Hacker Newsnew | past | comments | ask | show | jobs | submit | cetra3's commentslogin

Isn't your password manager a single point of failure?

How do you mean that?

Each password is a PGP-encrypted file, encrypted to security keys. The files are backed up in different places, including my laptop and my phone. The password manager app runs offline, so it has no reason to suddenly fail, but even if it did, my passwords are just encrypted with PGP, so I will never be "locked out".

I find it very unlikely that it would get compromised: again it's encrypted to security keys. If my device is compromised, the attacker can extract the passwords that I decrypt while the attacker has control, but not the whole database.

To lose my passwords, I would need to simultaneously lose all the copies (on my devices, and on the cloud). To lose access to my passwords, I would need to simultaneously lose all security keys.

Doesn't feel like a single point of failure. Or do I misunderstand what you mean by that?


Yeah would love this for logfire


Something like sherlock start --otel-endpoint?


Yes. It can get a bit more complex as some otels require authentication. You can check Pydantic AI Gateway, Cloudflare AI Gateway or LiteLLM itself. They do similar things. One advantage of yours would be simplicity.


I love this idea... Going to look into it, thank you!


Yes it is, page 29 of that PDF lists it:

- Sony WH-1000XM4


Thank you. My bad.


UDP and TCP are Layer 3 protocols, and so is ICMP. They all fill the same bits within network packets, like at the same level. So sending an ICMP packet (protocol 1) is not the same as sending a UDP packet (protocol 17).

You can see a list of network protocols in /etc/protocols actually, or here: https://www.iana.org/assignments/protocol-numbers/protocol-n...


For those like me who are obviously blind, the new location is at https://codeberg.org/ziglang/zig


> Node.js and Go are considered practically safe language

Node JS has had vulnerabilities in the past: https://www.cvedetails.com/cve/CVE-2021-22940/

Go is also not Memory safe: https://www.ralfj.de/blog/2025/07/24/memory-safety.html


Node.js and Go are both memory safe, as are Python, Ruby, and Java. "Memory safe" is a term of art referring to susceptibility to memory corruption vulnerabilities in code written by an ordinary practitioner of the language. Almost invariably, attempts to show languages like Go and Python as memory-unsafe involve a programmer deliberately working to defeat the language. But you can do that in any language, including Rust.

There are essentially just two mainstream memory-unsafe languages: C and C++.


It's easy to cause memory corruption with Go while building a concurrent system, you don't need to learn anything about "defeating the language".


I agree, and I personally wouldn't call golang memory safe for that reason. Thomas's semi-definition includes the word "vulnerability", which narrows the scope so much that golang fits under the bar, since the common data race that causes memory corruption hasn't been shown to be exploitable without being contrived.

My personal definition of memory safety for a language like golang would specify that you can't cause this sort of memory corruption without an explicit call to unsafe, but there's no real definition to fall back on.


The same thing happens any time a message board confronts a professional term of art. The same thing happened with "zero trust", where you'd have long wooly debates about what was meant by "trust", but really the term just meant not having a conventional perimeter network architecture. Sorry, but the term as used in industry, by the ISRG, and in government guidance refers specifically to vulnerabilities.


"Memory corruption vulnerabilities" != "concurrency bugs" or even data corruption. The last thread I was in about this, someone pointed to Go segfaults and said "see! memory corruption!" (obviously: no).

An easy response to claims like this: there's a huge tower of software written Go at this point, including the entire K8s ecosystem. Show me the memory corruption exploits.


The amount of Rust code using unsafe is a major issues for a language build around safety. And yes, the same argument can also be made about Go having a unsafe keyword.

The fact that there exist crates to detected the usage of unsafe in dependencies, shows that its a rather liberal used keyword. Geiger comes to mind.

Unsafe in a language like Go is very rare, mostly because people do not program at such low system level to get the max performance out of it.

Rust code with unsafe: 1.7M Go code with unsafe: 400k

and for comparison, Go has about 2.3x the amount of repo's. So Rust has about a 10x more usage of the unsafe keyword.


While unsafe is always a risk in Rust, measuring the risk is not nearly as straightforward as counting lines of code. In particular, Rust focuses on encapsulating unsafe code behind safe wrappers that prevent misuse, so the better measure is determining which crates don't do this, and to what extent they can be easily patched to do so.


It's got really not much at all to do with `unsafe`.


[flagged]


I didn't downvote you and couldn't have (you were replying to me).

Please don't comment about the voting on comments. It never does any good, and it makes boring reading.

https://news.ycombinator.com/newsguidelines.html


Having run into memory issues in go but not (yet) in rust I would tend to disagree with this. It's really not hard or esoteric to run into it in go.


"running into memory issues" doesn't relate to memory safety as a property


I thought it was clear "Running into memory issues" meant memory safety violations as that was what we we were talking about. I guess not...


I just added a deco planner for DiveDB (https://github.com/cetra3/divedb): https://divedb.net/dives/plan

Need to add gas planning next!


I can't seem to scroll horizontally very easily, like I have to middle click drag in empty space, is there any reason you are hiding scrollbars?


(Leaflet cofounder here) - sorry about that! Are you seeing that with 'canvas' pages, or multiple doc pages open side by side? What device / screen size? I haven't seen issues with horizontal scroll recently but lots of trickiness with slight differences across browsers and maybe things we can improve for particular cases.

Re: scrollbars honestly we just like the cleaner minimalist look and have gotten used to it but I hear you (+ others) that it can be annoying, we'll look into improving.


This looks like a (not even) thinly veiled advertisement for their Convex product: https://www.convex.dev/.

I am interested in knowing who would make a decision to pay for something like this when there are a gamut of open source options available. Like what is the compelling reason to use something like this.


note that convex is open source! https://github.com/get-convex/convex-backend

if you don't want to manage your own infrastructure, you can use our hosted product, but otherwise it's totally fine to self-host the open source binary.

(convex cofounder here)


Speed of development, developer experience, ready to go templates. You should check it out, it’s really cool


"Really cool" is not compelling enough for me to decide to build a product against something like this. Here is, at a minimum, I would require to even consider:

- Comparisons against other types of stacks, like laravel livewire or phoenix liveview

- Performance metrics/stats/benchmarks whatever. You need to be faster and more robust than the other things out there, or provide some other benefit

- First Class self-hosted on premise install version without dependency on any cloud provider. Kubernetes helm charts or docker compose stacks or whatever

- I do actually like that you have a time-windowed source available license. That is something that alleviates the concern if you go under

- Jepsen or similar analysis, need to make sure whatever consistency guarantees you are advertising hold up


One public comparison on latency is https://db-latency.vercel.app/

For comparisons, you can check out:

https://stack.convex.dev/convex-vs-firebase https://stack.convex.dev/convex-vs-relational-databases https://www.convex.dev/compare/supabase https://www.convex.dev/compare/mongodb

I'll save you more of a marketing pitch, since you seem to have enough of my pitching Convex in the article:) The bullet points at the bottom of the article should be a pretty concise list - I'd call out the reactivity / subscriptions / caching. To learn how all that magic works, check out https://stack.convex.dev/how-convex-works


How does the speed of development of the entire app, not just the backend, compare to Rails + Hotwire or Laravel Livewire?


Author here- and yes as a disclaimer I work at Convex. As a caveat to that disclaimer, I pivoted my career to work here b/c I genuinely believe it moves the industry forward b/c of the default correctness guarantees, along with other things.

To this question here, some of the things that accelerate full stack development:

1. Automatically updates your UI when DB data changes, not just on a per-document one-off subscription, but based on a whole server function's execution which is deterministic and cached. And regardless if the changes were made in the current browser tab or by a different user elsewhere. Not having to remember all the places to force refresh when a user updates their profile name, e.g., makes it way faster. And not only do the Convex client react hooks fire on data changes, the data they return for a page render is all from the same logical timestamp. You don't have to worry about one part of the UI saying that payment is pending when another says it's been paid.

2. End-to-end types without codegen. When you define a server function, you define the argument validators, which immediately show up on the types for calling it from the frontend. You can iterate on your backend function and frontend types side-by-side without redefining types or codegen in the loop.

3. Automatic retries for database conflicts, as well as retries for mutations fired from the client. B/c mutations are deterministic and side-effect-free (other than transactional changes to the DB and scheduler), the client can keep retrying them and guarantee exactly-once execution. And if your mutation had DB conflicts, it's automatically retried (up to a limit with backoff). So the client can submit operations without worrying about how to recover on conflict.

There's obv. a bunch more in the article about features like text search and other things out of the box, but those maybe are more conveniences on the backend, since maybe a frontend person wouldn't have been setting up Algolia, etc.


Remix is really cool too! On the paper


I don't consider this strictly open source if components it depends on (I.e, the LLM) is closed source. I've seen a lot of these Fauxpen source style projects around


It only depends on the interface. There's a lot of projects which present the openai interface to whatever you want.


Not quite certain about your meaning. Could you be more specific? RAGFlow does not have its own LLM model or souce code. RAGFlow supports API calling from third-party large language model providers, as well as local deployment of these large models. RAGFlow has open-sourced these two parts of codes already.



Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: