Hacker News: pheggs

New comment by pheggs in "OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability"

pheggs — Fri, 06 Nov 2026 13:26:48 +0000

> it showed errors in the methodology of an earlier study, it did not produce a novel result.

It showed that there's no big difference. From the link:

> Combining corrections for all of these aforementioned items, the reanalysis revealed that only 4 out of the original 11 languages correlated with abnormal defect rates, and even for those the effect size is exceedingly small.

> we have real-world evidence that rust leads to significantly less bugs in the real world

no, we only have evidence for memory bugs, that's not what I was talking about

New comment by pheggs in "OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability"

pheggs — Fri, 06 Nov 2026 09:00:20 +0000

> that only tries to show a single study is flawed, nothing else

no the study failed to show any difference in bug count for a specific set of common used languages, where C and Python were both part of the dataset.

I don't think programming languages have a big impact on bugs per line when every line is written by a human. Now given that I was talking about bug counts, not severity.

New comment by pheggs in "OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability"

pheggs — Thu, 05 Nov 2026 23:28:40 +0000

With all the respect but I don't think I am: https://arxiv.org/html/1901.10220v2

New comment by pheggs in "Alpine Linux Security Advisory: OpenSSH-server password authentication bypass"

pheggs — Thu, 05 Nov 2026 21:14:51 +0000

different kind of programming languages change the kinds of bugs and their properties, but it does not change the amount of bugs per line of code. in respect to C and rust for example, rust may have less memory bugs - which LLMs seems to be able to spot now - but it did increase supply chain attacks for example.

New comment by pheggs in "Alpine Linux Security Advisory: OpenSSH-server password authentication bypass"

pheggs — Thu, 05 Nov 2026 19:45:14 +0000

Don't get me wrong, I think rust has some great features and does some things extraordinarily good. But at the same time I can see that for 99% of cases it's just as prone to bugs, including security and supply chain attacks, as any other language. I think I could just as much argue that any "->" is clearly de-referencing that needs checking, which is also pretty easy to see.

New comment by pheggs in "Alpine Linux Security Advisory: OpenSSH-server password authentication bypass"

pheggs — Thu, 05 Nov 2026 19:32:43 +0000

That's exactly what I mean. And I have seen a huge amount of unchecked unwraps in production code in the past years

New comment by pheggs in "Alpine Linux Security Advisory: OpenSSH-server password authentication bypass"

pheggs — Thu, 05 Nov 2026 19:09:24 +0000

I don't think it's that people forget it while writing the code, it's that people want their program to work with as little effort as possible and decide to ignore it "for now". And that definitely can happen with Option and Result as well. There's no protection for not checking return values, and it's probably not even possible to protect against (in entirety)

New comment by pheggs in "Alpine Linux Security Advisory: OpenSSH-server password authentication bypass"

pheggs — Thu, 05 Nov 2026 19:02:51 +0000

I have to admit that I am a bit disappointed in this kind of thinking. There's vulnerabilities everywhere as especially the past few weeks have shown.

One occurrence is not a statistic and should not be used as evidence - it's just an example of a vulnerability that due to various bad circumstances lead to a particularity bad outcome. This logic is in my opinion equally flawed as calling alpine safe now because this particular vulnerability has been fixed.

I'm not a big fan of blaming and I think it's just a result of bad circumstances, but it's interesting to see how some seem to blame musl, but one could argue further that musl documented the behavior of their API which was ignored by openssh and so on

New comment by pheggs in "OpenSSH 10.6p2 has been released with a workaround for a critical vulnerability"

pheggs — Thu, 05 Nov 2026 18:04:53 +0000

both alpine and musl are great in my opinion, and as far as I know theres no empirical evidence that it is more or less secure overall than alternatives. would you like to elaborate your opinion?

New comment by pheggs in "DeepSeek: DeepSeek v4.1 Flash 1017"

pheggs — Sat, 17 Oct 2026 10:36:59 +0000

in my experience there's a huge difference in token usage when creating new projects versus working on existing ones

New comment by pheggs in "I Love Software Rendering"

pheggs — Fri, 16 Oct 2026 15:04:09 +0000

I know this is not entirely what this article is about, but I love software rendering for desktop apps. It seems to me that the performance impact with proper paint invalidation is negligible, but doesn't suffer from the same driver issues as hardware accelerated rendering seems to have. Bonus that it doesnt use any GPU resources in the age of AI

New comment by pheggs in "Why isn't the industry freaking out about DeepSeek 4.1 Flash?"

pheggs — Fri, 09 Oct 2026 10:04:10 +0000

It could be.

New comment by pheggs in "Why isn't the industry freaking out about DeepSeek 4.1 Flash?"

pheggs — Fri, 09 Oct 2026 09:48:57 +0000

should you not be worried more about sending data to providers of your own country? I think they are equally bad personally, but if you think one of them is acceptable, why do you prefer it to be your own government that has more ties to your life?

New comment by pheggs in "Why isn't the industry freaking out about DeepSeek 4.1 Flash?"

pheggs — Fri, 09 Oct 2026 09:45:21 +0000

I have a different experience and find them just as good as the latest anthropic and openai models. But then, we probably can just have opinions on this as benchmarks are probably used for marketing to a large degree. I find it hard to find truly independent benchmarks that don't have any ties to the cash flow of openai and anthropic, can not be trained up on etc.

New comment by pheggs in "Why isn't the industry freaking out about DeepSeek 4.1 Flash?"

pheggs — Fri, 09 Oct 2026 09:37:17 +0000

I find it curious that almost every AI post has way more comments than other posts, and I sometimes wonder how big of a part agents play here. I can't seem to distinguish whether it's just real interest in the subject or a big campaign trying to influence people's opinion

New comment by pheggs in "Why Switzerland has 25 gbit internet and America doesn't"

pheggs — Fri, 03 Jul 2026 06:43:16 +0000

for those curious, regarding your first point, as far as I know any home that is dark red on this map has access to it, and any light red is planned to get access: https://ftth.init7.net/

New comment by pheggs in "Fable 5 is Back"

pheggs — Thu, 02 Jul 2026 07:02:00 +0000

I dont buy that, mainly because in blind tests where people dont know which model was used and choose a result, this does not seem to hold true

New comment by pheggs in "Fable 5 is Back"

pheggs — Wed, 01 Jul 2026 21:37:52 +0000

I find it difficult to compare LLMs in general. It will do better in some cases, worse in others. As far as I see it, most of it is marketing. You can try it out extremely cheaply though through their API and OpenCode. I personally would recommend it.

New comment by pheggs in "Claude Fable 5 Promotional Access"

pheggs — Wed, 01 Jul 2026 21:27:52 +0000

I would not call them idiots personally, they are just facing an extraordinary difficult situation with their open weight competition that's almost impossible to fix. They will have to aim for the high-end B2B market eventually, and attempt to lock out their competition through regulation or other means

New comment by pheggs in "Fable 5 is Back"

pheggs — Wed, 01 Jul 2026 21:20:25 +0000

I was wrong, I thought they would only go for B2B already. But instead they will remove it from the subscription and price it at 50$/mtok. Compared to GLM-5.2 for 4.40$ that's quite a gap