Readit News logoReadit News
woodruffw commented on Waymo granted permit to begin testing in New York City   cnbc.com/2025/08/22/waymo... · Posted by u/achristmascarl
Dylan16807 · 2 days ago
Do you mean that in the sense of "anyone getting killed is unacceptable" or the sense of "we need complete separation between cars and pedestrians/bikers, somehow"?
woodruffw · 2 days ago
I think there's a third more charitable reading: that current injury and fatality rates are still too high, even if they compare favorably to the rest of the US's rates. It's unrealistic to have no traffic injuries ever; this doesn't imply that NYC can't do better.
woodruffw commented on Code formatting comes to uv experimentally   pydevtools.com/blog/uv-fo... · Posted by u/tanelpoder
Calavar · 2 days ago
cargo publish bundles your source files into a format (.crate) that can be distributed to other developers. This includes instructions for actually building the project at a later time. This is analagous to 'uv build' making an .sdist file.

I guess it gets more complicated with .whl since those can contain build artifacts as well and not just build instructions.

It's true that 'cargo publish' can also upload your .crate files to a remote repository, while uv breaks that functionality out into a separate command called 'uv publish' but I think that's neither here nor there on the difference between bundling the source and building the source.

woodruffw · 2 days ago
I would say that `cargo publish` uploading a package to a remote index (like crates.io) is its primary purpose. I've been writing Rust for about 7 years now and I don't think I've ever seen someone use it primarily to generate a `.crate` file without uploading it somewhere.
woodruffw commented on Code formatting comes to uv experimentally   pydevtools.com/blog/uv-fo... · Posted by u/tanelpoder
zahlman · 2 days ago
Would Linux similarly be better if we wrote e.g. "cu list" instead of "ls", "cu change" instead of "cd", etc.? (The "cu" stands for "coreutils", of course.) Because it seems to me like the same arguments apply. I was already thinking of uv as a "project manager" and I understand that intended scope, and even respect the undertaking. My point is that I don't believe that labeling all the tasks under that scope like this actually improves the UX.

Maybe I'm wrong about that. But I don't know that it can actually be A/B tested fairly, given network effects (people teaching each other or proselytizing to each other about the new way).

woodruffw · 2 days ago
I don't think Linux would be better with a `cu` prefix for coreutils, but I do think git would be worse without a `git` prefix. I think it's ultimately a question of user expectations, and I think user expectations around packaging tooling in particular have shifted towards the Go and Rust styles of providing a "namespace" tool that provides a single verb-style interface for developer actions.
woodruffw commented on Code formatting comes to uv experimentally   pydevtools.com/blog/uv-fo... · Posted by u/tanelpoder
Calavar · 2 days ago
It gets difficult when you compare scripting languages to natively compiled languages, since some of the terminology is overloaded.

"uv build" makes .wheel files, so it is analogous to "cargo publish" (which makes .crate files) as opposed to "cargo build"

I would call this a packaging tool as opposed to a build system.

woodruffw · 2 days ago
> "uv build" makes .wheel files, so it is analogous to "cargo publish" (which makes .crate files) as opposed to "cargo build"

This isn't exactly right: `uv build` executes a PEP 517[1] build backend interface, which turns a Python source tree into installable distributions. Those distributions can be sdists or wheels; in this sense, it's closer to `cargo build` than `cargo publish`.

The closer analogy for `cargo publish` would be `uv publish`, which also already exists[2]: that command takes an installable distribution and uploads it to an index.

TL;DR: `uv build` is a proxy for a build system, because that's how distribution construction is standardized in Python. I would not say it's analogous to `cargo publish`, since it's responsible for builds, not publishes.

[1]: https://peps.python.org/pep-0517/

[2]: https://docs.astral.sh/uv/guides/package/#publishing-your-pa...

woodruffw commented on Code formatting comes to uv experimentally   pydevtools.com/blog/uv-fo... · Posted by u/tanelpoder
petcat · 2 days ago
Doesn't cargo just have a subcommand plugin system? Or is fmt actually hard-coded into the cargo code?

I prefer the plugin system. I don't like god programs like what the npm monstrosity became.

woodruffw · 2 days ago
cargo has an external subcommand system, but it also has "blessed" (my word choice) external subcommands that are typically bootstrapped via Rust toolchain components. This makes them pretty analogous to what uv does here with `uv format`, in my opinion.
woodruffw commented on Code formatting comes to uv experimentally   pydevtools.com/blog/uv-fo... · Posted by u/tanelpoder
slightwinder · 2 days ago
> To clarify, `ruff` and `uv` aren't being merged.

ruff at least seems to be compiled into uv, as the format worked here without a local ruff. This is significant more than just an interface. Whether they are managed and developed as separate tools doesn't matter.

> This is more about providing a simpler experience for users that don't want to think about their formatter as a separate tool.

Then build a separate interface, some script/binary acting as a unified interface, maybe with its separate distribution of all tools. Pushing it into uv is just adding a burden to those who don't want this.

uv and ruff are poor names anyway, this could be used to at least introduce a good name for this everything-python-tool they seem to aim for.

woodruffw · 2 days ago
ruff is not compiled into uv; it's bootstrapped from an independent build, much like how `cargo fmt` is bootstrapped from a separate toolchain component (rustfmt). You can see how that works in the PR[1]. Importantly, that means that you don't experience any build-, install-, or run-time burden if you don't use this subcommand.

[1]: https://github.com/astral-sh/uv/pull/15017

woodruffw commented on Code formatting comes to uv experimentally   pydevtools.com/blog/uv-fo... · Posted by u/tanelpoder
zelphirkalt · 2 days ago
If I want to call ruff, I can do so myself. Why should I want to call it through uv?
woodruffw · 2 days ago
If you want to call ruff directly, this doesn't change anything. It's a purely optional feature.

However, to answer the question generally: people want this for the same reason that most people call `cargo fmt` instead of running rustfmt[1] directly: it's a better developer experience, particularly if you don't already think of code formatting as an XY-type problem ("I want to format my code, and now I have to discover a formatter" versus "I want to format my code, and my tool already has that").

[1]: https://github.com/rust-lang/rustfmt

woodruffw commented on Show HN: Anchor Relay – A faster, easier way to get Let's Encrypt certificates   anchor.dev/relay... · Posted by u/geemus
eternauta3k · 4 days ago
Why not sign it yourself?
woodruffw · 4 days ago
Most people find the user experience of self-signed certificates much worse. The developer experience for local issuance isn't great, although mkcert does a really great job of smoothing the parts that can be smoothed[1].

[1]: https://github.com/FiloSottile/mkcert

woodruffw commented on Modern CI is too complex and misdirected (2021)   gregoryszorc.com/blog/202... · Posted by u/thundergolfer
captn3m0 · 4 days ago
They are instead focusing on Agentic Workflows which used natural language instead of YAML.

https://github.com/githubnext/gh-aw

woodruffw · 4 days ago
I personally find this pretty concerning: GitHub Actions already has a complex and opaque security model, and adding LLMs into the mix seems like a perfect way to keep up the recent streak of major compromises driven by vulnerable workflows and actions.

I would hope that this comes with major changes to GHA’s permissions system, but I’m not holding my breath for that.

woodruffw commented on How we exploited CodeRabbit: From simple PR to RCE and write access on 1M repos   research.kudelskisecurity... · Posted by u/spiridow
KingOfCoders · 5 days ago
The chuzpe to use this as PR.
woodruffw · 5 days ago
Off topic, but: chutzpah is the conventional English spelling :-)

Edit: I'm this old when I learned that Germans spell it "chuzpe."

u/woodruffw

KarmaCake day38330May 26, 2015
About
I'm a Software Engineer in New York City (prev. Trail of Bits, currently Astral). Before that, I studied philosophy.

On the philosophy side, I'm chiefly interested in metaphysics (ontology and mathematics/formal systems & semantics) and deontological ethics (praise and blame, moral education, honesty & bad faith).

On the computational side, I'm chiefly interested in program analysis (compilers), security (compilers), and systems (compilers). I do a decent amount of professional open source work on projects that encompass some of those.

My opinions are my own and do not reflect those of any employer, institutions, affiliates, lovers or haters past, present, or future. They might not even be mine anymore!

Sites: https://yossarian.net / https://blog.yossarian.net / @yossarian@infosec.exchange

View Original