Live data from Hacker News

Less is safer: Reducing the risk of supply chain attacks

obsidian.md

231–240 of 274 posts

Re: Less is safer: Reducing the risk of supply chain attacks

#231

Earlier quoted context omitted.

Because that would be a distraction to the point they're actually making.

The point is thoroughly undermined since we can't judge the veracity of their claims

And discussing the specifics of whatever OS GP uses is exactly the type of OT he was wise enough to avoid.

Personally, I think he uses Emacs.

Re: Less is safer: Reducing the risk of supply chain attacks

#232
post #133
post #97

Earlier quoted context omitted.

When I was young there were a few luminaries in the software world who talked about how there is a steady if small flow of ideas from video game design into conventional software. But I haven't heard anyone talk like that in quite sometime (unless it's me parroting them). Which is quite unfortunate. I think for example if someone from the old guard of Blizzard were to write a book or at least a novella that described…

I’ve been of the opinion that every hard problem in CS shows up somewhere in gamedev. It’s a great space for inspo.

Game dev also rewards people for applying the 80/29 rule effectively and you see less of that in commercial software.

In each game generation there’s a game that would be easy to write on the next or subsequent generation of hardware and is damned difficult to implement on the current one. Cleverness and outright cheating make it work, after all fashion.

Re: Less is safer: Reducing the risk of supply chain attacks

#233
post #97

Earlier quoted context omitted.

When I was young there were a few luminaries in the software world who talked about how there is a steady if small flow of ideas from video game design into conventional software. But I haven't heard anyone talk like that in quite sometime (unless it's me parroting them). Which is quite unfortunate. I think for example if someone from the old guard of Blizzard were to write a book or at least a novella that described…

Kernel design is (to me) another one where ideas have flowed into other software fields - there were monolithic kernels, micro kernels, and hybrid kernels, and they all need to work with third party modules (drivers) The lessons from all fields seem to be relearnt again and again in new fields :-)

A lot of stuff we think is top shelf today was tried on mainframes in the late 80’s through the 90’s. Cloud computing is mostly recycled 90’s “fashion”.

See also people trying to bring Erlang back into fashion.

Re: Less is safer: Reducing the risk of supply chain attacks

#234
post #214
post #91

Earlier quoted context omitted.

> what exactly are you doing with a markdown note-taking application such that performance is a legitimate concern? Launching it and expecting a fast startup.

That’s a reason I moved away from Notion. The startup is so terribly slow (perhaps because it’s updating too often?).

[dead]

Re: Less is safer: Reducing the risk of supply chain attacks

#235
post #56

Earlier quoted context omitted.

Funny enough, I thought this earlier about Arch Linux and it's deritives. It was mentioned on reddit that they operate on a small budget. A maintainer replied that they have very low overhead, and the first thought that popped into my mind was that most of the software I use and rely on comes from the AUR, which relies on the user to manage their own security. If engineers can't even manage their own security, why ar…

I'm shocked it is most of your software. I think I have under a dozen AUR packages. It has been that way for about a decade. I added a couple for gaming recently (mostly because Lutris just crashes for me), but nearly all of my software comes from the official repos.

Same for me. I learned about AUR before installing Arch, but went months before installing my first package from there.

Re: Less is safer: Reducing the risk of supply chain attacks

#236
post #133

Earlier quoted context omitted.

I’ve been of the opinion that every hard problem in CS shows up somewhere in gamedev. It’s a great space for inspo.

Game dev also rewards people for applying the 80/29 rule effectively and you see less of that in commercial software. In each game generation there’s a game that would be easy to write on the next or subsequent generation of hardware and is damned difficult to implement on the current one. Cleverness and outright cheating make it work, after all fashion.

80/29 rule is the paretypo principle?

Re: Less is safer: Reducing the risk of supply chain attacks

#238
post #127
post #38

This doesn't make any sense to me. I've always been told you don't write anything yourself unless you absolutely have to and having a million micro-dependencies is a good thing. JavaScript and now Rust devs have been saying this for years. Surely they know what they're doing...

There is a balance to be struck. NPM in particular has been a veritable dependency hell for a long time. I don't know if it just attracts inexperienced developers, or if its security model is fundamentally flawed, but there have been soooo many supply chain attacks using NPM that being extra careful is very much warranted.

Right, I get that. I was just making a joke because I really dislike the micro-dependency approach. Honestly bothers me more in Rust then JavaScript, but that's probably just because I'm not a web dev.

From my buddies who have worked in JS my understanding is that a lot of it is rooted in JavaScript having a really shitty standard library for a long time. So that lead to a culture of code sharing early on since everyone was rewriting the same utilities and what not. Which evolved into the package management ecosystem over time.

Why that came about in something like JavaScript but not C, which also obviously has a really small std is super interesting. My only guess is that JavaScript came up in the internet when package managers started to take on a new meaning, and web dev is more relavent to a broader range of (nontech) companies and they're more likely to put a huge focus on quality over quantity.

Re: Less is safer: Reducing the risk of supply chain attacks

#239
post #230

Is that the reason why Obsidian does not support the https://textbundle.org/ format for import/export like any other markdown editor?

for import it does: https://help.obsidian.md/import/textbundle

for export it's the same reason many features don't exist yet — the team only has 3 full time developers

Re: Less is safer: Reducing the risk of supply chain attacks

#240
post #75

If the obsidian team did a 2 hour q&a livestream every week, I'd watch every one (or at least get the AI summary). One of my favorite pieces of software ever.

I recently had a similar experience using Libby for the first time. An absolutely incredible piece of software. If anyone here on HN works on it, you deserve to be proud of your work.

Fully agree. Libby is awesome!
Post reply on HN