Readit News logoReadit News
Elucalidavah commented on Gh-actions-lockfile: generate and verify lockfiles for GitHub Actions   gh-actions-lockfile.net... · Posted by u/gjtorikian
tomeraberbach · 2 months ago
Mildly ironic that the quickstart suggests starting with an unpinned action

gjtorikian/gh-actions-lockfile@v1

Presumably since it has to run first it must run unpinned?

Elucalidavah · 2 months ago
Arguably, that's exactly the one action that will need to be hash-pinned, since all the consecutive actions will at least be verified against the lockfile.
Elucalidavah commented on Freeing a Xiaomi humidifier from the cloud   0l.de/blog/2025/11/xiaomi... · Posted by u/stv0g
wnevets · 2 months ago
> On a tangent note: don’t use ultrasonic humidifiers. Unless distilled water is used, they create a shit-ton of pm2.5 particles.

Not according to my uHoo air quality monitor. I have had one running a few feet from the monitor for over a week and there hasn't been any notable increase in PM2.5 particles.

Elucalidavah · 2 months ago
> any notable increase in PM2.5 particles

What's your PM2.5 baseline, and did you measure TDS in the water?

Elucalidavah commented on Capsudo: Rethinking sudo with object capabilities   ariadne.space/2025/12/12/... · Posted by u/fanf2
charcircuit · 2 months ago
The root account shouldn't exist either. Having god accounts is a bad idea security wise. Instead everything should follow the principle of least privilege.
Elucalidavah · 2 months ago
If you have a privilege to replace the kernel or bootloader, you effectively have all privileges on that system. Therefore, there's no need to complicate the access limitations when you get full access anyway.
Elucalidavah commented on Cloudflare outage on December 5, 2025   blog.cloudflare.com/5-dec... · Posted by u/meetpateltech
8cvor6j844qw_d6 · 2 months ago
Is there some underlying factors that resulted in the recent outages (e.g., new processes, layoffs, etc.) or just a series of pure coincidences?
Elucalidavah · 2 months ago
Sounds like their "FL1 -> FL2" transition is involved in both.
Elucalidavah commented on ScribeOCR – Web interface for recognizing text, OCR, & creating digitized docs   github.com/scribeocr/scri... · Posted by u/atomicnature
aidenn0 · 4 months ago
This is my first encounter with Scribe.js; since I have many book scans I always try OCRing them when I see this. Compared to Tesseract (which is the best I have so far), it gets the words right slightly more, but the paragraph segmentation is many times worse. On a book where every paragraph is indented, it reliably decides two consecutive one-line paragraphs are the same paragraph, which is understandable, but a downgrade from Tesseract which gets the paragraph segmentation as correct as possible (It doesn't handle paragraphs that spanpage-breaks, since I'm feeding it one page at a time)
Elucalidavah · 4 months ago
> Tesseract (which is the best I have so far)

Have you looked at EasyOCR?

Elucalidavah commented on Python developers are embracing type hints   pyrefly.org/blog/why-type... · Posted by u/ocamoss
seanparsons · 4 months ago
As a static typing advocate I do find it funny how all the popular dynamic languages have slowly become statically typed. After decades of people saying it's not at all necessary and being so critical of statically typed languages.

When I was working on a fairly large TypeScript project it became the norm for dependencies to have type definitions in a relatively short space of time.

Elucalidavah · 4 months ago
> how all the popular dynamic languages have slowly become statically typed

Count the amount of `Any` / `unknown` / `cast` / `var::type` in those codebases, and you'll notice that they aren't particularly statically typed.

The types in dynamic languages are useful for checking validity in majority of the cases, but can easily be circumvented when the types become too complicated.

It is somewhat surprising that dynamic languages didn't go the pylint way, i.e. checking the codebase by auto-determined types (determined based on actual usage).

Elucalidavah commented on Privacy and Security Risks in the eSIM Ecosystem [pdf]   usenix.org/system/files/u... · Posted by u/walterbell
ACCount37 · 5 months ago
And that's a major flaw of eSIM. Providers shouldn't even have been given that kind of discrimination capability.

With a physical SIM, I can pry my card out of one phone and put it into another, and expect it to work. With eSIM, every single eSIM has to be carrier approved and GSMA approved, and every single transfer from one eSIM to another has to be carrier approved too.

Elucalidavah · 5 months ago
> With a physical SIM, I can pry my card out of one phone and put it into another, and expect it to work

Is anything preventing the provider from denying a SIM swap based on IMEI?

Elucalidavah commented on Cap'n Web: a new RPC system for browsers and web servers   blog.cloudflare.com/capnw... · Posted by u/jgrahamc
fitzn · 5 months ago
Just making sure I understand the "one round trip" point. If the client has chained 3 calls together, that still requires 3 messages sent from the client to the server. Correct?

That is, the client is not packaging up all its logic and sending a single blob that describes the fully-chained logic to the server on its initial request. Right?

When I first read it, I was thinking it meant 1 client message and 1 server response. But I think "one round trip" more or less message "1 server message in response to potentially many client messages". That's a fair use of "1 RTT", but took me a moment to understand.

Just to make that distinction clear from a different angle, suppose the client were _really_ _really_ slow and it did not send the second promise message to the server until AFTER the server had computed the result for promise1. Would the server have already responded to the client with the result? That would be a way to incur multiple RTTs, albeit the application wouldn't care since it's bottlenecked by the client CPU, not the network in this case.

I realize this is unlikely. I'm just using it to elucidate the system-level guarantee for my understanding.

As always, thanks for sharing this, Kenton!

Elucalidavah · 5 months ago
> the client is not packaging up all its logic and sending a single blob that describes the fully-chained logic to the server on its initial request. Right

See "But how do we solve arrays" part:

> > .map() is special. It does not send JavaScript code to the server, but it does send something like "code", restricted to a domain-specific, non-Turing-complete language. The "code" is a list of instructions that the server should carry out for each member of the array

Elucalidavah commented on Bypass PostgreSQL catalog overhead with direct partition hash calculations   shayon.dev/post/2025/221/... · Posted by u/shayonj
Elucalidavah · 5 months ago
Tangential: is "without requiring knowledge of data patterns" a frequently useful requirement? I.e. isn't knowledge of data patterns basically required for any performance optimization?
Elucalidavah commented on StarDict sends X11 clipboard to remote servers   lwn.net/SubscriberLink/10... · Posted by u/pabs3
Elucalidavah · 6 months ago
Querying a local dictionary on each clipboard seems okay; having a feature to request remote dictionaries is okay; making it easy to combine both is dubious but understandable (would be better off as a special flag); but having them combined by default? That's pretty much malicious.

u/Elucalidavah

KarmaCake day137July 8, 2015View Original