Hacker News new | past | comments | ask | show | jobs | submit | lexh's comments login

It is Postgres specific, but I’ve gotten a lot of mileage out of the advice in this article:

https://supabase.com/blog/postgres-audit


I think some of it is shown on this page:

https://docs.dagger.io/features/visualization/


Gee whiz is this person is in for a treat when they discover the joys of OpAMP https://github.com/open-telemetry/opamp-spec/blob/main/speci...

Turtles all the way down.


Blech.

If you already have reloadable configuration infrastructure, or plan to add it in the future, this is just spreading out your configuration capture. No thank you (and by “no thank you” I mean fuck right off).

If you want to improve your bus number for production triage, you have to make it so anyone (senior) can first identify and then reproduce the configuration and dependencies of the production system locally without interrupting any of the point people to do so. If you cannot see you cannot help.

Just because you’re one of k people who usually discover the problem quickly doesn’t mean you’ll always do it quickly. You have bad days. You have PTO. People release things or flip feature toggles that escape your notice. If you stop to entertain other people’s queries or theories you are guaranteed to be in for a long triage window, and a potential SLA violation. But if you never accept other perspectives then your blind spots can also make for SLA violations.

Let people putter on their own and they can help with the Pareto distributions. Encourage them to do so and you can build your bus number.


A bit over my head, but I enjoyed the way the writing brings us along for the ride.

This can’t be the first pass someone has made at something like this, right? There must be literal dozens of SIMD thirsty Gophers around. Would a more common pattern be to use CGO?


The problem with cgo is the high function-call overhead; you only want to use it for fairly big chunks of work. Calling an assembly function from Go is a lot cheaper.

https://pkg.go.dev/github.com/grailbio/base/simd has some work I’ve done in this vein.


I think people certainly have been trying for a while. In fact, I recall being on a (Skype?) call with my brother almost a decade ago while he was trying to write an SIMD library in Go. If I remember correctly, at that time, a bunch of the AVX instructions weren't even encodable in Go's Plan9 assembler - so we had to manually encode them as bytes [0].

The most complete library I've seen (though admittedly never used) uses CGO _partially_, with a neat hack to avoid the overhead that it comes with [1].

[0]: https://github.com/slimsag/rand/blob/f1e8d464c0021a391d5cd64...

[1]: https://github.com/alivanz/go-simd/


(Rejected) proposal to add something like this to the standard library gives some context: https://github.com/golang/go/issues/53171


What line of work is full of former programmers?


Nowadays, that's the unemployment line.


“pretty scary stuff” indeed!

This would inevitably end up ingesting secrets, right? Like say from my password manager? Or API keys in my terminal?

Lots of ways for this to go sideways even if the data stays local.

What’s the plan there?


Come together as a community and help build the right thing. This isn’t the first implementation and I don’t have a fiduciary duty to create value to investors.


> Lots of ways for this to go sideways even if the data stays local.

Could you name some?


The impression I was left with is that this tool would write things to disk. It would be helpful to know how that data is stored. I wouldn’t want my password manager OCR’d and then sitting in plain text on disk for example.


> Like say from my password manager? Or API keys in my terminal?


That's not describing a bad outcome, it's describing how the tool works.


Oh, well I think what he meant is that some malicious program could read and transmit this unencrypted recorded data which is normally stored in an encrypted form


Thanks, I think so too, but the threat model is a bit odd. On a Mac, potentially malicious programs do not normally have access to files in every location (e.g. the prompts to allow a process to access your Documents dir); there is hardware-backed crypto available for further protections; full disk encryption; and so on. It's unclear to me how to evaluate the severity of the risk.

Every security decision is a risk-reward tradeoff, and the reward of a complete memory of computing tasks seems pretty huge.


All the staff at my local coffee shop ask “for stay or for takeaway?”

They never deviate from this exact script and I find it grating every single time. Coffee is decent though so I let it slide.

Edit: “local” meaning Southern California.


That’s bizarre, is the owner British or something? “Here or to go?” is the standard in the US as far as I’m concerned.


I prefer "to go" over "takeaway" for two essentially meaningless reasons:

First, _go_ is older than _away_. According to Etymology Online, go dates back to Old English ("gan"), while away in sense of "at a distance" is from 1712. Second, I get to save a syllable.

So "to go" is older and less effortful than "takeaway". Also, both work.


"Takeaway" is also the term used in many non-english speaking countries (by waiters who speak very limited English).


Oh, data collection. And subscriptions.

This makes sense (and myQ’s privacy policy is a nightmare: https://www.myq.com/privacy-notice) but I’ve never understood how this particular bit of data is valuable to anyone. Any ideas?


I buy a garage door opener. That is the end of my transaction.

I buy a connected garage door opener. The provider knows my geolocation, my name, email address, socioeconomic status, even the phone I own. Inferences can be made on activity such as "they leave for work at 7am when garage door opens".

The collection of data doesn't need to be used specifically for reengaging me with Chamberlain. It is now an asset to the company that can be sold to others as outlined in their Information Sharing section. Which basically says "we share it with everyone".

Partners can be anyone from insurance companies to academic researchers. Remember that partners aren't limited to just one data set. They have the ability to ask multiple companies: "What data do you have for all occupants of houses in this geographic area?"


> Remember that partners aren't limited to just one data set. They have the ability to ask multiple companies: "What data do you have for all occupants of houses in this geographic area?"

Yup. And to make the issue clear: there is no such thing as "anonymized data", there's only "anonymized until correlated with enough related data sets".


No direct experience, just my guesses

* someone who drives frequently may rank higher for automotive products and services

* use to independently rank other statistics, i.e. someone with kids probably comes and goes more than a single person or non-child-rearing couple. Take the dataset where you know they have kids (and myQ) and see if you can detect the ones with kids using only myQ data (plus other statistics). If it allows you to infer this property accurately enough, profit.

* Someone who comes and goes a lot is most likely not physically disabled, so exclude them from those specific marketing materials.

* someone who is home a lot (hardly ever opens their garage door) might like to spend money on useless gadgets, try selling them IoT toasters


Plus some of their door openers have a camera and microphone. From that they could get a lot more very specific data.


Number of active car owners living in an area could be valuable for a few industries and governments


  > Perhaps it is the article On Sense and Reference by Gottlob Frege?
  >
  > http://www.scu.edu.tw/philos/98class/Peng/05.pdf
from previous discussion https://news.ycombinator.com/item?id=18895613


> You're telling me i provided $14/m in ad revenue? Of course not.

Do you really think Google just set the price arbitrarily? That would be surprising.

My impression has always been that ad free tiers are actually less profitable for video providers.


> Do you really think Google just set the price arbitrarily?

No, not arbitrarily. But that $14/mo bundles in the price of other services as well, namely Youtube Music. Youtube Music doesn't cost Google nothing, so obviously $14/mo isn't what they're getting from people in ad revenue. A comparable music subscription from spotify costs $11/mo, so subtract that from $14/mo. $3/mo is a fair estimate for what they expect to get for showing ads.


> My impression has always been that ad free tiers are actually less profitable for video providers.

I'd be interested to see those numbers. More importantly though, i don't want to pay more than my share if we're actually talking a fair trade of services here. If the justification is cost of video hosting vs ads i'd see, then it should be variable.

Also, it's including a service i have zero interest in. So upcharging alone is insulting.


Consider applying for YC's Summer 2025 batch! Applications are open till May 13

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: