<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Hacker News: lazaroclapp</title><link>https://news.ycombinator.com/user?id=lazaroclapp</link><description>Hacker News RSS</description><docs>https://hnrss.org/</docs><generator>hnrss v2.1.1</generator><lastBuildDate>Wed, 06 May 2026 15:11:32 +0000</lastBuildDate><atom:link href="https://hnrss.org/user?id=lazaroclapp" rel="self" type="application/rss+xml"></atom:link><item><title><![CDATA[New comment by lazaroclapp in "Why most product tours get skipped"]]></title><description><![CDATA[
<p>Interestingly, there are basically two kinds of programs I am sometimes happy to see guided tours embedded in:<p>* Creation programs (image/video editors, 3D rendering... hell, even a slides program or an IDE). Doesn't mean I won't dismiss them sometimes anyways, but these are tools that often I do want to get an initial idea how to use, that I have allotted some time to play around with, and that are sufficiently complex that a tutorial is justified. These are also places were I can spend 2-5 minutes learning the basics of the tool, because whatever I am about to do with it is going to take the next few hours anyways.<p>* Videogames (i.e. the tutorial). For very similar reasons to the above ;)<p>Also, this is always on first install. Getting a tutorial on update for an authoring tool (and to a lesser extent a game) is far less likely to be welcome.</p>
]]></description><pubDate>Wed, 06 May 2026 04:36:08 +0000</pubDate><link>https://news.ycombinator.com/item?id=48032214</link><dc:creator>lazaroclapp</dc:creator><comments>https://news.ycombinator.com/item?id=48032214</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48032214</guid></item><item><title><![CDATA[New comment by lazaroclapp in "RegreSSHion: Remote Unauthenticated Code Execution Vulnerability in OpenSSH"]]></title><description><![CDATA[
<p>Actually, the technical advisory is even more pertinent to the HN crowd: <a href="https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt" rel="nofollow">https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion....</a><p>And there is apparently already a discussion thread for it: <a href="https://news.ycombinator.com/item?id=40843778">https://news.ycombinator.com/item?id=40843778</a></p>
]]></description><pubDate>Mon, 01 Jul 2024 13:17:28 +0000</pubDate><link>https://news.ycombinator.com/item?id=40845591</link><dc:creator>lazaroclapp</dc:creator><comments>https://news.ycombinator.com/item?id=40845591</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=40845591</guid></item><item><title><![CDATA[RegreSSHion: Remote Unauthenticated Code Execution Vulnerability in OpenSSH]]></title><description><![CDATA[
<p>Article URL: <a href="https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server">https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server</a></p>
<p>Comments URL: <a href="https://news.ycombinator.com/item?id=40845540">https://news.ycombinator.com/item?id=40845540</a></p>
<p>Points: 2</p>
<p># Comments: 1</p>
]]></description><pubDate>Mon, 01 Jul 2024 13:11:45 +0000</pubDate><link>https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server</link><dc:creator>lazaroclapp</dc:creator><comments>https://news.ycombinator.com/item?id=40845540</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=40845540</guid></item><item><title><![CDATA[New comment by lazaroclapp in "Rust Receives Sigplan Programming Languages Software Award 2024"]]></title><description><![CDATA[
<p>Not sure if there is an official announcement to link here vs the toot, either way a very well deserved award and a success story for fundamental PL research influencing industry practice and vice versa.</p>
]]></description><pubDate>Fri, 28 Jun 2024 07:42:08 +0000</pubDate><link>https://news.ycombinator.com/item?id=40818565</link><dc:creator>lazaroclapp</dc:creator><comments>https://news.ycombinator.com/item?id=40818565</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=40818565</guid></item><item><title><![CDATA[Rust Receives Sigplan Programming Languages Software Award 2024]]></title><description><![CDATA[
<p>Article URL: <a href="https://mastodon.social/@regehr/112689940055802450">https://mastodon.social/@regehr/112689940055802450</a></p>
<p>Comments URL: <a href="https://news.ycombinator.com/item?id=40818564">https://news.ycombinator.com/item?id=40818564</a></p>
<p>Points: 2</p>
<p># Comments: 1</p>
]]></description><pubDate>Fri, 28 Jun 2024 07:42:08 +0000</pubDate><link>https://mastodon.social/@regehr/112689940055802450</link><dc:creator>lazaroclapp</dc:creator><comments>https://news.ycombinator.com/item?id=40818564</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=40818564</guid></item><item><title><![CDATA[More Feature Flags, Less Tech Debt: Launching automated feature flag cleanup]]></title><description><![CDATA[
<p>Article URL: <a href="https://gitar.co/blog/more-feature-flags-less-tech-debt">https://gitar.co/blog/more-feature-flags-less-tech-debt</a></p>
<p>Comments URL: <a href="https://news.ycombinator.com/item?id=40515882">https://news.ycombinator.com/item?id=40515882</a></p>
<p>Points: 2</p>
<p># Comments: 2</p>
]]></description><pubDate>Wed, 29 May 2024 19:27:36 +0000</pubDate><link>https://gitar.co/blog/more-feature-flags-less-tech-debt</link><dc:creator>lazaroclapp</dc:creator><comments>https://news.ycombinator.com/item?id=40515882</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=40515882</guid></item><item><title><![CDATA[New comment by lazaroclapp in "Gitar: From the Team Behind Uber's Developer Platform"]]></title><description><![CDATA[
<p>The easy answer when bringing up something like IntelliJ is that we very much intend to go beyond the IDE (local edit-build-debug loop) and beyond an specific programming language (or set of related languages in the case of IntelliJ). But it is generally true that we aren't the first or only company to think about multiple parts of the development workflow. You could point to, say, Jetbrains Space as a better example of something from them in the same space (pun not intended).<p>We want to build an integrated development platform that goes from locally writing code, to code review, to continuous monitoring of code quality, to enabling automated dependency upgrades and migrations, to compiler optimizations guided by usage data and constraints. That doesn't mean that every tool in the platform will be something we build from scratch, though, we are looking to integrate with existing developer tools along a number of supported "golden paths", besides making our tooling available a la carte for others.<p>For linting, specifically. It's easy to add linting frameworks and checks, for most languages, but there are a few things we need to be considered when a diagnostic is surfaced locally:
- Is it a suggestion or an actual error?
- Is there an automated fix available?
- Is the right set of checks turned on for the right subset of the code?<p>Then there is also the aspect of visibility and observability. Here is an example of an issue for which a lint was readily available, but ignored: <a href="https://imgur.com/a/wWqa0Wg" rel="nofollow">https://imgur.com/a/wWqa0Wg</a>. We believe that's common and not a matter of human error, but a direct consequence of the tooling not surfacing the issue in the right ways or providing an easy path to fix it once the code is already in the codebase.<p>Or, consider code refactoring. Many IDEs support code refactoring with full AST information, but for large codebases it can hit limits fairly easily: for a large monorepo, it might not scale in the sense of being able to keep all code indexed in memory within the same session; for a set of microrepos, it can struggle to perform refactorings across repo boundaries. One approach here is to build a powerful refactoring engine and expose it via integrations to the IDE (including IntelliJ!), code review system, and some sort of global management UI.<p>For each of the questions above you can find potential solutions, both from companies and in open-source, and yet, companies that can afford it benefit from having a "dev platform" team integrating, customizing, and maintaining various such tools benefit from that investment. I'd argue there isn't currently a clear go to answer for "Developer Platform as a service", particularly one that doesn't care to tie you to a particular language or stack.</p>
]]></description><pubDate>Sat, 03 Feb 2024 20:53:49 +0000</pubDate><link>https://news.ycombinator.com/item?id=39244639</link><dc:creator>lazaroclapp</dc:creator><comments>https://news.ycombinator.com/item?id=39244639</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=39244639</guid></item><item><title><![CDATA[New comment by lazaroclapp in "Gitar: From the Team Behind Uber's Developer Platform"]]></title><description><![CDATA[
<p>A cliche, perhaps, but build times and land times have always been a top priority of developers, particularly as tooling, specially code analysis, grows more complex. Developer tooling <i>should</i> be as blazingly fast as we can make it! (And obviously we aren't the only ones aiming for that, but it's good to have it as an explicit top priority!)</p>
]]></description><pubDate>Fri, 02 Feb 2024 05:21:19 +0000</pubDate><link>https://news.ycombinator.com/item?id=39225359</link><dc:creator>lazaroclapp</dc:creator><comments>https://news.ycombinator.com/item?id=39225359</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=39225359</guid></item><item><title><![CDATA[New comment by lazaroclapp in "Gitar: From the Team Behind Uber's Developer Platform"]]></title><description><![CDATA[
<p>Well, an IDE is not fundamentally out of scope, but for the foreseeable future the plan there is more along the lines of plugins for common IDEs (e.g. VSCode, Jetbrains) and integrations with existing code review and code hosting services (GitHub, GitLab, etc.).<p>We want to integrate with a few reasonable permutations of a development environment and overlay stuff like dead code deletion and refactoring (Already got a tool for that! More to come soon, but that's not the full business for us, just the first feature), static analysis (see NullAway/NilAway for examples that go beyond basic linting), tools for managing compatibility between dependencies and fixing flaky tests, and LLM-based code transformation and code review tools. At some point or another we have talked about how we'd rebuild each and every step of the development process (up to including version control), but for now there are easier and more urgent problems we think we can solve than that or building a new IDE :)</p>
]]></description><pubDate>Fri, 02 Feb 2024 05:14:33 +0000</pubDate><link>https://news.ycombinator.com/item?id=39225312</link><dc:creator>lazaroclapp</dc:creator><comments>https://news.ycombinator.com/item?id=39225312</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=39225312</guid></item><item><title><![CDATA[New comment by lazaroclapp in "Gitar: From the Team Behind Uber's Developer Platform"]]></title><description><![CDATA[
<p>Hi, everyone! We are some of the authors behind Uber’s OSS developer tools, which have appeared in HN previously, including: Piranha (automated stale flag cleanup and code refactoring), NullAway/NilAway (NPE/nil panic static detection), OkBuck, etc.<p>While we think all those tools are great (they are not going away and there are hopefully more to come both from us and from the team remaining at Uber!), we believe that the main thing a developer platform team brings to a company is an integrated experience. We started Gitar to provide that same experience across multiple companies, including those which do not (yet) have a large developer platform team!<p>We have plenty of ideas (starting with some interesting tooling around code refactoring!), but also happy to hear about the challenges you all see at various scale companies related to developer experience and tooling.</p>
]]></description><pubDate>Thu, 01 Feb 2024 19:08:28 +0000</pubDate><link>https://news.ycombinator.com/item?id=39219835</link><dc:creator>lazaroclapp</dc:creator><comments>https://news.ycombinator.com/item?id=39219835</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=39219835</guid></item><item><title><![CDATA[Gitar: From the Team Behind Uber's Developer Platform]]></title><description><![CDATA[
<p>Article URL: <a href="https://gitar.co/blog">https://gitar.co/blog</a></p>
<p>Comments URL: <a href="https://news.ycombinator.com/item?id=39219833">https://news.ycombinator.com/item?id=39219833</a></p>
<p>Points: 15</p>
<p># Comments: 11</p>
]]></description><pubDate>Thu, 01 Feb 2024 19:08:27 +0000</pubDate><link>https://gitar.co/blog</link><dc:creator>lazaroclapp</dc:creator><comments>https://news.ycombinator.com/item?id=39219833</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=39219833</guid></item><item><title><![CDATA[New comment by lazaroclapp in "NilAway: Practical nil panic detection for Go"]]></title><description><![CDATA[
<p>No worries, that's how I understood it too :) Just adding a bit more context on why we feel the approach does beat "grep panic" for people checking out this thread.</p>
]]></description><pubDate>Sun, 19 Nov 2023 00:09:13 +0000</pubDate><link>https://news.ycombinator.com/item?id=38326546</link><dc:creator>lazaroclapp</dc:creator><comments>https://news.ycombinator.com/item?id=38326546</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=38326546</guid></item><item><title><![CDATA[New comment by lazaroclapp in "NilAway: Practical nil panic detection for Go"]]></title><description><![CDATA[
<p>We'd be interested in the general characteristics of the most common ones you are seeing. If you have a chance to file a couple issues (and haven't done so yet): <a href="https://github.com/uber-go/nilaway/issues">https://github.com/uber-go/nilaway/issues</a><p>We definitely have gotten some useful reports there already since the blog post!<p>We are aware of a number of sources of false positives and actively trying to drive them down (prioritizing the patterns that are common in our codebase, but very much interested in making the tool useful to others too!).<p>Some sources of false positives are fundamental (any non-trivial type system will forbid some programs which are otherwise safe in ways that can't be proven statically), others need complex in-development features for the tool to understand (e.g. contracts, such as "foo(...) returns nil iff its third argument is nil"), and some are just a matter of adding a library model or similar small change and we just haven't run into it ourselves.</p>
]]></description><pubDate>Sat, 18 Nov 2023 23:53:51 +0000</pubDate><link>https://news.ycombinator.com/item?id=38326333</link><dc:creator>lazaroclapp</dc:creator><comments>https://news.ycombinator.com/item?id=38326333</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=38326333</guid></item><item><title><![CDATA[New comment by lazaroclapp in "NilAway: Practical nil panic detection for Go"]]></title><description><![CDATA[
<p>Actually, if we were running into cases where we <i>aren't</i> logging a panic which is actually happening in production, then the first thing to note is that we need to improve our observability. The issue might or might not be recoverable, but it should be logged. If nothing else, it should show up as a service crash somewhere within those logs, which is also something that service owners monitor and get alerts on.<p>The advantage of NilAway is not just detecting nil panic crashes after the fact (as you note, we should always be able to detect those eventually, once they happen!), but detecting them early enough that they don't make it to users. If the tool had been online when that panic was first introduced, it would have been fixed before ever showing up in the logs (Presumably, at least! The tool is not currently blocking, and developers can mistake a real warning for a false positive, which also exist due to a number of reasons both fundamental and just related to features still being added)<p>But, on the big picture, this is the same general argument as: "Why do you want a statically typed language if a dynamically typed one will also inform you of the mismatch at runtime and crash?" "Well, because you want to know about the issue <i>before</i> it crashes."<p>Beyond not making it all the way to prod, there is also a big benefit of detecting issues early on the development lifecycle, simply in terms of the effort required to address them: 'while typing the code' beats 'while compiling and testing locally' beats 'at code review time' beats 'during the deployment flow or in staging' beats 'after the fact, from logs/alerts in production', which itself beats 'after the fact, from user complains after a major outage'. NilAway currently works on the code review stage for most internal users, but it is also fast enough to run during local builds (currently that requires all pre-existing warnings in the code to either be resolved or marked for suppression, though, which is why this mode is less common).</p>
]]></description><pubDate>Sat, 18 Nov 2023 23:36:20 +0000</pubDate><link>https://news.ycombinator.com/item?id=38326125</link><dc:creator>lazaroclapp</dc:creator><comments>https://news.ycombinator.com/item?id=38326125</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=38326125</guid></item><item><title><![CDATA[New comment by lazaroclapp in "Ask HN: Those making $500+/month on side projects in 2023 – Show and tell"]]></title><description><![CDATA[
<p>Native Spanish speaker here (ES-MX, specifically, if it matters). I think this is one of the cases where a solid general rule breaks down in the specifics.<p>You are correct about the difference between "ser" (to be, permanently/over an indeterminate time) and "estar" (to be in a particular state right now). But "No soy feliz" sounds perfectly idiomatic to me, even for a relatively transient state of sadness. ("No estoy feliz" doesn't sound wrong to me either, but feels just slightly less natural than "No soy feliz" even in a context like "No soy feliz ahorita", with an explicit "right now").<p>As a note: "No estoy contento" (Also "I am not happy", or maybe "I am not in a good mood") is definitely "estoy", rather than "soy". No clue why "No soy feliz" does feel idiomatic.</p>
]]></description><pubDate>Mon, 23 Jan 2023 00:16:42 +0000</pubDate><link>https://news.ycombinator.com/item?id=34483856</link><dc:creator>lazaroclapp</dc:creator><comments>https://news.ycombinator.com/item?id=34483856</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=34483856</guid></item><item><title><![CDATA[New comment by lazaroclapp in "Tether Fined $41M for Lying About Reserves"]]></title><description><![CDATA[
<p>> Isn't this pretty much the description of every company?<p>For the most part, sure. But that's the parent's point, I think. <i>Central</i> banks are not companies, they are part of the public financial infrastructure of a nation (or, in the EU case, group of nations).</p>
]]></description><pubDate>Fri, 15 Oct 2021 19:58:41 +0000</pubDate><link>https://news.ycombinator.com/item?id=28882403</link><dc:creator>lazaroclapp</dc:creator><comments>https://news.ycombinator.com/item?id=28882403</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=28882403</guid></item><item><title><![CDATA[New comment by lazaroclapp in "Can I get some reasons to use Java instead of Kotlin?"]]></title><description><![CDATA[
<p>While admittedly not as nice as having it built into the type system from day one, there are a number of tools one can integrate into their build to add various degrees of null safety to Java.<p>Disclaimer: I am one of the maintainers of one such tool, namely <a href="https://github.com/uber/NullAway" rel="nofollow">https://github.com/uber/NullAway</a><p>It certainly won't help with verbosity (in fact, it does the opposite to at least a small degree :)), but it can dramatically reduce the number of actual NPEs when running your Java code.<p>Obviously I am not saying this is a reason to not use Kotlin. But, when, e.g. based on the things mentioned elsewhere in this comment section, you are deciding to stick with Java for a particular codebase, it doesn't mean static null checking is not an orthogonal option to consider.</p>
]]></description><pubDate>Mon, 17 May 2021 17:36:35 +0000</pubDate><link>https://news.ycombinator.com/item?id=27185961</link><dc:creator>lazaroclapp</dc:creator><comments>https://news.ycombinator.com/item?id=27185961</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=27185961</guid></item><item><title><![CDATA[New comment by lazaroclapp in "Show HN: This website moves your mouse cursor"]]></title><description><![CDATA[
<p>Since this can make you think your cursor is in a different position in the page than it actually is, couldn't it potentially be used to mislead you to click outside the page as well? Possibly not into browser chrome[1], but what about on a iframe?<p>Place button A the user wants to interact with at position (X,Y), place iframe button B at position (X+W,Y), with as little a border as possible with the rest of the page, then offset fake cursor by -W. User will try to mouse over button A, mistakenly mouse over button B, and click it in the time it takes to register that the mouse pointer just jumped from the edge of one button to the edge of the other...<p>[1] Though I can see the trick below maybe working for some browser's permission request "tooltip" UIs...</p>
]]></description><pubDate>Sat, 03 Apr 2021 03:36:15 +0000</pubDate><link>https://news.ycombinator.com/item?id=26678233</link><dc:creator>lazaroclapp</dc:creator><comments>https://news.ycombinator.com/item?id=26678233</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=26678233</guid></item><item><title><![CDATA[New comment by lazaroclapp in "U.S. citizens no longer have access to most of the world"]]></title><description><![CDATA[
<p>Independently of that, an exceedingly large number of countries require visas from Chinese citizens. See <a href="https://en.m.wikipedia.org/wiki/Visa_requirements_for_Chinese_citizens#/media/File%3AVisa_requirements_for_Chinese_citizens_holding_ordinary_and_ordinary_passports_for_public_affairs_and_Two-way_and_Exit_%26_Entry_permits.png" rel="nofollow">https://en.m.wikipedia.org/wiki/Visa_requirements_for_Chines...</a><p>This squares ok with geopolitical reasons, but not economic ones (although they certainly influence that map now and in the future).</p>
]]></description><pubDate>Tue, 28 Jul 2020 16:51:20 +0000</pubDate><link>https://news.ycombinator.com/item?id=23977784</link><dc:creator>lazaroclapp</dc:creator><comments>https://news.ycombinator.com/item?id=23977784</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=23977784</guid></item><item><title><![CDATA[New comment by lazaroclapp in "U.S. citizens no longer have access to most of the world"]]></title><description><![CDATA[
<p>If this were the only criteria, then Chinese passports would be accepted visa-free in a lot more countries than they currently are. Not saying that travel bans will remain in place once the current pandemic ends (which might take a while still), but "high spend potential" is not the sole determinant for this kind of polices when outside of a worldwide health emergency.</p>
]]></description><pubDate>Tue, 28 Jul 2020 16:34:43 +0000</pubDate><link>https://news.ycombinator.com/item?id=23977553</link><dc:creator>lazaroclapp</dc:creator><comments>https://news.ycombinator.com/item?id=23977553</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=23977553</guid></item></channel></rss>