(Anyway: the main offence is using the term "jerk" instead of "wanker").

Comments URL: https://news.ycombinator.com/item?id=47434380

Points: 3

# Comments: 0

This lack of detail may cause folks to form the incorrect impression that this is PostgreSQL, or a fork of it, or some module or plugin for it. Folks will be upset to learn that they were misinformed. Some will assign deception as the cause, whether that is true or not.

I think your interests would be best served by trying to make that distinction clear and prominently so. So for example "A PostgreSQL-compatible, fully serverless database", or similar.

I hope I have explained better.

I feel like the lede is a bit buried here, bordering on deceptive.

That or the architecture doc is wrong. Both plausible I guess, in this day and age.

[0] https://db9.ai/docs/sql

https://resources.jetbrains.com/storage/products/mps/docs/MP...

Comments URL: https://news.ycombinator.com/item?id=46187135

Points: 8

# Comments: 1

Comments URL: https://news.ycombinator.com/item?id=45934978

Points: 16

# Comments: 0

Comments URL: https://news.ycombinator.com/item?id=45594522

Points: 1

# Comments: 0

This is not what I had in mind and now I'm embarrassed that I helped make it possible.

OK, sure, let's pencil this out.

Debian has ~1k volunteers overseeing ~20k packages. Say the ratio is 20:1.

npm alone -- not counting other ecosystems, just npm -- has 3 million packages.

So you'd need 150k volunteers. One hundred and fifty thousand unpaid individuals, not counting original authors.

For one repo.

"Nonsense", you riposte. "Only maybe 100k of these packages are worth it!"

Cool, cool. Then you'd need "only" 5 thousand volunteers. Debian maxed out at 1k and it is probably the source of the most-used software in history. But sure, we'll find 5 thousand qualified people willing to do it for free.

Oh, but how do you identify those 100k packages? OK, let's use download count. Or maybe reference count. Network centrality perhaps? Great, great. But some of them will be evicted from this paradise of rigorous repackaging. What replaces them? Oh, shoot, we need humans to go over up to 3 million packages to find the ones we want to keep.

What I need distro boosters to understand is that the universe of what is basically a package manager for large C libraries is at least two orders of magnitude smaller than everything else, bordering on three if you roll all the biggest repos together. The dynamics at language ecosystem scale are simply different. Yelling at the cloud that it should actually be a breeze isn't going to change things.

1. "2FA doesn't work". Incorrect. MFA relying on SMS or TOTP is vulnerable to phishing. Token or device based is not. And indeed GitHub sponsored a program to give such tokens away to critical developers.

In 2021.

2. "There's no signing". Sigstore support shipped in like 2023.

The underlying view is that "Microsoft isn't doing anything". They have been. For years. Since at least 2022, based on my literal direct interactions with the individuals directly tasked to do the things that you say aren't or haven't been done.

I have no association with npm, GitHub or Microsoft. My connection was through Shopify and RubyGems. But it really steams me to see npm getting punched up with easily checked "facts".

[0] https://github.com/ossf/wg-securing-software-repos

[1] https://alpha-omega.dev/grants/grantrecipients/

Comments URL: https://news.ycombinator.com/item?id=45087595

Points: 2

# Comments: 1

But combine it with TDD & pairing and it becomes a license to deliver robust features at warp speed.

However.

I paired full-time, all day, at Pivotal, for 5 years. It was incredible. Truly amazing. The only time in my career when I really thrived. I miss it badly.

Sounds like Pyx is trying to do a bit of both.

Disclosure: I have interacted a bunch with folks from all of these things. Never worked for or been paid by, though.