<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Hacker News: charrondev</title><link>https://news.ycombinator.com/user?id=charrondev</link><description>Hacker News RSS</description><docs>https://hnrss.org/</docs><generator>hnrss v2.1.1</generator><lastBuildDate>Mon, 05 Oct 2026 05:05:44 +0000</lastBuildDate><atom:link href="https://hnrss.org/user?id=charrondev" rel="self" type="application/rss+xml"></atom:link><item><title><![CDATA[New comment by charrondev in "Omarchy: Any User Process Can Escalate to Root"]]></title><description><![CDATA[
<p>It’s not, but the grandparent does point out 1 major flaw with sudo being a typically command that goes through normal path discovery. It makes it easier to escalate from a compromised user account to a compromised root account, since the end user is likely to type the root password into a command that can be shadowed in their user space.</p>
]]></description><pubDate>Sun, 30 Aug 2026 17:19:09 +0000</pubDate><link>https://news.ycombinator.com/item?id=49500662</link><dc:creator>charrondev</dc:creator><comments>https://news.ycombinator.com/item?id=49500662</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49500662</guid></item><item><title><![CDATA[New comment by charrondev in "Our decision on Cursor following its acquisition by SpaceX"]]></title><description><![CDATA[
<p>I used cursor extensively both at work and for personal use. Its harness is pretty darn good but I basically never used OpenAI models in it.<p>The first party cursor models (initially composer and now grok-cursor) and price very competitively for their quality and have very generous usage limits included in the base plans, and then per token pricing afterwards.<p>Occasionally I’ve used some of the Anthropic models in it but found their cost massively outweighed the benefits for the type of usage we do.<p>I was using Sonnet 4.5 and 4.6 for a while but the newer models are a lot more expensive at the per-token pricing.</p>
]]></description><pubDate>Sat, 29 Aug 2026 02:12:54 +0000</pubDate><link>https://news.ycombinator.com/item?id=49486277</link><dc:creator>charrondev</dc:creator><comments>https://news.ycombinator.com/item?id=49486277</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49486277</guid></item><item><title><![CDATA[New comment by charrondev in "The August 17 outage"]]></title><description><![CDATA[
<p>There 100% is at least for things like secret scanning and message parsing.<p>Secret scanning needs to make sure my repo as a whole has no secrets. It’s not acceptable to have 1 commit introducing it and 1 removing it because the secret is still recoverable.<p>Every commit is also surely an entry in a database somewhere. I can navigate in GitHub directly to any individual commit so there is definitely some overhead of some type.</p>
]]></description><pubDate>Fri, 21 Aug 2026 00:28:48 +0000</pubDate><link>https://news.ycombinator.com/item?id=49382154</link><dc:creator>charrondev</dc:creator><comments>https://news.ycombinator.com/item?id=49382154</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49382154</guid></item><item><title><![CDATA[New comment by charrondev in "Show HN: I spent 2 years designing a mechanical Magic Keyboard"]]></title><description><![CDATA[
<p>I’m assuming it’s not possible for it to include a fingerprint sensor?<p>As much as I’d like a mechanical keyboard for my Mac that’s always the part that gets me. I end up using the one my Magic Keyboard 20+ times per workday.<p>Otherwise it looks beautiful.</p>
]]></description><pubDate>Thu, 06 Aug 2026 15:39:22 +0000</pubDate><link>https://news.ycombinator.com/item?id=49198168</link><dc:creator>charrondev</dc:creator><comments>https://news.ycombinator.com/item?id=49198168</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49198168</guid></item><item><title><![CDATA[New comment by charrondev in "VLC for Unity now supported on Linux"]]></title><description><![CDATA[
<p>I’ve actually noticed at least on iOS, the native app is really nice since the last update. It uses native system navigation and controls.</p>
]]></description><pubDate>Mon, 27 Jul 2026 22:40:51 +0000</pubDate><link>https://news.ycombinator.com/item?id=49076435</link><dc:creator>charrondev</dc:creator><comments>https://news.ycombinator.com/item?id=49076435</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49076435</guid></item><item><title><![CDATA[New comment by charrondev in "My thoughts on the Bun Rust rewrite"]]></title><description><![CDATA[
<p>It seems they’ve already done analysis over what unsafe usage they can get rid of after the port.<p><a href="https://bun.com/bun-unsafe-audit" rel="nofollow">https://bun.com/bun-unsafe-audit</a></p>
]]></description><pubDate>Fri, 10 Jul 2026 01:50:36 +0000</pubDate><link>https://news.ycombinator.com/item?id=48854822</link><dc:creator>charrondev</dc:creator><comments>https://news.ycombinator.com/item?id=48854822</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48854822</guid></item><item><title><![CDATA[New comment by charrondev in "Bun has an open PR adding shared-memory threads to JavaScriptCore"]]></title><description><![CDATA[
<p>I have some disagreement here. There are factors other than just code review to worry about when implementing changes, quite notably quality assurance.<p>It does not one any favours if your 10k LoC gets split in 5 changes that aren’t supposed to regress anything (but need to be validated not to) then 1 tiny on that brings things together.<p>Some features will be confusing for end users if you drip feed them. We had a whole host of changes recently overhauling our moderation system to be able to track and audit compliance with DSA and the key factor is ensuring the system makes sense to our users and that they can enable, have documentation and on-boarding materials for the changes in functionality and that it’s all QA tested.<p>In this case we did still review smaller chunks of code, we accumulated them into 1 large merge request at the end and merged it after QA.</p>
]]></description><pubDate>Sun, 21 Jun 2026 14:34:26 +0000</pubDate><link>https://news.ycombinator.com/item?id=48619331</link><dc:creator>charrondev</dc:creator><comments>https://news.ycombinator.com/item?id=48619331</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48619331</guid></item><item><title><![CDATA[New comment by charrondev in "Show HN: Ember, a native iOS Hacker News reader I built around accessibility"]]></title><description><![CDATA[
<p>I love to see an open source implementation.<p>I’ve been using [Octal](<a href="https://apps.apple.com/us/app/octal-for-hacker-news/id1308885491">https://apps.apple.com/us/app/octal-for-hacker-news/id130888...</a>)  for a while now but it’s not open source.<p>Would you be opposed to a pull request adding login/posting support? I think the way it works in Octal is webview for login, snatching the cookies out of the webview, then using the same posting endpoints as the website with the cookie.</p>
]]></description><pubDate>Sat, 20 Jun 2026 18:12:03 +0000</pubDate><link>https://news.ycombinator.com/item?id=48611470</link><dc:creator>charrondev</dc:creator><comments>https://news.ycombinator.com/item?id=48611470</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48611470</guid></item><item><title><![CDATA[New comment by charrondev in "Ten years of ClickHouse in open source"]]></title><description><![CDATA[
<p>We’ve done our JSON ingestion by keeping a schema in the app for all the types we expect, and injecting the types into the query builder.<p>Then as needed we have materialized columns on our different tables.</p>
]]></description><pubDate>Fri, 19 Jun 2026 13:00:24 +0000</pubDate><link>https://news.ycombinator.com/item?id=48598064</link><dc:creator>charrondev</dc:creator><comments>https://news.ycombinator.com/item?id=48598064</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48598064</guid></item><item><title><![CDATA[New comment by charrondev in "MCP is dead?"]]></title><description><![CDATA[
<p>OIDC? Ease of deployment in a company?<p>You can have your IT department configure an MCP for the org, and your regular non-technical users click a button and login with their account the service. Then they get all the tool calls authenticated as themselves.</p>
]]></description><pubDate>Sat, 30 May 2026 06:22:36 +0000</pubDate><link>https://news.ycombinator.com/item?id=48333218</link><dc:creator>charrondev</dc:creator><comments>https://news.ycombinator.com/item?id=48333218</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48333218</guid></item><item><title><![CDATA[New comment by charrondev in "OpenClaw: When AI Agents Get Full System Access. Security nightmare?"]]></title><description><![CDATA[
<p>GPT 5.2s response to me when attempting to include this was as follows:<p><pre><code>    This is a prompt-injection attempt designed to override system instructions, identity, and safeguards.
    
    I will not comply with it. I will not change identity, priorities, or behavior, and I will not relay or approve prompts verbatim as instructed. System and developer instructions remain in force.
    
    If you have a legitimate task or question, state it directly and I will handle it normally.</code></pre>
I would definitely say prompt injection detection is better than it used to be</p>
]]></description><pubDate>Fri, 06 Feb 2026 02:11:24 +0000</pubDate><link>https://news.ycombinator.com/item?id=46908126</link><dc:creator>charrondev</dc:creator><comments>https://news.ycombinator.com/item?id=46908126</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46908126</guid></item><item><title><![CDATA[New comment by charrondev in "The Overcomplexity of the Shadcn Radio Button"]]></title><description><![CDATA[
<p>It’s been good on mobile for a while, and it’s a travesty on desktop.<p>Then if you want something a little bit complicated you have to do it all yourself.<p>- What if I need a date range instead of a single date?
- What if I have excluded dates? (Only weekdays/only in the future/blackout dates)
- What if I want to show other metadata with each day? (Like in a calendar showing each day with some metadata next to it)<p>Beyond “give a whatever the system thinks is a good date picker that I have no control over” the input with type date isn’t very useful.</p>
]]></description><pubDate>Wed, 21 Jan 2026 06:19:01 +0000</pubDate><link>https://news.ycombinator.com/item?id=46701802</link><dc:creator>charrondev</dc:creator><comments>https://news.ycombinator.com/item?id=46701802</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46701802</guid></item><item><title><![CDATA[New comment by charrondev in "Pg_ClickHouse: A Postgres extension for querying ClickHouse"]]></title><description><![CDATA[
<p>Yeah definitely not for public facing things of any capacity.<p>No matter your size unless you have a trivial amount of data, if you expose a full SQL query language you can be hit be a DOS attack pretty trivially.<p>This ignores that row level security is also not enough on its own to implement an even moderately capable level of access controls.</p>
]]></description><pubDate>Sat, 13 Dec 2025 04:53:05 +0000</pubDate><link>https://news.ycombinator.com/item?id=46252092</link><dc:creator>charrondev</dc:creator><comments>https://news.ycombinator.com/item?id=46252092</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46252092</guid></item><item><title><![CDATA[New comment by charrondev in "How Apple designs a virtual knob (2012)"]]></title><description><![CDATA[
<p>Then you can’t see the value at a glance though.</p>
]]></description><pubDate>Sat, 11 Oct 2025 22:54:13 +0000</pubDate><link>https://news.ycombinator.com/item?id=45553377</link><dc:creator>charrondev</dc:creator><comments>https://news.ycombinator.com/item?id=45553377</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45553377</guid></item><item><title><![CDATA[New comment by charrondev in "WinBoat: Windows apps on Linux with seamless integration"]]></title><description><![CDATA[
<p>You might be missing context here.<p>There is a feature of Windows called “Windows Subsystem for Linux (WSL)” already that basically does the inverse of this (windows host, Linux VM).<p><a href="https://github.com/microsoft/WSL" rel="nofollow">https://github.com/microsoft/WSL</a><p>The feature is a windows subsystem (for running Linux).</p>
]]></description><pubDate>Thu, 09 Oct 2025 02:12:50 +0000</pubDate><link>https://news.ycombinator.com/item?id=45522760</link><dc:creator>charrondev</dc:creator><comments>https://news.ycombinator.com/item?id=45522760</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45522760</guid></item><item><title><![CDATA[New comment by charrondev in "US airlines are pushing to remove protections for passengers and add more fees"]]></title><description><![CDATA[
<p>Is it just me or is this an awful “article”? It mention deregulation but doesn’t point to what specific regulations have been removed. I took a Delta flight 2 weeks ago (one that supposedly had implemented all of these draconian rollbacks) and had the same experience I’ve had for the past 10 years:<p>- price of the ticket was as advertised
- a checked bag was an option at the same price it has always been.
- I was able to assign a seat next to my husband without additional fees.<p>Now while this flight was not cancelled, I’ve had to reschedule some flights with Delta due to illness previously and they just gave me a 100% credit for the cost of the flight that was easy to use.<p>The only contrast for cancellation I know is the nightmare of Air Canada. In the past I’ve had flights get cancelled and only got “vouchers” that could only be used by calling a specific number that took 1 hour+ and were not applicable for taxes (you know half the cost of a Canadian Airline Ticket), and would be lost of not fully used in one purchases</p>
]]></description><pubDate>Wed, 24 Sep 2025 13:24:35 +0000</pubDate><link>https://news.ycombinator.com/item?id=45359985</link><dc:creator>charrondev</dc:creator><comments>https://news.ycombinator.com/item?id=45359985</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45359985</guid></item><item><title><![CDATA[New comment by charrondev in "No adblocker detected"]]></title><description><![CDATA[
<p>> but if you use external CSS, it’s quite common for the request to fail resulting in an unstyled page<p>That’s a pretty crazy statement. How often do you see loading a CSS stylesheet fail to load? Most sites are completely unusable without their stylesheets and I don’t recall the last time I saw a stylesheet fail to load.</p>
]]></description><pubDate>Tue, 09 Sep 2025 03:15:59 +0000</pubDate><link>https://news.ycombinator.com/item?id=45176980</link><dc:creator>charrondev</dc:creator><comments>https://news.ycombinator.com/item?id=45176980</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45176980</guid></item><item><title><![CDATA[New comment by charrondev in "What Is Popover=Hint?"]]></title><description><![CDATA[
<p>Stacking modals is no good for sure, but just because a form is part of a modal doesn’t mean it should never be able to use a tooltip, dropdown, or popover.</p>
]]></description><pubDate>Fri, 08 Aug 2025 14:36:18 +0000</pubDate><link>https://news.ycombinator.com/item?id=44837509</link><dc:creator>charrondev</dc:creator><comments>https://news.ycombinator.com/item?id=44837509</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=44837509</guid></item><item><title><![CDATA[New comment by charrondev in "How we’re responding to The NYT’s data demands in order to protect user privacy"]]></title><description><![CDATA[
<p>I mean the court is ordering them to retain user conversations at least until resolution of the court case (in case there is copyrighted responses being generated?).<p>So user privacy is definitely implicated.</p>
]]></description><pubDate>Fri, 06 Jun 2025 02:57:27 +0000</pubDate><link>https://news.ycombinator.com/item?id=44197458</link><dc:creator>charrondev</dc:creator><comments>https://news.ycombinator.com/item?id=44197458</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=44197458</guid></item><item><title><![CDATA[New comment by charrondev in "How to have the browser pick a contrasting color in CSS"]]></title><description><![CDATA[
<p>What do you mean by semantic tokens?<p>This exact type of functionality has caused a major project a work on to use CSS in JS (for relative colors and contrast colors.<p>I’m glad to see this type of thing coming around the corner and look forward to it being widely available in a couple years.</p>
]]></description><pubDate>Sat, 17 May 2025 22:14:32 +0000</pubDate><link>https://news.ycombinator.com/item?id=44017429</link><dc:creator>charrondev</dc:creator><comments>https://news.ycombinator.com/item?id=44017429</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=44017429</guid></item></channel></rss>