Hacker News: colinmarc

New comment by colinmarc in "CVE-2026-111943: Compromised Intermediate Certificate Authority"

colinmarc — Thu, 22 Oct 2026 10:17:39 +0000

Go is not vulnerable in the same way software using webpki is, because it generally uses the system trust store. However, this change is about golang proactively blocking the certs, so that even if your OS doesn't update, it still won't trust them.

https://github.com/golang/go/issues/82345

New comment by colinmarc in "CVE-2026-111943: Compromised Intermediate Certificate Authority"

colinmarc — Thu, 22 Oct 2026 09:30:01 +0000

TL;DR:

The very urgent uv/certifi/etc releases (and yet-to-be-done bun release) are about removing the compromised CAs as described here:

https://emudhra.we-have-a-problem.com/

In other words, that software bundled the compromised certs into the binary, so upgrading it is the only way to remove them.

This is about Go proactively blocking intermediates. Which shouldn't strictly be necessary as long as your OS has removed or distrusted the CAs (on my laptop, macOS has done that, although it seems like it did so in a way not all tools have access to; for example, rustls-platform-verifier respects it, but rustls-webpki still loads the bad CAs from the system trust store).

edit: forgot I can't use code blocks on HN

New comment by colinmarc in "CVE-2026-111943: Compromised Intermediate Certificate Authority"

colinmarc — Thu, 22 Oct 2026 09:25:41 +0000

The eMudhra CA compromises had nothing to do with LLMs? But I love the vibes.

DevEx for developers who don't write code

colinmarc — Tue, 20 Oct 2026 22:11:22 +0000

Article URL: https://bauplanlabs.com/post/devex-for-developers-who-dont-write-code

Comments URL: https://news.ycombinator.com/item?id=50173395

Points: 1

# Comments: 0

GitHub Actions Feedback Survey

colinmarc — Tue, 20 Oct 2026 19:26:05 +0000

Article URL: https://survey3.medallia.com/?actions&id=821775

Comments URL: https://news.ycombinator.com/item?id=50171416

Points: 1

# Comments: 0

New comment by colinmarc in "Redesigning source control at Anthropic"

colinmarc — Wed, 14 Oct 2026 07:41:35 +0000

Thank you for engaging with my point! I agree, actually. I think if good design patterns could simply be copied out of a book, LLMs might be better at software engineering.

My point is more about up-front investment paying dividends. To speculate, it seems like the reward hacking is not there for long-term thinking.

New comment by colinmarc in "Redesigning source control at Anthropic"

colinmarc — Wed, 14 Oct 2026 06:57:09 +0000

Good interface design allows extending or changing component X without having to step on the toes of your colleague working on component Y downstream. It's absolutely essential.

Interface design is one of the things Claude is worst at in my experience (using it every day for the past year).

New comment by colinmarc in "Redesigning source control at Anthropic"

colinmarc — Wed, 14 Oct 2026 06:45:53 +0000

Code quality - and its best friend, interface design - pay dividends in large codebases. The fastest moving and most effective organizations I've worked at are ones that focused on code quality from the beginning.

All software is broken, but LLMs seem to make the wrong compromises consistently when working in large codebases.

New comment by colinmarc in "Codex CLI installs a persistent, self-updating background daemon by default"

colinmarc — Mon, 12 Oct 2026 21:30:51 +0000

It's trivial to bypass this by tweaking the system prompt in other harnesses. They use string matching and a blacklist.

https://x.com/FlorianKluge/status/2041855675295318039

(Whether that's against the ToS is not clear.)

New comment by colinmarc in "Griffin: Human Interaction Model"

colinmarc — Fri, 02 Oct 2026 04:50:28 +0000

Nothing good can come of "hacking" our natural inclination to trust other human faces this way.

New comment by colinmarc in "Can gzip be a language model?"

colinmarc — Tue, 22 Sep 2026 10:21:50 +0000

Would this work with video compression? Video codecs encode a lot of meaning; they use motion vectors to track the movement of objects on screen, for example.

New comment by colinmarc in "Breaking Claude Code Opus 5 Auto Mode"

colinmarc — Mon, 31 Aug 2026 11:08:58 +0000

What's interesting to me about this is that it targets Claude's specific tics. Anthropic has created model that reliably reaches for the same tools (yes, and phrases; `python -c` is a load-bearing tool for it). Everyone gets the same model, so by learning the model's behavioral patterns you can target it better.

New comment by colinmarc in "Tailcat – Like netcat, but over Tailscale’s data plane"

colinmarc — Thu, 27 Aug 2026 09:51:02 +0000

I'm a big fan of iroh, but I think iroh's holepunching algorithm is at least partly based on tailscale's, so it's not 100% accurate to say iroh got there first. (Just the "as a library without a control plane" bit.)

New comment by colinmarc in "AWS Acquires DuckDB"

colinmarc — Wed, 26 Aug 2026 13:37:23 +0000

Came here to post the same thing. DataFusion is fantastic.

New comment by colinmarc in "Pi's Minimalism Is Its Advantage"

colinmarc — Wed, 05 Aug 2026 22:08:51 +0000

...funnily enough, a few hours after posting this, it stopped working.

New comment by colinmarc in "Pi's Minimalism Is Its Advantage"

colinmarc — Wed, 05 Aug 2026 06:54:38 +0000

I use my Anthropic subscription with Pi. I thought they would start charging me API usage at some point, but it never happened. (If it did happen, I would switch to open weights models.)

New comment by colinmarc in "Ruff v0.16.0 – Significant new updates – 413 default rules up from 59"

colinmarc — Sun, 26 Jul 2026 10:50:52 +0000

It's conventional for semver to allow breaking changes for 0.x minor releases (but not for patch releases).

New comment by colinmarc in "Decoy Font"

colinmarc — Fri, 17 Jul 2026 14:42:15 +0000

I find it works a lot better at smaller sizes.

New comment by colinmarc in "I Built a Telegram Client for Pi"

colinmarc — Thu, 09 Jul 2026 12:10:48 +0000

I use my Anthropic sub with Pi. They keep saying they're going to disallow that and then walking back the decision. Or at least I think that's what's happening.

New comment by colinmarc in "Ask HN: Is anyone experimenting with different ways of using LLMs for coding?"

colinmarc — Fri, 03 Jul 2026 12:15:12 +0000

My absolute favorite modality is one I don't use all that much at the moment: Zed's edit completion.

If you're unfamiliar, it's like tab-completion, but it has a context that includes the edits you've made in the last few seconds, and it can predict around the cursor.

The model isn't advanced enough to understand complex tasks, but it has more the feel of the "crafting gun" in Subnautica or other survival crafting games, if that analogy makes any sense.

Personally I hate working with a chatbot - it's low-bandwidth and rage-inducing. If I could imagine a perfect workflow, it would be something like me whispering my train of thought as I program, and then pointing a very fancy "autocomplete gun" at the code.