Hacker Newsnew | past | comments | ask | show | jobs | submit | withinboredom's commentslogin

The mailing list doesn't seem to make it out into such a controversial issue. It's an optional field that doesn't require a real birthday.

The issue isn’t the field but how the governance system for critical software is non-existant.

It also has to be considered in light of the fact that Lennart builds a company for "cryptographically verifiable integrity on Linux".

Because someone added a new user field? Does that need governance?

When your software is the core piece of tech in almost all mainline Linux distros, yes it does require governance. However you may like someone being an authoritarian regardless of the “it’s only a user field no big deal” view and the next thing they change without governance for everyone you will be fine with also, even if you disagree. Again it’s not about the field.

If this is the “straw that broke the camel’s back” as they say… it seems it is more about the field than anything else. It’s a strange hill to die on… there are much larger changes happening on a daily basis… or is this like a bike shedding effect, where it’s such a small trivial and pointless change that it is worth fighting over? Something everyone can understand.

I dunno. The only reason I’m even on the mailing list was to report a bug several years ago…


I think it’s about raising visibility of an issue. What type of code change the issue is tied to is irrelevant. However it helps that the code change has some already existing political momentum.

What other arguments are we going to try and whittle the governance issue down to “its just the code change who cares!”?


This is why I prefer the AGPL over the GPL. But isn't this the entire point of open source? So long as it is attributed/following the license, who cares if they're selling it or not?

I would say it was a collapse of ethics, not morality. Most people have morals (their own belief system on what is fair), but their morals may not be ethical (rule-based morals to achieve fairness). I personally attribute it to cars and the internet.

The internet removed consequences. You can say the most vile thing imaginable to another human being and… nothing happens. No social cost, no awkward eye contact at the grocery store, no reputation hit in your actual community. Just a dopamine hit and a notification count.

Cars did something sneakier. We spend hours every week sealed in a metal box, alone or with the same people. No random encounters, no friction with people who think differently. Just you, your podcast, and whatever is important in your tiny echo chamber.

Put those two together and you get people with deeply held morals and zero framework for applying them to anyone outside their bubble. Ethics requires seeing strangers as real. We've engineered that out of daily life.


this is really mind-boggling to me as someone who grew up on the (old) internet.

I think the reward factor is also a large part of it, for most of the last 10 years young people have seen that unethical behaviour results in success. For a developing brain, it's easy to see how that resulted in the current state of SV.


> a dev/test/prod workflow involved copying filesystem content, database content, and changing URLs that got saved in the database.

This just sounds like deploying web software. You always have static assets that need to be deployed, the code/binary itself, and database migrations.


The "copying filesystem content, database content" part of that is perfectly sane. I should have phrased that better.

The insane part is the search-and-replace on the database backup to find hard-coded URLs referencing the environment's hostname. That's ridiculous. It speaks to the lack of serious operational experience that went into building the software.


Ah. That’s like a 15-line rite-of-passage plugin you write once and never have to worry about it again. Filter content going into the database and use relative uri for the same site. Configure everything else via environment variables.

I moved away from Wordpress altogether earlier this year because I got tired of babysitting MySQL.


Email isn't guaranteed to have a faster round-trip. https://groups.io/email-provider-status -- sometimes goes into hours of latency.

My blog does a proof-of-work before submission (withinboredom.info) in your browser. It'll use a fair bit of cpu power, but should only take a few seconds to complete. For an attacker... that's quite slow and self-limiting.

I did Ctrl-F on "proof-of-work" in this thread to see if anyone had tried this, you seem to be the only one. Seems like a good precaution before sending even a verification email.

Did you have to roll your own or was there some proof of work library you were able to use?

Update: Ah, found the code - https://withinboredom.info/posts/how-this-blog-actually-work...


A $150 hold would clearly be noticed by the victim, so the attacker wouldn't even try it.

Maybe if my bank emailed me, otherwise I doubt it. Local gas stations routinely use $200 holds and I'd have to go way out of my way to see it happen.

The point is whether every user actually notices it, it's that enough of them do that attackers are specifically looking for the ability to do small charges. If you remove that capability, they will look elsewhere.

Yeah… no it wouldn’t. I’ve watched users have their bank accounts emptied (by accident) because they kept refreshing. A measly £150 isn’t going to register until it’s too late anyway.

There's a reason attackers exploit any site that lets them do small charges, it's because enough users will notice a larger charge.

Whether every user notices it or not, attackers are looking for the ability to do small charges, and if you remove that they'll move on.


> The key difference is with cloudflare your site is globally distributed by default, and you get to buy into the whole ecosystem, if you want.

The real question nobody asks: do you even really need global distribution?


Most of the time: no

But sometimes you do have clients in both sides of the atlantic and it's nice being able to cut their request times by a few hundred ms "for free". Personally, that's not the main reason I use cloudflare, but it can be handy!


environment variables can change while the process is running and are not memory safe (though I suspect node tries to wrap it with a lock). Meaning if you check a variable at point A, enter a branch and check it again at point B ... it's not guaranteed that they will be the same value. This can cause you to enter "impossible conditions".

Wait, is it expected for them to be able to change? According to this SO answer [0] it's only really possible through GDB or "nasty hacks" as there's no API for it.

[0] https://unix.stackexchange.com/questions/38205/change-enviro...


The process itself (including other threads) can call setenv whenever it wants.

I'd prefer if we just wrote off space-x and pretend they don't exist.

SpaceX is the only major operator of spaceflights in the US: more than 95% of all satellites launched are launched by SpaceX, not just in the US, but worldwide.

That's an eye catching stat. What is the impact of starlink satellites on the number, ie what if you drop them from both numerator and denominator?

It looks like 70% of all satellites deployed in 2025 were starlink. Seems they make up over half (~65%) of all satellites currently in orbit.

> more than 95% of all satellites launched are launched by SpaceX

Another way to look at this number is that they are responsible for 95% of the light pollution caused by orbiting objects.


Lets just ban lightbulbs so we don't have light pollution.

We have regions where we deliberately minimize light pollution, but those regions aren't immune to Elon's swarm of photobombing satellites.

Not that I don't think it's cool to have a web of spacecraft enveloping the planet and bringing high-speed communications to everyone everywhere - it's pretty impressive to point up and show a train of satellites to a kid - but astronomers have been complaining about them and they are right.


why because "elon bad" ??

cut your nose off to spite your face if you want but the rest of us will recognize the importance of space-x and be grateful it is here.


This is about going to the moon. Space-x is over budget and extremely late. It has nothing to do with the management there, only that it is better to come up with a solution without them.

I only suggested a Falcon Heavy because the rocket exists, is flight proven, and has enough capacity to shoot an Orion to any trajectory it is expected to encounter.

If that was the truth I have a strong feeling your wording would be different.

Please read the https://news.ycombinator.com/newsguidelines.html

I literally can’t even continue this thread.


Because of your personal politics?

Imagine if NASA had the resources and the freedom to pursue a high-risk high-return strategy the same way SpaceX did. NASA can't afford high-profile failures because it needs political support to function from a Congress that doesn't understand engineering.

Now imagine the public good will if the US could have built a network of LEO satellites providing communications to everyone on Earth regardless of nationality, with equal access and funded by governments so that all their residents could have access to it for free (once they buy an antenna made in the US).

Some will say it'd be communism. I would say it could be part of a Pax Americana that doesn't involve coups, but is based on willing cooperation.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: