Hacker News: neandrake

New comment by neandrake in "Getting phpBB 1.4.4 working in Docker"

neandrake — Wed, 09 Sep 2026 01:47:43 +0000

I was looking into forum software maybe 10 years ago and came across Flarum. Worth a look

New comment by neandrake in "Paged Out Issue #8 [pdf]"

neandrake — Thu, 19 Feb 2026 18:02:23 +0000

Finding this one-page was great! It gave me a new term I didn't have before that leads to all sorts of new materials to go rifling through.

New comment by neandrake in "MongoDB Server Security Update, December 2025"

neandrake — Tue, 30 Dec 2025 04:35:25 +0000

>>This [...] vuln is not a breach or compromise of MongoDB

>IANAL, but this seems like a pretty strong stance to take? Who exactly are you blaming here?

You elide the context that explains it. It's a vulnerability in their MongoDB Server product, not a result of MongoDB the company/services being compromised and secrets leaked.

New comment by neandrake in "Jujutsu worktrees are convenient (2024)"

neandrake — Mon, 08 Dec 2025 17:07:22 +0000

Worktrees are useful particularly because they look like entirely separate projects to your IDEs or other project tooling. They are more useful on larger projects with lots of daily commits. If you just use branches then whenever you switch, in the worst case, your IDE has to blow away caches and reconstruct the project layout or build the project fresh. On large projects this takes significant time. But switching your IDE to a different project, there are now two project and build caches to switch between.

New comment by neandrake in "A years-long Turkish alphabet bug in the Kotlin compiler"

neandrake — Sun, 12 Oct 2025 22:07:02 +0000

There are OS-level settings for date and unit formats but not all software obeys that, instead falling back to using the default date/unit formats for the selected locale.

New comment by neandrake in "Hypervisor 101 in Rust"

neandrake — Thu, 18 Sep 2025 15:56:08 +0000

Render to pdf or ebook to read from an ereader, at least that's what I prefer. I use Instapaper to quickly snag articles while browsing then later use my kobo to sit and read through them.

New comment by neandrake in "Inboxfuscation: Because Rules Are Meant to Be Broken"

neandrake — Wed, 17 Sep 2025 02:35:39 +0000

The article presumes the reader is familiar with "malicious inbox rules" and doesn't elaborate or link to further info on it. From what I can find online it seems to be a scenario where an email account has already been compromised somehow and the malicious actor sets up inbox rules to e.g. auto-forward emails to another attacker-controlled email. I assume the intent is to effectively gain access to emails like 2FA and password recovery in the event the target changes their email account password.

New comment by neandrake in "Hardening Firefox – a checklist for improved browser privacy"

neandrake — Sun, 31 Aug 2025 14:59:38 +0000

I'm a huge fan of uMatrix too, and have debated getting involved to help revive it.

Can you share more information on the bypass you mention?

New comment by neandrake in "Hardening Firefox – a checklist for improved browser privacy"

neandrake — Sun, 31 Aug 2025 13:11:20 +0000

Looks like the source to Bitestring's blog is still up, maybe domain registration just lapsed?

https://github.com/bitestring/bitestring.github.io/blob/main...

New comment by neandrake in "Unexpected productivity boost of Rust"

neandrake — Wed, 27 Aug 2025 21:57:53 +0000

Thank you, I look forward to watching your presentation.

New comment by neandrake in "Unexpected productivity boost of Rust"

neandrake — Wed, 27 Aug 2025 21:50:15 +0000

Rust caught the lock being held across an await boundary, but without further context I'd hedge there's still a concurrency issue there if the solution was to release the lock before the await.

Presumably the lock is intended to be used for blocking until the commit is created, which would only be guaranteed after the await. Releasing the lock after submitting the transaction to the database but before getting confirmation that it completed successfully would probably result in further edge cases. I'm unfamiliar with rust's async, but is there a join/select that should be used to block, after which the lock should be unlocked?

New comment by neandrake in "Unexpected productivity boost of Rust"

neandrake — Wed, 27 Aug 2025 21:45:48 +0000

Same would be true for any resource that needs cleaned up, right? Referring to stop-polling-future as canceling is probably not good nomenclature. Typically canceling some work requires cleanup, if only to be graceful let alone properly releasing resources.

New comment by neandrake in "How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos"

neandrake — Wed, 20 Aug 2025 02:59:16 +0000

They first disabled rubocop to prevent further exploit, then rotated keys. If they awaited deploying the fix that would mean letting compromised keys remain valid for 9 more hours. According to their response all other tools were already sandboxed.

However their response doesn't remediate putting secrets into environment variables in the first place - that is apparently acceptable to them and sets off a red flag for me.

New comment by neandrake in "Jane Street's sneaky retention tactic"

neandrake — Sat, 28 Jun 2025 18:08:37 +0000

If your only professional experience is OCaml and you want to look elsewhere for work then your opportunities shrink noticeably. Especially if you're looking for a position that requires experience. It's much more digestible for a company to hire someone out of college and invest in training on tooling. But many companies won't get past the resume if a senior developer has to take more time to on-board.

New comment by neandrake in "Jujutsu (jj), a Git compatible VCS"

neandrake — Sun, 20 Oct 2024 14:55:17 +0000

Git’s rerere functionality should address this, right?

https://git-scm.com/book/en/v2/Git-Tools-Rerere

New comment by neandrake in "Null-Restricted and Nullable Types"

neandrake — Fri, 02 Aug 2024 10:52:23 +0000

I don’t even prefer it for indicating that something can return null. In most cases the Option API is more tedious and awkward than a null check and there are existing annotations that can be used to flag nullable return types, for documentation. The only places I’ve found Option to be helpful are where it helps with method composability, or in some hashmaps as a simple way to distinguish between “lookup not previously tried” vs “lookup resulted in no value” vs “lookup resulted in value” - it’s a hack and looked down upon because the Option value itself is null, but I view it the same as “Boolean” being nullable. As long as the details are encapsulated it’s not too problematic.

New comment by neandrake in "Anti-Cheat Expert: all your pixels are belong to us"

neandrake — Tue, 11 Jun 2024 03:08:19 +0000

I mean, the same goes for all crime being a people problem. The anti-cheat keeps honest people honest as they say.

New comment by neandrake in "Ask HN: Founders who offer free/OS and paid SaaS, how do you manage your code?"

neandrake — Tue, 14 May 2024 01:43:51 +0000

> The technique was called product-line engineering.

Thank you for adding this bit of info! We’ve been using this model for a while but I hadn’t come across a label for it. Now knowing this, I’m coming across a ton of great info about managing/sustaining these product families.

New comment by neandrake in "Ask HN: Which books/resources to understand modern Assembler?"

neandrake — Mon, 22 Apr 2024 05:26:59 +0000

I think you misread the original post. They’re referring to LLVM the compiler toolchain, not LLMs.

New comment by neandrake in "Basic Things"

neandrake — Sat, 30 Mar 2024 16:00:09 +0000

Great write up. I read through maybe half of the points and skipped to the end, bookmarked to come back and finish later.

I’d like if the author could elaborate a bit about the types of projects that influenced these guidelines. Roughly what constitutes a “large” project, were the projects open source, private/commercial, or a mix of both, does web/service platform vs. desktop/local platform have an impact on these, etc.