Hacker Newsnew | past | comments | ask | show | jobs | submit | tytho's commentslogin

I was a heavy macOS Spaces user. Upon a recommendation to use Aerospace from somewhere else here a few months ago, I switched and love it. I considered Yabai, but some features required disabling SIP (System Integrity Protection).


At least with pnpm, you can specify minimumReleaseAgeExclude, temporarily until the time passes. I imagine the other package managers have similar options.

[1]: https://pnpm.io/settings#minimumreleaseageexclude


Game development is often a completely different set of skills and maintenance profile compared to enterprise SaaS development. Many single-player games especially indie ones don’t need to worry about multi-year contracts or having to work through many cycles of different developers coming in and out of a project. Having a 1000+ line switch statement seems totally reasonable on a project with a handful of developers that will continue to work on the project.

My understanding is that the switch statement was for npc character conversation text. That seems pretty reasonable, even in enterprise SaaS for something like translations. It might not be as easy to maintain in other circumstances.


I would suggest that the 1000 line switch statement implies a state machine that has suffered from the "state explosion".

This usually results from an inadequate system-subsystem decomposition and/or not considering modes, both of which lead to hierarchal state machines instead of one big flat one.

This aspect of architecture is difficult to teach, it is one of the "black arts" that comes from experience and is difficult to codify.

Just one example why, is that often it might require the synthesis of state machines not directly evident as needed from the functionality, eg to perform a one to many or many to one functionality.


https://i.redd.it/vglorgtzx0kd1.png

can't find the actual code, but its a look up table for what dialogue to use. The existence of a switch statement does not force the code to be a state machine.

it could still be some architectural deficit around making it harder to look up the dialogue rather than having it in place when uts triggered, but it makes it nice to understand all the dialogue in the game at once


Even if not explicitly looking like a state machine, it will have state based behaviour that could be represented by a state machine.

Almost everything is state based behaviour.


I’ve been using Zed [1] for some time now. They are also pretty AI focused so it may only be a matter of time, but so far I’ve been able to disable all of the AI interactions.

[1] https://zed.dev/


Many applications need a way to contact a user (security breach, password reset). If one only has a username and forgets the password, there’s no way to reverify the user.


There are many ways to re-verify the user if one forgets a password. Some may even be more secure than sending a e-mail. Simplest is a set of single-use reset codes that could be generated at signup or later on, like the ones to remove 2FA.


You don't need to validate email for that.


I think if you're not verifying emails, you'll also receive lots of bot signups.


> If one only has a username and forgets the password, there’s no way to reverify the user.

Tough beans?


A good user experience does its best to avoid tough beans. That's kind of UX 101.


In the case of security procedures, I'd argue that there is some room for tough beans. Reducing security to cater for carelessness seems like a really bad compromise to me, one that I see far too often.


This is an absurd position, and potentially illegal - for paid services.

You have a business relationship between the company and a person. Whether that person remembers the password or not is immaterial to whether they have the legal right to anything they purchased in the app.


Having your account taken over is also a bad user experience.


> Many applications need a way to contact a user … password reset

At this point the password is pointless, you might as well just use the email address. Or perhaps a distinct username and email address, but then there would probably be a “forgot username” workflow making that as pointless as the separate password.


Fly has a form of auto-scaling. You have to provision the max amount of machines then you configure them to auto-sleep. It's possible that the creator didn't anticipate this much traffic or didn't want to pre-pay for all those sleeping machines.


That's just pre-provisioning by another name, auto-scaling implies on-the-fly provisioning

E: I can't even load the fly.dev website, it keeps timing out. I guess they forgot to pre-provision/under-provisioned it


No, they have auto-scaling as well. Not sure what GP was talking about: https://fly.io/docs/reference/autoscaling/

However, it's understandable that some people wouldn't necessarily want to pay for high amounts of max machines.

Apparently it doesn't auto-scale automatically either, you have to opt into it.


I can’t speak to the official decisions made by these camps/courses, but from my own experience as an undergrad, I was first introduce to MySQL, and the professors at my university did not teach using migration management tools for bringing a schema in a database up. You were either using a GUI to set up the tables, or running your own cobbled together sql files. For class assignments this was fine. Then I had a professor introduce mongo to me. I was floored by the idea of having my schema live along-side the application code! No more messing around in SQL GUIs! Then of course over time I realized you still need to maintain a schema over time and provide someway to “upgrade” data when your schema evolves, and keep your data consistent. Then I discovered the tools around migrating mongo data are not nearly as mature as the ones you’ll find for SQL databases.

I find mongo alright at producing a short-lived prototype of an application (e.g. school assignments), but the risk of it shipping to production for a long period is too risky for the “benefit”.


They can be, but they both offer PostgreSQL services. The article touches on Supabase’s other offerings, but the comparison is mostly on the database offerings.


The browser EventSource constructor does not have options to pass in your own headers. You can pass an option to have it use the cookies for the domain you’re using. There are libraries that allow you to pass in additional HTTP options, but they essentially reimplement the built-in EventSource object in order to do so. Not terribly difficult, fairly simple spec.


Well, that constructor by default sends all the headers you have for your own domain and auth you are entitled to. This is how all other APIs in browsers work due to security and privacy concerns.

If you call to other domains, then this problem is no different to what we had with CORS years ago.


> This is how all other APIs in browsers work due to security and privacy concerns

They're probably comparing it to the fetch and XHR APIs, which both allow custom headers.


Ah, I titled that wrong. Fixed! Mostly authentication, but authorization is also a topic I’m studying a lot recently. I feel like there’s more resources on that than the questions I have about authentication. I’m currently diving into the Google Zanzibar papers.


People on HN love to talk about authentication. I was excited for an authorization discussion! Alas. Good luck in your research! I am not the right person to help you here (beyond wondering at the former discrepancy).


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: