MurphyA/hacker-news huggingface dataset:
Show HN: Thand – open-source, distributed, JIT, PAM and provisioning platform
by hugofromboss | 2025-11-25 15:34:40+00:00
Hey HN!

We are building Thand, an open-source, distributed platform for Just-in-Time (JIT) access, authorization (PAM), and provisioning.

Why? I’ve been at various companies now; either having to raise tickets, waiting on internal processes to get access to systems, resources or SaaS tools. Or, having extremely elevated accounts all in one place and as a single point of failure when services go down just as you need them. None of the available PAM tools seemed easy to work with, so it got me seeking an alternative.

What is Thand? Thand is a lightweight, open source and self-hosted agent that runs locally or in your cloud environment. It orchestrates and distributes requests via durable workflows (via Temporal and CNCF Serverless workflows) to grant temporary access to resources or provision resources via its “providers”.

Unlike other tools, that are locked into particular cloud environments or SaaS providers. With Thand you deploy the agents with their respective access. Wherever, you need to get access to. Temporal can route the workflow execution to elevate or provision resources across multiple environments (cloud and local) and identities.

What's with the name? Thand is Sindarin, (‘Shield/Guard of the Forest’).

We are currently in preview and looking for feedback.

GitHub: https://github.com/thand-io/agent Docs: https://docs.thand.io Website: https://www.thand.io/

Thanks!
by nathan_douglas | 2025-11-25 15:34:42+00:00
https://github.com/allengarvin/inform-zork1/blob/main/zork.i...

I feel the same about Inform 6 vs 7. I wrote some very simple games in Inform 6 thirty or so years ago, just for personal amusement, but never did a thing with Inform 7.

I guess I'm skeptical of "literate programming" in general, where I have to learn a special way of phrasing English just to interact with some magical process that I don't and can't understand... all so I can avoid typing a few square brackets and semicolons. I think there's an underlying symmetry to the conceptual structure of interactive fiction and the way it looks in Inform 6 that is much easier to reason about... but eh. I'm a couple decades late to the argument.
by znpy | 2025-11-25 15:34:53+00:00
> conversely, running a firewall on something like ZFS also sounds like too much.

this makes no sense. firewalling does not touch the filesystem very much if at all.

what FS is being used is essentially orthogonal to firewalling performances.

if anything, having a copy-on-write filesystem like ZFS on your firewall/router means you have better integrity in case of configuration mistakes and OS upgrade (just rollback the dataset to the previous snapshot!)
by deltoidmaximus | 2025-11-25 15:35:00+00:00
What does power-cycle mean in this case?

I've seen this topic come up a lot on a datahoarder forum but there was never any consensus on what it would take to assure the data was refreshed because no one really knew how it worked. People would assume anything from a short power up to simply rewriting all data as possibilities.

The firmware engineer responding up thread is actually the best information I've seen on this. And it kind of confirmed my suspicions. He works on enterprise drives and they run a refresh cycle as background cycle that seems to start on a random timer. I didn't see any response (yet) on how long this process takes but I think we can infer that it takes a while based on it being a background process. Probably hours or more. And this is all for an enterprise drive, I wouldn't be surprised if consumer drives have a less robust or even non-existent refresh function.

I'm of the opinion that that based on the little information about some implementations of this function, the logical conclusion is you should just rewrite all of the data over again on your cold backups for the cycle. Powering it on isn't enough, even powering it on for a day might not do anything. As you said this is a pretty big drawback for uses flash as a cold backup.
by sschueller | 2025-11-25 15:35:02+00:00
Some things just work, like paper ballots. No reason to re-invent the wheel or to "verschlimmbessern" what works.

We vote a lot in Switzerland on a lot of issues but we do so on paper ballots which we can either drop directly in the box or send in the post. When there is a close vote the maximum wait for a result is usually around 4-5 hours so that isn't really an issue either. Counting is a highly distributed effort and IMO that also reduces the risk for large scale fraud.
by Cthulhu_ | 2025-11-25 15:35:51+00:00
I suspect it's a cultural thing as well, with most (all?) wealthy cultures veering towards individualism and working. Whereas with previous generations, the grandparents and environment would be more involved in raising children and educating the new parents.

But I also feel like people grew up or had to grow up earlier back when. My parents were married, bought a house and had kids on the way by their mid 20's, when I was that age I had just about finished my education and started my first fulltime job, it'd take another decade to buy a house. Buying a house / getting a mortgage is a major commitment, and I think you'd get a big boost of adulthood / personal development if you do that in your mid 20's.
by movpasd | 2025-11-25 15:36:09+00:00
You might this blog post interesting, which argues that it's Rust semantics and not syntax that results in the noisiness, i.e.: it's intrinsic complexity:

https://matklad.github.io/2023/01/26/rusts-ugly-syntax.html

I found it reasonably convincing. For what it's worth, I found Rust's syntax quite daunting at first (coming from Python as well), but it only took a few months of continuous use to get used to it. I think "Perl-esque" is an overstatement.

It has some upsides over Python as well, notably that the lack of significant whitespace means inserting a small change and letting the autoformatter deal with syntax changes is quite easy, whereas in Python I occasionally have to faff with indentation before Black/Ruff will let me autoformat.

I appreciate that for teaching, the trade-offs go in the other direction.
by ls-a | 2025-11-25 15:36:10+00:00
On the topic of atomic bombs I have some rhetorical questions

1. What happened to the deadly radioactivity? 2. Would exploding the equivalent amount of TNT look exactly the same? 3. Would USA fake having a single bomb that destroys an entire city? 4. What happened to the deadly radioactivity in Japan? 5. What is carpet bombing? 6. Would USA fake having a single bomb that destroys an entire city?
by thousand_nights | 2025-11-25 15:36:37+00:00
nta you're replying to, but as someone who doesn't know rust, on first glance it seems like it's littered with too many special symbols and very verbose. as i understand it this is required because of the very granular low level control rust offers

maybe unreadable is too strong of a word, but there is a valid point of it looking unapproachable to someone new
by leoh | 2025-11-25 15:36:41+00:00
I hate learning new things. It sucks. Also, I hate things that make my knowledge of C++ obsolete. I hate all the people that are getting good at rust and are threatening to take away my job. I hate that rust is a great leveler, making all my esoteric knowledge of C++ that I have been able to lord over others irrelevant. I hate that other people are allowed to do this to me and to do whatever they want, like making the decision to use rust in apt. It’s just sad and crazy to me. I can’t believe it. There are lots of people like me who are scared and angry and we should be able to control anyone else who makes us feel this way. Wow, I’m upset. I hope there is another negative post about rust I can upvote soon.
by Muromec | 2025-11-25 15:36:44+00:00
It is possible the deb package is parsed to extract some metadata before being installed and before verifying signature.

Also there is aspect of defence in depth. Maybe you can compromise one package that itself can't do much, but installer runs with higher priviledges and has network access.

Another angle -- installed package may compromise one container, while a bug in apt can compromise the environment which provisions containers.

And then at some point there is "oh..." moment when the holes in different layers align nicely to make four "bad but not exploitable" bugs into a zero day shitshow
by officeplant | 2025-11-25 15:36:47+00:00
Cinnamon getting good recently kind of blew my mind. I'm an ancient Gnome 2.x elitist, and typically hated cinnamon every-time I've tried it.

Every now and then I distro hop and ended up on LMDE (linux mint debian edition, the real linux mint) which only has a cinnamon offering out of the box. Much to my surprise its actually good. It still has random bugs triggered by stuff I've tried adding to the panel, but that's par for the course with gnome, XFCE, and MATE lately anyway. Over all it's a solid DE now even if the stock start/menu is underwhelming everything is fixable.
by neilalexander | 2025-11-25 15:37:55+00:00
30 years ago, Microsoft was writing books that were hundreds of pages long detailing not just how to build effective and consistent user interfaces but also with explanations from user-centric research as to why those things mattered. Every user interface component carefully considered and rationalised, every reusable pattern carefully reinforced, all to build a desktop where interactive elements look interactive, skills learned in one application pretty reliably carry across to others, and avoiding dead ends that result in user panic. Windows 2000 was the last vaguely-consumer-oriented Microsoft operating system that was built with any of those lessons in mind.

Everything they have developed since then has strayed further and further from those principles. With Windows 11 and their "modern" application lineup, it is like they have absolute amnesia about ever having done any of this. It is clear as day that nobody inside Microsoft has ever gone back and read one of those books in the last decade or two, nor is there any evidence that they spend any amount of time researching and testing their products with real users or trying to understand the ways that users get stuck or fatigued.

All of the user interface consistency is gone thanks to the half-dozen competing/failed UI toolkits and webview-driven applications scattered everywhere. Visual cues and interactivity hints are either gone or are no longer reliable. You can't even tell when something in Windows will allow you to drag-and-drop or copy-and-paste or even what new and horrifying form the Open/Save/Print dialogs are going to take in any given application. "Disastrous" isn't a strong enough word for it.
by lizknope | 2025-11-25 15:37:57+00:00
I've been hearing about this for years and it makes sense theoretically but has anyone ever actually seen it? What are the errors reported? Or does the drive return bad data but reports no error?

There was a guy on reddit that took about 20 cheap USB flash drives and checked 1 every 6 months. I think after 3 years nothing was bad yet.

I've copied OS ISO images to USB flash drives and I know they sat for at least 2 years unused. Then I used it to install the OS and it worked perfectly fine with no errors reported.

I still have 3 copies of all data and 1 of those copies is offsite but this scare about SSDs losing data is something that I've never actually seen.
by mikestew | 2025-11-25 15:38:13+00:00
Starting with the fact that every one of those novelty songs on the soundtrack were actual period songs. “Atom Bomb Baby” might not have been a huge hit (or maybe it was, I can’t seem to find info), but it’s period music: https://www.reddit.com/r/Fallout/comments/3tzsma/update_ama_...
by rayiner | 2025-11-25 15:38:33+00:00
I have a 10 gig internet connection (Comcast fiber, 5.6 ms ping to google.com with almost no jitter). Websites are slower today than they were when I got DSL for the first time in the 1990s--except HN of course. It takes multiple seconds to load a new tab in Teams (e.g. the activities tab) and I can see content pop in over that time. It's an utter disgrace.
by gorgoiler | 2025-11-25 15:38:59+00:00
”[One] major contributor to APT suggested it would be better to remove the Rust code entirely as it is only needed by Canonical for its Launchpad platform. If it were taken out of the main APT code base, then it would not matter whether they were written in Rust, Python, or another language, since the tools are not directly necessary [for regular installations].”

Given the abundance of the hundreds of deb-* and dh-* tools across different packages, it is surprising that apt isn’t more actively split into separate, independent tools. Or maybe it is, but they are all in a monorepo, and the debate is about how if one niche part of the monorepo uses Rust then the whole suite can only be built on platforms that support Rust?

#!/bin/sh build_core if has_rust then build_launchpad_utils fi

It’s like arguing about the bike shed when everyone takes the bus except for one guy who cycles in every four weeks to clean the windows.
by Cthulhu_ | 2025-11-25 15:39:00+00:00
I'd also like to add anecdotally that a lot of people develop burnout at that age, probably because they keep pushing themselves and/or get sucked into their own enthusiasm / passion instead of set limits and the like. But then, I also think people get less resilient to stress and the like after 30, less able to compartimentalize or bounce back quickly.

What you end up getting is people ~10 years into an exciting career where suddenly they can't perform or cope as well as they used to. But they can also be in a pretty senior position by then and be pushed out of their comfort zone.
by Weves | 2025-11-25 15:39:15+00:00
Really appreciate the feedback (and glad to hear the core concept resonated with you).

The admin side of the house has been missing a bit of love, and we have a large overhaul coming soon that I'm hoping addresses some (most?) of your concerns. For now, if you'd like to view documents that have been processed, you can check out the `Explorer` panel on the left.

In general, I'd love to hear more about what gives it that "unbaked" feel for you if you're up for a quick chat.
by nickpsecurity | 2025-11-25 15:39:43+00:00
A brother in Christ told me that cell phones start working the moment you turn them on. He said that's because the designer of the phones built in a program that tells them how to operate. Likewise, our Designer (God) gave us a program for how to operate. It also has built-in morals of seeking God (who made me?), love, and fairness. That hints at the creation's purpose.

I'll add to his assessment that God's amazing designs exist at levels of genes, cells, organs, brain patterns, and so on. Then, the very, mathematical formulae that make them work has a haroneous order. In a universe He causes to remain stable despite being inherently chaotic.

One of the best benefits for scientists of following Jesus Christ is that, one day, we'll be able to ask Him about any of this. What? Where? When? Why? And how did it all fit together to optimize for what goals?

Meanwhile, I can be in awe of the Creator for making from scratch what our AI labs can't get close to: embryo to effecient brains that produce others by the billions in all envuronments with diverse materials (foods). No need for billions in fabs, toxic chemicals, gigawatts of power, etc. God's supremacy as a designer is evidenced by all that is made.
by enriquto | 2025-11-25 15:40:00+00:00
> I am thrown back by how... "janky" the syntax is.

Well if you come from C++ it's a breath of fresh air! Rust is like a "cleaned-up" C++, that does not carry the historical baggage forced by backwards compatibility. It is well-thought out from the start. The syntax may appear a bit too synthetic; but that's just the first day of use. If you use it for a few days, you'll soon find that it's a great, beautiful language!

The main problem with rust is that the community around it has embraced all the toxic traditions of the js/node ecosystem, and then some. Cargo is a terrifying nightmare. If you could install regular rust dependencies with "apt install" in debian stable, that would be a different story! But no. They want the version churn: continuously adding and removing bugs, like particle/anti-particle pairs at the boundary of a black hole.

Concerning TFA, adding rust to apt might be a step in the right direction. But it should be symmetric: apt depends on rust, that's great! But all the rust that it depends on needs to be installed by apt, and by apt alone!
by thatcks | 2025-11-25 15:40:34+00:00
I can't remember the 10G firewall figures we got in testing off the top of my head, but we didn't max out the 10G network; I think we were getting somewhere in the 8G range. This is significantly better than our OpenBSD performance but not quite up to the level of full network speed or the full speed that two Linux machines can get talking directly to each other over our 10G network. I also suspect that performance depends on which specific NICs you have due to driver issues. The live performance of our deployed FreeBSD firewalls is harder to assess because people here don't push the network that hard very often (although every so often someone downloads a big thing from the right Internet source to get really good rates).

(I'm the author of the linked-to article.)
by dboon | 2025-11-25 15:41:29+00:00
It’s very easy to write a string library in C which makes string operations high level (both in API and memory management). Sure, you shouldn’t HAVE to do this. I get it. But anyone writing a parser is definitely skilled enough to maintain a couple hundred lines of code for a linear allocator and a pointer plus length string. And to be frank, doing things like “string operations but cheaply allocated” is something you have to do ANYWAY if you’re writing e.g. a parser.

This holds for many things in C
by stavros | 2025-11-25 15:41:36+00:00
It sounds like "3 out of 3" is too risky, as you're basically tripling the risk of losing a key (but you're reducing the risk of compromise). Something like "3 out of 4" would have been a better balance, in my opinion, but I think there were technical issues in requiring such a quorum (I think I read that the encryption scheme didn't support it, but don't quote me).
by pavon | 2025-11-25 15:42:00+00:00
Windows 11 is much slower for me than Windows 7 or 10. A noticeable sub-second delay to bring up the start menu and respond to typing, about 3 seconds for file explorer to load, 5-20 seconds to start a screenshot. I wouldn't be surprised if antivirus is to partially to blame (only use Windows at work where it is required), but it is the same antivirus we used on Windows 10 and it wasn't this bad.
by recursivecaveat | 2025-11-25 15:42:17+00:00
It's okay to admit when C++ doesn't have a feature. std::variant is an approximation of sum type support. It's ergonomics are an absolute travesty as a result, any errors you get are going to be 5 pages of template gunk, and I'm sure that using it pervasively is terrible for compile times. It has been possible to construct a type safe unit library as demonstrated in the article for forever. I've never seen anyone use this ability in a production codebase, because a terrible library emulation of a feature is not a real feature.

The notion that just using the new fancy types automatically makes everything memory safe has to stop. std::expected contains either a value or an error. If you call .value() and you're wrong you get an exception. If you call .error() and you're wrong you get undefined behaviour. This was added in C++23. Since there's no destructuring you have to call these methods btw, just don't make any mistakes with your preconditions! Regardless 90% of memory safety errors I see are temporal. Unless we completely ban references and iterators they will not be going anywhere. Using unique_ptr instead of new does not do anything when you insert into a map while holding a reference to an element.

Developers also have to be able to make their own things. We can't pretend that absolutely everything we will ever need is bundled up in some perfect library. To write a typesafe application you need to be able to create your own domain specific abstractions, which to me precludes them looking like this:

template <class ty> concept db_result_tuple = requires { typename remove_cvref_t<ty>; } && []<class... Es>(std::tuple<Es...>*) { return all_result_args_ok_v<Es...>; }( static_cast<typename std::add_pointer_t<remove_cvref_t<ty>>>(nullptr) );
by powerclue | 2025-11-25 15:42:53+00:00
How is this arrogant? Are open source developers now responsible for ensuring every fork works with the dependencies and changes they make?

This seems like a long window, given to ports to say, "we are making changes that may impact you, heads up." The options presented are, frankly, the two primary options "add the dependency or tell people you are no longer a current port".
by parineum | 2025-11-25 15:43:23+00:00
> an opportunity which was all-but-explicitly created by Elon Musk's payout system.

Nobody seems to remember it now because the narrative got shifted to "Russians manipulating the election" but, in 2015/16, the whole "Fake News" phenomenon was originally attributed to click bait websites being thrown up to get Facebook/AdWords revenue. I believe it was a European outlet interviewing an Indian person, IIRC. (Found it, or one of them, this isn't the one I remember and it's from after the election) [1].

Once the narrative turned to it being Russian bots influencing the election (to further the "Trump as a Russian agent" narrative, speaking of fake news...), that reporting seemed to dry up.

[1] https://www.npr.org/sections/alltechconsidered/2016/11/23/50...
by GrumpyGoblin | 2025-11-25 15:43:26+00:00
> based on the brain scans of nearly 4,000 people aged under one to 90, mapped neural connections and how they evolve during our lives.

That is an absurdly small sample size to make such a conclusion.

It seems this age range could at least partly be culturally attributed. In modern industrialized life, many people don't have to "grow up" until a later age. At the risk of generalizing, people have more support from family, friends, and society at large.

Is the forming of those neurons based on some natural law, or is that people just haven't had to live the experiences that do so until their 30's nowadays?

As far as I know, forming neurons isn't something that "just happens". It happens due to catalysts in life. In pre-modern society, and indeed most likely in under-industrialized nations today, those catalysts, those experiences, would happen earlier. As others mentioned, there is a clear correlation with the typical age in which modern society gets married, settles down, and has kids.

I wonder what that era age would have been 200+ years ago.