Write the code to solve that and be done with it.

In the game development sphere, there's plenty of giant middleware packages for audio playback, physics engines, renderers, and other problems that are 1000x more complex and more useful than any given npm package, and yet I somehow don't have to "manage a dependency tree" and "resolve peer dependency conflicts" when using them.

alexvitkov

il y a 11 moisdiscuss

Play stupid games, win stupid prizes.

If you need 40,000 servers to keep your business running (which you don't, your ~3-8 million weekly transactions can be processed on 1 computer, but whatever), hire people that will work on you, and whose paycheck depends on keeping those computers working, to keep those computers working.

Game theory arguments like "they wouldn't screw me over because other people won't want to do business with them" don't work when the other party is trying to maximize quarterly earnings, and their long-term thinking is in the order of ~2 years.

alexvitkov

il y a 11 moisdiscuss

> Every pixel and every function went through me. The AI translated what I asked for into code, but every decision was human.

You'll find that programmers are a lot less prickly when you use AI to generate code, than say artists are, when you use it to generate pictures. You don't have to defend yourself, it's OK to use it to make cool things that you couldn't otherwise.

You should be aware though that even though it may "feel like magic" when just getting started, there's an upper limit to the complexity of what you can build with AI-generated code - it's very low quality and will start falling apart once you stack a lot of it. For the same reason I wouldn't recommend using it as a learning resource, if you really want to get into programming.

alexvitkov

il y a 11 moisdiscuss

> how capabilities could be used to write simple scripts without sacrificing simplicity.

I proposed a solution for that in my original comment - you should be able to trivially bypass the capability system if you trust what you're running ($ yolo my_script.sh).

The existance of such a "yolo" command implies you're running in a shell with the "full capabilities" of your user, and that by default that shell launches child processes only a subset of those. "yolo" would then have to be a shell builtin, that overrides this behavior and launches the child process with the same caps as the shell itself.

alexvitkov

il y a 11 moisdiscuss

The idiotic statement is yours. If the "sometimes" is important to you, you can have it - you're not the first person on the internet to play word games.

But unless you can come up with a very detailed list of when it's acceptable "to lock people down and physically prevent them from harming themselves" and when it's not acceptable (it never is, it's a crazy statement), and I don't think you have such a list, your "sometimes" just means "whenever I, as the person writing the software judge", rendering it completely meaningless.

alexvitkov

il y a 11 moisdiscuss

No, not everything is a trade-off. Some things are just good and some are just bad.

A working permission system would be objectively good. By that I mean one where a program called "image-editor" can only access "~/.config/image-editor", and files that you "File > Open". And if you want to bypass that and give it full permissions, it can be as simple as `$ yolo image-editor` or `# echo /usr/bin/image-editor >> /etc/yololist`.

A permission system that protects /usr/bin and /root, while /home/alex, where all my stuff is is a free-for-all, is bad. I know about chroot and Linux namespaces, and SELinux, and QEMU. None of these are an acceptable way to to day-to-day computing, if you actually want to get work done.

alexvitkov

il y a 11 moisdiscuss

Please read again the sentence you just typed.

> We have to lock people down and physically prevent them from harming themselves.

You can apply this argument to literally anything, and taken to its logical conclusion, this is exactly what will happen.

alexvitkov

il y a 11 moisdiscuss

"Don't use the phone."

Let me just give up on banking and the proprietary 2FA app that my job requires. Guess we're going homeless to protest Google, boys.

alexvitkov

il y a 11 moisdiscuss

It's not illegal to not release your software on a platform. But the mobile market is so top-heavy on both the apps and the games side, that without a few key developers - Meta, ByteDance, Tencent, etc your union is dead in the water - and the top 1% of developers would very much like to more friction for new developers, not less.

alexvitkov

il y a 11 moisdiscuss

Too bad there is one.

https://en.wikipedia.org/wiki/Digital_Millennium_Copyright_A...

alexvitkov

il y a 12 moisdiscuss

Conspiracy: They're shutting it down so competitors' AI and search crawlers can't visit the links, but theirs can, since archiving efforts aside only they have the DB.

Given that it doesn't make money, it has zero value alive and at least epsilon value dead. Plus they don't need the links to work to collect metrics.

alexvitkov

il y a 12 moisdiscuss

Should I also change it on my mother's computer who doesn't speak English? We can also start distributing .bat files that change the system language along with our spreadsheets, for anyone who wants to open them. Maybe automate it with VBS, so it changes automatically when you open the spreadsheet. That's the solution.

alexvitkov

il y a 12 moisdiscuss

There's a very restrictive RAM usage limit on iOS and the tab crashes when you reach it.

alexvitkov

il y a 12 moisdiscuss

I wouldn't call using Bitcoin legitimately trying. Even in 2017 Monero existed, which solves both the fee and transaction time problems, and as an added bonus is way more private.

comments