Hacker Newsnew | past | comments | ask | show | jobs | submit | getcrunk's commentslogin

A lot of people use their laptop as a desktop replacement and kinda leave it in one spot or only move it between two spots (home desk/office desk) rather than as an actually portable take anywhere use anywhere situation

In that case I'd rather just have one of those big usb hubs that has every port on it. Rather than an adapter designed that it only works on one laptop. Sure in theory you could plug them in to any but the design of it is such that you'd snap the connector if you plugged it in to a normal port.

While a regular usb-c ethernet adapter has a flexible cable between the laptop and the bulky rigid part.


Thunderbolt hubs are rather amazing now; in the past they'd either get super hot and have reliability issues, or had severe bandwidth limitations (especially if using larger displays).

The current crop has been great for my needs — a couple models have 10G Ethernet built in (CalDigit is the one I'm using now), and most now have more than one Thunderbolt port that allows a high speed storage device to be used as well (in addition to a 5K or 4K display or two!).


My TB5 dock from OWC on a M4 Pro MacBook can run dual 4k 240hz displays, 2.5gb ethernet, and several peripherals no problem. It also provides 100W of power. All over a single cable. So good these days

I may have the same one and I love it so much. Plug one USB C-looking cable into my laptop, and two 32” monitors and a host of accessories light up as it starts charging. It’s the greatest docking station ever.

Then dock it - these things have USB4 / TB, may as well get a TS5 and cover all your bases in one wire.

In that case why wouldn't you use a hub/docking station type thing? And again, that configuration still lends itself just fine to a dongle.

I assume they are referring to the general tide of improvements valve has brought to gaming working generically on linux, and that they are using omarchy to experience it

Okay but banning private relay emails would also mean your site is blocking Apple sign in?

That was always opt-in from the sites, and many never bothered - me included, because I refuse to pay Apple $99 per year for the privilege to offer easier authentication to their users.

Today


It’s not like they are discriminating on someone’s race or religion. If they don’t want a major vibe coded surface, do they even have to defend that? It’s part their “artistic” license as developers.

Or did we forget software inherently is opinionated


Given some posters on the GitHub issue, I get the sense some people feel their religion is being violated.


You don't even have to leave this site: when the original Bun rewrite posts were made, an incredible number of comments were focused, not on Bun, but on Jarred, who I'm assured is a complete rockstar and would never harm Bun.

Unfortunately, his followers don't realize that something like a batteries-included runtime is a huge commitment to build on top of, and governance you can trust matters as much, if not more, than the lines of code.

The way this has been handled is just baffling. A Rust rewrite is supposed to be a freebie for hype, and even an AI rewrite could have been interesting if approached more scientifically and transparently... but instead the opposite of that happened.


I don't think they have to defend it, but I don't think there's any issue questioning the validity of the approach.


If you don't like a decision don't harass, fork.


exactly... and it's not like it's hard to fork and just raise the minimum version. It will probably be just one number somewhere (I haven't actually looked.)

if it works, it will keep working. they just don't want to support and maintain it and solve issues.


Based on the comments I think a lot of people assume the headline pertains to Bun itself.


This stuff brings bad vibes.


Yes, it’s actually similar to discriminating based on race or religion, in the sense that it’s an arbitrary, meaningless criterion to discriminate on. If the Rust Bun port is better in every measurable way — passes all tests, has the same performance or better, and fixes existing bugs — then who cares what language it’s written in or how it was implemented? The point is that it’s higher quality. If you don’t trust the Bun team when they release a Rust version and give it their stamp of approval, why did you trust them when they released the Zig version two weeks ago? It makes no logical sense, and it makes the yt-dlp devs look foolish.


> If you don’t trust the Bun team when they release a Rust version and give it their stamp of approval, why did you trust them when they released the Zig version two weeks ago?

I think you cannot make this comparison because Rust version wasn’t in fact written by the Bun team. It wasn’t even read by them.


“All runtimes matter”

Yt-dlp devs made a good call. If Claude is good enough to rewrite millions of lines of Bun, it is good enough to maintain Bun fork of yt-dlp. And since Bun is part of Anthropic, they can afford it too.


people don’t care if it’s good. they only care it’s made with AI so they can signal their moral superiority. hence the derogatory term slop that is paraded around like it’s the way to win an argument


[flagged]


Anyone who isn’t supporting using runtime rewritten by an LLM is obviously “doesn’t get it” and a luddite.


But in this case, the yt-dlp maintainers didn't actually evaluate the rewrite yet, they just declared they wouldn't support it, sight unseen.

Not really an argument on its merits.


OSS is not a testing ground for rewrites made by hyperscalers. Bun is free to fork yt-dlp and prove it is stable enough.


Why is it their job to evaluate a 1m+ line code rewrite?


That’s the fun part no one has evaluated the rewrite yet! Not even the bun team!

Claude says it’s all good though so what could go wrong


What about people who view AI as a useful tool, and use it daily while still recognizing it’s limitations?

I’m no AI hater, but there’s a limit to how much trust I give it and the Bun rewrite is well beyond that limit.


It's a bit of a contradiction. We understand that AI can be used usefully, and to great effect. But if someone else uses it, it's a potential liability.

I think the issue is, we understand our own usage of it, and respect the boundaries of what's possible and what needs to be done to use these tools properly.

But we don't know how the other guy is using it.

We don't know if they're being responsible, and using it in a safe manner.

If they are: great. But if they aren't, we're opening ourselves up to all kinds of security shenanigans.

It's one of those things where we're only going to be okay with it, if we're the ones using it. But that also means other people will be suspect of our code.

It's really a no win scenario, except for inside each of own little bubbles.


AI or not, I trust a development team with a rigorous code review process, and I distrust a team that merges one-shot seven-figure PRs.

Bun has very loudly defected from the former category to the latter.


In this case though we do know how it was used? We’re talking about a specific case here.

It was used to write 1 million lines of code in a week.

Yes it was translating an existing codebase, but still there’s no way that is a safe transition.

Would you ship that at your job? I definitely would not


At my FAANG we do similar things all the time, but at a smaller scale.


Oh great. After never fully grasping tasting notes of food, coffee, wines … now water.

Jokes aside this is seriously impressive and makes me want to try and see if I can register them as unique enough. I certainly can taste different water bottle brands difference, but going from that to saying what’s good for x recipe is pretty next level


Anyone remember the Samsung ssd issue with bitlocker from maybe like a decade or so ago where it was an empty encryption key or something


I think we are at the point where everyone really needs to run each project in its own vm.

Given the recent lpe vulns docker 100% won’t cut it.

And containers were never meant primarily as a security boundary anyways


QubesOS had the right idea. You want layers and layers of security, with multiple VMs at the root.


See also: https://genode.org/

Also, in addition to isolation and https://en.wikipedia.org/wiki/Capability-based_security between processes, capability security within processes, see languages like E (https://web.archive.org/web/20260506035108/https://erights.o...) or Monte (https://monte.readthedocs.io/en/latest/index.html)


> had the right idea

Is it no longer the right idea?


I mean that in the sense that they had the idea way before the wave of rapid linux 0days and supply chain attacks were common. The design they picked has only become more relevant.


Luckily, projects using more secure language ecosystems like C and C++ are spared this kind of problems :-)


No, instead the code that isn't from a dependency is what will cause you to get pwned


I think you missed the joke/sarcasm there.


It's been less than a month since I responded to a comment on a different thread arguing basically the same thing about C/C++ in a serious way. I've long since lost the ability to distinguish.


Fair, I'm in fact not 100% sure it's a joke. But there's a smiley, that's pushing me to 90%.


The virus fest of the 90s would like a word with you and your C


you can't get infected through the package manager if your language doesn't have a package manager :) turns out C and C++ were playing 4D chess all along


Devcontainers (I know it's not a full VM, but it's most prominent version of this "isolated development environment" concept) wouldn't fully protect you against this. Github credentials are automatically pulled into the container. If you are using other cloud services that need to be accessed within the container, this cred stealer will grab their creds too.

It would limit the blast radius, which at least is an improvement.


This is one reason I have my own dev container script. And the container pulls nothing in except whatever I explicitly put in my .podman folder. It runs without any GitHub access at all. I do all of that from the host machine.


Or a vm per container, if you insist on containers. I've have a couple of relaxed weeks recently due to running everything on VMs rather than some random Kubernetes service.


it's not going to help if you share a cache across security boundaries. That is what happened here and seems to be driving a spate of github action related problems.


Well for one, so it doesn’t get recalled after getting a reputation for making people blind


[flagged]


It's trivial to design a cap that leaks before it becomes mechanically free, and most lids are so designed. If this one becomes mechanically free at or before the seal allows any pressure differential to equalize, then it's an avoidable design defect that fails to meet current minimum standards.


From the Consumer Product Safety Commission https://bsky.app/profile/cpsc.gov/post/3mkpsy7mgkk2j

"Is this user error?"

No. If we're recalling a product for a safety issue, it is not user error. There is an engineering error, or a design error, or a manufacturing error. Whatever the product is doing it should not be doing.


Idk how git works under the hood but those both seem like they could both be easily accomplished with git itself .

but if not just your own work flow, have a dir dedicated to storing prompt history and then each file is titled with the commit id.

As for the flag just agree to some convention and toss it in the commit message


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: