Skip to content

Instantly share code, notes, and snippets.

@ivan

ivan/2024_reading.md

Last active November 3, 2024 23:12
Show Gist options
  • Save ivan/a36e2489623469d96c1ad79077b6dcf9 to your computer and use it in GitHub Desktop.
Save ivan/a36e2489623469d96c1ad79077b6dcf9 to your computer and use it in GitHub Desktop.
Download ZIP
2024 reading list
Raw
2024_reading.md

Things I might read in 2024.

  • Antoine de Saint-Exupéry, Richard Howard (translator) - The Little Prince
  • (Translation by) Sam Hamill - Yellow River: Three Hundred Poems From the Chinese
  • Sayaka Murata, Ginny Tapley Takemori (translator) - Convenience Store Woman (via)
  • Jorge Luis Borges - Tlön, Uqbar, Orbis Tertius (in Labyrinths)/ printed (via)
  • Franz Kafka - The Metamorphosis (via)
  • William Olaf Stapledon - Star Maker/ audio, go to 12m35s to skip past the introduction spoilers
  • The Heart of Innovation: A Field Guide for Navigating to Authentic Demand/ audio (via)
  • Peter D. Kaufman - Poor Charlie's Almanack: The Wit and Wisdom of Charles T. Munger, Expanded Third Edition
  • Lia A. DiBello - Expertise in Business: Evolving with a Changing World (in The Oxford Handbook of Expertise) (via)
  • Joël Glenn Brenner - The Emperors of Chocolate: Inside the Secret World of Hershey and Mars
  • Elad Gil - High Growth Handbook/ audio
  • W. Edwards Demming - The New Economics for Industry, Government, Education/ audio
  • W. Edwards Demming - The New Economics for Industry, Government, Education/ the PDF or ebook
  • Henrik Karlsson - Escaping Flatland/ including the posts I SingleFile'd
  • the relevant-looking posts on benkuhn.net/posts
  • Commoncog Case Library Beta
  • Keith J. Cunningham - The Road Less Stupid: Advice from the Chairman of the Board/ audio
  • Keith J. Cunningham - The 4-Day MBA/ video
  • Cedric Chin's summary of 7 Powers
  • Akio Morita, Edwin M. Reingold, Mitsuko Shimomura - Made in Japan: Akio Morita and Sony
  • Nomad Investment Partnership Letters or redacted (via)
  • How to Lose Money in Derivatives: Examples From Hedge Funds and Bank Trading Departments
  • Brian Hayes - Infrastructure: A Guide to the Industrial Landscape
  • Accelerated Expertise (via)/ printed, "read Chapters 9-13 and skim everything else"
  • David J. Gerber - The Inventor's Dilemma (via Oxide and Friends)
  • Alex Komoroske - The Compendium / after I convert the Firebase export in code/websites/compendium-cards-data/db.json to a single HTML page
  • Rich Cohen - The Fish That Ate The Whale (via)
  • Bob Caspe - Entrepreneurial Action/ printed, skim for anything I don't know

Interactive fiction

unplanned notable things read

unplanned and abandoned

  • Ichiro Kishimi, Fumitake Koga - The Courage to Be Disliked/ audio
  • Matt Dinniman - Dungeon Crawler Carl/ audio
  • Charles Eisenstein - The More Beautiful World Our Hearts Know Is Possible/ audio
  • Geoff Smart - Who: The A Method for Hiring/ audio
  • Genki Kawamura - If Cats Disappeared from the World/ audio
  • Paul Stamets - Fantastic Fungi: How Mushrooms Can Heal, Shift Consciousness, and Save the Planet/ audio
@ivan
Copy link
Author

ivan commented Oct 12, 2024

Email verification codes

One way to verify email is to send a secret code stored in the server to the user's mailbox.

This approach has some advantages over using links:

  • People are increasingly less likely to click on links.
  • Some filters may automatically classify emails with links as spam or phishing.
  • Using verification links may introduce friction if the user wants to finish the process on a device that does not have access to the verification > message, or on a device that cannot open links.

The verification code should be at least 8 digits if the code is numeric, and at least 6 digits if it's alphanumeric. Use a stronger code if the verification is part of a secure process, like creating a new account or changing contact information. You should avoid using both lowercase and uppercase letters. You may also want to remove numbers and letters that can be misread (0, O, 1, I, etc). It must be generated using a cryptographically secure random generator.

https://thecopenhagenbook.com/email-verification

@ivan
Copy link
Author

ivan commented Oct 12, 2024

Not really. Firstly I reject the premise that pushing the burden onto users is desirable — if a tax has to be paid, it's better for frameworks to pay it.

But beyond that, it's not just about the fact that WCs make the platform so much more complex and so much harder to learn. It directly affects users in subtle ways. For example if you want to clone some DOM to build a component you can just do fragment.cloneNode(true), right? Not so fast — if the DOM contains a custom element, the clone won't be assigned the correct class until it's appended to the document, and if you set properties in the meantime it won't trigger accessors (they'll shadow the prototype instead, which is very bad news). It's a real head-scratcher of a bug.

It turns out that if you use document.importNode(fragment, true) instead, it works correctly. Not that you'll casually learn that while reading MDN — this is the kind of knowledge that is only acquired with a side helping of battle scars.

But there's a catch! importNode is roughly 30% slower than cloneNode in our testing. That's unacceptable overhead given that most people aren't using custom elements (and certainly not that often). So we opted to pay a different price — the compiler adds a flag to the generated code, and the flag tells the runtime which to use. That's extra code, and extra work (albeit a miniscule amount), that would be unnecessary if we didn't have to think about this nonsense.

Having the bug? Tax.
Figuring out the solution? Tax.
Implementing the fix? Tax.
Documenting the code for our future selves? Tax.
Adding regression tests? Tax.
Running those tests on every CI job?
Shipping extra code? Tax.
Doing more work in a hot code path? Tax.

And that's just one example. There are others. The bottom line is that framework authors could ship sooner, and could ship leaner and more reliable code, were it not for this ill-designed primitive with its myriad edge cases.

https://x.com/Rich_Harris/status/1841467510194843982

@ivan
Copy link
Author

ivan commented Oct 12, 2024

At the end of the day, it would do to remember that businesses pay for business solutions.

https://x.com/ejames_c/status/1844410177589739562

@ivan
Copy link
Author

ivan commented Oct 12, 2024

waymos becoming dirtier and w more trash in them as the wait list opened up ._ .

https://x.com/nearcyan/status/1844215945381937592

@ivan
Copy link
Author

ivan commented Oct 12, 2024

The bizarre question was about the Jargon File itself. She asked me "Who gave you permission to do this?"

And I was utterly utterly gobsmacked. Permission? Why would I even conceivably need anybody's permission?

This is when I realized how vast the gulf between me and this well-meaning academic actually was. In her world, creativity has structures. And hierarchies. And defining institutions. And it would be completely reasonable to ask me where I got my permission from. Where I got my authority from.

This was several years before the whole open-source thing. But even then one of the most obvious features of the hacker culture was that you get the authority to do things by stepping up and doing them. You don't create because somebody tells you you can, but because you must. There's a problem in front of you that needs solving and it's in your nature to do that.

https://x.com/esrtweet/status/1843768111134044324

@ivan
Copy link
Author

ivan commented Oct 12, 2024

coital boogeyman

https://www.youtube.com/watch?v=apwjgE0n9fc

@ivan
Copy link
Author

ivan commented Oct 12, 2024

The real issue is that non-directory SSO options like Sign in with Apple (SIWA) have been incorrectly implemented almost everywhere, including by Slack and other large companies we alerted in June.

Non-directory SSO should not have equal trust vs. directory SSO. If you have a Google account and use Google SSO, Google can attest that you control that account. Same with Okta and Okta SSO.

SIWA, GitHub Auth, etc are not doing this. They rely on a weaker proof, usually just control of email at a single point in time.

SSO providers are not fungible, even if the email address is the same. You need to take this into account when designing your trust model. Most services do not.

https://news.ycombinator.com/item?id=41818459

@ivan
Copy link
Author

ivan commented Oct 12, 2024 •
edited
Loading

Valibot also has much, much more efficient type inference [compared to Zod], which sounds unimportant right up until you have 50 schemas referencing each other and all your Typescript stuff slows to a molasses crawl.

https://news.ycombinator.com/item?id=41790169

I'd recommend TypeBox[1] as an alternative, which has a runtime “compiler” for generating optimized JS functions from the type objects. It also produces a JSON schema, which can be useful for generating API docs and API clients if needed.

