Hacker News: nulltrace

New comment by nulltrace in "Benchmark in Milliseconds"

nulltrace — Tue, 06 Oct 2026 21:43:14 +0000

Looping works, though reusing the same small buffer mostly measures hot-cache performance.

New comment by nulltrace in "Small programming tricks"

nulltrace — Wed, 16 Sep 2026 23:25:34 +0000

No. Node's built-in fetch uses Undici. The custom hook is dispatcher, with an Undici-compatible dispatcher: fetch(url, { dispatcher })

New comment by nulltrace in "Proof of Capture: Apple Reference Image, but open source and using steganography"

nulltrace — Thu, 10 Sep 2026 22:52:46 +0000

Soon my phone can cryptographically prove the beauty filter lied at capture time.

New comment by nulltrace in "Trusting-Trust Attack against an Entire Linux Distribution"

nulltrace — Mon, 07 Sep 2026 22:46:43 +0000

Rebuilding strip from clean source doesn't clear it. The copy in the bootstrap seed modifies its replacement, and the replacement carries on from there. The provenance can still look normal.

New comment by nulltrace in "Sort branches by last commit date"

nulltrace — Sun, 30 Aug 2026 22:55:32 +0000

Rebase an old branch and it suddenly looks recent again. The rewritten tip gets a fresh committer date.

New comment by nulltrace in "Mojo is now open source"

nulltrace — Thu, 20 Aug 2026 23:22:02 +0000

Anything in our stack is modern C++ if we can help it. If Mojo can replace those kernels without the Python runtime sitting underneath, even better.

New comment by nulltrace in "Perfection is not over-engineering"

nulltrace — Tue, 21 Jul 2026 00:02:43 +0000

I think your concrete treehouse counts too though. Add a shower and suddenly you need plumbing, drainage, the structure has to hold more weight. The overcomplicated part drags the overengineered part along with it. They pretty much collapse into the same thing.

New comment by nulltrace in "Almost Always Unsigned"

nulltrace — Wed, 08 Jul 2026 23:18:30 +0000

That loop reads like a bug to anyone who hasn't memorized the wrapping rules. while (i-- > 0) on a signed index does the same thing.

New comment by nulltrace in "Building durable workflows on Postgres"

nulltrace — Thu, 28 May 2026 23:46:54 +0000

The SKIP LOCKED pattern is fine until the worker count climbs. Then vacuum can't keep up. Dead tuples pile up, visibility map turns to swiss cheese. Queue table is tiny on disk but the planner thinks it's huge and stops using the index. It gets ugly fast.

New comment by nulltrace in "C constructs that still don't work in C++"

nulltrace — Mon, 25 May 2026 23:50:56 +0000

Compiler mode won't catch the `extern "C"` thing though. Both sides compile happily, link blows up on mangled names. What I do is just keep a throwaway .cpp in tests that #includes the header and calls a few of the public functions. Dumb but it's basically the only thing that ever catches that case before some downstream user does.

New comment by nulltrace in "Nim-Presto – REST API Framework for Nim Language (2024)"

nulltrace — Tue, 19 May 2026 23:10:27 +0000

Being a generalist isn't easy.

New comment by nulltrace in "AI didn't delete your database, you did"

nulltrace — Tue, 05 May 2026 23:52:34 +0000

Most IAM policies start as "whatever made the deploy pass." Need rds:CreateDBInstance? Fine, rds:* it is. Ship it. Months later that same role can wipe the cluster and nobody remembers why it ever had that permission.

Separate accounts help, but only if someone actually goes back and cleans it up, which… yeah, doesn't really happen.

New comment by nulltrace in "I am worried about Bun"

nulltrace — Mon, 04 May 2026 22:48:01 +0000

There's a GitHub issue for the freeze thing. Their security scanner passes the full dep list as CLI arguments, large monorepo on Linux and you blow past ARG_MAX. Spawn silently hangs, no error, --ignore-scripts doesn't help because the scanner is separate from postinstall. Been broken since 1.3.5 at least.

New comment by nulltrace in "I built my own hair electrolysis machine"

nulltrace — Sun, 03 May 2026 23:42:09 +0000

designed, but never tested

New comment by nulltrace in "Alert-driven monitoring"

nulltrace — Sun, 03 May 2026 23:15:30 +0000

We went through the same switch. Half our alerts had been firing for a while and nobody ever acted on them.

New comment by nulltrace in "LinkedIn is scanning browser extensions"

nulltrace — Fri, 01 May 2026 00:43:31 +0000

Firefox at least randomizes extension IDs per install. Chrome hands all of that to extension devs, basically a "your problem now".

New comment by nulltrace in "Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library"

nulltrace — Thu, 30 Apr 2026 23:21:37 +0000

Stale training data is part of it. But even a current model can't tell what setup.py is going to run on your box. Nothing actually inspects the package before it executes. You'd want something that pulls the metadata and checks what hooks are in there before anything runs.

New comment by nulltrace in "GitHub Actions is the weakest link"

nulltrace — Tue, 28 Apr 2026 19:56:29 +0000

Common mistake is trusting the repo instead of the workflow. Then any workflow inherits the same cloud access.

New comment by nulltrace in "The woes of sanitizing SVGs"

nulltrace — Mon, 27 Apr 2026 23:06:14 +0000

Browsers already treat the same SVG differently depending on how you embed it. strips scripts and external resource loads. and inline don't. People test with img tags, looks fine, then someone switches the embed method and everything opens up.

New comment by nulltrace in "NPM website was down"

nulltrace — Mon, 27 Apr 2026 22:17:52 +0000

We added a preflight curl against registry.npmjs.org before the install step in CI. Not surprising they went down together.