<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Hacker News: raggi</title><link>https://news.ycombinator.com/user?id=raggi</link><description>Hacker News RSS</description><docs>https://hnrss.org/</docs><generator>hnrss v2.1.1</generator><lastBuildDate>Fri, 28 Aug 2026 12:53:35 +0000</lastBuildDate><atom:link href="https://hnrss.org/user?id=raggi" rel="self" type="application/rss+xml"></atom:link><item><title><![CDATA[New comment by raggi in "Tailcat – Like netcat, but over Tailscale’s data plane"]]></title><description><![CDATA[
<p>always have! our darwin and windows clients are closed source, but they wrap the oss implementation in github.com/tailscale/tailscale and you can see and even use all the same hooks yourself.<p>the control plane is closed source, but headscale is an open source alternative that we embrace and encourage people to use if it meets their needs/desires</p>
]]></description><pubDate>Wed, 26 Aug 2026 19:56:24 +0000</pubDate><link>https://news.ycombinator.com/item?id=49454925</link><dc:creator>raggi</dc:creator><comments>https://news.ycombinator.com/item?id=49454925</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49454925</guid></item><item><title><![CDATA[New comment by raggi in "Xwayland 26.1.0 rc1"]]></title><description><![CDATA[
<p>> But, at the same time. A design that requires everyone to implement their own protocols and everyone to refix the same bugs in their own compositor is inherintly bad.<p>Consider that if every DE wrote their own Xorg implementation the story would be the same.<p>A key question is why everyone is writing their own compositor, this is not about the protocol design, it's about the state of collaboration.<p>I spent some time in the last week fixing lowdpi font rendering in cosmic, enabling me to switch to it. I then discovered that cosmic-comp's VRR had a terrible feedback path causing conformant applications to stutter badly, so I have large patch stack rewiring full screen feedback, tranche compatibility, fence timing and so on (it's fucking buttery now though, which is nice). That then showed up some input processing bugs becoming visible via playing videos in firefox, leading further to me discovering that cross-plane locking was causing frame drops too. Now I've got a giant stack of shit I need to cleanup and upstream - but the end result (along with the freetype render patches I got into Firefox a while back) is a better DE than I've had on Linux in decades. Maybe if upstreaming goes well I'll do MPO for an encore.<p>> In X, if the WM crashes, X is still running, and you can just restart the WM. In Wayland, if you hit a bug it takes everything down with it.<p>See above, the WM did not need to embed the compositor. That's not a protocol requirement, it's and implementer choice. I actually really wish it didn't. Of all the aforementioned patches only two are in Smithay. As I was actually fixing compositing for the workflow I just had to suffer through I would have had to restart pretty much the whole session anyway - though in fact the later stages of my workflow I was only directly killing cosmic-comp and cosmic-session was automatically restarting it all. No really good way to recover the surfaces though, so apps still need to restart.<p>This is not unlike the _another_ bug stream I tracked down this evening, where cosmic-applets would fail to display tray icons on both displays correctly - that turned out to be a bug where one icon provider was unresponsive to part of the protocol, coupled with a synchronous dispatch from the event handle into that blocking return call. Perhaps more interestingly though that manifest during diagnosis something I've seen a lot in other DE chains where tray icons for auto-started electron apps were highly sketchy - well a common electron wrapper gives up entirely on the first whiff of an error with the dbus interface and doesn't retry.<p>Years ago I gave up on Linux DE's because reconfiguring xft, gnome, etc was too much of a time sink. How far I've come, now I'm back :'(</p>
]]></description><pubDate>Thu, 20 Aug 2026 01:59:29 +0000</pubDate><link>https://news.ycombinator.com/item?id=49369591</link><dc:creator>raggi</dc:creator><comments>https://news.ycombinator.com/item?id=49369591</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49369591</guid></item><item><title><![CDATA[New comment by raggi in "Xwayland 26.1.0 rc1"]]></title><description><![CDATA[
<p>Nice. XWayland has been a key transitional piece we'll still need for a while.</p>
]]></description><pubDate>Thu, 20 Aug 2026 01:07:02 +0000</pubDate><link>https://news.ycombinator.com/item?id=49369259</link><dc:creator>raggi</dc:creator><comments>https://news.ycombinator.com/item?id=49369259</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49369259</guid></item><item><title><![CDATA[New comment by raggi in "Google is making private AI practical with homomorphic encryption"]]></title><description><![CDATA[
<p><a href="https://www.jeremykun.com/2024/05/04/fhe-overview/#the-highest-level-view" rel="nofollow">https://www.jeremykun.com/2024/05/04/fhe-overview/#the-highe...</a><p>> Fourth, there is a bandwidth concern. FHE encryption schemes generally increase the size of the data being encrypted, and the user must send the server a special set of encryption keys to enable the computation, which are relatively large as well. The special keys need only be generated and sent once and can be used for all future computations, but they can easily be gigabytes in size. In one example FHE scheme with lightweight keys, a ciphertext encrypting a single integer is on the order of 25 KB, and the special keys are about 0.5 GB. In others, 16,000 or more integers are packed into a single ciphertext of similar size, but the keys can be 10s of GiBs.</p>
]]></description><pubDate>Fri, 14 Aug 2026 19:47:35 +0000</pubDate><link>https://news.ycombinator.com/item?id=49303716</link><dc:creator>raggi</dc:creator><comments>https://news.ycombinator.com/item?id=49303716</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49303716</guid></item><item><title><![CDATA[New comment by raggi in "Tracking down the 16-year-old WAL-reset SQLite bug"]]></title><description><![CDATA[
<p>SQLite has an online backup API as well, but it is slower and requires a significant additional page cache cost.<p>The team chose SQLite early on (there are some blog posts about this) and then we vertically scaled against the SQLite architecture. There are subtle ways you come to depend on the proximity/latency when you scale with local storage that mean switching requires a lot of non-obvious work - it’s probably the largest hazard for embracing SQLite in a growing saas - but at the same time you can push the vertical scale pretty far, which has great margins.<p>Had we scaled a different architecture of database there’s little reason to believe it would have been plain sailing as seems to be implied here.</p>
]]></description><pubDate>Thu, 13 Aug 2026 14:35:13 +0000</pubDate><link>https://news.ycombinator.com/item?id=49286616</link><dc:creator>raggi</dc:creator><comments>https://news.ycombinator.com/item?id=49286616</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49286616</guid></item><item><title><![CDATA[New comment by raggi in "Tracking down the 16-year-old WAL-reset SQLite bug"]]></title><description><![CDATA[
<p>We have very good reasons for our checkpointing model, related to our backup + disaster recover strategy, along with resource cost. It might be worth writing about one day, so I'll not give away all the details, but in very short form, we organize a backup strategy that has minimal pause time, avoids doubling the page cache cost of the database, and enables extremely fast byte-copy restores in disaster recovery.</p>
]]></description><pubDate>Wed, 12 Aug 2026 23:09:52 +0000</pubDate><link>https://news.ycombinator.com/item?id=49279817</link><dc:creator>raggi</dc:creator><comments>https://news.ycombinator.com/item?id=49279817</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49279817</guid></item><item><title><![CDATA[The FastLanes Unified Transport Layout]]></title><description><![CDATA[
<p>Article URL: <a href="https://blog.dave.tf/post/fastlanes-utl/">https://blog.dave.tf/post/fastlanes-utl/</a></p>
<p>Comments URL: <a href="https://news.ycombinator.com/item?id=49263928">https://news.ycombinator.com/item?id=49263928</a></p>
<p>Points: 7</p>
<p># Comments: 0</p>
]]></description><pubDate>Tue, 11 Aug 2026 20:22:48 +0000</pubDate><link>https://blog.dave.tf/post/fastlanes-utl/</link><dc:creator>raggi</dc:creator><comments>https://news.ycombinator.com/item?id=49263928</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49263928</guid></item><item><title><![CDATA[New comment by raggi in ""Code was never the hard part" is an insult to all programmers"]]></title><description><![CDATA[
<p>One of the strongest teams I worked with, working on an extremely large and ambitious project used to answer a lot of product/executive type questions regarding missing areas that we knew how to author and could safely assume general design consensus “it’s just typing”.<p>It was a very useful contraction in the right senior circles where there was a pretty good understanding of the meaning and decently reliable assumed consensus.<p>I eventually stoped using the phrase because it had started leaking deeper into the team and the impact on earlier career or less confident programmers was often no longer positive, it could be misinterpreted in lots of different ways but the most harmful was when it would further decimate confidence and discourage requests for help when something wasn’t obvious to the ultimate author.<p>As with almost every attempt to generalize in software engineering the repetition or extrapolation beyond the context in which it was intended can have negative side effects, it doesn’t matter if it’s a simple notion like “dry”, or a comment like “code was never the hard part”. None of these phrases survive context loss and still retain efficacy at general receivers.</p>
