Hacker Newsnew | past | comments | ask | show | jobs | submit | oncallthrow's commentslogin

> A library is something you call.

> A framework is some kind of application scaffolding that normally calls you.

There is no real distinction between these two.



Not every framework use IoC.

This. This. This. I currently work in a codebase where so much code has been abstracted away for “cleanliness” that it’s impossible to understand what code is actually running.

The worst is when three lines of completely standard code (immediately understandable to anybody inline) get „helpfully” lifted out into a utility function.


By the way, the reason behind all of this, like so many ills of our industry, is the completely broken promotion culture.

While I agree that the promotion culture appears to be broken in the US, I can assure you that these kinds of over-abstractions happen completely regardless of promotion culture.

I was expecting this to be stupid but it’s genuinely funny. I guess LLMs are better at humor than I remember

> most web developers are well aware of the risky parts of the language

In my experience this really isn’t true. Most web developers I know are not familiar (enough) with prototype pollution.

By the way, this isn’t because they are “dumb”. It’s the tool’s fault, not the craftsman’s, in this case. Prototype pollution is complicated and surprising


No, we just found Nicola sturgeon’s hacker news account

It sounds to me like you’re just arguing for premature optimization of another kind (specifically, prematurely changing your entire architecture for edge cases that probably won’t ever happen to you).

If you have an architecture already, obviously it's hard to change and you may want to postpone it until those edge cases which probably won't ever happen to you, happen. But for new architectures, value your own grey hairs over small performance improvements.

If you 300ms latency then yes, you defeat this detection mechanism.


Only if the detection mechanism is looking at that single IP and from a single location.

Find the ASN(s) advertising that network and figure out their location.

Even within the ASN there may still be multiple hops, and those IPs may be owned by others (eg the hosting facility) who are not playing the same latency games.


We operate servers for the purpose of measuring the internet using a wide variety of methods. We have more than 1,200 of these servers distributed across 530 cities, running not only ping but traceroute and many other types of active measurements.

In addition to active measurement and research, there are many other sources of data we use. Also, we are actively investing in R&D to develop new sources. Adding just 300ms of latency at the end of an IP address would simply appear as noise to us. We have dozens of locations, hints cut through the noise.

We welcome people to try to break the system. Perhaps it is possible to dupe this system.


Meh, this is a defence in depth measure anyway

Edit: also, the supported platforms are ARM and x86. If your code isn’t running on one of those platforms, you probably know what you’re doing.


Linux

Windows and MacOS?

Go is supposed to be cross-platform. I guess it's cross-platform until it isn't, and will silently change the semantics of security-critical operations (yes, every library builder will definitely remember to check if it's enabled.)


If you need this for Windows so desperately why aren’t you offering to add support for that platform? It’s open source.

Many advanced Go features start in certain platforms and then expand to others once the kinks are worked out. It’s a common pattern and has many benefits. Why port before its stable?

I look forward to your PR.


Absolutely not the right take unless the OP is a security researcher


> Meh, this is a defence in depth measure

Which is exactly why it should fail explicitly on unsupported platforms unless the developer says otherwise. I'm not sure how Go developers make things obvious, but presumably you have an ugly method or configuration option like:

  dangerousAllowSecretsToLeak()
...for when a developer understands the risk and doesn't want to panic.


This is a sharp-edged tool guarded behind an experimental flag. You are not meant to use it unless you want to participate in the experiment. Objections like this and the other one ("check if it's enabled" -- you can't, that's not what secret.Enabled() means) illustrate that this API may still need further evolution, which it won't get if it's never available to experiment with.


Alternatively:

  enclave, err := secret.GetEnclave()
  // err contains whether the platform doesn't support it
  enclave.Do(f)


Wrong, collective action doesn’t change anything. It simply interchanges who gets poorer.


But sometimes that's the goal.

In professional sports, the player's union helps raise athlete salaries and improve working conditions and that does ultimately come out of the owner's pockets.


Easy counterexample: safety. Unions have historically been on the forefront of safety improvements. Not having workers mutilated or killed -> increased wealth for all. That's not a zero-sum game.

And if you think this doesn't matter for game programmers, look at how many overworked people in the past few years have gotten in car crashes while driving home. Fatigue kills.


Sorry, which grass roots group exactly campaigned for this? Which party’s manifesto was it on?


"Never let a good crisis go to waste."

The "think of the children!" argument has long been used by people in government to give themselves more power. In this case there's been a global effort to shut down unapproved speech. The government gains the power to censor and arrest for "bad speech" but it also gets to decide how the labels for the same are applied. There have been panel discussions and speeches on this at the WEF, and discussions of tactics for selling or pushing through this kind of legislation for at least a decade.

That's how we got that video of John Kerry lamenting the U.S. Constitution's First Amendment.

So under the aegis of "think of the children!" (which may or may not have come from "grass roots" organizations) you get a committee with the power to decide what speech is badthink or wrongthink, label it as such, and hand out arrest warrants for it.

Disagree with policy: that's "hate" or "misinformation" or "inflammatory."

Voice a moral opinion: that's "hate" or "bigotry" or "intolerance."

Express doubt over a leader's actions: that's "misinformation" or "inflammatory."

Fascinating that they're more worried about VPN use than about shutting down rape gangs.


In Britain in particular? The NSPCC, Molly Rose Foundation, IWF among a bunch of others. 70% of Brits are supportive of the online safety act[1], it's been supported by Conservatives, Labour and the SNP.

There's simply no data in favor of the argument that this is a minority position or even some kind of conspiracy. Child safety is (not very surprisingly) usually a voter driven concern. You think banning people from social media is an idea coming from big tech and shadowy three letter agencies? What kind of sense does that make

[1] https://yougov.co.uk/technology/articles/52693-how-have-brit...


YouGov panel always returns huge numbers for any 'safety' question that doesn't match data collected from other sources. It's a panel poll, the people being polled are weird and unrepresentative.


Of course a poll that asks a leading question can get 70% in favour. It’s not a conspiracy by TLAs (the people they’re interested in won’t be fazed by these paper-thin measures) or big tech (this hurts their bottom line). It’s legacy media, who have lost a lot of ground to the Internet, and stand to lose nothing by making it worse, and coincidentally also have a captive audience of voters who wouldn’t know one end of a USB cable from another who simply don’t understand any of the downsides.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: