Hacker Newsnew | past | comments | ask | show | jobs | submit | dralley's commentslogin

Do you think only the Israelis are pissed about the Iranians funding the Houthis and Hezbollah?

The Saudis were at war with the Houthis for several years, Hezbollah assassinate Lebanese politicians and repeatedly starts wars that nobody else in Lebanon wants, which also includes intervening in the Syrian civil war on behalf of Assad and starving out Syrian villages. Ask the Syrians how they feel about Hezbollah.


>No state-sponsored hacking affected Americans materially.

Uh, what?

NotPetya was kind of a big deal.


Not in the US. I had to look it up and I work in infrastructure software

That is unequivocally true with some things. You don't want people exercising their "self-determination" to own private nukes.

LLMs aren't nukes.

They're more like printing presses or engines. A great potential for production and destruction.

At their invention, I'm sure some people wanted to ensure only their friends got that kind of power too.

I wonder the world we would live in if they got their way.


An LLM that can hack anything is not as harmless as a printing press. Please stop pretending it is.

There's a simultaneous push coming from the government to support PQC, ASAP, so it's not just researchers pushing this.

Rust is nowhere close to Node in terms of package number bloat. Most Rust libraries are actually useful and nontrivial and the supply chain risk is not necessarily as high for the simple reason that many crates are split up into sub-crates.

For example, instead of having one library like "hashlib" that handles all different kinds of hashing algorithms, the most "official" Rust libraries are broken up into one for sha1, one for sha2, one for sha3, one for md5, one for the generic interfaces shared by all of them, etc... but all maintained by the same organization: https://github.com/rustcrypto/

Most crypto libraries do the same. Ripgrep split off aho-corastick and memchr, the regex crate has a separate pcre library, etc.

Maybe that bumps the numbers up if you need more than one algorithm, but predominantly it is still anti-bloat and has a purpose...


While i agree the exact line “rust libraries are useful and non-trivial” i have heard from all over the place as if the value of a library is how complex it is. The rust community has an elitist bent to it or a minority is very vocal.

Supply chain attacks are real for all package registries. The js ones had more todo with registry accounts getting hacked than the compromised libraries being bad or useless.


I am sensing a "is-odd" and "is-even" vibes from that approach.

Not at all.

Most programs only use one or a few hash functions, so grouping each family into a separate crate reduces compliation time for the majority of users. Could also help when auditing the removal of vulnerable hash functions.

As for ripgrep, the organization is quite sensible:

1. one crate to define an interface for regex matchers

2. one crate to implement the native matcher

3. one crate to implement the PCRE2 matcher

4. one crate to define a safe interface to the underlying PCRE2 library

Depending on the application, any one of 1+2+3+4, 1+2, 1+3+4, or 4 alone could be useful.


Yes I perfectly understand the reasoning and technically it is sound.

It becomes insane once you start thinking of real life implications, specifically supply chain attacks.

Although it's only marginally more insane than the other ecosystems.


The alternative is sometimes that people just copy and paste code from libraries that never gets updated.

You're not beating the "written by an LLM" allegations.

I write it myself, the agent only translates it into English.

This is against the hacker news guidelines[1]:

> Don't post generated comments or AI-edited comments. HN is for conversation between humans.

[1]: https://news.ycombinator.com/newsguidelines.html


>I think that's an unfair framing. No one is paying Waterfox to allow ads

...

>Yes, that's correct. Startpage is the default search partner, and their search ads aren't blocked by default.

The framing seems fair to me. Certainly not more unfair than those who criticize Firefox for having a search deal that defaults to Google while allowing the user to change it (which some people do)


The distinction I'm drawing is between a revenue share from a search partnership and something like an acceptable ads programme where individual advertisers pay to bypass the blocker - those are different things.

"For how it works in practice: by default, text ads will remain visible on our default search partner’s page - currently Startpage. The idea is that this is what will keep the lights on."

The perfect is the enemy of the good.


Hezbollah has assassinated multiple government leaders and politicians and administrators within Lebanon, including a bombing that killed 23 people including the Prime Minister, and shootings that killed investigators responsible for investigating the Beirut port explosion a few years ago. Suspiciously this was shortly after Hezbollah was found by those investigations to have many links to the circumstances in which so much ammonium nitrate was being stored improperly in the first place.

