idlephysicist's comments

On: Tell HN: Cloudflare is blocking Pale Moon and other non-mainstream browsers

[idlephysicist]

> What are you protecting cloudflare?

A cheeky response is "their profit margins", but I don't think that quite right considering that their earnings per share is $-0.28.

I've not looked into Cloudflare much, I've never needed their services, so I'm not totally sure on what all their revenue streams are. I have heard that small websites are not paying much if anything at all [1]. With that preface out of the way–I think that we see challenges on sites that perhaps don't need them as a form of advertising, to ensure that their name is ever-present. Maybe they don't need this form of advertising, or maybe they do.

[1] https://www.cloudflare.com/en-gb/plans/

[tempest_ → idlephysicist]

If you log in to the CF dashboard every 3 months or so you will see pretty clearly they are slowly trying to be a cloud provider like Azure or AWS. Every time I log in there is a who new slew of services that have equivalent on the other cloud providers. They are using the CDN portion of the business as a loss leader.

On: Go Supply Chain Attack: Malicious Package Exploits Go Module Proxy Caching For

[idlephysicist]

It's kind of amazing that this periodic check has not been implemented already.

On: Toyota reduces price of new hydrogen car with $15,000 of free fuel

[idlephysicist]

Firstly, I love that website. It's simple and informative.

I don't the average mileage or a hydrogen vehicle nor tank size, so I'll take your word on that. Using your numbers and the map I plotted a route that does get you from San Diego to the Oregon border. But you will need a tow truck to meet you at the end, because there would not be enough fuel to get you back to Sacramento.

https://maps.app.goo.gl/p5tgvAkErktL7LTF6

On: A phishing attack involving g.co, Google's URL shortener

[idlephysicist]

Anyone that get’s a telephone call from “Google” should be immediately suspicious. I used to work for a company that paid GCP about as much as my annual salary _every_ month, and we still struggled to get GCP on the phone when we needed assistance.

[ravetcofx → idlephysicist]

what's wild is when Google Play Music came to Canada where you could upload your music to the cloud, I was able to get phone support for a bug it had with Linux, and they were very helpful

On: Ask HN: What is the best terminal emulator for Mac?

[idlephysicist]

I used Alacritty until about 3 weeks ago, switched to Ghostty. I'm very happy with the change.

On: A rigid but foldable indoor airship aerial system for cave exploration

[idlephysicist]

Fair play to them, it's a detailed paper. But I'm not sure that this would have much practicality in other caves. The terrain just changes too quickly (most of the time).

On: Passengers at EU Airports Not Allowed over 100ml of Liquids on Cabin Luggage

[idlephysicist]

The woeful inconsistency between airport security checks within the same country and sometimes within the same airport, really lends itself to the theory that it’s all a farce.

Travel time makes a big difference too, e.g. at peak times please keep your shoes on.

[eastbound → idlephysicist]

So “shoe terrorists” will commit attacks at peak time? (I don’t even know how much botleg water a shoe contain to upset the border control so much).

On: A network engineer in search of greener pastures

[idlephysicist]

I've never come across that myself, but the audacity of some firms is outrageous.

On: A network engineer in search of greener pastures

[idlephysicist]

Part of me thinks that you're right, but I've applied to _so many_ jobs over the years (prior to AI) that use workday and required that I fill in all the info again. I've also never ever heard back from a company that used workday.

Today I will only apply to a job that requires me to make an account (like workday) if at least one of these criteria are met (i) I am exceptionally qualified (in my own eyes), (ii) I have a reference, (iii) I already have made an account previously. Though thankfully there are many (smaller) companies these days (at least in my current field) that don't require me to make an account.

On: Node.js adds experimental support for TypeScript

[idlephysicist]

Can you explain what you mean when you say "to be sound"?

[pansa2 → idlephysicist]

Here's an example of TypeScript failing to be sound - it should give a type error but it doesn't. I believe Flow does indeed give a type error in this situation:

https://news.ycombinator.com/item?id=41069695

[recursive → pansa2]

You don't have to go even that far to find unsoundness in flow.

    const arr = ["abcd"];
    const str = arr[1];
    const num = str.length; // this throws
    console.log(num);

For me, typescript is a pretty good balance.

[hajile → recursive]

I think this is not a very good example. Not only does it also throw in TS, but it even throws in Haskell which is pretty much the poster boy for sound type systems.

This isn't a type error unless your type system is also encoding lengths, but most type systems aren't going to do that and leave it to the runtime (I suspect the halting problem makes a general solution impossible).

    main = putStrLn (["a", "b", "c"]!!4)

[recursive → hajile]

Yes it throws in typescript. Typescript isn't the the language chasing soundness at any cost. This just illustrates the futility of chasing soundness.

Soundness is good as long as the type-checking benefit is worth the cost of the constraints in the language. If the poster child for soundness isn't able to account for this very simple and common scenario, then nothing will actually be able to deliever full soundness.

It's just a question of how far down the spectrum you're willing to go. Pure js is too unsound for my taste. Haskell is too constrained for my taste. You might come to a different conclusion, but for me, typescript is a good balance.

[hajile → recursive]

My balance point is StandardML. SML and TS both have structural typing (I believe this is why people find TS to be more ergonomic). SML has an actually sound type system (I believe there is an unsoundness related to assigning a function to a ref, but I've never even seen someone attempt to do that), but allows mutation, isn't lazy, and allows side effects.

Put another way, SML is all the best parts of TS, but with more soundness and none of the worst parts of TS and non of the many TS edge cases baked into the language because they keep squashing symptoms of unsoundness or adding weird JS edge cases that you shouldn't be doing anyway.

[recursive → hajile]

Personally, I think javascript kind of sucks, but it's approximately* the only choice for targeting browsers. If it wasn't for this face, I probably never would have touched TS. SML sounds pretty good.

[fabiospampinato → recursive]

Wait, so Flow is not actually sound and their website is lying? Or do they have some "technically correct" definition of "sound" that takes stuff like that into account?

[price → fabiospampinato]

Flow is not sound. They have the ambition of trying to be sound (which I appreciate), but they've never accomplished it.

I went looking for where on their website they claim to be sound. There's definitely some misleading wording here: https://flow.org/en/docs/lang/types-and-expressions/#toc-sou... but if you read the whole section, it ends up also acknowledging that it's not entirely sound.

[recursive → fabiospampinato]

I have no idea about the lawyerly technicalities, but you can try it yourself to verify what I'm saying.

https://flow.org/try/

Compare these two programs.

    const arr = ["abcd"];
    const str = arr[1];
    const num = str.length; // this throws at runtime

    const arr = [new Date];
    const dt = arr[1];
    const num = dt.length; // fails to type check

[hajile → fabiospampinato]

Even haskell will generate a runtime error for an out-of-bounds index

    main = putStrLn (["a", "b", "c"]!!4)

[recursive → hajile]

This is different. Neither flow, typescript, nor javascript generate a runtime error for an out of bounds index. It's explicitly allowed by the language.

The result of the an OOB access of an array is specified to be `undefined`. The throw only happens later when the value is treated as the wrong type.

I don't consider a runtime error to be a failure of the type system for OOB array access. But in javascript, it's explicitly allowed by specification. It's a failure of any type system that fails to account for this specified behavior in the language.

[hajile → recursive]

> It's explicitly allowed by the language.

This is like arguing that a null exception is fine because it's allowed by the language. If you get `undefined` when you expect another type, most future interaction are guaranteed to have JS throw because of the JS equivalent of a null pointer exception. They are technically different because a dynamic language runtime can prevent a total crash, but the effect on your web app is going to be essentially the same.

    [1,2,3][4].toFixed(2)

> It's a failure of any type system that fails to account for this specified behavior in the language.

Haskell has the ability to handle the error.

How do you recommend a compiler to detect out-of-bounds at compile time? It can certainly do this for our trivial example, but that example will also be immediately evident the first time you run the code too, so it's probably not worth the effort. What about the infinite number of more subtle variants?

[recursive → hajile]

> How do you recommend a compiler to detect out-of-bounds at compile time?

I wouldn't make the recommendation that they do at all. Full soundness is not my thing. But... if Flow wanted to do it, it would have to change the type of indexing into `(Element[])[number]` with a read from `Element` to `Element | undefined`.

[price → idlephysicist]

When a language's type system is sound, that means that if you have an expression with type "string", then when you run the program the expression's value will only ever be a string and never some other sort of value.

Or stated more abstractly: if an expression has type T, and at runtime the expression evaluates to a value v, then v has type T.

The language can still have runtime errors, like if you try to access an array out of bounds. The key is that such operations have to give an error — like by throwing, so that the expression doesn't evaluate to any value at all — rather than returning a value that doesn't fit the type.

Both TypeScript and Flow are unsound, because an expression with type "string" can always turn out to evaluate to null or a number or an object or anything else. Flow had the ambition to be sound, which is honorable but they never accomplished it. TypeScript announced up front that they didn't care about soundness: https://www.typescriptlang.org/docs/handbook/type-compatibil...

Soundness is valuable because it makes it possible to look at the types and reason about the program using them. An unsound type-checker like TypeScript or Flow can still be very useful to human readers if most of the types in a codebase are accurate, but you always have to keep that asterisk in the back of your head.

One very concrete consequence of soundness that it makes it possible to compile the code to fast native code. That's what motivated Dart a few years ago to migrate from an unsound type system to a sound one: https://dart.dev/language/type-system so that it could AOT-compile Flutter apps for speed.