<rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:atom="http://www.w3.org/2005/Atom"><channel><title>Hacker News: staticassertion</title><link>https://news.ycombinator.com/user?id=staticassertion</link><description>Hacker News RSS</description><docs>https://hnrss.org/</docs><generator>hnrss v2.1.1</generator><lastBuildDate>Sat, 13 Jun 2026 02:59:20 +0000</lastBuildDate><atom:link href="https://hnrss.org/user?id=staticassertion" rel="self" type="application/rss+xml"></atom:link><item><title><![CDATA[New comment by staticassertion in "Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised"]]></title><description><![CDATA[
<p>Docker is a lot more than just an unprivileged user. In particular, it comes with a seccomp filter. A lot of LPEs are blocked by that filter. Docker is actually a quite decent security boundary - in this case the attackers did not attempt to subvert docker by attacking the kernel attack surface, they attacked a weak configuration via the docker socket being mounted.<p>The reason you don't use a "grown up VM" is because it's significantly more difficult. Which VM? Firecracker requires KVM and a guest operating system - so how are you getting things in and out in a way that doesn't violate security? That's real work.<p>gVisor is great and my recommendation, certainly, but the difference between "nothing" and "docker" is actually pretty huge imo.</p>
]]></description><pubDate>Tue, 19 May 2026 19:07:18 +0000</pubDate><link>https://news.ycombinator.com/item?id=48197891</link><dc:creator>staticassertion</dc:creator><comments>https://news.ycombinator.com/item?id=48197891</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48197891</guid></item><item><title><![CDATA[New comment by staticassertion in "Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised"]]></title><description><![CDATA[
<p>The solution is to do exactly what you suggest - separate access. In CI this is a matter of having your "build/test" jobs happen separately from your "deploy/publish" jobs.<p>The trickier part is dev environments, but ideally you take a similar approach. The place that devs do `npm install` should be isolated from, say, your browser / ssh keys etc.<p>Package manager support would be an amazing win here since you'd have an easier time managing the isolation but you can do this today.</p>
]]></description><pubDate>Tue, 19 May 2026 19:03:54 +0000</pubDate><link>https://news.ycombinator.com/item?id=48197829</link><dc:creator>staticassertion</dc:creator><comments>https://news.ycombinator.com/item?id=48197829</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48197829</guid></item><item><title><![CDATA[New comment by staticassertion in "Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised"]]></title><description><![CDATA[
<p>No. NPM's not particularly bad at all tbh.</p>
]]></description><pubDate>Tue, 19 May 2026 19:01:23 +0000</pubDate><link>https://news.ycombinator.com/item?id=48197788</link><dc:creator>staticassertion</dc:creator><comments>https://news.ycombinator.com/item?id=48197788</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48197788</guid></item><item><title><![CDATA[New comment by staticassertion in "Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised"]]></title><description><![CDATA[
<p>Most of them definitely let you do that.</p>
]]></description><pubDate>Tue, 19 May 2026 19:00:53 +0000</pubDate><link>https://news.ycombinator.com/item?id=48197777</link><dc:creator>staticassertion</dc:creator><comments>https://news.ycombinator.com/item?id=48197777</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48197777</guid></item><item><title><![CDATA[New comment by staticassertion in "I’ve joined Anthropic"]]></title><description><![CDATA[
<p>That seems like the opposite. Why would someone with high market value stay in one place? 2 years is basically optimal - you vest 50%, maybe collect a promotion, do some good work and learn a lot, and then get to move on for another solid bump/ promotion and a new set of stocks.<p>I expect the people with low market value to be the ones sticking around labs for long periods of time, they don't have the option to move and they aren't getting poached.</p>
]]></description><pubDate>Tue, 19 May 2026 18:39:52 +0000</pubDate><link>https://news.ycombinator.com/item?id=48197441</link><dc:creator>staticassertion</dc:creator><comments>https://news.ycombinator.com/item?id=48197441</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48197441</guid></item><item><title><![CDATA[New comment by staticassertion in "Project Glasswing: what Mythos showed us"]]></title><description><![CDATA[
<p>> The harder question is what the architecture around the vulnerability should look like. The principle is to make exploitation harder for an attacker even when a bug exists, so that the gap between when a vulnerability is disclosed and when it is patched matters less. That means defenses that sit in front of the application and block the bug from being reached. It means designing the application so that a flaw in one part of the code cannot give an attacker access to other parts. It means being able to roll out a fix to every place the code is running at the same moment, rather than waiting on individual teams to deploy it.<p>So nothing new then.</p>
]]></description><pubDate>Mon, 18 May 2026 17:20:42 +0000</pubDate><link>https://news.ycombinator.com/item?id=48182515</link><dc:creator>staticassertion</dc:creator><comments>https://news.ycombinator.com/item?id=48182515</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48182515</guid></item><item><title><![CDATA[New comment by staticassertion in "It is time to give up the dualism introduced by the debate on consciousness"]]></title><description><![CDATA[
