Hacker Newsnew | past | comments | ask | show | jobs | submit | athrowaway3z's commentslogin

Its also worth underlining that it's not just "The parsing computation is fast enough that V8's JIT eliminates any Rust advantage", but specifically that this kind of straight-forward well-defined data structures and mutation, without any strange eval paths or global access is going to be JITed to near native speed relatively easily.

> > I also don't care for the "security" argument when parts of the core reference implementation are written in a memory-unsafe language.

> Doesn't sound like a super informed way to look at security (not even mentioning that Wayland was started in 2008, and Rust was not a thing). One can also say that "as long as you run X11, there is no need to think about security because X11 just defeats it all".

I think the argument is not that X11 defeats it all - but that for 99.9999% of users its security theater when deployed in the real world. Most commonly, as long as processes can read each other's memory/configuration/etc.

I'm sure there is a use-case for untrusted sharing of Wayland enabled GPU rendering or something - though AFAIK none of the enterprise remote desktop use it, and they have the resources to implement it themselves anyway.

I've been running Wayland for two years now. I still hit weird bugs with desktop sharing / obs tinkering; It's just not a critical use for me.

So it's fair to question the design wisdom of adding the complexity and UX pain points if it seems to be worth so little.

But maybe i'm overlooking some large group of people dependent on Wayland security boundaries?


> Most commonly, as long as processes can read each other's memory/configuration/etc.

And there is no point is working on the Desktop security as long as X11 defeats it all.

> if it seems to be worth so little

I, for one, value the security standpoint.


I'm using `pi` as my agent and build my entire agent orchestration on like 4 skills to start / stop / capture / await a set of tmux-bash & tmux-pi sessions.

This is the first time in a few months I might actually try `claude` cli again to try out this channels scheme.


Why not just "pi install npm:@e9n/pi-channels" ? It was there before Claude copied it.

people who use pi: is this stuff easy? do I just clone the repo and give SKILL.md arguments to implement features & customize ??

US Police are trained such that their first impression in any situation is to see how people are reacting to their authority, and if it's not acquiesced to go on high alert.

It's not that they couldn't understand; It's that it's a faux pas to question this way of thinking so nobody does.

Play that out long enough and you get clown shows like these.


For some reason I was under the impression this was already the default.

I first heard about the possibility of this kind of attack >10 years ago, and I'll sometimes do a xxd if i'm feeling a bit paranoid.


- you know each others IP's (or have a way to signal it)

- can't decide on a port in the same message

- don't suffer from NAT port randomization

I'm not saying it will never happen, but the Venn diagram of this being the minimum complexity solution just doesn't seem very large?


There are plenty of free public STUN servers and ways to share the information they return.

The real problem is the port randomization if any client is behind a symmetric NAT. The search space for randomly trying port numbers is too large.

There are some ways to reduce the search space, like port prediction. But ultimately, a large dose of port scanning is the only way I know of to make the connection reliably. And there’s only so much of that you can do before triggering IPS or overwhelming the NAT.

IPv6 makes this way easier, of course!


I think many people know how to google "what is my IP" and send that to a friend, but don't necessarily know what a port is.

NAT randomization, I don't know. Depends on your setup, I guess.


Pay of the credit card bill?

You mean pay the interests on it.


I have been an emacs user for almost a decade now.

My laptop taskbar is: terminal, filebrowser, emacs, firefox.

With emacsd running to make startup instance.

This week I removed emacsd service and Emacs from my taskbar because I had more miss-clicks - accidentally opening it - than I had need for it in the past few months.


What’s interesting is that as an Emacs user and caring about instant startup, you use clicks to open things instead of keyboard shortcuts.

Samsung 360 laptop with touch screen.


I'm not sure if HN is being flooded with bots or if the majority of people here nowadays lack a sense of simplicity.

Anybody looking to do interesting things should instantly ignore any project that mention "persistent memory". It speaks of scope creep or complexity obfuscation.

If a tool wants to include "persistent memory" it needs to write the 3 sentence explanation of how their scratch/notes files are piped around and what it achieves.

Not just claim "persistent memory".

I might even go so far that any project using the terminology "memory" is itself doomed to spend too much time & tokens building scaffolding for abstractions that dont work.


>scaffolding

The purpose of scaffolding is to create persistent memories.

>claim "persistent memory"

Just look at it as a build product.

>abstractions that don't work

Look at this as a testing problem.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: