Hacker Newsnew | past | comments | ask | show | jobs | submit | monlockandkey's commentslogin

Any practical tips for hardened security when programming? Don't want to be exposed to npm/pip/cargo installing password/browser cookie stealers. What worries me is the little to no isolation between the dev environment and the rest of the OS for day to day use.


Use as few deps as possible, and run your projects in containers, or even better, VMs.


That doesn't guarantee anything still, that's the beauty of Javascript ;)


How did were the apps able to collect geolocation even though location services were disabled?


Probably from IP address geolocation.


Indeed, the article notes that the lat/long wasn't "GPS exact", more like "postal code exact".


Doing that on the client side sounds pointless though, if you are already transmitting the ip.


It might be for consistency between vendors.


They just need to add a task runner feature (already being worked on) and the one tool to rule them all would be complete. Package manager, linter, formatter, type checker, task runner. Am I missing something? Maybe a build tool?

https://github.com/astral-sh/uv/issues/5903


I still hope they build a Heroku alternative. I think their work on uv might be some of the building blocks they would need?


That sounds plausible. Vercel equivalent for the Python ecosystem. UV deploy


Asserts are only available in debug compile mode.


$15,000 CPU is better than a $5000 CPU?

You can do all the benchmarks you want, but if you don't factor in price, then of course the more expensive product (in general) is going to be better.

It is the same thing with the Snapdragon Elite and Mediatek Dimensity 9400. The SDE is the faster processor and more expensive.


People do not seem to understand that these chips are in different price brackets, even between Qualcomm and Mediatek. That is why there is a discrepancy in performance.

Would not be fair to compare a $20 toaster to a $50 toaster and say that the $20 toaster is slower.


Nelson Mandela would have a good idea on what situation is apartheid.

https://www.pbs.org/newshour/world/nelson-mandelas-support-f...


No harm if all these requirements are met by some framework to cater to the Rust community.

In my opinion you should for 99% of cases use Golang for your web backend. Any other languages there are tradeoffs you are making.

Go:

- very easy to learn and grok Go code

- static typing

- fast compilation

- single binary (easier deployment)

- strong standard library

- large library ecosystem

- go routines for concurrency

- highly performant

Maybe Java,Kotlin and C# but they are still an order of magnitude more complex and resource heavy than Go.


Go is stuck in the eighties and replies like this are a good demonstration why it's very difficult to engage in intelligent discussion with many from Go communities.

As someone who mainly specializes in .NET, I have had incomparably better time participating in Java and C++ ones because people there are usually able to acknowledge pros and cons of various platforms, how they evolved and where are their strengths and weaknesses.

The average level of understanding and ability to consider what is the dev flow and how the language of choice impacts it in Go ones seems to be just so much worse it's not even funny.

That is to say, goroutines are discount futures/tasks which force you into synchronizing the "yielding of result" manually either via a channel or a waitgroup and a collection, or similar. Not to mention they are also much more expensive than .NET Tasks. I have not measured the cost of Java's new green threads yet but assume they are going to be in the same ballpark of memory cost as Goroutines, but with drastically better steady state performance provided by OpenJDK HotSpot when it comes to regular application code.

And lastly - Go requires you writing heaps of boilerplate for simplest things, Go channels come with a lot of footguns and gotchas you have to learn, standard library has weird omissions, type system is static but weak and as the demands put onto Go continue to become more complex, as more and more developers are forced into it, the language becomes the kind of unreadable soup you accuse other languages of. Just look at range over funcs and iterators discussions recently. It's ugly and token-heavy. And you will see a lot of code like this if you browse random libraries on Github - it's unnecessarily bulky, in a way that is excusable for true system programming languages but not in Go which has even higher level of abstraction runtime than .NET.


Good concept!

The important thing to know when learning hotkeys is how to perform the same action using application UI.

Otherwise the keyboard becomes an obscure medium for discovering application functionality


I've been using Blender for over 5 years. I'm also active on Blender.stackexchange.com and when I help someone there and write instructions, I'm always confused how to navigate to a particular thing using a menu (mostly because some operators' place is ambiguous e.g. "select" vs "mesh" vs "vertex". I think there's a lot of users like me, for efficiency you're just supposed to use shortcuts.

You wouldn't use a menu in notepad to cut/copy/paste, select all etc. right?

It's funny how, when I actually look in the menu, I discover some new things added in recent versions of Blender.


Flarum is a really nice open source forum

https://flarum.org/


I've been keeping my eye out for something more responsive (in an AJAX-like way) than phpBB, but less bloated than Discourse (as it's written in ruby). Something Open Source, decently low-effort to maintain (I like Debian), could run on a Raspberry Pi 5 for a small community, and doesn't require docker. This might be suitable. Thanks for the endorsement.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: