nerdwaller (u/nerdwaller)

nerdwaller commented on Ask HN: Who is hiring? (February 2025) · Posted by u/whoishiring

nerdwaller · a year ago

Volta Circuit | Senior Front End Engineer | Remote (US) | https://voltacircuit.com

At Volta Circuit, we specialize in developing secure and innovative smart contracts that empower users to take full control of their digital assets through enhanced self-custody solutions. We believe in providing companies with the tools and technology they need to manage access to their digital wealth with confidence and autonomy through multisig and an advanced rules engine to delegate access.

We are seeking a talented and passionate React developer with experience in decentralized applications (dApps) to join our small team. As the primary front end developer, you will play a crucial role in owning and guiding our front end architecture, ensuring that our users have a seamless and secure experience when interacting with our platform and smart contracts. Your expertise in dApp development will be invaluable in creating a user-friendly and intuitive interface that empowers users to take full control of their digital assets.

We are looking for a self-sufficient individual with excellent communication skills who can work as a self manager and as part of a team. dAPP and full stack experience, specifically with Golang and Postgresql, are a bonus as we all work across the stack (React, Golang, Postgesql, EVM, Cosmos).

If you’re interested in learning more, email us at hireme [at] voltacircuit.com.

nerdwaller commented on BambuLab new firmware to cut access to third-party API and tools github.com/SoftFever/Orca... · Posted by u/dazhbog

stamps · a year ago

When buying a 3D printer I found it better to support Prusa[0] or another company that cares more about open source / hardware.

[0] https://github.com/prusa3d

nerdwaller · a year ago

I couldn't bring myself to pay the premium at the time, especially with the slow rollout of the MMU. But now with multiple printers in my fleet, I might be kicking myself shortly. We all knew some of this was a possibility, unfortunately.

nerdwaller commented on Bitcoin Block 840000 mempool.space/block/00000... · Posted by u/greyface-

trappist · 2 years ago

Do you think that the world is a better place if ordinary Russians can't access their own money?

nerdwaller · 2 years ago

Just wait until their home banks interrogate them about how they want to spend their local currency they wish to withdraw or banks shut off withdrawals entirely due to systemic issues.

Bitcoin may not be the end all solution, but it's a great current option.

nerdwaller commented on PyPI halted new users and projects while it fended off supply-chain attack arstechnica.com/security/... · Posted by u/consumer451

g_p · 2 years ago

And this is a very sensible precaution where developer environments have SSH keys and other privileged credentials available and exposed in predictable locations, ready for exfiltration over the unfiltered internet connection that developers insist on having available.

Hopefully the VM/container run environment is also in a network-isolated environment too, so it can only be accessed and invoked through the expected routes, and it can't make arbitrary network calls to external hosts that haven't been manually reviewed and approved.

nerdwaller · 2 years ago

The types of secrets ought to be a bit different and less consequential on a developer's machine. If they're not, that's a pretty big red flag. It's one thing to gain access to clone some repositories (e.g. ~/.ssh) but an entirely different thing to get production aws credentials. Not to mention all the other protections that should be in place that mitigate the fallout (for example: no pushes to main/master/prod branches, requiring status checks and reviews before merges, etc).

nerdwaller commented on PyPI halted new users and projects while it fended off supply-chain attack arstechnica.com/security/... · Posted by u/consumer451

Denvercoder9 · 2 years ago

I'm not convinced of the additional danger in letting packages run code during installation. You install them because you want to use them, so the code they ship will get run anyway. Are there really common environments where the final product only gets run with less permissions than the package manager?

nerdwaller · 2 years ago

The issue isn't when you get what you're wanting. The issue is when either you accidentally get something you didn't want (such as type-o squatting - a not too distant issue on PyPi) or a package was published maliciously (imagine bumping a patch version and it being compromised) - a few fairly recent issues on npm.

I agree that the happy path is ideal and hopefully the common case. Regardless, anything with access to production secrets for my team is run on the most minimal image possible (and none of those secrets are available during dependency installation and compilation).

nerdwaller commented on PyPI halted new users and projects while it fended off supply-chain attack arstechnica.com/security/... · Posted by u/consumer451

cjk2 · 2 years ago

Am I the only one who is scared by the entire ecosystem of "drag random crap and dependencies off the Internet from who the hell knows"?

I've had a couple of minor incidents with NodeJS dependencies over the last few years on this front which sort of opened my eyes to running untrusted code. I tend to err on the side of distribution packages since, with the restrictions that imposes on what I do.

nerdwaller · 2 years ago

Some packaging ecosystems are more risky than others, primarily because they allow running arbitrary code at some point during the install cycle. Node and Python being two notable ones, especially considering how commonly they are used[1]. Others do it more safely where, at a minimum, no code can run until the library is imported and run with application code.

Depending on how and where you deploy, you can mitigate some of that by isolating the installs and not keeping sensitive information there (e.g. in a docker image).

[1] - I don't follow node/npm closely anymore, so this may have changed.

nerdwaller commented on Campfire once.com/campfire... · Posted by u/tosh

cjpearson · 2 years ago

The idea of a simpler, less bloated Slack is definitely appealing to me as a user, but I'm not sure there's much of a market. What kind of companies are they targeting here? Small enough that user access dialog is usable and the lack of features/integrations is acceptable, but also willing to pay $300 and take on the trouble of self-hosting.

My biggest issue is with the UI though. Without watching the video I wouldn't know what half the buttons do. Many of them have multiple actions/states and there are no labels or tooltips for buttons.

Forms do have labels, but you have to click an icon to read them. It seems the only benefit of this is that you can also see what the label is in French, but unless you're translating the app, most users would prefer to just see the label in the language of their choice. And there are some dialogs where just English text is shown, so this isn't entirely consistent. Maybe I'm totally missing something here, but I think simply having a user select their preferred language isn't something that needed to be innovated away.

nerdwaller · 2 years ago

They did a live stream this morning and said they've already crossed the six figure mark on the initial private/soft launch. I was pretty surprised by that, as similarly I questioned the market.

nerdwaller commented on Coming home from the South Pole brr.fyi/posts/redeploymen... · Posted by u/sklargh

kylehotchkiss · 2 years ago

I’m gonna miss these blog posts, they’ve been so fun. Dear author if you’re reading, please write some more blogs in the future. Maybe you’ll take a cargo ship across the ocean as a passenger or something else unique and mysterious.

nerdwaller · 2 years ago

Agreed, this has been a really fun experience to follow. I know these last couple will continue to be engaging, but I hope there's something else in the future from the author!

nerdwaller commented on Was Javascript really made in 10 days? buttondown.email/hillelwa... · Posted by u/redbell

wk_end · 2 years ago

`==` and `!=` are still quite handy when you don't want to deal with the distinction between `null` and `undefined`, which is almost always what you want.

nerdwaller · 2 years ago

I find that I really appreciate the explicit rather than the implicit comparisons (requiring `===` in js), especially picking up a new program or coming back to one after some time away. I view it like a database - do I really want multiple ways to show a value is empty? For something like a Boolean you have: `false`, `true` and `null` as valid values (trilean?) that now have to be handled.

nerdwaller commented on Why Prusa is floundering, and how you can avoid their fate drewdevault.com/2023/12/2... · Posted by u/ingve

nerdwaller · 2 years ago

I wasn't aware that Prusa is floundering and wouldn't have minded a little more development there. However it wouldn't surprise me as when I was shopping for my latest 3d printer replacement it was too easy to choose something else. For the price of the Mk4 most of the market is within the same budget (many options arguably better and more capable).

This post is the Armin Ronacher take that the author here is talking about: https://news.ycombinator.com/item?id=38768997