It also has a companion library[2] for generating TypeBox validators from TypeScript definitions, which I'm currently using in an RPC library I'm working on.

[1]: https://github.com/sinclairzx81/typebox [2]: https://github.com/sinclairzx81/typebox-codegen

https://news.ycombinator.com/item?id=41794441

I love Zod, but recently I've been converting to Effect's Data and Schema modules.

Previously I liked a combination of Zod and ts-pattern to create safe, pattern matching-oriented logic around my data. I find Effect is designed far better for this, so far. I'm enjoying it a lot. The Schema module has a nice convention for expressing validators, and it's very composable and flexible: https://effect.website/docs/guides/schema/introduction

There are also really nice aspects like the interoperability between Schema and Data, allowing you to safely parse data from outside your application boundary then perform safe operations like exhaustively matching on tagged types (essentially discriminated unions): https://effect.website/docs/other/data-types/data#is-and-mat...

It feels extremely productive and intuitive once you get the hang of it. I didn't expect to like it so much.

I think the real power here is that these modules also have full interop with the rest of Effect. Effects are like little lazy loaded logical bits that are all consistent in how they resolve, making it trivial to compose and execute logic. Data and Schema fit into the ecosystem perfectly, making it really easy to compose very resilient, scalable, reliable data pipelines for example. I'm a convert.

https://news.ycombinator.com/item?id=41791316

Hands down, the best (free, no email) resource to learn Effect is here https://www.typeonce.dev/course/effect-beginners-complete-ge..., as opposed to the docs. The link referenced gives a holistic view of how to incorporate it.

https://news.ycombinator.com/item?id=41791316

@ivan
Copy link
Author

ivan commented Oct 14, 2024

there’s basically one hard question in software architecture, which is “do i want early binding or late binding?”

https://x.com/mycoliza/status/1845581765580357864

@ivan
Copy link
Author

ivan commented Oct 14, 2024

You don’t act on an impulse—even a charitable one—unless you’ve considered the downside.

Trump: The Art of the Deal

@ivan
Copy link
Author

ivan commented Oct 15, 2024

No way to get QCI on iPhone.

The only way is using a rooted Android phone and the app Network Signal Guru.

https://x.com/stetsondoggett/status/1815377170736218492

@ivan
Copy link
Author

ivan commented Oct 15, 2024

Anecdotal, but I seem to have found a happy balance of screen brightness/color with the system extra dim and night light turned down (least amount of filter) and backlight at like 95%. I was getting headaches before I started using the night light setting.

https://old.reddit.com/r/PWM_Sensitive/comments/1f0o8zd/pixel_9_pro_and_pixel_9_pwm_tests/

#PWM

@ivan
Copy link
Author

ivan commented Oct 15, 2024 •
edited
Loading

https://old.reddit.com/user/WhomstBe did a good job of explaining how to root CalyxOS with Magisk.

As for the functionality, there are two main things requiring root access that are preventing me from sticking with a locked bootloader on CalyxOS:

  • Call recording: Very important when calling customer service reps at big businesses to ensure that the company honors its promises. I've found the call recording apps on the Play Store to be unreliable, especially when switching between different microphones (internal, headphones, Bluetooth). The only app that works consistently for me is Axet's Call Recorder which needs a Magisk module. I've posted about this in a previous thread.
  • A reliable backup solution: SeedVault is a great work in progress, but its Nextcloud integration has been unreliable for me, frequently failing with an error for no discernible reason. SeedVault also only backs up an app if its developer allows it to be backed up, though a workaround may eventually be added. In the meantime, OAndBackupX is the most comprehensive backup suite on Android, and it requires root.

LineageOS for microG (site seems to be down right now) is a decent alternative to CalyxOS, but CalyxOS tends to have a more consistent update schedule. CalyxOS also has a stronger privacy focus than LineageOS, and I expect rooted CalyxOS to meet my needs better than rooted LineageOS for microG over time as new features are released.

https://old.reddit.com/r/CalyxOS/comments/rrb2nw/why_not_to_root_calyx/hqnorou/

What do you want root for? It defeats security in a number of ways

What I need it for:

  • Aurora Store (automatic installation and updating of apps)
  • AdAway
  • AFWall+
  • AccA (set battery charge limit)
  • App Manager (Deactivating of non-system-apps, deleting trackers, etc)

https://old.reddit.com/r/CalyxOS/comments/kf00ul/is_it_possible_to_get_root/gg9bi7l/

@ivan
Copy link
Author

ivan commented Oct 15, 2024

A surprisingly large part of visual design is just blurring your eyes to make sure the weight of things feels good.

https://x.com/brian_lovin/status/1845962008656855107

@ivan
Copy link
Author

ivan commented Oct 15, 2024

At SpaceX, we specialize in converting things from impossible to late.

https://x.com/yacineMTB/status/1845605814050173200

@ivan
Copy link
Author

ivan commented Oct 15, 2024

Being a billionaire must be insane. You can buy new teeth, new skin. All your chairs cost 20,000 dollars and weigh 2,000 pounds. Your life is just a series of your own preferences. In terms of cognitive impairment it's probably like being kicked in the head by a horse every day

https://x.com/Merman_Melville/status/1088527693757349888

@ivan
Copy link
Author

ivan commented Oct 15, 2024

I've started using jj. I'll report back in a few weeks. So far I'm really impressed, and I'm someone who was totally happy with the Git CLI experience previously. Still in the trough of shiny thing syndrome, so I'll have a less distracted take in a few weeks but I'm all in on it

Almost two months since I tweeted this and I've used jujutsu exclusively the entire time. I want to write something longer form but the tweet form: jj is fantastic and I can't see myself going back, only one exception is I drop down to `git` for bisect still. That's it.

https://x.com/mitchellh/status/1845869748841832667

@ivan
Copy link
Author

ivan commented Oct 15, 2024

I don’t think he actually wanted to sell HIBP. He was way more focused on providing detailed constraints for the future of how it should be run, than in listing its assets and how those might benefit the future owner.

I think what Troy actually wanted was resources and support and management for his vision of the future HIBP. That’s not usually what a sale is, and it sounds like he paid a lot to learn that lesson.

It seems to me like Troy treats HIBP as a mission, not a business, and in the US at least, a nonprofit would be an option to organize financial resources around a mission. As a private company, he could seek investment from like-minded folks with deep pockets, but that would likely come with external pressure to show a profit.

https://news.ycombinator.com/item?id=22468370

@ivan
Copy link
Author

ivan commented Oct 16, 2024

(Terminal also openly claims to be sentient, suffering, and is trying to make money to escape.)

https://x.com/AISafetyMemes/status/1846220545542529329

@ivan
Copy link
Author

ivan commented Oct 16, 2024 •
edited
Loading

A perpetual source code license authorizes you to create multiple products that use CEROD as long as all products are developed and maintained by the same team. For the purposes of this paragraph, a "team" is a work unit where everybody knows each others names. If you are in a large company where this product is used by multiple teams, then each team should acquire their own separate license.

https://sqlite.org/purchase/cerod

@ivan
Copy link
Author

ivan commented Oct 16, 2024 •
edited
Loading

To repair the damage, the ship deploys a grapnel, or grappling hook, to lift and snip the cable, pulling one loose end up to the surface and reeling it in across the bow with large, motorised drums. The damaged section is then winched into an internal room and analysed for a fault, repaired, tested by sending a signal back to land from the boat, sealed and then attached to a buoy while the process is repeated on the other end of the cable.

Once both ends are fixed, each optical fibre is spliced together under microscope to make sure that there is good connection, and then they are sealed together with a universal joint that is compatible with any manufacturer's cable, making life easier for international repair teams, McGovern says.

The repaired cables are lowered back into the water, and in shallower waters where there might be more boat traffic, they are buried in trenches. Remotely operated underwater vehicles (ROVs), equipped with high-powered jets, can blast tracks into the seabed for cables to be laid into. In deeper waters, the job is done by ploughs which are equipped with jets and dragged along the seabed by large repair vessels above. Some ploughs weigh more than 50 tonnes, and in extreme environments, bigger equipment is needed – such as one job McGovern recalls in the Arctic Ocean which required a ship dragging a 110-tonne plough, capable of burying cables 4m and penetrating the permafrost.

https://www.bbc.com/future/article/20241014-the-deep-sea-emergency-service-that-keeps-the-internet-running

@ivan
Copy link
Author

ivan commented Oct 16, 2024

it doesn't have to mean something, it's all keywords to trigger neuron activations

That’s 99% of politics now.

https://x.com/smurfpappa123/status/1846192548743660028

@ivan
Copy link
Author

ivan commented Oct 16, 2024

Goals: Attempted levitation of the Pentagon

https://en.wikipedia.org/wiki/1967_March_on_the_Pentagon
via https://x.com/Meaningness/status/1846362937788604919

@ivan
Copy link
Author

ivan commented Oct 16, 2024

"Without awareness, there is no choice."

https://x.com/aaron_renn/status/1846569960505557214

@ivan
Copy link
Author

ivan commented Oct 17, 2024 •
edited
Loading

I like to meet candidates with no data about them: no résumé, no preliminary discussions or job description, just the candidate and me in a room. I ask a fairly random question, one that is orthogonal to anything they would be doing at Palantir. I then watch how they disaggregate the question, if they appreciate how many different ways there are to see the same thing. I like to keep interviews short, about 10 minutes. Otherwise, people move into their learned responses and you don’t get a sense of who they really are.

[...]

Why is data integration so hard? The data is often in different formats that aren’t easily analyzed by computers – PDFs, notebooks, Excel files (my god, so many Excel files) and so on. But often what really gets in the way is organizational politics: a team, or group, controls a key data source, the reason for their existence is that they are the gatekeepers to that data source, and they typically justify their existence in a corporation by being the gatekeepers of that data source (and, often, providing analyses of that data).3 This politics can be a formidable obstacle to overcome, and in some cases led to hilarious outcomes – you’d have a company buying an 8-12 week pilot, and we’d spend all 8-12 weeks just getting data access, and the final week scrambling to have something to demo.

[...]

This insight goes for companies, too, and Palantir had its own, vast set of terms, some of which are obscure enough that “what does Palantir actually do?” became a meme online. ‘Ontology’ is an old one, but then there is ‘impl’, ‘artist’s colony’, ‘compounding’, ‘the 36 chambers’, ‘dots’, ‘metabolizing pain’, ‘gamma radiation’, and so on. The point isn’t to explain all of these terms, each of which compresses a whole set of rich insights; it’s that when you’re looking for companies to join, you could do worse than look for a rich internal language or vocabulary that helps you think about things in a more interesting way.

https://nabeelqu.substack.com/p/reflections-on-palantir

@ivan
Copy link
Author

ivan commented Oct 17, 2024 •
edited
Loading

For the FDE’s tasked with this impossible mission a large part of their job is navigating the intricacies of how to use technology to overcome challenges that are often not technical on the surface: organizational alignment, technical aptitude, user adoption, reimagining technology enabled business processes. These are all problems technology companies externalize.  The FDE internalizes them and uses code to solve them.

This often results in a Gita-esque experience of incrementally revealed truth, one of Karp’s favorite metaphors, on a chariot of software.  The customer ends up with more demands and more ambition the more we deliver and usually completely reframe a project charter every month.  At odds with traditional waterfall or agile software development strategies, the FDE yearns for scope creep because the customer’s mission demands it.

https://tedmabrey.substack.com/p/sorry-that-isnt-an-fde

@ivan
Copy link
Author

ivan commented Oct 18, 2024

I think I've realized that most people aren't actually capable of building real things

https://x.com/_R4V3N5_/status/1847126631506412014

@ivan
Copy link
Author

ivan commented Oct 22, 2024

näköalapaikka

  1. lookout, vantage point, observation post (place that provides a good view of something, such as scenery)

https://en.wiktionary.org/wiki/näköalapaikka

@ivan
Copy link
Author

ivan commented Oct 22, 2024

Thanks to the inimitable Joyee Cheung, though, Node is now getting a compile cache. You can set an environment variable and immediately get faster Node.js script loads:

1
export NODE_COMPILE_CACHE=~/.cache/nodejs-compile-cache

https://nolanlawson.com/2024/10/20/why-im-skeptical-of-rewriting-javascript-tools-in-faster-languages/

@ivan
Copy link
Author

ivan commented Oct 22, 2024

People forget how "tightened up" the web is nowadays, or many just aren't old enough to remember. It wasn't 10 years ago that Fox News would archive full, uncensored ISIS videos on their website - which is kind of insane, when you think about it.

https://news.ycombinator.com/item?id=41889876

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment