Hacker News: ollien

Ninth Circuit Holds Copilot Creates New Code, Not Stripped Copies

ollien — Sun, 18 Oct 2026 02:12:49 +0000

Article URL: https://www.fenwick.com/insights/publications/nothing-remove-ninth-circuit-holds-copilot-creates-new-code-not-stripped

Comments URL: https://news.ycombinator.com/item?id=50137198

Points: 3

# Comments: 1

New comment by ollien in "OpenCode 2.0"

ollien — Thu, 15 Oct 2026 11:27:26 +0000

What sandboxing tools do you recommend? There's lots out there and I'm unsure which to trust.

New comment by ollien in "Plain text is still one of the best technologies we have"

ollien — Mon, 05 Oct 2026 19:39:11 +0000

Tangential to the actual point of the post, but the talk "Plain text? Really?" by Dylan Beattie[1] is one of my favorite talks. It does a great job capturing the problems with something that "seems" so simple. I think the author of the blog is well aware of these, though :)

[1] https://www.youtube.com/watch?v=_mZBa3sqTrI

New comment by ollien in "My last six months at Evernote"

ollien — Sat, 12 Sep 2026 14:22:46 +0000

Hug of death? Archives don't have it either

New comment by ollien in "Tile's security is so bad it's a feature for stalkers"

ollien — Sat, 25 Jul 2026 20:58:19 +0000

Very cool! I only skimmed Section 4 a bit, but that's really cool!

I was going to ask how the web UIs possibly work if the location is indistinguishable, but I went to the Google Find Hub, and it appears you can't view the location for tags unless you enter your phone's pin code / pattern lock. This must either communicate with the phone or the keys are stored on Google's end.

EDIT: I turned my phone off, and I can still get the location of my keys... surely this doesn't mean the key is stored on their end? Wouldn't be very good E2EE in that case :)

New comment by ollien in "Tile's security is so bad it's a feature for stalkers"

ollien — Sat, 25 Jul 2026 20:42:51 +0000

It's interesting to me that other trackers have end-to-end encryption. I wouldn't have expected it but makes sense for the threat model.

> Providerslike Apple and Google achieve location indistinguishability by end-to-end encrypting location information using a public key embedded in BLE advertisements emitted by a tag

Though it makes me wonder... What's the private key? If the public key is attached to the tag, how is the device getting it? I'm guessing it gets shared during pairing.

New comment by ollien in "An interview with an Apple emoji designer"

ollien — Tue, 16 Jun 2026 15:41:55 +0000

If the author is reading this, the hyperlink to the book in the first paragraph is broken. Looks like it's attempting to direct you to an absolute url that was meant to be relative.

New comment by ollien in "PS3 Emulator Devs Politely Ask That People Stop Flooding It with AI PRs"

ollien — Mon, 11 May 2026 00:45:30 +0000

I've struggled with this "responsibility" take. What does it mean in the context of an open source project? As far as I understand it, the original contributors of bugs are often not the ones fixing them (though they can be). Is it that if you write enough buggy code you get banned as a contributor? Is it that you're not allowed to say Claude ate my homework?

New comment by ollien in "I’ve banned query strings"

ollien — Sat, 09 May 2026 22:08:54 +0000

When the goal is "the funniest way", I think that's a hit :)

New comment by ollien in "I’ve banned query strings"

ollien — Sat, 09 May 2026 20:05:41 +0000

I don't think it's an abuse, RFC9110 defines 414 as a response for "refusing to service the request because the target URI is longer than the server is willing to interpret". Since adding a query string involves only adding characters, this seems fine; there's no stipulation as far as I can tell that all pages a server hosts must adhere to the same length. I'd be curious if any well-known clients interpret it that way though, and make caching decisions based on it. As far as I know, they shouldn't.

Obviously it's against the spirit of the thing, but I don't think it's wrong per-se.

