Hacker Newsnew | past | comments | ask | show | jobs | submit | chuckadams's commentslogin

If you're going for bit-for-bit equivalence of float values, then even with a single operation you're relying on compiler flags, architecture, the phase of the moon... I'm hard-pressed to think of any memory safety issues though.

Yea, you're in a fairly special niche of programming if you're somewhere that truly matters, and you can't accept any valid order's output. In most general code, if that kind of precision matters, float is the wrong choice: use a bignum object and be exactly correct regardless of how you organized your code.

Which is a niche that exists, obviously. So it is absolutely true for some cases. But I would hope that any code that requires this is extremely clear about requiring it.


AWS actually has a pretty good price calculator with some decent presets (but FFS, can I have an "uncheck all" button?) but of course it's an entirely separate app. Amazon naturally wants some friction to having this pricing information handy, though I suspect the main reason has to do with Conway's Law: AWS still ships their org chart.

The xz hack was still reproducible, because it was included in the distribution archive which did not match the upstream source -- even then, it was so obfuscated it likely would have gone unnoticed, but nevertheless it only lived in the uploaded tarball and not in the repo. Reproducibility is a good thing, but the next step is build provenance.

Still, lots of good non-security benefits to reproducible builds too.


You can just spin up a raw VPS on EC2 or Lightsail, give it a public IP, and call it a day. You aren't required to implement every enterprise pattern in the book.

If there is any single service I'd avoid on AWS it's Lightsail, it'll cost you a lot more than almost anything out there, is slow as molasses (even tiny services can need tens of minutes to deploy) and you'll experience random failures not even AWS reps can explain to you. Avoid at all costs.

It's a ghost of its former self, but I'd probably still rather use Heroku today than being forced to use Lightsail even once again.


>Lightsail, it'll cost you a lot more than almost anything out there,

Lightsail is pretty competitive (price wise) with other providers. Been running s B2B app on it for a few years now - nothing much, just your basic crud app running on lightsail instance + lightsail db. Nice to have a "monthly" rate on each instead of the EC2 opaque (and "surprise!") pricing.


I have only use lightsail for one project with two VPSs, but it just works like a VPS (two, because we have another for staging). Price is competitive.

Its not my favourite, but its not terrible.


Same experience here, hosting some small projects on LightSail. It was pretty smooth to set up and get running, and no real complaints so far.

Congrats, your raw EC2-hosted 500MB WebGL experimental card game went to the HN Front Page! You now owe AWS $30k in egress costs.

Well this is the dream right ?

You build something, well enough that it can handle the traffic, and people come, and it does.

Welcome to the gaming industry


No, it is not the dream. The same thing on Hetzner or Linode would cost $30 instead of $30k.

> Well this is the dream right ?

Yes it is, we call these dreams a nightmare


Egress costs have substantially reduced (thankfully)

> You can just spin up a raw VPS on EC2 or Lightsail, give it a public IP, and call it a day

You could do this, but for the life of me I can't imagine why you do this over using a platform like DO, vultr, hetzner or any one of a hundred similar services that will give you a better developer experience for this kind of workflow, often at a fraction of the price


I never said it would be cheaper. I did say it wasn't complicated.

But that's costly. Speaking of my own experience: going from a webapp fully hosted on an EC2 instance to a railway and vercel setup reduced my costs 10x.

t4g.nano is $3/m; a similar spec-ed fargate on ecs (just any docker container) is $10/m

This sentence beautifully encapsulates my point. I know that this is just ordinary jargon, but wow that's a lot all at once. And it does seem like something I need to know before I start.

sure but on the flip side - when I signed up for vercel I had literally no idea what was going on. It just said "do you want to start a blog? here are 1000 templaptes"

Maybe so, but it's still not the complexity nightmare that some would have us believe it is.

“EC2 or Lightsail”. And this right here is why I use GCP. Google got VMs right.

GCP has similar offerings to Lightsail, Fargate, EC2, Lambda, or other compute substrates. Nobody is forcing you to use more than “basic” offerings. AWS core services are often architected that way!

The fraud of passing off something of lesser value as the genuine article is the definition of counterfeiting.

But there is no such thing as a “genuine” $30 bill.

If it's being passed off as money, then someone thought it was. I don't think the Secret Service cares if it's an invalid denomination or has Bozo the Clown on the front. Probably not a high priority for them given the overall lack of believability, but the attempt is what counts.

If you’ll allow yourself to go one step further in the pedantry, there is no such thing as genuine money either.

There is if we agree that there is.

Which we have.


Isn’t this “uttering”?

Basically make software development so legally risky that only multi-billion dollar corporations will ever engage in it.

We could get somewhere where clouds can provide a framework of secure primitives that act as a framework.

E.g. you build an app, it stores data via api etc. etc. You can test in sandbox. The cloud deploys for customer who paid you via that cloud and you work at arms length. You may not even know their name. You just get the pro subscription fees.

The idea bubbling in my head would be an app store for cloud products. But with competition i.e. you use Railway or Heroku or AWS for the best deal.

Be gentle this is an idea in my head I am sure it can be torn down by a retort at this stage. But this exists in forms and I think it will emerge. It is inversion of control at the entire app level.

This is similar to buying a hammer. If you make hammers you sell them to a store, the store knows the customer and only the customer can see the nails.


> This is similar to buying a hammer.

No, it's similar to letting someone else do all your hammering because using a hammer is too dangerous. And then, to make the process more efficient, letting them take control of your home to be able to provide hammering services while making sure you can't touch the hammer.


I guess. It is like a writer letting someone else print the books, maybe?

Legal risk is what insurance is for. You get ensured for a small fee and you go about your job. That's how the non-software world operates anyway

You're assuming the fee would be small. Put yourself in the shoes of an insurance company, deciding what to charge for liability insurance. The potential cost if you have to pay out on the insurance is very very large: depending on the project, software vulnerabilities can cause millions to billions of damage to the economy. And the chance of you having to pay out is a complete unknown.

Unknown chance of having to pay out x large payout amount if you do = very very high premiums. Or not being willing to underwrite the insurance at all.

Remember, insurance is just gambling. The company is betting that the amount of money they'll make from everyone's total premiums added together is greater than the amount they'll have to pay out. Dumb gamblers don't last long. Smart gamblers will evaluate the risk and say "Okay, that'll be $X million a month in premiums", or even "Nope, we won't cover you". Can most open-source projects afford that?


The existence of null is not the problem, it’s when null populates every single non-primitive type, making every access into a logic bomb unless explicitly checked. When null is a distinct type, there’s no problem at all.

Nil of course (nothing happens). Not saying it’s a good idea, it would just be consistent.

Maybe because the style is just worn-out ragebait trolling now.

We do want to check for errors, we'd just prefer that it not be a repeated 3-line boilerplate pattern that ends up being >50% of all code. Rust does it with one character.

I agree that Rust's approach is better. I'm questioning the claim that Go "forces you" to handle errors, since to my understanding with Go someone can just eschew that 3-line boilerplate, silently ignoring the error, and still use the result (which is bad).

The point being that's how you've decided to deal with the error, by ignoring it.

Silently ignoring errors by leaving out some boilerplate doesn't really seem like an active/forced decision, or a selling point over the languages it disparages ("[...] hellscape doesn't make errors disappear, it just hides them"). Then that the correct path is the one of more resistance seems poor design, in my surface-level opinion.

It is a decision though, and one you have to consciously make for each and every occurrence. You can't just hope some catch block will eventually handle it...

I may be missing something, but I don't see how just forgetting to handle/propagate the error (and, say, causing data corruption by continuing with whatever empty/partial return value the function happens to give) would be a conscious decision.

Even when it is intentional, like writing some quick/dirty code and planning on handling errors properly later, I'd imagine it's difficult to grep for instances of unchecked errors in the way you can with `.unwrap()` - though tooling should help.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: