<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Hacker News: scottlamb</title><link>https://news.ycombinator.com/user?id=scottlamb</link><description>Hacker News RSS</description><docs>https://hnrss.org/</docs><generator>hnrss v2.1.1</generator><lastBuildDate>Wed, 27 May 2026 18:20:25 +0000</lastBuildDate><atom:link href="https://hnrss.org/user?id=scottlamb" rel="self" type="application/rss+xml"></atom:link><item><title><![CDATA[New comment by scottlamb in "All of human cooking compressed into 2 megabytes"]]></title><description><![CDATA[
<p>> It is missing the Italian, Japanese, Greek and Mexican cooking - that are incredibly popular worldwide and it is incomplete without them, and nothing from Africa at all or Middle East.<p>That's overstating it. There are certainly English-language sources describing Italian, Japanese, Greek, Mexican, African, and Middle Eastern recipes. They're likely not the most authoritative sources, but it's not as if I'd expect these cuisines to be completely absent.<p>The actual corpuses they used are listed in the supplement: <a href="https://arxiv.org/src/2605.22391v1/anc/supplement.pdf" rel="nofollow">https://arxiv.org/src/2605.22391v1/anc/supplement.pdf</a><p>edit: that document also breaks it out by region, including 33,923 Japanese recipes which seems respectable. 324 from Sub_Saharan_African which is tiny but still more than 0. Italian and Greek are likely a fair chunk of Mediterranean (164,107). I don't see a breakout for Middle Eastern. Some might be lumped into Mediterranean as well.</p>
]]></description><pubDate>Wed, 27 May 2026 16:54:50 +0000</pubDate><link>https://news.ycombinator.com/item?id=48297011</link><dc:creator>scottlamb</dc:creator><comments>https://news.ycombinator.com/item?id=48297011</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48297011</guid></item><item><title><![CDATA[New comment by scottlamb in "Twin brothers wipe 96 government databases minutes after being fired"]]></title><description><![CDATA[
<p>But <i>I'm</i> talking about general day-to-day security as well as off-boarding. What stops a single disgruntled employee from doing this before being fired? And if you have a good story there, why do you need the most extreme approach to "off-boarding"?<p>It makes sense to terminate someone's high-risk credentials immediately when they're fired. But it's extremely worrying if every credential held by every employee is considered high-risk. It suggests a bigger failure. "Unilateral access to a database filled with plain-text passwords" shouldn't ever exist. "Email account filled with dangerous stuff" should at least be unusual.</p>
]]></description><pubDate>Wed, 13 May 2026 23:05:04 +0000</pubDate><link>https://news.ycombinator.com/item?id=48128788</link><dc:creator>scottlamb</dc:creator><comments>https://news.ycombinator.com/item?id=48128788</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48128788</guid></item><item><title><![CDATA[New comment by scottlamb in "Twin brothers wipe 96 government databases minutes after being fired"]]></title><description><![CDATA[
<p>> Too complicated and subjective, stinks of more risk.<p>I actually think there's less risk, because it's not as narrowly focused on what a just-fired employee can do. That's not the only scenario of concern.<p>> Also, I don't think it's dehumanizing it all (having been on the receiving end of it way back when during a layoff, and involved in the process more times than I care to count).<p>Interesting. Thanks for the perspective. I've been fortunate enough to not be on the receiving end of a lay-off, knock on wood. It's happened to my teammates/reports though. Wasn't my decision. :-(</p>
]]></description><pubDate>Wed, 13 May 2026 22:44:14 +0000</pubDate><link>https://news.ycombinator.com/item?id=48128571</link><dc:creator>scottlamb</dc:creator><comments>https://news.ycombinator.com/item?id=48128571</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48128571</guid></item><item><title><![CDATA[New comment by scottlamb in "Twin brothers wipe 96 government databases minutes after being fired"]]></title><description><![CDATA[
<p>You always have to be careful about overfitting to a specific scenario like "this but if they had also forgotten to lock out the other evil twin". I'd prefer a system that is robust to a malicious employee (more likely: compromise of an employee's credentials) but has a slight gap in the "evil twins" scenario over one that prevents all post-firing malicious access from twins but doesn't consider at all what happens if a current employee's credentials are compromised.</p>
]]></description><pubDate>Wed, 13 May 2026 22:36:10 +0000</pubDate><link>https://news.ycombinator.com/item?id=48128510</link><dc:creator>scottlamb</dc:creator><comments>https://news.ycombinator.com/item?id=48128510</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48128510</guid></item><item><title><![CDATA[New comment by scottlamb in "Twin brothers wipe 96 government databases minutes after being fired"]]></title><description><![CDATA[
<p>> Just think of all the info you have in your inbox.<p>Meh? Sure, stuff that would help assemble a credible phishing attack, but not customer SPII or huge amounts of intellectual property or anything. If the assumption is that employees' inboxes are full of dangerous things, I would focus on fixing that.</p>
]]></description><pubDate>Wed, 13 May 2026 19:24:05 +0000</pubDate><link>https://news.ycombinator.com/item?id=48126258</link><dc:creator>scottlamb</dc:creator><comments>https://news.ycombinator.com/item?id=48126258</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48126258</guid></item><item><title><![CDATA[New comment by scottlamb in "Twin brothers wipe 96 government databases minutes after being fired"]]></title><description><![CDATA[
<p>> When you are talking about access like they had "make firings as abrupt as possible including terminating all access immediately" not doing this is incompetence.<p>You're proving my point—employers take the most extreme lesson and it's considered expected practice. They absolutely should have immediately terminated the credentials that granted unilateral access to sensitive databases. (Ideally those would never exist in the first place—there are two-person schemes. A pair of bad actors...well apparently happens according to this article...but is far more unusual.) But employers regularly (but shouldn't) terminate <i>all access</i> including credentials that allow last email to colleagues exchanging personal contact info or something.</p>
]]></description><pubDate>Wed, 13 May 2026 19:06:10 +0000</pubDate><link>https://news.ycombinator.com/item?id=48126053</link><dc:creator>scottlamb</dc:creator><comments>https://news.ycombinator.com/item?id=48126053</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48126053</guid></item><item><title><![CDATA[New comment by scottlamb in "Twin brothers wipe 96 government databases minutes after being fired"]]></title><description><![CDATA[
<p>> [Opexus] said that “the individuals responsible for hiring the twins are no longer employed by Opexus.”<p>Getting close to the classic Monty Python line: "Those responsible for sacking the people who have just been sacked, have been sacked."<p>Jokes aside, stuff like this sucks because I suspect many employers will take from it the most extreme, dehumanizing lessons, e.g.: (a) make firings [edit: including lay-offs] as abrupt as possible including terminating all access immediately, (b) never give second chances to anyone with any sort of criminal record (even say decades old marijuana posession or something).<p>I'd prefer a more balanced version: limit unilateral access to sensitive systems in general (not just of recently-fired employees), when someone is fired immediately shut off particularly sensitive credentials if they do exist (but not their general-purpose login/email account), avoid hiring people convicted of wire fraud as sysadmins, hash your @!#$ing passwords, etc.</p>
]]></description><pubDate>Wed, 13 May 2026 18:47:37 +0000</pubDate><link>https://news.ycombinator.com/item?id=48125818</link><dc:creator>scottlamb</dc:creator><comments>https://news.ycombinator.com/item?id=48125818</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48125818</guid></item><item><title><![CDATA[New comment by scottlamb in "Testing UPS Output Waveforms"]]></title><description><![CDATA[
<p>> Datacenters are focused on "never letting the equipment go down for any reason."<p>Disagree. I'm most familiar with Google. For a long time at least their UPSs were built in to each machine and not super reliable. They built entire datacenters without cooling with the understanding that for a few days a year it may be too hot for human access. The reliability is from failing over to other equipment—machine, cluster, even region.<p>Small/on-prem/co-location datacenters may make totally different choices, but I think the major cloud/AI providers would be similar to Google in this respect.<p>The sibling comment about other industries was enlightening to me though.</p>
]]></description><pubDate>Wed, 13 May 2026 18:00:42 +0000</pubDate><link>https://news.ycombinator.com/item?id=48125272</link><dc:creator>scottlamb</dc:creator><comments>https://news.ycombinator.com/item?id=48125272</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48125272</guid></item><item><title><![CDATA[New comment by scottlamb in "Testing UPS Output Waveforms"]]></title><description><![CDATA[
<p>You're reminding me that I have a couple conventional UPSs sitting in the garage. I should unload them before convincing everyone they're junk!</p>
]]></description><pubDate>Wed, 13 May 2026 00:06:28 +0000</pubDate><link>https://news.ycombinator.com/item?id=48116223</link><dc:creator>scottlamb</dc:creator><comments>https://news.ycombinator.com/item?id=48116223</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48116223</guid></item><item><title><![CDATA[New comment by scottlamb in "Testing UPS Output Waveforms"]]></title><description><![CDATA[
<p>I've found the difference in runtime between similarly-priced low-end units with similar power rating is hour+ (LifePO4 power station) vs not advertised but actually just minutes (lead acid UPS). And you can spend a bit more on the LifePO4 power station and get a proportional increase in runtime and power, vs. the lead acid UPS where the cost would quickly become prohibitive. And the LifePO4 power station gives you the choice to cut off above 0% or not, where the lead acid unit doesn't give you any control. So you can trade off 30% of your capacity for increased longevity if you choose and still come out way way ahead on runtime. Or you can not and still have much better battery longevity than lead acid. You can choose a spot on a Pareto frontier that lead acid can't even approach.<p>The rationale I've heard to justify conventional UPSs not even trying to compete on runtime is that they're just for giving you a few minutes to cleanly shut down your crap software that isn't crash-safe and/or for your auto-start generator to start up. But what I actually want is to keep working for an hour+ after the power goes out without owning/installing/maintaining a generator.</p>
]]></description><pubDate>Tue, 12 May 2026 22:42:50 +0000</pubDate><link>https://news.ycombinator.com/item?id=48115568</link><dc:creator>scottlamb</dc:creator><comments>https://news.ycombinator.com/item?id=48115568</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48115568</guid></item><item><title><![CDATA[New comment by scottlamb in "Testing UPS Output Waveforms"]]></title><description><![CDATA[
<p>Where is it a good option? I'd expect datacenters to be more focused on efficiency, not less.</p>
]]></description><pubDate>Tue, 12 May 2026 22:23:28 +0000</pubDate><link>https://news.ycombinator.com/item?id=48115395</link><dc:creator>scottlamb</dc:creator><comments>https://news.ycombinator.com/item?id=48115395</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48115395</guid></item><item><title><![CDATA[New comment by scottlamb in "When life gives you lemons, write better error messages"]]></title><description><![CDATA[
<p>Had the exact same thoughts.<p>* I thought at first they meant "later" was too vague, but omitting the word only makes the message more terse, not more specific. It's as if they decided ahead of time that the old message was bad and embodies certain qualities (which they highlighted) and the new was good and embodies certain other qualities (also highlighted), and they didn't bother to rethink the new one after seeing almost the same phrase used as examples of bad and good.<p>* "Your changes were saved": yeah, if the change is connecting your account to a third-party service, and they were unable to connect...did they save the intent to connect? How do you resume it? Or was this part of a greater set of changes? The reassurance works best if it's consistently true, but I'm doubtful.</p>
]]></description><pubDate>Tue, 12 May 2026 22:15:15 +0000</pubDate><link>https://news.ycombinator.com/item?id=48115316</link><dc:creator>scottlamb</dc:creator><comments>https://news.ycombinator.com/item?id=48115316</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48115316</guid></item><item><title><![CDATA[New comment by scottlamb in "Testing UPS Output Waveforms"]]></title><description><![CDATA[
<p>Yes, thousands of times, an order of magnitude improvement over lead acid. And the increased capacity means that they're much less likely to hit 0% (or whatever defined cut-off you set) during a typical outage anyway.</p>
]]></description><pubDate>Tue, 12 May 2026 20:45:01 +0000</pubDate><link>https://news.ycombinator.com/item?id=48114280</link><dc:creator>scottlamb</dc:creator><comments>https://news.ycombinator.com/item?id=48114280</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48114280</guid></item><item><title><![CDATA[New comment by scottlamb in "Testing UPS Output Waveforms"]]></title><description><![CDATA[
<p>> 20 milliseconds is barely distinguishable from a single 60 Hz sine wave period.<p>I've read that the newest PSUs are only guaranteed to last 12ms. Of course they may last much longer, especially if running near idle, but I'd prefer something that works well with any compliant device.<p>Here's one source: "Measured in milliseconds, hold-up time indicates how long a PSU can sustain its output within specified voltage limits after a loss or drop in input power. ATX 3.1 features a shorter hold-up time of 12ms, compared to ATX 3.0's 17ms hold-up time. This results in a small improvement in the PSU's efficiency." <a href="https://www.corsair.com/us/en/explorer/diy-builder/power-supply-units/atx-30-vs-atx-31-whats-the-difference/" rel="nofollow">https://www.corsair.com/us/en/explorer/diy-builder/power-sup...</a><p>I haven't dug through the spec itself.</p>
]]></description><pubDate>Tue, 12 May 2026 19:23:14 +0000</pubDate><link>https://news.ycombinator.com/item?id=48113153</link><dc:creator>scottlamb</dc:creator><comments>https://news.ycombinator.com/item?id=48113153</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48113153</guid></item><item><title><![CDATA[New comment by scottlamb in "Testing UPS Output Waveforms"]]></title><description><![CDATA[
<p>I toyed with this too, but I guess I have a slightly more diverse set of devices than you do. A few more weird voltages, and some things that expect mains. I looked into finding a DC version of their power supplies (e.g. the pico-box X9-ATX-500 to replace a conventional ATX PSU, tracking down DC versions of network switch hot-swappable PSUs from eBay) but decided it wasn't worth it. I just bought a stock LifePO4 power station. I found that I got most of the benefit [edit: measured in terms of runtime after power outage, not power draw while input power was available] just from switching to LifePO4 rather than from avoiding DC->AC->DC, and it was cheap and easy.</p>
]]></description><pubDate>Tue, 12 May 2026 19:15:42 +0000</pubDate><link>https://news.ycombinator.com/item?id=48113039</link><dc:creator>scottlamb</dc:creator><comments>https://news.ycombinator.com/item?id=48113039</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48113039</guid></item><item><title><![CDATA[New comment by scottlamb in "Testing UPS Output Waveforms"]]></title><description><![CDATA[
<p>I would be curious to see how LifePO4 power stations compare.<p>* These power stations are better than conventional (lead-acid battery) UPSs in the sense that they're cheaper, more flexible, have dramatically longer battery life, and require battery replacement less often.<p>* ...but I haven't seen any that claim to be "line-interactive" or even say specifically when they fail over (other than a total power cut). They do talk about how long it takes to fail over: older models are >20ms (long enough that your machine will probably reboot); many newer ones are <10ms. I'm not sure how high-quality their sine wave is when on battery.</p>
]]></description><pubDate>Tue, 12 May 2026 19:07:30 +0000</pubDate><link>https://news.ycombinator.com/item?id=48112892</link><dc:creator>scottlamb</dc:creator><comments>https://news.ycombinator.com/item?id=48112892</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48112892</guid></item><item><title><![CDATA[New comment by scottlamb in "Zed Editor Theme-Builder"]]></title><description><![CDATA[
<p>> Last I checked, high-resolution scroll reporting over USB is not based on pixels but on fractions of a detent, which is annoying to say the least.<p>I'd just be happy if it let me use the multiplier; don't care if it's not exactly pixels.<p>> Apple probably also didn't want to translate multitouch to scroll in hardware,<p>That much doesn't seem unique to Apple; both Windows and Linux appear to prefer accepting raw multitouch data.<p>> since scrolls are not reported the same in all contexts (e.g. applications can choose whether it locks to an axis; which axes it can lock to depends on the capabilities of the view; etc.)<p>I don't think they're actually taking advantage of this. My MBP's built-in trackpad will lock into pinch/rotate gestures when the cursor's over say Zed or iTerm2. (Zed's a bad example actually, as it has no accessibility tree to speak of. But I think it will lock into pinch/rotate anywhere.)<p>And for my own app, as far as I know (I'd be very happy to be corrected) there's no way to inspect a view to know what kinds of gestures it supports. It certainly would be nice to eliminate the possibility of locking into pinch/zoom in a place where that's meaningless but I don't see a way to do it.<p>> Applications can choose to ignore synthetic events, IIRC. Probably not an issue for scrolling, but for instance Little Snitch can be configured to ignore synthetic inputs to its security settings.<p>Yuck. I'm doing everything this way, including cursor movement and taps. I hope I don't come across such an app/configuration.</p>