]]></description><pubDate>Sat, 08 Aug 2026 18:44:29 +0000</pubDate><link>https://news.ycombinator.com/item?id=49224635</link><dc:creator>raggi</dc:creator><comments>https://news.ycombinator.com/item?id=49224635</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49224635</guid></item><item><title><![CDATA[New comment by raggi in "Show HN: ssh ssh.place"]]></title><description><![CDATA[
<p>So really the trend I'm talking about here is people turning SSH into a browser, hosting apps behind SSH that expect a much higher volume of TOFU happening, which is a departure from the "first time i setup my vps" kind of case.<p>Honestly at this point I'd be kind of happy if we could just use an x.509 cert from a webpki acme provider in the sshd and be done with it, for the host identity part.</p>
]]></description><pubDate>Wed, 05 Aug 2026 22:03:02 +0000</pubDate><link>https://news.ycombinator.com/item?id=49189650</link><dc:creator>raggi</dc:creator><comments>https://news.ycombinator.com/item?id=49189650</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49189650</guid></item><item><title><![CDATA[New comment by raggi in "Show HN: ssh ssh.place"]]></title><description><![CDATA[
<p>i've seen it, so the answer is non-zero</p>
]]></description><pubDate>Wed, 05 Aug 2026 22:02:03 +0000</pubDate><link>https://news.ycombinator.com/item?id=49189633</link><dc:creator>raggi</dc:creator><comments>https://news.ycombinator.com/item?id=49189633</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49189633</guid></item><item><title><![CDATA[New comment by raggi in "TIME Is Serving AI Bots a Different Website, with Ads Built In"]]></title><description><![CDATA[
<p>Next step the ads become increasingly sophisticated prompt injection to ensure they make it to the user, but the prices plummet in the meantime because the ads have low efficacy. They get purchased mostly by the scammers and by the time they start showing up in user chats they’ll be full on LLM assisted interactive user manipulation campaigns with far worse outcomes than the worst of YouTube and social media ads.</p>
]]></description><pubDate>Wed, 05 Aug 2026 15:29:46 +0000</pubDate><link>https://news.ycombinator.com/item?id=49184312</link><dc:creator>raggi</dc:creator><comments>https://news.ycombinator.com/item?id=49184312</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49184312</guid></item><item><title><![CDATA[New comment by raggi in "Show HN: ssh ssh.place"]]></title><description><![CDATA[
<p>When you see people advertising a coffee shop at a conference and people TOFU'ing on conference wifi then plugging in credit card numbers, the picture gets a little more clear.</p>
]]></description><pubDate>Wed, 05 Aug 2026 02:39:43 +0000</pubDate><link>https://news.ycombinator.com/item?id=49177952</link><dc:creator>raggi</dc:creator><comments>https://news.ycombinator.com/item?id=49177952</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49177952</guid></item><item><title><![CDATA[New comment by raggi in "Show HN: ssh ssh.place"]]></title><description><![CDATA[
<p>Fair!<p>When I last harassed Crawshaw about this and we discussed bits, he submitted <a href="https://github.com/C2SP/C2SP/blob/main/well-known-ssh-hosts.md" rel="nofollow">https://github.com/C2SP/C2SP/blob/main/well-known-ssh-hosts....</a><p>Unfortunately neither of us has taken time (AFAIK) to go back and implement it anywhere.</p>
]]></description><pubDate>Tue, 04 Aug 2026 16:26:58 +0000</pubDate><link>https://news.ycombinator.com/item?id=49171138</link><dc:creator>raggi</dc:creator><comments>https://news.ycombinator.com/item?id=49171138</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49171138</guid></item><item><title><![CDATA[New comment by raggi in "Show HN: ssh ssh.place"]]></title><description><![CDATA[
<p>sshfp is not PKI. It's an option and it is off by default in ssh(1). In practice no one actually deploys it, exe.dev, terminal.shop, jobs.{whoever.com}, etc. I've yet to see an in the wild deployment. The aforementioned sites let you perform electronic payment transactions over ssh without it, which is probably a PCI violation tbh, but auditors aren't good enough.<p>webpki is on by default.</p>
]]></description><pubDate>Mon, 03 Aug 2026 07:06:08 +0000</pubDate><link>https://news.ycombinator.com/item?id=49152213</link><dc:creator>raggi</dc:creator><comments>https://news.ycombinator.com/item?id=49152213</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49152213</guid></item><item><title><![CDATA[New comment by raggi in "Show HN: ssh ssh.place"]]></title><description><![CDATA[
<p>here, less than most, but look for ssh agents<p>on terminal.shop, steal credit cards
on jobs endpoints, perform identity theft
on exe.dev, whatever you put on there</p>
]]></description><pubDate>Mon, 03 Aug 2026 07:00:28 +0000</pubDate><link>https://news.ycombinator.com/item?id=49152152</link><dc:creator>raggi</dc:creator><comments>https://news.ycombinator.com/item?id=49152152</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49152152</guid></item><item><title><![CDATA[New comment by raggi in "Show HN: ssh ssh.place"]]></title><description><![CDATA[
<p>Time for your regular reminder that ssh has no PKI and is trivial to mitm during tofu.</p>
]]></description><pubDate>Mon, 03 Aug 2026 03:50:33 +0000</pubDate><link>https://news.ycombinator.com/item?id=49151021</link><dc:creator>raggi</dc:creator><comments>https://news.ycombinator.com/item?id=49151021</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49151021</guid></item><item><title><![CDATA[New comment by raggi in "Tailscale didn't stop the Hugging Face intrusion"]]></title><description><![CDATA[
<p>fwiw, we have been working on increasing modularity options in the client and a substantial volume of features can now be built out of the clients, see <a href="https://github.com/tailscale/tailscale/tree/main/feature" rel="nofollow">https://github.com/tailscale/tailscale/tree/main/feature</a> for details.<p>If you are motivated to build a much less featureful client, it is easier now than it has ever been, and this work is ongoing.</p>
]]></description><pubDate>Fri, 31 Jul 2026 22:45:26 +0000</pubDate><link>https://news.ycombinator.com/item?id=49129390</link><dc:creator>raggi</dc:creator><comments>https://news.ycombinator.com/item?id=49129390</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49129390</guid></item><item><title><![CDATA[New comment by raggi in "GCC steering committee announces AI policy"]]></title><description><![CDATA[
<p>The mental model of slow decay into copyable is complicated. The code base is already a wash with contributions that have low copyrightability in US case law anyway, things derived directly from external architecture or documentation in barely novel ways, common system interfaces, and so on. LLM output is another output of this kind of class and sure sometimes large contributions happen that seem more significant, but they likely have little bearing on the work as a whole given it's earlier design provenance (at least for established and massive projects like this).<p>What is likely to get more muddy over time is the accuracy of any copyright registration, and the enforcement of copyright infringements on portions of the whole. These are already complicated cases and definitely so for compilers with so much "scènes à faire".<p>It's not clear how much this has a negative impact on cases around the whole, which tend to be the more important cases for the four freedoms that, while they have other intentions, have a primary intention of ensuring that the whole continues to be available for redistribution and extension in perpetuity.<p>I do not think that there is a clear link between these two areas at all, and the GPL's most important intents may be far safer long term than concerns of dilution suggest.</p>
]]></description><pubDate>Fri, 31 Jul 2026 02:06:30 +0000</pubDate><link>https://news.ycombinator.com/item?id=49118236</link><dc:creator>raggi</dc:creator><comments>https://news.ycombinator.com/item?id=49118236</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49118236</guid></item><item><title><![CDATA[New comment by raggi in "Document-borne AI worms can self-propagate through Copilot for Word"]]></title><description><![CDATA[
<p>Parse for what? The model has “arbitrary understanding” of “arbitrary input”. The filter is unbounded and the only actually safe result is to filter everything.</p>
]]></description><pubDate>Wed, 29 Jul 2026 21:50:41 +0000</pubDate><link>https://news.ycombinator.com/item?id=49103539</link><dc:creator>raggi</dc:creator><comments>https://news.ycombinator.com/item?id=49103539</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49103539</guid></item><item><title><![CDATA[New comment by raggi in "Document-borne AI worms can self-propagate through Copilot for Word"]]></title><description><![CDATA[
<p>with LLM architectures I think that’s true, and we don’t have anything looking particularly competitive for large scale use atm<p>I also don’t think this is about mixing, the LLM part of the problem doesn’t have determinism around the boundaries so they’re feel good at best, maybe making some cases a bit harder<p>trifecta is a forever problem with this architecture</p>
]]></description><pubDate>Wed, 29 Jul 2026 21:47:28 +0000</pubDate><link>https://news.ycombinator.com/item?id=49103505</link><dc:creator>raggi</dc:creator><comments>https://news.ycombinator.com/item?id=49103505</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=49103505</guid></item></channel></rss>