New comment by ollien in "Tell HN: Fiverr left customer files public and searchable"

ollien — Wed, 15 Apr 2026 00:46:02 +0000

I've never been in the position that I've had to deal with this. Is the best you can do in this situation to pull the files and optionally republish them to a robots.txt'd path (with authn/z, too)? I can't imagine you can get it pulled from search engines very quickly...

New comment by ollien in "Show HN: I made a "programming language" looking for feedback"

ollien — Mon, 30 Mar 2026 00:06:08 +0000

I've been waiting for something like this to come along. I keep hearing people say LLMs are a new abstraction layer, and I fundamentally disagree. We don't commit our compiled machine code, we commit our C. Yet, with LLMs, we commit our generated source code, completely throwing away the English language abstraction.

This seems to scratch that itch. The non determinism makes it probably not suitable for most uses, though.

New comment by ollien in "OpenTelemetry profiles enters public alpha"

ollien — Thu, 26 Mar 2026 19:59:50 +0000

As far as I'm aware, Pyroscope itself is not a profiler, but a place you can send/query profiles. OpenTelemtry is releasing a profiler, so they don't compare. One can be used with the other.

New comment by ollien in "OpenTelemetry profiles enters public alpha"

ollien — Thu, 26 Mar 2026 18:47:26 +0000

Very excited for this. We've used the Elixir version of this at $WORK a handful of times and have found it exceptionally useful.

New comment by ollien in "AI Usage Policy"

ollien — Fri, 23 Jan 2026 13:14:00 +0000

Not sure how I feel about transcripts. Ultimately I do my best to make any contributions I make high quality, and that means taking time to polish things. Exposing the tangled mess of my thought process leading up to that either means I have to "polish" that too (whatever that ends up looking like), or put myself in a vulnerable position of showing my tangled process to get to the end result.

New comment by ollien in "Install.md: A standard for LLM-executable installation"

ollien — Sat, 17 Jan 2026 01:01:43 +0000

I don't love the concept, but I do wonder if it could be improved by using a skill that packages and install script, and context for troubleshooting. That way you have the benefits of using an install script, and at least a way to provide pointers for those unfamiliar with the underlying tooling.

New comment by ollien in "Unauthenticated remote code execution in OpenCode"

ollien — Tue, 13 Jan 2026 12:27:36 +0000

Yep yep, makes sense. I was thinking about it running in headless mode (i.e. with --listen)

New comment by ollien in "Unauthenticated remote code execution in OpenCode"

ollien — Tue, 13 Jan 2026 04:36:31 +0000

> Neovim’s server defaults to named pipes or domain sockets, which do not have this issue. The documentation states that the TCP option is insecure.

Good note on pipes / domain sockets, but it doesn't appear there's a "default", and the example in the docs even uses TCP, despite the warning below it.

https://neovim.io/doc/user/api.html#rpc-connecting

(EDIT: I guess outside of headless mode it uses a named pipe?)

> VS Code’s ssh daemon is authenticated.

How is it authenticated? I went looking briefly but didn't turn up much; obviously there's the ssh auth itself but if you have access to the remote, is there an additional layer of auth stopping anyone from executing code via the daemon?

New comment by ollien in "Unauthenticated remote code execution in OpenCode"

ollien — Tue, 13 Jan 2026 00:08:44 +0000

A coworker raised an interesting point to me. The CORS fix removes exploitation by arbitrary websites (but obviously allows full access from the opencode domain), but let's take that piece out for a second...

What's the difference here between this and, for example, the Neovim headless server or the VSCode remote SSH daemon? All three listen on 127.0.0.1 and would grant execution access to another process who could speak to them.

Is there a difference here? Is the choice of HTTP simply a bad one because of the potential browser exploitation, which can't exist for the others?

New comment by ollien in "RTX 5090 and Raspberry Pi: Can it game?"

ollien — Sat, 10 Jan 2026 03:00:13 +0000

I'm not very familiar with this layer of things; what does it mean for a GPU to drive a boot sequence? Is there something massively parallel that is well suited for the GPU?