<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Hacker News: igregoryca</title><link>https://news.ycombinator.com/user?id=igregoryca</link><description>Hacker News RSS</description><docs>https://hnrss.org/</docs><generator>hnrss v2.1.1</generator><lastBuildDate>Fri, 15 May 2026 18:26:15 +0000</lastBuildDate><atom:link href="https://hnrss.org/user?id=igregoryca" rel="self" type="application/rss+xml"></atom:link><item><title><![CDATA[New comment by igregoryca in "Postmortem: TanStack NPM supply-chain compromise"]]></title><description><![CDATA[
<p>The baffling part is why it takes hours for the npm security team to unpublish packages that contain malware, as attested by multiple independent sources? That should be able to happen in minutes.</p>
]]></description><pubDate>Tue, 12 May 2026 02:06:25 +0000</pubDate><link>https://news.ycombinator.com/item?id=48103353</link><dc:creator>igregoryca</dc:creator><comments>https://news.ycombinator.com/item?id=48103353</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48103353</guid></item><item><title><![CDATA[New comment by igregoryca in "Postmortem: TanStack npm supply-chain compromise"]]></title><description><![CDATA[
<p>Postinstall scripts have remained an effective attack vector for quite a while – which, ironically, has meant the worm's authors had little incentive to try something else, so it was easier to inoculate yourself. Alas, you're right, it should be pretty simple to bypass this kind of protection, if they haven't already (and seems like they have).</p>
]]></description><pubDate>Mon, 11 May 2026 23:53:43 +0000</pubDate><link>https://news.ycombinator.com/item?id=48102353</link><dc:creator>igregoryca</dc:creator><comments>https://news.ycombinator.com/item?id=48102353</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48102353</guid></item><item><title><![CDATA[New comment by igregoryca in "Appearing productive in the workplace"]]></title><description><![CDATA[
<p>Can't speak for intelligent autocomplete writ large, but I treat it as an ergonomic feature, and Cursor's implementation is pretty good (though I'm not sure it's improved all that much in the past year).<p>It constantly takes whatever is currently visible in your editor to feed its context. If you get a nonsense/hallucinated suggestion, you can accept it, get it to read the error message from LSP diagnostics, undo, and then it'll correct itself next time. Or if you need to make changes in 5 places, and the next 4 changes are easy to guess after seeing the first one, it'll guess the next 4 for you.<p>I still use standard IDE features extensively. The intelligent autocomplete is just another tool to reduce typing when the next change is easy to guess.<p>Oh, and I turn it off when I'm writing prose or need to actually think deeply. Then it really does hurt more then help.<p>(Worth noting: I currently work primarily in Go, which is a language that's ridiculously verbose and has lots of repetitive patterns. YMMV for more expressive languages.)</p>
]]></description><pubDate>Thu, 07 May 2026 13:32:40 +0000</pubDate><link>https://news.ycombinator.com/item?id=48049238</link><dc:creator>igregoryca</dc:creator><comments>https://news.ycombinator.com/item?id=48049238</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48049238</guid></item><item><title><![CDATA[New comment by igregoryca in "Async Rust never left the MVP state"]]></title><description><![CDATA[
<p>Goroutines/"fibers"/"green threads" are usually scheduled by the runtime system across a small pool of actual OS threads.</p>
]]></description><pubDate>Tue, 05 May 2026 12:50:01 +0000</pubDate><link>https://news.ycombinator.com/item?id=48021807</link><dc:creator>igregoryca</dc:creator><comments>https://news.ycombinator.com/item?id=48021807</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48021807</guid></item><item><title><![CDATA[New comment by igregoryca in "Opus 4.7 knows the real Kelsey"]]></title><description><![CDATA[
<p>Article:<p>> To avoid this, you will probably need to intentionally write in a very different style than you usually do (or to have AIs rewrite all your prose for you, but, ugh, that’s not a world I look forward to living in).<p>I agree. The amount of vague and cliche'd AI writing I read on the daily is already exhausting enough.<p>It would be interesting if you could train a model to sprinkle random red herrings throughout your text in a minimally disruptive way. But I fear you might have to stretch the definition of "minimally disruptive" to make it robust against detection.</p>