<p>I was rejecting your definition of the hard problem as it contains an assertion that a physicalist wouldn't accept.<p>Yes, reduction would be one very viable strategy. It doesn't require precisely defining the phenomenon in order for me to just say that it reduces based on the fact that reduction has been a successful approach for everything else in cognition.<p>> There is an in principle barrier to a transparent structural description of phenomenal consciousness.<p>Yeah this is what I reject. Why do you say that this is <i>in principle</i> a barrier? You're discussing it as an explanatory gap, not <i>in principle</i>.</p>
]]></description><pubDate>Mon, 18 May 2026 13:04:18 +0000</pubDate><link>https://news.ycombinator.com/item?id=48179227</link><dc:creator>staticassertion</dc:creator><comments>https://news.ycombinator.com/item?id=48179227</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48179227</guid></item><item><title><![CDATA[New comment by staticassertion in "It is time to give up the dualism introduced by the debate on consciousness"]]></title><description><![CDATA[
<p>> The hard problem identifies the in principle difficulty in explaining phenomenal consciousness, something not definable in terms of structure and function<p>Great, I'm a physicalist so uhhhh I reject this lol. I think you can define cognitive capabilities and phenomenal experience by reducing to structure and function. You're right that it's simple though.</p>
]]></description><pubDate>Mon, 18 May 2026 12:12:41 +0000</pubDate><link>https://news.ycombinator.com/item?id=48178607</link><dc:creator>staticassertion</dc:creator><comments>https://news.ycombinator.com/item?id=48178607</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48178607</guid></item><item><title><![CDATA[New comment by staticassertion in "It is time to give up the dualism introduced by the debate on consciousness"]]></title><description><![CDATA[
<p>That's like saying that "water" is a philosophical invention and so if you accept that water is a thing then you've put it into a special category.<p>You can derive consciousness as a somewhat obvious conclusion of empirical study of behaviors, we have multiple fields of study that lay out cognitive function and criteria.</p>
]]></description><pubDate>Mon, 18 May 2026 12:10:25 +0000</pubDate><link>https://news.ycombinator.com/item?id=48178581</link><dc:creator>staticassertion</dc:creator><comments>https://news.ycombinator.com/item?id=48178581</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48178581</guid></item><item><title><![CDATA[New comment by staticassertion in "A Meta employee gets real about the horror of working there"]]></title><description><![CDATA[
<p>That's true and probably a kinda critical distinction here. Facebook is sort of making the bet that they can not only treat the world like shit but their direct employees too.</p>
]]></description><pubDate>Sat, 16 May 2026 14:05:52 +0000</pubDate><link>https://news.ycombinator.com/item?id=48160380</link><dc:creator>staticassertion</dc:creator><comments>https://news.ycombinator.com/item?id=48160380</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48160380</guid></item><item><title><![CDATA[New comment by staticassertion in "A Meta employee gets real about the horror of working there"]]></title><description><![CDATA[
<p>You could have said this every year for so many years about so many companies. If people will work for Palantir, they'll work for Facebook. Facebook could be a <i>lot</i> worse and I think a lot of their employees would stick around.<p>I guess a response at the industry level would be not hiring ex-FB people etc, treating it as a red flag.</p>
]]></description><pubDate>Sat, 16 May 2026 13:31:44 +0000</pubDate><link>https://news.ycombinator.com/item?id=48160127</link><dc:creator>staticassertion</dc:creator><comments>https://news.ycombinator.com/item?id=48160127</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48160127</guid></item><item><title><![CDATA[New comment by staticassertion in "Bun Rust rewrite: "codebase fails basic miri checks, allows for UB in safe rust""]]></title><description><![CDATA[
<p>> The no-AI policy of the Zig compiler project is for the compiler, other projects can do whatever they want.<p>Well, presumably they want to contribute to the compiler. I know that you did not like those contributions, and that view seems entirely valid, but obviously "no AI" rules out their development model (by design, and you likely think that's good, and maybe it is!).<p>Not intending to defend the bun move, but obviously a project using Zig and also using AI might feel motivated to avoid Zig since they're ruled out as contributors.</p>
]]></description><pubDate>Fri, 15 May 2026 20:01:35 +0000</pubDate><link>https://news.ycombinator.com/item?id=48153123</link><dc:creator>staticassertion</dc:creator><comments>https://news.ycombinator.com/item?id=48153123</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48153123</guid></item><item><title><![CDATA[New comment by staticassertion in "LLM Policy for Rust Compiler"]]></title><description><![CDATA[
<p>Yes. The policy is pretty clear on what the rules are for LLM generated code. You need a reviewer to agree to review LLM generated code, you need to read the code yourself, etc.</p>
]]></description><pubDate>Fri, 15 May 2026 15:30:53 +0000</pubDate><link>https://news.ycombinator.com/item?id=48149947</link><dc:creator>staticassertion</dc:creator><comments>https://news.ycombinator.com/item?id=48149947</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48149947</guid></item><item><title><![CDATA[New comment by staticassertion in "LLM Policy for Rust Compiler"]]></title><description><![CDATA[
<p>I think that the only significant caveat here is the need for reviewers to opt in, otherwise it's effectively "you can do it if you are open about it and are responsible for the output". The only notable ask here that's different from other policies is "if it's an LLM, tell reviewers beforehand".<p>TBH I think that makes no sense ("I have an LLM written PR ready, can I open it?") but yeah the policy is also in draft and has actually already changed since my first comment.</p>
]]></description><pubDate>Fri, 15 May 2026 15:30:09 +0000</pubDate><link>https://news.ycombinator.com/item?id=48149940</link><dc:creator>staticassertion</dc:creator><comments>https://news.ycombinator.com/item?id=48149940</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48149940</guid></item><item><title><![CDATA[New comment by staticassertion in "LLM Policy for Rust Compiler"]]></title><description><![CDATA[
<p>I guess that's the problem with the term. It should likely be left entirely out of a document like this since it's just confusing.</p>
]]></description><pubDate>Fri, 15 May 2026 15:24:17 +0000</pubDate><link>https://news.ycombinator.com/item?id=48149873</link><dc:creator>staticassertion</dc:creator><comments>https://news.ycombinator.com/item?id=48149873</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48149873</guid></item><item><title><![CDATA[New comment by staticassertion in "New Nginx Exploit"]]></title><description><![CDATA[
<p>I'm not making a claim about this bug, I'm saying that oracles and leaks are common and that nginx seems like a good target for them.</p>
]]></description><pubDate>Fri, 15 May 2026 14:52:11 +0000</pubDate><link>https://news.ycombinator.com/item?id=48149438</link><dc:creator>staticassertion</dc:creator><comments>https://news.ycombinator.com/item?id=48149438</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48149438</guid></item><item><title><![CDATA[New comment by staticassertion in "LLM Policy for Rust Compiler"]]></title><description><![CDATA[
<p>What are you even talking about lol the policy doesn't imply that at all.<p>That's in the "allowed with caveats" section. It's just saying to not open bug reports without first reading them yourself or your bug may be closed. No one is saying "by policy we will have to add the bug back in" jesus christ<p>The policy is insanely straightforward, idk how you can be misinterpreting it this badly. It's just "Disclose that you use a model, you are on the hook for reviewing model output as a human" and then some clear cut examples.</p>
]]></description><pubDate>Fri, 15 May 2026 08:57:49 +0000</pubDate><link>https://news.ycombinator.com/item?id=48146213</link><dc:creator>staticassertion</dc:creator><comments>https://news.ycombinator.com/item?id=48146213</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48146213</guid></item><item><title><![CDATA[New comment by staticassertion in "New Nginx Exploit"]]></title><description><![CDATA[
<p>Information leaks are not uncommon at all. nginx seems like a good target for them as well (fork + exec == no re-randomize,  so you have the ability to reexec your exploit a lot of times to improve stability). edit: Seems that there's already good work in this area, I kinda forgot about brop gosh I'm old <a href="https://www.scs.stanford.edu/brop/" rel="nofollow">https://www.scs.stanford.edu/brop/</a><p>I suppose to keep the password analogy together, people reuse passwords all the time, timing attacks exist, etc?</p>
]]></description><pubDate>Fri, 15 May 2026 08:52:33 +0000</pubDate><link>https://news.ycombinator.com/item?id=48146163</link><dc:creator>staticassertion</dc:creator><comments>https://news.ycombinator.com/item?id=48146163</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48146163</guid></item><item><title><![CDATA[New comment by staticassertion in "LLM Policy for Rust Compiler"]]></title><description><![CDATA[
<p>> even when the rust-lang/rust repository itself largely forbids vibe coding.<p>This policy does not seem to forbid vibe coding?</p>
]]></description><pubDate>Fri, 15 May 2026 08:41:52 +0000</pubDate><link>https://news.ycombinator.com/item?id=48146102</link><dc:creator>staticassertion</dc:creator><comments>https://news.ycombinator.com/item?id=48146102</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48146102</guid></item><item><title><![CDATA[New comment by staticassertion in "LLM Policy for Rust Compiler"]]></title><description><![CDATA[
<p>They're just giving examples of what you can do and explicitly saying so. Saying "you couldn't stop me" is completely missing the point.<p>This is not very different from the Linux kernel's policy so it's an odd comparison. It's actually almost identical in practical terms.<p>edit: lol proof that this doc needs to be stupidly explicit is in the pudding with the HN comments going out of their way to radically misread it</p>
]]></description><pubDate>Fri, 15 May 2026 08:40:58 +0000</pubDate><link>https://news.ycombinator.com/item?id=48146089</link><dc:creator>staticassertion</dc:creator><comments>https://news.ycombinator.com/item?id=48146089</comments><guid isPermaLink="false">https://news.ycombinator.com/item?id=48146089</guid></item></channel></rss>