Hezbollah also assisted the Assad regime in Syria during the Syrian Civil war - participating in laying siege to entire villages for long enough that people starved to death.

https://www.amnesty.org/en/latest/press-release/2017/11/syri...

You are willfully ignorant. There is tremendous anger at Hezbollah even within Lebanon, especially since they restarted the war on Iran's behalf in recent weeks, giving Israel the causus belli to resume their bombing campaign against them.


Man that's crazy. Just to compare, how many have died from Israeli attacks on Lebanon?

Looking at Wikipedia, apparently 1000+ have been killed in Lebanon so far during this war. So it seems Israel has done 50x more harm. Interesting.


Same thing with Pulse Audio

People cursed the name for years, because it exposed all of the terrible, glitchy audio hardware drivers and refused on general principle to work around the issues to the degree that previous audio solutions had. And the result was that while the experience was inconsistent and buggy for years, it did eventually drag the Linux audio stack into a better place.


PulseAudio dragged linux to replacing that stinkin pile of garbage with PipeWire.


The argument that can be made is that we never would've gotten PipeWire without going through PulseAudio first.


We got the much superior jack two years before pulseaudio was even a thing.

Pulseaudio was a derail of Linux audio. We could have skipped it entirely.


Comparing JACK and PulseAudio is like comparing apples and oranges. And honestly, JACK by itself is unsuitable as an audio server for general desktop usage.

JACK doesn’t support device hotplug (ya know, connecting and disconnecting a headset, something most of us do) and it also doesn’t support multiple applications generating audio without the user having to configure how audio is mixed.

JACK is designed for low latency in environments like Digital Audio Workstations (DAW) where you know 1) what audio hardware is present at all times, and 2) what applications are going to generate audio.

Many people who use/used JACK ran a PulseAudio bridge on top of it for every application that wasn’t the one or two applications that needed ultra low latency audio.

PulseAudio had some major warts, but JACK wasn’t some panacea that did everything better.


It also used a large multiple more memory than Alsa + basically any existing plausible combo of mixer software on top of alsa. While doing nothing. For no clear reason. And chewed processor cycles, while doing nothing. Back when 50MB was a meaningful amount of memory, and most machines were still single-core.

It was plainly really poorly-architected, just looking at its resource use patterns made this obvious in a heartbeat.


It also introduced fun new audio bugs and indeterminate latency. Which still haven't gone away entirely in 2026. To such an extent that any time I have an audio issue, I reflexively `pkill -9 pulseaudio` and about 99% of the time the problem just vanishes.

On the first machine where I had pulseaudio foisted on me - an 800mhz single core Duron - pulseaudio used literally 20% of my CPU time...

...At idle. When no audio was playing...

...To do software audio mixing which my creative labs audio hardware was capable of doing better and for free.

When I filed an issue with the pulseaudio people, saying "hey, you're wasting 20% of my CPU time at idle when no audio is playing because you're ignoring the fact that I have superior hardware that can do audio mixing for free", they closed the issue saying that pulseaudio wasn't meant to be used in situations where you have dedicated hardware for audio mixing.


Pulseaudio was, is, and always will be trash.

The ALSA drivers for all the creative labs cards worked perfectly well. I never had any issues at all under ALSA, or under OSS before that.

I've had tons of issues with audio bugs once pulseaudio was introduced. To this day the most common solution to any audio issue I see is `pkill -9 pulseaudio`. And it solves the problem about 99% of the time.


It's a shame. In the late 2010s there was a lot of hope for Satya Nadella, but it seems like the organization has regressed back to the mean.


Which is sad because the CEO's job is not to focus on the individual body parts but to make sure that the whole system is strong, beautiful, and healthy.

They can afford people who would do better. Windows 11 is trash. Azure is trash. Onedrive is trash. Outlook is trashier than it has ever been before, but it's not quite trash yet. Word is trash. Excel is rapidly enshittifying. Copilot is hot flaming radioactive tar cancer.

Does microslop even have a single thing left that isn't either completely terrible or worse than it used to be a mere 5 years ago?


> Outlook is trashier than it has ever been before

Which one? There’s two now! Lol


Both. "New" outlook doesn't work with all of the add-ons and plug ins that "classic" outlook did. Both new and classic have copilot wedged into them. Classic has unasked for and unwanted Linkedin integrations that have to be turned off on a per-user basis, and it is patently clear that microslop has every intention of abandoning classic outlook the instant they believe that they can do so without severely alienating their userbase.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: