Hacker Newsnew | past | comments | ask | show | jobs | submit | BinaryRage's commentslogin

You can relax permissions while avoiding the flag with BashTool sandboxing, see /sandbox.

No, these are just default imports. Module import declarations are in for JDK 25 to make this kind of thing even easier: https://openjdk.org/jeps/511


See Brian's article "Paving the on-ramp": https://openjdk.org/projects/amber/design-notes/on-ramp


I remember talking to Brendan about the PreserveFramePointer patch during my first months at Netflix in 2015. As of JDK 21, unfortunately it is no longer a general purpose solution for the JVM, because it prevents a fast path being taken for stack thawing for virtual threads: https://github.com/openjdk/jdk/blob/d32ce65781c1d7815a69ceac...


The figure is about the overall improvement, not sure why that reads increase.

On JDK 8 we are using G1 for our modern application stack, and we saw a reduction in CPU utilisation with the upgrade with few exceptions (saw what I believe is our first regression today: a busy wait in ForkJoinPool with parallel streams; fixed in 19 and later it seems).

G1 has seen the greatest improvement from 8 to 17 compared to its counterparts, and you also see reduced allocation rates due to compact strings (20-30%), so that reduces GC total time.

It's a virtuous cycle for the GRPC services doing the heavy lifting: reduced pauses means reduced tail latencies, fewer server cancellations and client hedging and retries. So improvements to application throughput reduce RPS, and further reduce required capacity over and above the CPU utilisation reduction due to efficiency improvements.

JDK 21 is a much more modest improvement upgrading from 17, perhaps 3%. Virtual threads are incredibly impressive work, and despite having an already highly asynchronous/non-blocking stack, expect to see many benefits. Generational ZGC is fantastic, but losing compressed oops (it requires 64-bit pointers) is about a 20% memory penalty. Haven't yet done a head to head with Genshen. We already have some JDK 21 in production, including a very large DGS service.


> G1 has seen the greatest improvement from 8 to 17

Yep. G1 in newer JDKs is very different from G1 in JDK 8, but Parallel GC has also seen very significant improvements: https://kstefanj.github.io/2021/11/24/gc-progress-8-17.html


> Virtual threads are incredibly impressive work,

Do you have an (un)informed opinion on minimum task sizes for the green threads?

My interest is re-factoring java code to reduce total wall clock time, on large compute with plenty of memory/cache.


Lunatics all.


Same for SimCity 2013, except the flaws extended to every agent. I've always thought that's why they limited the city size so heavily. Such a shame, because there was so much promise there.

Power, water, etc. randomly chose a direction at a junction, so even basic grid would make it impossible to power a building on the other side of the city, even if the power demand was there https://www.youtube.com/watch?v=tvq6zAMJfOU.

Traffic and pedestrians were attracted to available houses/work, but randomly every day, rather than having a defined home/work location. I built a pedestrian heavy city and would watch crowds of pedestrians head for the nearest available house on a street, before the whole street filled, and they turned around for the next nearest. Same for work, shopping, despite there being plenty available.


SC 2013 was such a let down after so much hype, for so many reasons. As a lifelong Sim-anything fan it was crushing.

Cities Skylines seems like the successor to SimCity, but even that has some deep-rooted flaws in traffic management and agent flow. Some mods exist to help coax it a bit, but it's still just a broken approach at scale.

Traffic and routing is hard, I get that, but there has to be a better way. Building a city around the routing flaws is not that much fun.


Cities Skylines can provide among the best city sim experiences to be had if you're willing to invest a day (or two) modding it to within inches of its life.

That and 32gb of RAM


Is there a list somewhere of "Essential" mods?


The CitiesSkylines subreddit has a list that contains (IMO) a good number of useful and essential mods.

Word of warning: if you're one of those people that likes to install a lot of mods keeping everything up to date and non-conflicting can be an pain the rear. There is, of course, a mod to keep track of which mods are out of date or could cause issues, but that's really a band-aid on top of a larger problem. The game is old enough now that many popular mod authors have long been abandoned their projects or otherwise moved on so you end up with things like "MyPopular Mod" and "MyPopular Mod UPTODATE" or "MyPopular Mod FORKED" or "Use this instead of MyPopular Mod".

If I take a few weeks / months between plays this usually ends up with me having to take 30 minutes to an hour to get the mods up to date and tested. Not a huge amount of time, but when your gaming time is limited it's something to take into account.


You could just... not update every time you play ?


They still add updates to the game once or twice a year, so you usually want some of the new features. That can also lead to the issue of when you finally do decide to update 3 years later or whatever, now it's a 4 hour ordeal to fix instead of 30 minutes. There's no really perfect solution, but it's worth it if you love city builders.


Steam updates the game and mods automatically. It can be overridden but that's a pain in the behind.


Can it ? In my experience, once Steam is aware that there is an update, you cannot even start the game before updating, even in offline mode... but that was some years ago, maybe this behaviour has changed ?

(Don't use Steam.)


Steam has the option to let you pin a specific version of the game if the publisher supports it, but Cities Skylines does not.


Yes, that is an annoyance. I think that Steam should put more pressure on developers to make old versions of their games available. I am glad that the software support is there (even if the UI is buried; it was originally intended to support beta–testing programs, complete with passwords to unlock the beta releases), and that developers sometimes use it, but I wish it was a formal requirement for publishing on Steam.


If you don't mind video format, I like this person's guide. He also has a 2nd video with essential mods for "advanced" players.

https://youtu.be/Nr8Wlib4jqE

He also has some fun youtube series' where he builds up a region by following a "story" he makes up (or sometimes uses viewer polls). So rather than building a super optimized city, it gets a very natural layout as he pretends to play out rivalries between developers, mayoral or policy changes, etc.


Also I seem to remember something silly involving a nuclear meltdown if you don’t have enough educated workers or if they are stuck in traffic long enough (related to the aforementioned random house issue). I wonder if there has been any fan mods to fix the issues since then. I seem to recall they eventually added an offline mode. The always online requirement was a bit excessive and plagued with issues on launch.


log4j2 supports lookups, which allows you to add additional logging context:

https://logging.apache.org/log4j/2.x/manual/lookups.html

The problem here is the JNDI lookup because for historical reasons there is code in these providers which causes Java to deserialize and load bytecode if it's found in a result for a lookup against an LDAP server. That exploit was partially fixed in the JDK in 2008, then in 2018, but there are multiple naming providers that are affected.

Yes, it's enabled by default before 2.15.0, released today to mitigate this issue.


I don’t understand these Java protocols enough to understand why was loading arbitrary bytecode from URLs even considered a feature, but I guess it was the 90s and Objects were all the rage


A lot of libs for logging have similar convenient ways for getting usernames and so on. The error here seems to be that even though you use the lib correctly a bug was introduced that made the injected parameters a part of the layout, at least that is what people are claiming. The example from the article though is an incorrect use of the lib and one can expect the same type of issues in a lot of libs when dealing with input parameters.


I understand that. I don’t understand JDNI, LDAP and why it ever downloads and runs remote bytecode and why was that ever considered a good feature.


LDAP is typically a behind-the-firewall protocol. At that point, in the "old school" mindset, it's considered a trusted service. Having features to automatically pick up stuff across your own network of boxes might be considered useful by many an admin.


Also, my understanding is that Java deserialization (or deserialization in general) wasn't intended to explicitly allow actual code execution, just reconstitution of an object's state from storage on disk, the network, etc. Sometimes the state of certain types of object can be repurposed to result in arbitrary code execution, but AFAIK that wasn't an anticipated outcome or design goal back in the 90s.


I was staggered by how much adjustment was required when watching CuriousMarc's excellent Model 19 restoration series, seems incredibly finicky.

https://www.youtube.com/watch?v=_NuvwndwYSY&list=PL-_93BVApb...


I just put up a few stills of my own restorations, some short demo videos, and Github repositories for the interface board and the software. I had no idea anyone would want to watch four hours of Teletype repair videos.

Model 15 and 19 Teletypes are not hard to work on. Everything comes apart easily; it's all screws and lockwashers. They're human scale; it's not like building surface mount electronics or repairing an iPhone, where you work under a microscope. The adjustments aren't that finicky, except for a few near the selector magnet. It also helps that the whole thing is unidirectional - there's a straightforward path from input signal to typebar hitting the paper, and you can work through problems in order. As a nice feature, movement is powered in one direction and spring-loaded in the other, so if something gets stuck, it's just stuck in the operated position and doesn't get bent or broken.

Aircraft are built like that. Some parts require careful adjustment, but there's almost always an easy way to check that you got it right. Because, after all, you can't fix it in flight.

Mechanical design has a design philosophy embedded in it. If you work on complex mechanical systems, you can sometimes get a feel for how the original designer thought. Good machinery design is not a common skill. All the good Teletypes were designed by only two people - Howard Krum and Ed Kleinschmidt.

Very few people study this any more in the US, which hurts when you need to design production machinery.


They should rewrite in Rust...


No, they should stop using C or C style coding in C++, and write those parts in a mix of modern C++17 and Swift.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: