suchar

2 maanden geledendiscuss

This is not privilege separation/sandboxing. Separate virtual machine for an agent with limited credentials is reasonably safe approach

suchar

9 maanden geledendiscuss

With remote development (vscode and remote extension in jetbrains with ssh to VM) performance is good with headless VM in UTM. Although it always (?) uses performance cores on Apple Silicon Macs, so battery drain is a problem

suchar

9 maanden geledendiscuss

In my case (although I have not yet flown with APP3) the ANC works great, however, transparency mode (and adaptive mode) have issue with a noise. In a silent room I hear quiet noise in transparency mode (not present in ANC nor in "Off") which wasn't present in APP1. I tried different tips

Also, transparency mode felt more "natural" in APP1 in comparison to APP3. Currently it feels like a downgrade from APP1 (unfortunately my pair of APP1 broke recently), because I used transparency a lot and it feels worse

suchar

vorig jaardiscuss

They need to keep KV cache to avoid prompt reprocessing, so they would need to move it to ram/nvme during longer api calls to use gpu for another request

suchar

2 jaar geledendiscuss

Could you point to some functionalities removed from dbt Core? I love dbt and use it where applicable but I have not yet encountered a loss of features upon upgrade yet - it would be useful to be aware what kind of features get removed

suchar

2 jaar geledendiscuss

I would imagine that good IDE integration would summarise each module/file/function and feed high-level project overview (best case: with business project description provided by the user) and during CoT process model would be able to ask about more details (specific file/class/function).

Humans work on abstractions and I see no reason to believe that models cannot do the same

suchar

2 jaar geledendiscuss

Sometimes you can avoid writing multiple queries with different filters by creating single parameterized query with conditions like:

    WHERE (name LIKE :name OR :name IS NULL)
      AND (city = :city OR :city IS NULL)
      AND ...

By no means it is perfect, but can save you from writing many different queries for different filters while being easy to optimize by db (:name and :city are known before query execution).

Still, I prefer explicit SQL in webservices/microservices/etc. the code and its logic is "irrelevant" - we care only about external effects: database content, result of a db query, calls to external services (db can be considered to be nothing more than an external service). And it's easier to understand what's going on when there is one less layer of abstraction (orm)

suchar

2 jaar geledendiscuss

For remote development there is Fleet from JetBrains which is still in preview but mostly works (year ago it had a lot of issues). Nonetheless, it still needs a lot of improvements (rendering performance IME is poor, some functionality is missing in comparison to full-fledged IDEs like IntelliJ)

There is also JetBrains Gateway which allows you to run IntelliJ/PyCharm/etc. remotely. I'm using it and it is very usable, however, there are occasional bugs which could be explained by synchronization issues

Btw. Vim should be very usable over ssh (especially with tmux and maybe iTerm2/other terminal integration with tmux' control mode - tmux panes are native windows, new terminal window/tab creates new tmux window/pane etc.). Why are you using VSCode over Vim for remote development?

suchar

2 jaar geledendiscuss

Tmux integration: tmux is running remotely in control mode and local iTerm2 is managing it. This way tmux panes and windows are mapped to native windows and iTerm2's split panes. Makes remote feel like a local machine

suchar

3 jaar geledendiscuss

Same here, but IMO, if company believes that such software is useful (and they wouldn't be using it if company believed otherwise), then why do they often (always?) include node_modules in exclusion rules? After all, node_modules usually contains a lot of untrusted code/executables

suchar

3 jaar geledendiscuss

I do not see license in either repository and it seems that this tool only has 30 day evaluation tier for free. Anyway, using this means that you have dependency on a single vendor and you accept their future pricing changes.

Now compare this with JSON ecosystem

suchar

3 jaar geledendiscuss

Some time ago I tried Retool and it does have "Query JSON with SQL": https://docs.retool.com/queries/guides/sql/query-json (it is somewhat relevant because it was extremely convenient)

It is somewhat similar to Linq in C# although SQL there is more standardised so I like it more. Also, it would be fantastic to have in-language support for querying raw collections with SQL. Even better: to be able to transparently store collections in Sqlite.

It is always sad to see code which takes some data from db/whatever and then does simple processing using loops/stream api. SQL is much higher level and more concise language for these use cases than Java/Kotlin/Python/JavaScript

suchar

3 jaar geledendiscuss

I'm not sure if there is any open source XSLT tool as complete as jq is for JSON. There is xsltproc but IIRC it does not support streaming scenarios (jq has some support for streaming processing)

Though, personally, I prefer JSON. Probably due to superior tools (thanks to its popularity) and less-bloated syntax (it is somewhat easier for me to read raw JSON file than raw XML file).

suchar

3 jaar geledendiscuss

For DigitalOcean (and several other providers) you can build your own image with provided configurations, e.g.: https://github.com/NixOS/nixpkgs/blob/master/nixos/modules/v...

(see `virtualisation` folder for other providers)

Then you can do something like:

    nix build .#nixosConfigurations.doImage.system.build.digitalOceanImage

And in the `result` directory you will have droplet image which can be uploaded to digital ocean as droplet template.

Its probably best to also create separate configuration only for the image. As a bonus, its already configured, so no need to run `nixos-rebuild switch` after droplet creation. Partitioning configuration is also handled by the builded, however, filesystem choice (and partitioning schema) is limited

(I'm not saying that this is easier than out of the box support for NixOS: IMO if you are even aware how to create custom NixOS image then you are probably somewhat experienced NixOS user)

suchar

3 jaar geledendiscuss

From my personal experience, the first example doesn't really happen: thankfully I rarely see people randomly throwing annotations at methods/classes hoping one of them will stick. For most of the time annotations are self-explanatory.

However, there are some real issues with annotations in Spring/Java: - Application will sometimes run just fine without annotation processor/interceptor. Think of `@EnableScheduling` in Spring: you won't know that `@Scheduled` is not working (because of missing `@EnableScheduling`) until you observe that method is not executed. In this case static code is a clear win. - Annotation order: not all annotation processors/interceptors in Spring support specifying order. Annotation order in the code doesn't matter: it is lost during compilation. Good luck figuring out what is applied first in a method with `@Retry`, `@Transactional` and `@Cached` - will retry be executed within transaction or each retry will have its own transaction? This also is easily solved with static code instead of annotations.

As for compile-time error vs runtime-error: personally I don't really care as long as there is any error (which is not always the case in the first example) during the build/test/init/assembly phase. When I'm writing SQL queries in the code, I'm getting SQL parsing/compilation errors during application runtime - but that's fine, because I've written SQL-s against DB execution engine. When I'm writing Spark SQL job, I'm getting errors during query planning phase - and that's also fine, because I'm writing code against Spark's execution engine. Writing annotations against "annotation execution engine" (annotation processor/interceptors) doesn't seem any different or wrong in principle. Although, there are things that could be improved.

Stacktraces: there are a few additional interceptor method calls in the stacktrace when annotations are in use, however, most of the complexity comes from library/framework structure and developer's familiarity with it. Spring covers a lot of use cases thus it has its share of complexity. I'm not sure if "Spring without annotations" would be noticeably easier to work with, although I assume that feature-parity with Spring (MVC) is not a goal of this project so it probably will be easier to understand.

suchar

3 jaar geledendiscuss

The main issue with Java-based projects (possibly using Spring) is the amount of existing resources: there are thousands/millions of example projects, code snippets, answers on StackOverflow etc. and majority of them is very old (as far as software development is considered). Even fresh resource are often using outdated techniques.

Modern Java is pretty good (although Kotlin is a bit cleaner IMO), but you should really use Spring documentation (if you are using Spring) and avoid code snippets from SO/Github.

suchar

3 jaar geledendiscuss

Yup, it's "funny" that even basic functionality doesn't work as expected: https://gitlab.com/gitlab-org/gitlab/-/issues/350662

I encounter this issue pretty often and it makes code review experience miserable. It's not blocking any work, but it is frustrating enough that for any new project I would try to avoid using Gitlab

suchar

3 jaar geledendiscuss

One major disadvantage of triggers is the inability to do canary deployments and vastly increased complexity of rolling deployments. When SQL code lives within the application, we can trivially run multiple variants of such code simultaneously. Running alternate version of a trigger for e.g. 10% of traffic is way harder.

What I would recommend instead is making use of CTE (Common Table Expression), because DML (modifying queries) inside `WITH` are allowed and taking leverage of `RETURNING` keyword in both `UPDATE` and `INSERT` we can execute multiple inter-dependent updates within single query.

With such approach we can trivially run multiple versions of an application in parallel (during deployment, for canary deployment etc.) and we have similar performance advantage of a single roundtrip to database. Additional advantage is the fact that there is only one statement which means that our query will see consistent database view (with very common read committed isolation level it is easy to introduce race conditions unless optimistic locking is used carefully).

suchar

3 jaar geledendiscuss

This is true for SSH key, but not for all data on MacOS, e.g. if you run `find ~/Library/Application Support/AddressBook` the OS will ask you if you want to give access to contacts to iTerm2/whatever (unless you have given it before). I'm not aware of a way to create additional sandboxed "folders".

Also, some applications on MacOS are sandboxed, IIRC Mail is one of them. Also, some (all?) applications installed from AppStore. That's the reason I prefer installing applications from AppStore: they seem to be at least somewhat sandboxed.

For development, I try as much as possible to leverage remote development via [JetBrains Gateway](https://www.jetbrains.com/remote-development/gateway/) and [JetBrains Fleet](https://www.jetbrains.com/fleet/). VSCode also has remote development but they explicitly assume that remote machine is trusted (in the security note in the remote extension plugin readme). In the case of JetBrains tools I have not seen any explicit declaration whether remote host is trusted (as in: if remote machine is pwnd then we may as well let pwn your personal machine), but at a glance it seems like there are minimal precautions (if you run web application and open it in a browser, the Gateway will ask if you want to be redirected to a browser etc.)

Probably best scenario for such remote development clients on MacOS would be to put them in AppStore: this way they could leverage sandboxing and in the case of thin client, the sandboxing likely won't limit functionality.

suchar

4 jaar geledendiscuss

Major benefit of Airflow is the number of already implemented integrations. Importing data from GCS to BigQuery, copying data from Postgres to GCS, KubernetesPodOperator and so on. IIUC with Temporal you get only workflow management which can be easily integrated with any application to implement business logic. And this is great, because implementing business workflow in Airflow is even more awful than the Airflow itself. But for any ETL or plumbing job Airflow is IMO better due to existing integrations.

Submissions

Ask HN: Development Environment Sandboxing on macOS

Application Isolation Using NixOS Containers

comments