]]></description><pubDate>Sun, 10 May 2026 04:40:51 +0000</pubDate><link>https://news.ycombinator.com/item?id=48081057</link><dc:creator>scottlamb</dc:creator><comments>https://news.ycombinator.com/item?id=48081057</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48081057</guid></item><item><title><![CDATA[New comment by scottlamb in "Zed Editor Theme-Builder"]]></title><description><![CDATA[
<p>macOS is a whole thing in terms of smooth scrolling, or HID (human interface devices) in general. It seems like Apple just doesn't put a lot of effort in terms of working with third-party HIDs:<p>* There's a standard way to enable high-resolution scroll reporting (pixel-level instead of line-level), but Apple doesn't use it.<p>* There's a standard approach to multi-touch digitizers/trackpads (documented and I think to some extent created by Microsoft, called PTP) which Apple doesn't support.<p>* Apple's own Magic Trackpad speaks a proprietary protocol and it appears you can only speak it if you claim to use their USB VID/PID. And I don't think doing  that would go over well in a commercial product. (And if you do manage to speak it, it turns out their driver really doesn't do two-finger scrolling well with tiny trackpads anyway. They probably only tested it on the generous dimensions of their hardware.) (Also, it attaches to your entire device, so having an additional interface with a different driver doesn't appear to work either.)<p>But...you can inject smooth scrolling events via Core Graphics. So you can run a userspace program with accessibility permission that scrolls smoothly. And you can also communicate with USB devices from such a program. There are some existing programs for doing smooth scrolling with standard mice (Mac Mouse Fix is one). I'm writing a userspace driver for PTP to make my keyboard's built-in trackpad work properly.</p>
]]></description><pubDate>Sat, 09 May 2026 23:14:46 +0000</pubDate><link>https://news.ycombinator.com/item?id=48079237</link><dc:creator>scottlamb</dc:creator><comments>https://news.ycombinator.com/item?id=48079237</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48079237</guid></item><item><title><![CDATA[New comment by scottlamb in "Today I've made the difficult decision to reduce the size of Coinbase by ~14%"]]></title><description><![CDATA[
<p>That's the most reasonable interpretation I've heard. I'm not assuming they're being reasonable, though. I have a deeply negative view of the crytocurrency industry including Coinbase, and they just wrote "non-technical teams are now shipping production code", so I'm more primed to assume they mean something unethical, short-sighted, unrealistic, and negligent.<p>Another somewhat reasonable interpretation occurred to me later: that they're using "AI-native" as a shorthand for "AI-native systems" aka systems designed with AI / to take advantage of AI from the start, and thus "AI-native talent" as a shorthand for "people talented in creating those systems", rather than the people themselves being AI-native. But again, given who said it, I'm not going to assume that's what they meant.<p>scoot's comment [1]: "I'm not sure exactly which children they're planning to replace all their staff with, nor how they plan to get around the child labour laws" sounds exactly right to me.<p>[1]: <a href="https://news.ycombinator.com/item?id=48030120">https://news.ycombinator.com/item?id=48030120</a></p>
]]></description><pubDate>Wed, 06 May 2026 22:02:51 +0000</pubDate><link>https://news.ycombinator.com/item?id=48042485</link><dc:creator>scottlamb</dc:creator><comments>https://news.ycombinator.com/item?id=48042485</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48042485</guid></item><item><title><![CDATA[New comment by scottlamb in "Today I've made the difficult decision to reduce the size of Coinbase by ~14%"]]></title><description><![CDATA[
<p>Everybody had a chance to learn it those year. No one who had already learned to code had a chance to learn it <i>first</i>, as in before other ways of coding. Not everyone can be <i>AI-native</i>.<p>You might assume they aren't going to be so stupid as to try to exclude everyone who isn't new to programming. I wouldn't. They're a crypto business.<p>See also "digital native", a popular term which is absolutely about growing up after the technology in question was ubiquitous. <a href="https://en.wikipedia.org/wiki/Digital_native" rel="nofollow">https://en.wikipedia.org/wiki/Digital_native</a></p>
]]></description><pubDate>Wed, 06 May 2026 01:50:55 +0000</pubDate><link>https://news.ycombinator.com/item?id=48031187</link><dc:creator>scottlamb</dc:creator><comments>https://news.ycombinator.com/item?id=48031187</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48031187</guid></item></channel></rss>