101–110 of 116 posts
Earlier quoted context omitted.
> Honest [...] > Happy to get into the addressing scheme I truly loathe how all of the HN spambots promoting shovelware include a stupid call-to-action for feedback/discussion.
They can be spotted a mile away. Check the repo - 2 weeks to complete!
Earlier quoted context omitted.
> Honest [...] > Happy to get into the addressing scheme I truly loathe how all of the HN spambots promoting shovelware include a stupid call-to-action for feedback/discussion.
They can be spotted a mile away. Check the repo - 2 weeks to complete!
Earlier quoted context omitted.
I still have no comprehension of how curl piped into a shell command has become the default installation method for many projects (looking at you, Rust...). It breaks my brain as to how potentially unsafe it is.
Everyone’s eventually going to run a binary they downloaded from the same place, if you’ve already decided to do that, why is a curled install script worse?
By comparison, a curl|bash not only skips over my ability to do any of that but it also introduces two new potential paths to exploitation if a malicious user has control over the web server. There's the classic "hidden text that doesn't appear visually but will be in the copy/paste version" and the more complicated "server detection of manual download vs. curl|bash to deliver different content".
A curl|bash saves the "friction" of a `chmod +x` command and maybe an unzip/untar in exchange for introducing multiple different ways for malicious actions to be hidden.
Earlier quoted context omitted.
If you have any previous experience in this domain and/or other relevant credentials it would help to mention them here as well.
Yeah I run an HFT firm. Apart from that, why does it matter? This isn't finance! But of course, rayfish is NOT production ready. For home servers might be ok. BUT NOT PRODUCTION READY
To not care who you are would mean not only having to review the current code as is, but to review every update that follows as possibly written by a hostile party. Ie, the time invested would be several times of that invested in something written by a more trusted party.
Earlier quoted context omitted.
Stable IP addresses solve it as well, but these kinds of things are not generally aimed at contexts where those are an option. Even IPv6 isn't generally stable - the prefix is ISP-defined and tends to vary similarly to IPv4 with CGNAT. There's also "dynamic DNS", which is basically just caching one side of that server/relay/TUN/STUN handshake, and relying on DNS for global discovery. For Iroh vs Scuttlebutt / DHT, I'…
One of the n0/iroh devs here. Iroh doesn't use DHT as its main discovery mechanism. It uses DNS/pkarr and relays as the primary method. DHT is a separate feature if folks like to do that, we don't have it on by default and don't have it on the public relays. The whole idea is p2p but trying to be realistic about what network environments actually look like.
Thanks for clarifying that. So does that mean Iroh still require a DNS server or domain name even though it doesn't rely on IP address?
I thought dial by key means the other party just need to be on internet and has the right key/pubic identifier then they can reached.
Where does the message resides if the other end is NOT online?
Interesting project but can't find anything useful about the author's background on GitHub. Commit history shows the project is a couple weeks old and the commit velocity only seems possible with heavy LLM involvement. Not unexpected but worth noting. The repo's CLAUDE.md is huge which conflicts with published best practices around agent instructions and makes me wonder how much experience the author has using LLMs.…
Hello. Yeah this is my secondary account. Main one is dgrr. I still dont do much there. I have projects in github.com/infinitefield and now rayfish. Indeed yes I do not use LLMs too much. Rayfish was a project we had pending for years and I had a lot of sketches about it in my obsidian folders. After the release of iroh v1 I decided to try out claude and prompt it to solve the problem. Still, there is a lot of boiler…
Earlier quoted context omitted.
If you have any previous experience in this domain and/or other relevant credentials it would help to mention them here as well.
Yeah I run an HFT firm. Apart from that, why does it matter? This isn't finance! But of course, rayfish is NOT production ready. For home servers might be ok. BUT NOT PRODUCTION READY
Trust at two levels: who are you? What HFT firm do you run? How do we know you are actually this HFT leader? What are you doing in the HFT firm that lends credibility to build a project like this? I.e. if you lead the sales team, and have no software dev background, it doesn't increase trust in this project. If you built all the software for the HFT firm, that matters.
Since it's security related, we want there to be signals in the project that we can trust it to not start sending all our data to some bad actor state or org.
Then there is trust at the code level... Does it work? Will it continue to work?
You built it in two weeks because, for the last four years, you were busy with other things. If you get busy again, will the project lag for the next four years?
You don't owe us any of these answers. It's OSS, engage at whatever level you want. But, understand that when you publish your efforts to a place like HN, we are going to find and mention the things that make us uncomfortable.
That said, it's a good sign that people are pushing back. It is a cool project and fits a real need. So if you can increase the trust signals in the project, I think you will get more users... If you really want them. More users means more critique. :)
I hope you do make an effort to increase the trust signals and keep working on the project because I'd like to use it.
Earlier quoted context omitted.
But ... Rayfish creates a layer 3 network too. It assigns IP addresses to each node. I don't really see why it matters from this point of view whether it uses Iroh or something else to provide its backhaul. That's like saying Wireguard works at layer 4 because it uses UDP. The whole point of VPNs is to offer some kind of tunneling over higher level protocols.
I always imagined that the application layer had some kind of extra overhead that would be unacceptable for general purpose use.
Earlier quoted context omitted.
Yeah I run an HFT firm. Apart from that, why does it matter? This isn't finance! But of course, rayfish is NOT production ready. For home servers might be ok. BUT NOT PRODUCTION READY
It's the attention economy. You're engaging in something that is related to privacy and security, thus the credibility of the author in this domain will also be a factor for people wanting to invest their time exploring these solutions. To not care who you are would mean not only having to review the current code as is, but to review every update that follows as possibly written by a hostile party. Ie, the time inves…
In terms of the credentials; again, it is not a product like Bitcoin. I am not a researcher from some university. I don't even have a computer science degree. So I don't oblige to "credentials".
I am an entrepreneur, I had some ideas. One of those ideas is rayfish. I like to give back to groups or people. I live in a country where I pay no taxes so I can donate part of that to cat shelters from my homecountry and in this case I open-sourced rayfish because I think it is a good product many people like me will enjoy.
Does that reply to your concerns?
Earlier quoted context omitted.
Yeah I run an HFT firm. Apart from that, why does it matter? This isn't finance! But of course, rayfish is NOT production ready. For home servers might be ok. BUT NOT PRODUCTION READY
Because it's security related, the trust needed to consider using it is just higher. Trust at two levels: who are you? What HFT firm do you run? How do we know you are actually this HFT leader? What are you doing in the HFT firm that lends credibility to build a project like this? I.e. if you lead the sales team, and have no software dev background, it doesn't increase trust in this project. If you built all the soft…
But anyways, first of all; you can see we run a trading company called Infinite Field (https://github.com/infinitefield) and we trade on a decentralized venue called Hyperliquid. You can check the leaderboard there, we are in the top 15 or so. We are doing more than just trading there, we also run a validator with 0 revenue on our side. We charge no fees. Although maintenance cost is high (20k/month). We also built an SDK for users building in Hyperliquid because the official one was not good enough (https://github.com/infinitefield/hypersdk). No other market maker is going to do that. Mostly. Also, I built and released our in-house websocket library (https://github.com/infinitefield/yawc) because I consider it to be better than tokio-websockets or tungstenite. Why is it better? It supports compression (which no other does) and WASM (that one was pre-LLMs so code is mine alone hehe).
> You built it in two weeks because, for the last four years, you were busy with other things. If you get busy again, will the project lag for the next four years?
I am always busy. But I want to deliver a minimum set of features that will work without me. You can see the open issues and PRs. All of the work is being made transparently on Github. I also use the product myself and I hope I can use it internally at my company too. If you want to reach out to me you can do it over email or telegram (ask for it) and I am 24/7 online. When I say the idea was sitting idle for 4 years; it basically means I was a guy from a town in Spain and I had to do something to get out of there. Although I contributed a lot to opensource when I was younger (check https://github.com/dgrr) it didn't pay the bills! So it took me 4 years to reach a level in which I feel comfortable dedicating some time to opensource stuff like hypersdk, yawc or now rayfish (actually more than 4 years, but rayfish was there for that amount of time).
I am very transparent. I'll open up my X account so you can engage more directly with me if you want.