Hacker Newsnew | past | comments | ask | show | jobs | submit | faceplanted's commentslogin

You said that's not really true and the described exactly how it's true, what did you mean?


I parsed the comment as something along the lines of clever hackers somehow stuffing soundless videos into gif containers which is most certainly not what is going on. I was attempting to convey that they have nothing to do with gifs. Gifs are not involved anywhere in the process.

I'm not sure why people disagree so strongly with what I wrote. Worst case scenario is that it's a slightly tangential but closely related rant about deceptive web design practices. Best case scenario is that someone who thought some sort of fancy trick involving gifs was in use learns something new.


Transpilers in general tend to be significantly less well maintained and optimised than direct APIs


I'm not a disinterested observer.

Py2many has had a mojo backend for a year now.

https://github.com/py2many/py2many/tree/main/tests/expected


> I am pretty sure the Rust version has a lot of logic bugs

What makes you say that? I'm not trying to be argumentative, I'm genuinely interested.


Whenever a complex system is rewritten, there are a lot of bugs and regressions in it.


Often worse than the original system, because the writers expertise and motivation are different.

At times the authors who rewrite-in-foo are just motivated to expand the foo ecosystem and are not primarily interested in making a working program, much less in possession of the requisite subject matter expertise or focus.


All the rewriters are offended by the truth.


Yup, hence why the downvotes. :( I thought it was a no-brainer, but I guess not.


I see what you mean now. The way you phrased it came off as much more a critique of the language used and/or the developers using it, rather than the simple fact of it being a rewrite of a complex tool.

Also does `sudo` not have a spec or any existing unit tests for the previous vulnerabilities that they can benefit from? I'd be pretty shocked if there wasn't a lot of regression testing and documentation available to anyone implementing something this vital.


Rewrites by engineers can also uncover cases where the original tool does not conform to its own spec, this rewrite uncovered two issues with the original sudo.

One of our engineers involved in the project wrote about the testing approach they used and about the issues they found here https://ferrous-systems.com/blog/testing-sudo-rs/.

Later, a dedicated security audit for the rewrite was performes which uncovered three issues, one of which also affects the original sudo implementation. https://ferrous-systems.com/blog/sudo-rs-audit/

I generally support the notion that rewrites of large complex code bases are usually a bad choice, but sudo is not a particularly large codebase not is it particularly comples - it's just particularly sensitive. In those cases, I believe the tradeoff can fall the other way - rewriting old, feature-stable codebases (to a reduced scope) can lead to improvements on all axis.


Saying "a lot" and especially that it's still "a lot" is not a no-brainer.


Some. More than enough. Potentially two, critical ones. Is that better?


I bet you the existing program also has two critical bugs. It's replacing imperfect with imperfect and rewrites are not necessarily worse. Especially if a program grew a ton over time and you can give it a better structure and a better spec document.

There are systems where you really want to preserve accidental quirks of behavior that other things depend on. Sudo I think is not one of those.


Someone said this: https://news.ycombinator.com/item?id=44364842

I agree.

How about we just start using doas, anyway?


I'm not well versed in the motivation of this project.

But yeah a simpler program is probably good in this situation.


I’m a pretty big advocate on Rust and while Rust does protect classes of certain kinds of bugs and probably encourages better unit test hygiene and thus higher code quality, it does not protect against logic bugs and all the historical CVEs and thus it’s possible for previous exploits vectors to resurface. Thus it’s not an unreasonable prior to assume there are vulnerabilities lurking.

On the other hand, if the replacement isn’t targeting full sudo feature set and also reducing the amount of code and/or making architectural improvements like keeping most code not running as root, then the blast area of such logic bugs can be reduced.


It makes sense that a very popular language would be being used to make one of the most popular projects.


You seem to think the issue is noise, but have you considered noise might just be the most noticeable symptom of general city living? i.e. having much less personal space, nature, privacy, and free time to spend in them?


I had a great time living in cities, and still miss it. It's not an objective choice, depends absolutely on your preferences and lifestyle if city living is worth it or not.

Having less personal space, privacy, nature, etc. are trade-offs for what a city provides if you are into city life. I don't live far away from the city centre but have nature around, depending where you live on Earth it's not mutually exclusive to have access to both.

So the issue is noise, the rest are trade-offs one can make but I'd venture to say that almost absolutely no one would choose "noisy environment" as a preference for their lifestyle.


Ok, so what are those place where one have lot of personal space, nature , privacy and free time but very noisy all the time.


No no, maybe he's right and there are only 8536 ways to sort a deck of cards, the casinos have taken us all for fools!


Well, 0 isn't really possible, but assuming you're just asking "What would the impact be on the world if me made matrix multiplication trivial" in the same way that people ask what making a room temperature superconductor would do for us.

The answer is quite a lot in computing terms, matrix multiplication is used everywhere, most notably at the moment, neural networks use almost entirely matrix multiplication, so their power consumption would drop almost entirely, and correspondingly we could scale them up enormously, your phone could run GPT5 locally as long as it had the storage space, high fidelity computer vision everywhere would become trivial, Google Glass might even become useful.

Previously very limited engineering simulations like weather forecasting would improve by leaps and bounds.

Basically everything would change all at once because we'd have effectively made p = np, any problem you can turn into a matrix multiplication (so basically most maths problems) would become solvable.

At the moment we use hardware like GPU's and TPU's in the case of AI to make matrix multiplication much quicker and the companies that make them have recently become some of the biggest in the world because it's so important to everything we do now to be able to multiply matrices quickly.


> Most real world buttons are elevated off the surface to let us know it is pressable, but digital buttons now just have a white or colored pill shape around it. I can't recall the last time I saw a pill shaped button in the real world.

Well not really, real world buttons are elevated off the surface because of the practicalities of producing buttons and attaching them to a surface, some of the material has to be above the surface and some below for it to clamp on. Buttons are also usually produced as separate components and thus tend to be round or square because it's more mechanically simple and suits the most use cases, labels can be put around the button.

Computers have completely different mechanics, all buttons can be a bespoke size and shape, and they're inherently not tactile, the pill shape is just the easiest way to allow a button with variable width for variable font sized text, because it's easier to put the text on the button itself digitally than irl.


In the real world, toggle switches cannot jump instantly from one state to another but on a computer they can because of completely different mechanics.

Either we want to resemble the real world or we don't or it depends on what is currently fashionable.


Microsoft teams doesn't load slowly because of the animations, you can turn all of them off if you mess around with the settings and your windows registry enough. It loads slowly because MS have a huge incentive to keep adding features and almost no incentive to optimise it because the software is almost always purchased by large institutions, half of whom have vendor lock in already, and imposed on the people who actually use it day to day, who have no power to change it.


> It loads slowly because MS have a huge incentive to keep adding telemetry and ads and almost no incentive to optimise it

Fixed that for you.


I'm skeptical of the idea that anything is going to derive intelligence from the bottom up, but I'll be super impressed if that's how it goes.


Why not? We started off as single celled organisms and look at where we are now.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: