Hacker Newsnew | past | comments | ask | show | jobs | submit | Null-Set's commentslogin

So fuel would basically become a corn based battery. (Ideally something more efficient than corn would be grown though)

The name of this feature is transclusion.

https://en.wikipedia.org/wiki/Transclusion

It was part of Project Xanadu, and originally considered to be an important feature of hypertext.

Notably, mediawiki uses transclusion extensively. It sometimes feels like the wiki is the truest form of hypertext.


Ward Cunningham (inventor of the Wiki) spent some time trying to invent a transclusion-first wiki, where everyone had their own wiki-space and used transclusion socially https://en.wikipedia.org/wiki/Federated_Wiki

it never quite took off


I think true transclusion would be more than that.

In Xanadu you could transclude just an excerpt from one document into another document.

If you wanted to do this with HTML you need an answer for the CSS. In any particular case you can solve it, making judgements about which attributes should be consistent between the host document, the guest document and the guest-embedded-in-host. The general case, however, is unclear.

For a straightforward <include ...> tag the guest document is engineered to live inside the CSS environment (descendant of the 3rd div child of a p that has class ".rodney") that the host puts it in.

Another straightforward answer is the Shadow DOM which, for the most part, lets the guest style itself without affecting the rest of the document. I think in that case the host can still put some styles in to patch the guest.


This looks like it was caused by this update https://developers.cloudflare.com/waf/change-log/2025-04-22/ rule 100741.

It references this CVE https://github.com/tuo4n8/CVE-2023-22047 which allows the reading of system files. The example given shows them reading /etc/passwd


AFAICT it's also (though I'm very rusty) in ModSecurity, if XML content processing is enabled then rules like these will trip:

    SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pmFromFile lfi-os-files.data"
    SecRule REQUEST_COOKIES|!REQUEST_COOKIES:/__utm/|REQUEST_COOKIES_NAMES|ARGS_NAMES|ARGS|XML:/* "@pmFromFile unix-shell.data" ...
where the referenced files contain the usual list of *nix suspects including the offending filename (lfi-os-files.data, "local file inclusion" attacks)

The advantage (whack-a-mole notwithstanding) of a WAF is it orders of magnitude easier to tweak WAF rules than upgrade say, Weblogic, or other teetering piles of middleware.


So that's why immediately when I hear "WAF" I read "...and the site will break in weird and exciting ways due to arbitrary, badly developed heuristics outside of your control, every odd day of every even week" - I remember the glory days of shared hosting and mod_security.

Turns out the hunches were right all along.


See https://developers.cloudflare.com/waf/change-log/2025-04-22/ rule 100741.

It references this CVE https://github.com/tuo4n8/CVE-2023-22047 which allows the reading of system files. The example given shows them reading /etc/passwd


No, it can't because the checksums won't match.


I don't think that's actually a problem, but it would require continuing to host both versions (at distinct URLs) for any users who may have installed the package before the Zopfli-compressed version completed. Although I think you could also get around this by tracking whether the newly-released package was ever served by the API. If not, which is probably the common case, the old gzip-compressed version could be deleted.


I don't believe it mentioned Twinkle Twankle but your description reminded me of the old radio play The Cinnamon Bear where some kids eventually go to the North Pole looking for their Silver Star.

https://youtu.be/0XIijKoRJ6A?si=zsXuaYNT60jtPt4f


A more generous way to say this is that the code is more readable, which is in fact important in a growing codebase.


plenty of react code looks nice but is still unreadable


The code samples in Hackers Delight are awfully pretty, but by no means readable.

Pretty definitely does not mean readable.


Asteroids which enter a planet's atmosphere will probably yield even better food, because they will be a little meteor.


My 3 year old used to think the dinosaurs are gone because a meat eater killed them all.


The Dodo bird could probably be considered a dinosaur, not entirely wrong...


underrated comet


stellar even


because they will be a little meteor, right?

How did you comet o that conclusion?

And a hungry mouth will approach: "please sir, armageddon some more?"


I think that if you simply call someone bitch in place of a name, it has become largely but not entirely degendered, but if you call someone "a bitch" it is still pretty gendered.


A CEO has a fiduciary duty to lie.


A CEO that is the CEO of a publicly traded company who has over-leveraged their position and is now locked into chasing growth even if the company they're running suffers has a fiduciary duty to lie. There are plenty of CEOs not in this position.

I'm not talking about Altman in particular, I'm just annoyed with this constant spam on HN about how we all need to turn a blind eye to snake oil salesman because "that's just how it's supposed to be for a startup."

For a forum that complains about how money ruins everything, from the Unity scandal to OSS projects being sponsored and "tainted" by "evil companies," it's shocking to see how often golden boy executives are excused. I wish people had this energy for the much smaller companies trying to be profitable by raising subscriptions once in the 20 years they've been running, but instead they are treated like they burned a church. It truly is an elitist system.


Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: