Preferences

smarx007
Joined 3,247 karma
[ my public key: https://keybase.io/berezovskyi; my proof: https://keybase.io/berezovskyi/sigs/3mjvOATTRWRhdEjHztuHmn6apGrT7hyWrAJufziVBmw ]

hi there

https://berezovskyi.me/


  1. I am assuming that the GP was referring to buying these exact speakers second-hand, given how they spoke of the environmental impact.
  2. > I want my sandbox to be backed by a large, well funded security team

    How much are you ready to pay for a license?

  3. I think the SSH key that has push permissions is SSH-forwarded. It is quite a sophisticated setup (in both a good and a bad sense).
  4. The output from Jules is a PR. And then it's a toss-up between "spot on, let's merge" and "nah, needs more work, I will check out the branch and fix it properly when I am the keyboard". And you see the current diff on the webpage while the agent is working.
  5. How about specifying a version in the CI config? [0]

    Also, you know that you can do a binary search for the version that works for you? 0.154.0, 0.77.0, 0.115.0 ... (had to do it once myself)

    [0]: https://github.com/oslc-op/website/blob/9b63c72dbb28c2d3733c...

  6. I am assuming the message durability guarantees lean towards YOLO rather than ACID? See also https://www.hackerneue.com/item?id=46196105
  7. You did not check my link and ss02 out, did you?
  8. IBM Plex is very good. Recently, I have been enjoying https://rsms.me/inter/ for interfaces a bit more (with ss02 for body and ss02+tnum for tables activated).
  9. To test 'limit > 0' according to MC/DC, you need only two values, e.g. -1 and 1. There may be other code inside the branch using limit in some other ways, prompting more test cases and more values of limit but this one only needs two.

    But yes, exhaustively testing your code is a bit exhausting ;)

  10. Modified Condition/Decision Coverage (MC/DC) is a test coverage approach that considers a chunk of code covered if:

    - Every branch was "visited". Plain coverage already ensures that. I would actually advocate for 100% branch coverage before 100% line coverage.

    - Every part (condition) of a branch clause has taken all possible values. If you have if(enabled && limit > 0), MC/DC requires you to test with enabled, !enabled, limit >0, limit <=0.

    - Every change to the condition was shown to somehow change the outcome. (false && limit > 0) would not pass this, a change to the limit would not affect the outcome - the decision is always false. But @zweifuss has a better example.

    - And, of course, every possible decision (the outcome of the entire 'enabled && limit > 0') needs to be tested. This is what ensures that every branch is taken for if statements, but also for switch statements that they are exhaustive etc.

    MC/DC is usually required for all safety-critical code as per NASA, ESA, automotive (ISO 26262) and industrial (IEC 61508).

  11. I think the phase change hypothesis* is a bit wrong.

    I think it happens not at 100% coverage but at, say, 100% MC/DC test coverage. This is what SQLite and avionics software aim for.

    *has not been confirmed by a peer-reviewed research.

  12. For dotnet, there is a built-in flag "--self-contained".
  13. How would it stack up against BeagleBoard BeagleY-Ai, save for the lack of drama?
  14. Maybe in the middle, processing the items - classifying, summarizing.

    But the post bills the tool as an n8n alternative. Therefore, I am evaluating it as such. Solid basics before the AI whizbang.

  15. So here is a case that I wanted to implement in n8n a few years ago and it required quite heavy JS blocks:

    - I want to check some input - pick one of your 138 blocks

    - I want to extract a list of items from that input

    - I want to check which items did I encounter before <- that's the key bit

    - Do something for the items that have not been encountered before; bonus point for detecting updated and deleted items

    - Rinse and repeat

    It could be a row added to a CSV file, a new file dropped into a Nextcloud folder, a list of issues pulled from a repo, or an RSS feed (Yahoo! Pipes, what a sweet memory).

    How good is the support for such a case in Sim? And did it get better in n8n?

  16. Is it coming to Google Jules?
  17. > Even XML schemas, the one thing you'd think they were great at

    Of course not! W3C SHACL shapes, on the other hand...

    schema.org is also a move in the right direction

  18. > developers used it and did not like it.

    This makes sense.

    However, there are two ways to address it:

    1) Work towards a more advanced system that addresses the issues (for example, RDF/Turtle – expands XML namespaces to define classes and properties, represents graphs instead of being limited to trees unlike XML and JSON)

    2) Throw it away and start from scratch. First, JSON. Then, JSON schema. Jq introduces a kind of "JSONPath". JSONL says hi to XML stream readers. JSONC because comments in config files are useful. And many more primitives that existed around XML were eventually reimplemented.

    Note how the discussion around removing XSLT 1 support similarly has two ways forward: yank it out or support XSLT 3.

    I lean towards Turtle replacing XML over JSON, and for XSLT 3 to replace XSLT 1 support in the browsers.

  19. The very first issue was locked and limited to collaborators.
  20. Gotta put in a plug for Migadu: https://www.migadu.com/pricing/

    Happy customer over a couple of years.

  21. How would I share Quadlet files for my repo? Today I have a docker-compose.yml in my repo, the instructions to try it out are usually `docker compose up --build -d`.

    I read about the recently released CLI support for quadlets [0] and the ability to install Quadlets from a URL but still cannot wrap my head around it (as in, no matter how I look at it, Quadlets seem to require non-trivially higher knowledge to use and more steps/files).

    If we need a concrete example to discuss: https://github.com/oslc-op/refimpl/blob/main/src/docker-comp...

    [0]: https://blog.podman.io/2025/08/level-up-your-container-game-...

  22. Apache Accumulo solved the access-aware querying a while ago.
  23. MCP tools with OAuth support + RFC 8693 OAuth 2.0 Token Exchange (aka OAuth 2.0 On-Behalf-Of flow in Azure Entra - though I don't think MCP 2025-06-18 accounts for the RFC 8693) could be used to limit the MCP bot responses to what the current user is authorized to see.
  24. Who said it must be done during training? Most of the enterprise data is accessed after training - RAG or MCP tool calls. I can see how the techniques I mentioned above could be applied during RAG (in vector stores adopting Apache Accumulo ideas) or in MCP servers (MCP OAuth + RFC 8693 OAuth 2.0 Token Exchange + Zanzibar/Biscuit for faithfully replicating the authz constraints of systems where the data is being retrieved from).
  25. Two points/questions:

    1. Why is tracking access rights "on a per user basis or [...] along with the content" is not feasible? A few mentions: Google Zanzibar (+Ory Keto as OSS impl) - makes authz for content othoronal to apps (i.e. possible to have it in one place, s.t. both Jira and a Jira MCP server can use the same API to check authz - possible to have a 100% faithful authz logic in the MCP server), Eclipse Biscuit (as far as I understand, this is a Dassault's attempt to make JWTs on steroids by adding Datalog and attenuation to the tokens, going in the Zanzibar direction but not requiring a network call for every single check), Apache Accumulo (DBMS with a cell-level security) and others. The way I see it, the tech is there but so far, not enough attention has been put on the problem of a high-fidelity authz throughout the enterprise on a granular level.

    2. What is the scale needed? Enterprises with more than 10000 employees are quite rare, many individual internal IT systems even in large companies have less than 100 regular users. At these levels of scale, a lot more approaches are feasible that would not be considered possible at Google scale (i.e. more expensive algorithms w.r.t. big-O are viable).

  26. How was the sandbox implemented? Just a one-off Docker container execution or something more substantial?
  27. > there are typically no legal requirements

    Not after EU CRA https://en.m.wikipedia.org/wiki/Cyber_Resilience_Act goes into effect

This user hasn’t submitted anything.

Keyboard Shortcuts

Story Lists

j
Next story
k
Previous story
Shift+j
Last story
Shift+k
First story
o Enter
Go to story URL
c
Go to comments
u
Go to author

Navigation

Shift+t
Go to top stories
Shift+n
Go to new stories
Shift+b
Go to best stories
Shift+a
Go to Ask HN
Shift+s
Go to Show HN

Miscellaneous

?
Show this modal