<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Hacker News: amichal</title><link>https://news.ycombinator.com/user?id=amichal</link><description>Hacker News RSS</description><docs>https://hnrss.org/</docs><generator>hnrss v2.1.1</generator><lastBuildDate>Fri, 19 Jun 2026 23:12:34 +0000</lastBuildDate><atom:link href="https://hnrss.org/user?id=amichal" rel="self" type="application/rss+xml"></atom:link><item><title><![CDATA[New comment by amichal in "Claude Fable is relentlessly proactive"]]></title><description><![CDATA[
<p>Do we care that the bug here was a horizontal scrollbar showing and the fix after all this insane tool writing was to add a very obvious overflow-x: hidden to the element?<p>We dont mind because its so fast a writing these tools and tricks but step back and if a human tool took this path i would seriously question thief gras of fundamentals.</p>
]]></description><pubDate>Fri, 12 Jun 2026 06:26:10 +0000</pubDate><link>https://news.ycombinator.com/item?id=48500589</link><dc:creator>amichal</dc:creator><comments>https://news.ycombinator.com/item?id=48500589</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48500589</guid></item><item><title><![CDATA[New comment by amichal in "FSF trying to contact Google about spammer sending 10k+ mails from Gmail account"]]></title><description><![CDATA[
<p>Edit: <a href="https://www.twilio.com/en-us/blog/insights/leveraging-gmail-feedback-loop-identifiers" rel="nofollow">https://www.twilio.com/en-us/blog/insights/leveraging-gmail-...</a><p>Shows you how to use googles thing if you are a sender to know if @gmail folks are reporting you. It doesnt address what to do if someone's @gmail is doing this to you (a workspace custom domain yes)... @gmail are rate-limited to a few 1000s per day per gmail address but this is still a lot obviously</p>
]]></description><pubDate>Thu, 16 Apr 2026 12:38:37 +0000</pubDate><link>https://news.ycombinator.com/item?id=47792125</link><dc:creator>amichal</dc:creator><comments>https://news.ycombinator.com/item?id=47792125</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47792125</guid></item><item><title><![CDATA[New comment by amichal in "FSF trying to contact Google about spammer sending 10k+ mails from Gmail account"]]></title><description><![CDATA[
<p>I did some tiny digging because I remembered that there is a way to report individual messages in a structured machine readable way to abuse@ for these things --- i suspect that this is technically supported by gmail (if not given a lot of signal weight)<p><a href="https://en.wikipedia.org/wiki/Abuse_Reporting_Format" rel="nofollow">https://en.wikipedia.org/wiki/Abuse_Reporting_Format</a><p>How to bulk do this is interesting too. <a href="https://en.wikipedia.org/wiki/Feedback_loop_(email)" rel="nofollow">https://en.wikipedia.org/wiki/Feedback_loop_(email)</a> says that gmail has a bulk format and that sendgrid is seeing some success.<p>Not defending just trying to see what a technical solution looks like</p>
]]></description><pubDate>Thu, 16 Apr 2026 12:27:41 +0000</pubDate><link>https://news.ycombinator.com/item?id=47792001</link><dc:creator>amichal</dc:creator><comments>https://news.ycombinator.com/item?id=47792001</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47792001</guid></item><item><title><![CDATA[New comment by amichal in "Chess in SQL"]]></title><description><![CDATA[
<p>PostgresSQL<p>"crosstab ( source_sql text, category_sql text ) → setof record"<p><a href="https://www.postgresql.org/docs/current/tablefunc.html" rel="nofollow">https://www.postgresql.org/docs/current/tablefunc.html</a><p>VIA <a href="https://www.beekeeperstudio.io/blog/how-to-pivot-in-postgresql/" rel="nofollow">https://www.beekeeperstudio.io/blog/how-to-pivot-in-postgres...</a> as a current googlable reference/guide</p>
]]></description><pubDate>Wed, 01 Apr 2026 11:58:35 +0000</pubDate><link>https://news.ycombinator.com/item?id=47599656</link><dc:creator>amichal</dc:creator><comments>https://news.ycombinator.com/item?id=47599656</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47599656</guid></item><item><title><![CDATA[New comment by amichal in "Claude Code's source code has been leaked via a map file in their NPM registry"]]></title><description><![CDATA[
<p>If this code is real and complete then there are no callers of those methods other than a logger line</p>
]]></description><pubDate>Tue, 31 Mar 2026 16:31:57 +0000</pubDate><link>https://news.ycombinator.com/item?id=47589888</link><dc:creator>amichal</dc:creator><comments>https://news.ycombinator.com/item?id=47589888</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47589888</guid></item><item><title><![CDATA[New comment by amichal in "Caxlsx: Ruby gem for xlsx generation with charts, images, schema validation"]]></title><description><![CDATA[
<p>Good memories of the open source world. I couldn't find my commits in either repo and i'm afraid i might have been shy to upstream them and just did them in a fork. it was tiny, There was some issue in some less number formatting variation involving currencies in multiple locales. we needed xlsx for its ability to do some nice formatting etc but i really wanted to have a need for things like generating charts, embedding scripts etc just for the sheer nerdiness</p>
]]></description><pubDate>Tue, 10 Mar 2026 14:48:11 +0000</pubDate><link>https://news.ycombinator.com/item?id=47324025</link><dc:creator>amichal</dc:creator><comments>https://news.ycombinator.com/item?id=47324025</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47324025</guid></item><item><title><![CDATA[New comment by amichal in "Ireland rolls out basic income scheme for artists"]]></title><description><![CDATA[
<p>I wonder, can we not turn all threads into a "when will AI do this creative thing better than humans".<p>Humans need basic income (or at least resources) and to have culturally valuable work to do. Art and craft esp as a form of human expression seems like we should ASSUME that humans want to do this, that we as a society value the human energy that goes into it.</p>
]]></description><pubDate>Thu, 12 Feb 2026 14:16:04 +0000</pubDate><link>https://news.ycombinator.com/item?id=46989104</link><dc:creator>amichal</dc:creator><comments>https://news.ycombinator.com/item?id=46989104</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46989104</guid></item><item><title><![CDATA[New comment by amichal in "Show HN: Minimal NIST/OWASP-compliant auth implementation for Cloudflare Workers"]]></title><description><![CDATA[
<p>I would love to see alternatives of educational code that implements these things in a "compliant" way.<p>Security does not come from Compliance (sometimes they are at odds) but as someone who is not an academically trained security professional but who has read NIST* in detail, implements such code and has passed a number of code reviews from security professionals. <i>And</i> who has been asked to do things like STRIDE risk assessment on products I write code for I do appreciate the references and links along side actual code of any kind.<p>Now to be fair, I have not yet looked at any of the code here, it's commit history or its level of AI-induced fantasy confidence in the validity of the specific solutions. That could be good or bad but the intent of this is really on point for me.<p>Edit: I looked at some code:<p>This is missing a lot from NIST SP 800-63B<p>Looking at <a href="https://github.com/vhscom/private-landing/blob/main/packages/core/src/auth/services/account-service.ts" rel="nofollow">https://github.com/vhscom/private-landing/blob/main/packages...</a><p><pre><code>    - the db select runs before the password has so you can detect if the account exists with timing attacks
    - there is no enforced minimum nor maximum length on the stored secret (e..g para 5.1.1.1 and 5.1.1.2 recommend length range of 8 to 64 unicode printable chars normalized to some form i forget)

    - there is no enforced min max length on the account identifier (in this case email) and no normalization
</code></pre>
At least not in the code i saw. so there is still a lot of basics/low hanging fruit from NIST recommendations at least you would find in any production grade auth framework missing</p>
]]></description><pubDate>Mon, 09 Feb 2026 14:02:38 +0000</pubDate><link>https://news.ycombinator.com/item?id=46945300</link><dc:creator>amichal</dc:creator><comments>https://news.ycombinator.com/item?id=46945300</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46945300</guid></item><item><title><![CDATA[New comment by amichal in "When internal hostnames are leaked to the clown"]]></title><description><![CDATA[
<p>Marginally better for sure but in this case the path would also have been "leaked" to the sentry instance owned by developers of the the NAS device phoning home. This can happen in zillions of ways and is a good reason to use relatively opaque urls in generally and not "friendly ids" and generally being careful abou putting secrets in URLs.</p>
]]></description><pubDate>Thu, 05 Feb 2026 16:50:59 +0000</pubDate><link>https://news.ycombinator.com/item?id=46901647</link><dc:creator>amichal</dc:creator><comments>https://news.ycombinator.com/item?id=46901647</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46901647</guid></item><item><title><![CDATA[New comment by amichal in "We architected an edge caching layer to eliminate cold starts"]]></title><description><![CDATA[
<p>Yeah, as a salty greybeard i tried to tell our FE tech-lead to  just render the proper HTTP Cache-Control headers in the Next.js site we recently built. He tried and then linked me to <a href="https://nextjs.org/docs/app/guides/caching" rel="nofollow">https://nextjs.org/docs/app/guides/caching</a> and various version of their docs on when you can and cannot set Cache-Control headers (e.g. <a href="https://nextjs.org/docs/app/api-reference/config/next-config-js/headers#cache-control" rel="nofollow">https://nextjs.org/docs/app/api-reference/config/next-config...</a>) and I got several hours of head-ache before calling it a problem for another day. That site is not high traffic enough to care but this is not the first time that i've gotten the "not the Next.js way" talk and was not happy.<p>I obviously can be done but clearly is not the intended solution which really bothers me</p>
]]></description><pubDate>Mon, 15 Dec 2025 23:11:37 +0000</pubDate><link>https://news.ycombinator.com/item?id=46282229</link><dc:creator>amichal</dc:creator><comments>https://news.ycombinator.com/item?id=46282229</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46282229</guid></item><item><title><![CDATA[New comment by amichal in "We architected an edge caching layer to eliminate cold starts"]]></title><description><![CDATA[
<p>this too...</p>
]]></description><pubDate>Mon, 15 Dec 2025 20:30:51 +0000</pubDate><link>https://news.ycombinator.com/item?id=46280163</link><dc:creator>amichal</dc:creator><comments>https://news.ycombinator.com/item?id=46280163</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46280163</guid></item><item><title><![CDATA[New comment by amichal in "We architected an edge caching layer to eliminate cold starts"]]></title><description><![CDATA[
<p>I feel the same, 72 million monthly page views is about 8 pages per second even if in a single timezone (72e6 / 8h * 30d * 3600h/s) - even with today's heavy weight pages we are talking under well under 1000 req/s. Assuming they are not super image/asset heavy i would expect this to comfortably be served by a couple of reasonable old school ngnix servers[1]. If each page was a full megabyte of uncached content we are < 10Gbits/sec. Probably under 1<p>The build logic to decide which things to rebuild of course is probably the interesting bits but we dont need all these services... </grey-beard-rant><p>[1] <a href="https://openbenchmarking.org/test/pts/nginx&eval=c18b8feaeca6235b318667a0c1159c7eb54ce634#metrics" rel="nofollow">https://openbenchmarking.org/test/pts/nginx&eval=c18b8feaeca...</a><p>edit: to be less ranty they are more or less building static sites out of their Next.js codebase but on-demand updated etc which is indeed interesting but none of this needs cloudflare/hyerscaler tech<p>Not sure how many customers/sites they have. Perhaps they don't want to spend CPU regenerating all sites on every deployment? They do describe a content-driven pre-warmer but I'm still unclear why this couldn't be a content-driven static site generator running on some build machine</p>
]]></description><pubDate>Mon, 15 Dec 2025 20:18:54 +0000</pubDate><link>https://news.ycombinator.com/item?id=46279981</link><dc:creator>amichal</dc:creator><comments>https://news.ycombinator.com/item?id=46279981</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46279981</guid></item><item><title><![CDATA[New comment by amichal in "Doom song on the Oldest Digital Computer in America [video]"]]></title><description><![CDATA[
<p>Does it? I watched this video and the explanation of how they (mostly Bill in Vermont) did it had barely enough room for the song data. I think the line graphics might have been some good story telling</p>
]]></description><pubDate>Thu, 15 May 2025 11:16:18 +0000</pubDate><link>https://news.ycombinator.com/item?id=43993815</link><dc:creator>amichal</dc:creator><comments>https://news.ycombinator.com/item?id=43993815</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43993815</guid></item><item><title><![CDATA[New comment by amichal in "Debugging Lotus 1-2-3 by fax"]]></title><description><![CDATA[
<p>One of my first legit independent contractor jobs was a background job for coldfusion-based website that needed to get partners to update their data periodically. The business had figured out that their building supply partners were more responsive to faxes than emails and had a desktop window machine with a fax-modem used for that. A quick "micro-service" in  classic asp to bridge the website to the desktop machine and they made it through the last few years of common usage of faxing for these kinds of things.</p>
]]></description><pubDate>Mon, 31 Mar 2025 17:27:32 +0000</pubDate><link>https://news.ycombinator.com/item?id=43537494</link><dc:creator>amichal</dc:creator><comments>https://news.ycombinator.com/item?id=43537494</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43537494</guid></item><item><title><![CDATA[New comment by amichal in "ToS;DR"]]></title><description><![CDATA[
<p>Does a good job of showing how completely unparsable ToS are:<p><a href="https://tosdr.org/en/service/1448" rel="nofollow">https://tosdr.org/en/service/1448</a> says both:<p>"You maintain ownership of your data: This service does not claim ownership over user-generated content or materials, and the user * doesn't need to waive any moral rights* by posting owned content."<p>and<p>"You waive your moral rights"<p>Edit: I have no energy for figuring out which of these statements is more true.</p>
]]></description><pubDate>Mon, 31 Mar 2025 10:53:32 +0000</pubDate><link>https://news.ycombinator.com/item?id=43533465</link><dc:creator>amichal</dc:creator><comments>https://news.ycombinator.com/item?id=43533465</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43533465</guid></item><item><title><![CDATA[New comment by amichal in "English Multinyms"]]></title><description><![CDATA[
<p>Yeah, not a candidate for the list. I thought it wasn't because the list was about > 2 different spellings that sound "identical" but mean different things.<p>I agree with you and when I (a non-linguist) first learned about this it did occur to me that there was probably some infinite recursive version and it took *some* of the fun out of it. Its' still fun as is this list.<p>I also suspect there are lots of good examples of whatever a word with multiple meanings with different parts of speech is called. So it should be possible to find...use many "Buffalo buffalo buffalo..."</p>
]]></description><pubDate>Tue, 18 Mar 2025 13:07:37 +0000</pubDate><link>https://news.ycombinator.com/item?id=43398995</link><dc:creator>amichal</dc:creator><comments>https://news.ycombinator.com/item?id=43398995</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43398995</guid></item><item><title><![CDATA[New comment by amichal in "Court filing: DOGE aide broke Treasury policy by emailing unencrypted database"]]></title><description><![CDATA[
<p>"database" in legal/business speak (AFAIK) is the more general "organized collection of data" - not the more software engineer focused relational/object/graph- implementations of such.</p>
]]></description><pubDate>Tue, 18 Mar 2025 13:01:24 +0000</pubDate><link>https://news.ycombinator.com/item?id=43398935</link><dc:creator>amichal</dc:creator><comments>https://news.ycombinator.com/item?id=43398935</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43398935</guid></item><item><title><![CDATA[New comment by amichal in "English Multinyms"]]></title><description><![CDATA[
<p>This reminds me of <a href="https://en.wikipedia.org/wiki/Buffalo_buffalo_Buffalo_buffalo_buffalo_buffalo_Buffalo_buffalo" rel="nofollow">https://en.wikipedia.org/wiki/Buffalo_buffalo_Buffalo_buffal...</a><p>Edit: It's not on the list because its using multiple meanings of the same spelling...</p>
]]></description><pubDate>Tue, 18 Mar 2025 12:40:54 +0000</pubDate><link>https://news.ycombinator.com/item?id=43398718</link><dc:creator>amichal</dc:creator><comments>https://news.ycombinator.com/item?id=43398718</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=43398718</guid></item><item><title><![CDATA[New comment by amichal in "Rails is better low code than low code"]]></title><description><![CDATA[
<p>Wasn't fintech but was fin something. Several weeks into trying to port a Excel workbook with a zillion tabs, some VBscript from stackoverflow and other nastiness and being unable to replicate the results. I discovered the "consultant" who help them create this insane thing had turned on the "allow circular references"[1] option and choosen a number of iterations that "Seemed to make it work"<p>Yay! for non-deterministic financial modeling.<p>Also was really fun trying to explain to the folks who hired me why I couldnt get the results they wanted to see.<p>[1] <a href="https://support.microsoft.com/en-us/office/remove-or-allow-a-circular-reference-in-excel-8540bd0f-6e97-4483-bcf7-1b49cd50d123" rel="nofollow">https://support.microsoft.com/en-us/office/remove-or-allow-a...</a></p>
]]></description><pubDate>Mon, 02 Dec 2024 12:26:09 +0000</pubDate><link>https://news.ycombinator.com/item?id=42295512</link><dc:creator>amichal</dc:creator><comments>https://news.ycombinator.com/item?id=42295512</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=42295512</guid></item><item><title><![CDATA[New comment by amichal in "Show HN: I built a(nother) house optimized for LAN parties"]]></title><description><![CDATA[
<p><a href="https://datatracker.ietf.org/doc/html/rfc3927" rel="nofollow">https://datatracker.ietf.org/doc/html/rfc3927</a><p>"Microsoft Windows 98 (and later) and Mac OS 8.5 (and later) already support this capability."<p>And <a href="https://www.techrepublic.com/forums/discussions/win-98-fails-to-get-ip-from-dhcp/" rel="nofollow">https://www.techrepublic.com/forums/discussions/win-98-fails...</a></p>
]]></description><pubDate>Sun, 17 Nov 2024 15:28:16 +0000</pubDate><link>https://news.ycombinator.com/item?id=42164663</link><dc:creator>amichal</dc:creator><comments>https://news.ycombinator.com/item?id=42164663</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=42164663</guid></item></channel></rss>