]]></description><pubDate>Fri, 01 May 2026 01:26:12 +0000</pubDate><link>https://news.ycombinator.com/item?id=47970361</link><dc:creator>igregoryca</dc:creator><comments>https://news.ycombinator.com/item?id=47970361</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47970361</guid></item><item><title><![CDATA[Apple WWDC 2014 scrapped opening video]]></title><description><![CDATA[
<p>Article URL: <a href="https://archive.org/details/apple-scrapped-wwdc-14-video">https://archive.org/details/apple-scrapped-wwdc-14-video</a></p>
<p>Comments URL: <a href="https://news.ycombinator.com/item?id=47929361">https://news.ycombinator.com/item?id=47929361</a></p>
<p>Points: 3</p>
<p># Comments: 1</p>
]]></description><pubDate>Tue, 28 Apr 2026 01:12:30 +0000</pubDate><link>https://archive.org/details/apple-scrapped-wwdc-14-video</link><dc:creator>igregoryca</dc:creator><comments>https://news.ycombinator.com/item?id=47929361</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47929361</guid></item><item><title><![CDATA[New comment by igregoryca in "Native Instant Space Switching on macOS"]]></title><description><![CDATA[
<p>The (shift+)cmd+` order also resets to match the window z-order whenever you switch apps. So if the order is windows A, B, C, then you select window B, cmd+tab away, then cmd+tab back, the order will now be B, A, C.<p>I've developed an intuitive understanding of this, but I had to experiment just now to describe the behavior precisely. And my intuition is still wrong sometimes (like if the app has windows on multiple monitors, it's hard to predict the z-order).<p>> if I Slack open in Firefox in workspace 1 and Outlook open in Firefox in workspace 2, there is no way to switch between Slack and Outlook<p>My local maximum is to never use workspaces – just cmd+tab, cmd+`, and sometimes cmd+h to reduce screen clutter.</p>
]]></description><pubDate>Fri, 10 Apr 2026 12:50:22 +0000</pubDate><link>https://news.ycombinator.com/item?id=47717362</link><dc:creator>igregoryca</dc:creator><comments>https://news.ycombinator.com/item?id=47717362</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47717362</guid></item><item><title><![CDATA[New comment by igregoryca in "Google details new 24-hour process to sideload unverified Android apps"]]></title><description><![CDATA[
<p>What can Bank X do to stop phone malware from scraping the user's session token from the Bank X app or website?<p>Yes, banks should (and sometimes do) double- and triple-check with you before allowing large transfers/withdrawals, but scammers know how to coach their victims past this. Speaking from experience.<p>(I also don't fully agree this is Google's responsibility, and I am not happy about this development. But there are legitimate points in favor of outsourcing the question of "will this software do nefarious things" to some kind of trusted signing authority.)</p>
]]></description><pubDate>Fri, 20 Mar 2026 01:23:34 +0000</pubDate><link>https://news.ycombinator.com/item?id=47449134</link><dc:creator>igregoryca</dc:creator><comments>https://news.ycombinator.com/item?id=47449134</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47449134</guid></item><item><title><![CDATA[New comment by igregoryca in "A new California law says all operating systems need to have age verification"]]></title><description><![CDATA[
<p>Wood is edible when processed correctly, but it's not legally considered "food" because there are a bunch of nontrivial steps to get it into that state. Likewise, any reasonable interpretation of "general purpose computer" in this context by a judge would not include your microwave oven just because someone with skill and finesse could transform it into a cursed Doom arcade machine.<p>Laws are interpreted by people trained to fill in the blanks[1] with a best guess of the legislative body's intent. And the intent here seems pretty clear: to regulate computing devices that let end users easily install software from a centralized catalog.<p>[1] which we all do subconsciously in day-to-day speech, because all language is ultimately subjective</p>
]]></description><pubDate>Sat, 28 Feb 2026 13:44:07 +0000</pubDate><link>https://news.ycombinator.com/item?id=47195290</link><dc:creator>igregoryca</dc:creator><comments>https://news.ycombinator.com/item?id=47195290</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47195290</guid></item><item><title><![CDATA[New comment by igregoryca in "Google restricting Google AI Pro/Ultra subscribers for using OpenClaw"]]></title><description><![CDATA[
<p>The irony is that web searches for an explanation of something often lead to a discussion thread where the poster is downvoted and berated for daring to ask people instead of Google. And then there's one commenter who actually actually explains the thing you were wondering about.</p>
]]></description><pubDate>Mon, 23 Feb 2026 02:00:51 +0000</pubDate><link>https://news.ycombinator.com/item?id=47117126</link><dc:creator>igregoryca</dc:creator><comments>https://news.ycombinator.com/item?id=47117126</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=47117126</guid></item><item><title><![CDATA[New comment by igregoryca in "Resizing windows on macOS Tahoe – the saga continues"]]></title><description><![CDATA[
<p>It's kind of nice, though, because you can click anywhere on a window to focus it. If you want to interact with a background window without focusing it, hold Cmd and click.</p>
]]></description><pubDate>Fri, 13 Feb 2026 02:53:32 +0000</pubDate><link>https://news.ycombinator.com/item?id=46998389</link><dc:creator>igregoryca</dc:creator><comments>https://news.ycombinator.com/item?id=46998389</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46998389</guid></item><item><title><![CDATA[New comment by igregoryca in "Resizing windows on macOS Tahoe – the saga continues"]]></title><description><![CDATA[
<p>This is already the pre-26 bounding box, isn't it? It's the new graphics that don't line up. (Not a great excuse, but the graphics are here to stay at least for a little while.)</p>
]]></description><pubDate>Fri, 13 Feb 2026 02:37:15 +0000</pubDate><link>https://news.ycombinator.com/item?id=46998292</link><dc:creator>igregoryca</dc:creator><comments>https://news.ycombinator.com/item?id=46998292</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46998292</guid></item><item><title><![CDATA[New comment by igregoryca in "Last Year on My Mac: Look Back in Disbelief"]]></title><description><![CDATA[
<p>The lack of a "refresh" option has been a problem with iCloud for years. Back in the iOS 8/9 days, I'd write in Pages on an iPad and then try to open the document on a Mac or the Pages web app. Pages itself was (and is) pretty nice, but iCloud sync was constantly broken. Things didn't appear when I needed them to.<p>Some designers say that refresh buttons shouldn't exist because the interface should always reflect the current state of reality. They're right, but until the day we get 100% bug-free bidirectional sync with perfect conflict resolution that instantly polls the network whenever it reconnects, refresh buttons are a necessary evil.</p>
]]></description><pubDate>Sun, 28 Dec 2025 23:24:28 +0000</pubDate><link>https://news.ycombinator.com/item?id=46415536</link><dc:creator>igregoryca</dc:creator><comments>https://news.ycombinator.com/item?id=46415536</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46415536</guid></item><item><title><![CDATA[New comment by igregoryca in "I tried Gleam for Advent of Code"]]></title><description><![CDATA[
<p>I think most people struggle to one-shot Lisp parens. Visual guides or structured editing are sorta necessary. LLMs don't have that kind of UI (yet?)</p>
]]></description><pubDate>Sun, 14 Dec 2025 20:45:46 +0000</pubDate><link>https://news.ycombinator.com/item?id=46266703</link><dc:creator>igregoryca</dc:creator><comments>https://news.ycombinator.com/item?id=46266703</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46266703</guid></item><item><title><![CDATA[New comment by igregoryca in "Cloudflare outage should not have happened"]]></title><description><![CDATA[
<p>The only languages that eliminate logic bugs are formally verified ones, as the article points out. (And even then, your program is only as correct as your specification.) Ordinary Rust code is not formally verified. Anyone who claims Rust eliminates errors is either very naive or lying.<p>Type-safe Rust code is free from <i>certain classes</i> of errors. But that goes out the window the moment you parse input from the outside, because Rust types can enforce invariants (i.e. internal consistency), but input has no invariants. Rust doesn't ban you from crashing the program if you see input that violates an invariant. I don't know of any mainstream language that forbids crashing the program. (Maybe something like Ada? Not sure.)<p>I don't understand why you bemoan that Rust hasn't solved this problem, because it seems nigh unsolvable.</p>
]]></description><pubDate>Thu, 27 Nov 2025 02:41:16 +0000</pubDate><link>https://news.ycombinator.com/item?id=46064948</link><dc:creator>igregoryca</dc:creator><comments>https://news.ycombinator.com/item?id=46064948</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46064948</guid></item><item><title><![CDATA[New comment by igregoryca in "We should all be using dependency cooldowns"]]></title><description><![CDATA[
<p>Some people appreciate it when terminal output is easier to read.<p>If chalk emits sequences that aren't supported by your terminal, then that's a deficiency in chalk, not the programs that wanted to produce colored output. It's easier to fix chalk than to fix 50,000 separate would-be dependents of chalk.</p>
]]></description><pubDate>Fri, 21 Nov 2025 20:51:22 +0000</pubDate><link>https://news.ycombinator.com/item?id=46008833</link><dc:creator>igregoryca</dc:creator><comments>https://news.ycombinator.com/item?id=46008833</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46008833</guid></item><item><title><![CDATA[New comment by igregoryca in "We should all be using dependency cooldowns"]]></title><description><![CDATA[
<p>Most of your supply chain attack surface is social engineering attack surface. Doesn't really matter if I use Lodash, or 20 different single-function libraries, if I end up trusting the exact same people to not backdoor my server.<p>Of course, small libraries get a bad rap because they're often maintained by tons of different people, especially in less centralized ecosystems like npm. That's usually a fair assessment. But a single author will sometimes maintain 5, 10, or 20 different popular libraries, and adding another library of theirs won't really increase your social attack surface.<p>So you're right about "pull[ing] in universes [of package maintainers]". I just don't think complexity or number of packages are the metrics we should be optimizing. They are correlates, though.<p>(And more complex code can certainly contain more vulnerabilities, but that can be dealt with in the traditional ways. Complexity begets simplicity, yadda yadda; complexity that only begets complexity should obviously be eliminated)</p>
]]></description><pubDate>Fri, 21 Nov 2025 20:38:38 +0000</pubDate><link>https://news.ycombinator.com/item?id=46008710</link><dc:creator>igregoryca</dc:creator><comments>https://news.ycombinator.com/item?id=46008710</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=46008710</guid></item><item><title><![CDATA[New comment by igregoryca in "Memory Safety for Skeptics"]]></title><description><![CDATA[
<p>1) Null pointer derefs can sometimes lead to privilege escalation (look up "mapping the zero page", for instance). 2) As I understand it (could be off base), if you're already doing static checking for other memory bugs, eliminating null derefs comes "cheap". In other words, it follows pretty naturally from the systems that provide other memory safety guarantees (such as the famous "borrow checker" employed by Rust).</p>
]]></description><pubDate>Mon, 10 Nov 2025 23:54:41 +0000</pubDate><link>https://news.ycombinator.com/item?id=45882490</link><dc:creator>igregoryca</dc:creator><comments>https://news.ycombinator.com/item?id=45882490</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45882490</guid></item><item><title><![CDATA[New comment by igregoryca in "Show HN: SQLite Online – 11 years of solo development, 11K daily users"]]></title><description><![CDATA[
<p>If you're making enough money, you can hire a designer every now and then to tell you where your UX suffers and how to fix it. No investors necessary.<p>(or: just solicit feedback in a space frequented by designers, and harness the power of being wrong on the internet ;)</p>
]]></description><pubDate>Mon, 13 Oct 2025 16:46:49 +0000</pubDate><link>https://news.ycombinator.com/item?id=45570503</link><dc:creator>igregoryca</dc:creator><comments>https://news.ycombinator.com/item?id=45570503</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45570503</guid></item><item><title><![CDATA[New comment by igregoryca in "Electron-based apps cause system-wide lag on macOS 26 Tahoe"]]></title><description><![CDATA[
<p>Discovering and using private APIs is not a walk in the park. I doubt "laziness" is a common motivation for doing so. Lack of knowledge or bad docs, perhaps. But there's often no officially sanctioned way to do something that people want (and perhaps will pay for) - most private API usage I've seen falls into this third bucket.</p>
]]></description><pubDate>Fri, 26 Sep 2025 00:28:31 +0000</pubDate><link>https://news.ycombinator.com/item?id=45381114</link><dc:creator>igregoryca</dc:creator><comments>https://news.ycombinator.com/item?id=45381114</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=45381114</guid></item></channel></rss>