Hacker Newsnew | past | comments | ask | show | jobs | submit | more 0rzech's commentslogin

> some town in Germany

The Polish city of Gdańsk, of the then Polish-Lithuanian Commonwealth. He was also born there at the time. [1]

> He defined 0 degrees as the coldest measurement, 100 the hottest measurement.

Nope. It was neither about the temperatures in Gdańsk, nor about the temperature of his wife, btw. ;) [2]

  [1] https://en.wikipedia.org/wiki/Daniel_Gabriel_Fahrenheit
  [2] https://en.wikipedia.org/wiki/Fahrenheit


  * Dual Mode: GAIA comes in two flavors:
    * Hybrid Mode: Optimized for Ryzen AI PCs, combining AMD Neural Processing Unit (NPU) and Integrated Graphics Processing Unit (iGPU) for maximum performance
    * Generic Mode: Compatible with any Windows PC, using Ollama as the backend
https://github.com/amd/gaia/blob/a8b8b6e10b585f58ed1aafcef0d...


IMHO, workplace politics can happen and be caused at any level of a company. I think it's a natural thing for some people to do.

Especially at big companies, which kinda resemble small countries. You get "who likes whom", supervisors' pets, weird alliances, power struggles, backstabbing and other toxic stuff.

What management (at any level) is at fault of is failing to actively weed out these behaviours or indeed straight up doing the same thing.

Also, companies often fail to reward silent, but effective and solid people, and instead opt into creating a loud, noisy rockstar culture even if the overall quality suffers. This in turn motivates people to seek other means of being recognized, including workplace politics.

I've seen all of it while being a manager. I hated it with a passion, and fell a victim of it quite a few times myself.

And I agree that people playing workplace politics should either change their behaviour or be let go.


>failing to actively weed out these behaviours

>companies often fail to reward silent, but effective and solid people, and instead opt into creating a loud, noisy rockstar culture.

Excellent observations.

People think politics is inevitable when a bunch of people are put together. But if one has courage to retain only the right people, politics can be eliminated. I once worked for a company that achieved that - near zero politics among the managers. It left a lasting impression on me.


>. Also, companies often fail to reward silent, but effective and solid people, and instead opt into creating a loud, noisy rockstar culture even if the overall quality suffers. This in turn motivates people to seek other means of being recognized, including workplace politics.

But that's also a management failure. A lot of managers ask "What can you do for my team or me so we can be more important?" But instead they should be asking, "What can my team do for you?"


This. Using tags is acceptable only for official GitHub actions, anything else should be pinned.


Some people do actually pin versions, like me. For instance:

  - uses: Swatinem/rust-cache@f0deed1e0edfc6a9be95417288c0e1099b1eeec3 # v2.7.7
or

  - uses: subosito/flutter-action@f2c4f6686ca8e8d6e6d0f28410eeef506ed66aff # v2.18.0
It's a bit more manual work, but lepiej dmuchać na zimne (lit. it is better to blow on something cold), as the Polish proverb says.


>It's a bit more manual work

after this incident, I started pinning all my github workflows with hashes, like other folks here I guess :D But I quickly got tired of doing it manually so I put together this [0] quick and dirty script to handle it for me. It just updates all workflow files in a repo and can be also used as a pre-commit hook to catch any unpinned steps in the future. It’s nothing fancy (leveraging ls-remote), but it’s saved me some time, so I figured I’d share in case it helps someone else :)

[0] https://github.com/brokenpip3/pre-commit-hooks?tab=readme-ov...


> github action dependency with the hash of the specific tag and a human readable tag that dependabot will keep/update in the future [1]

Allowing bots to do that is going to make you vulnerable to such attacks anyway.

[1] https://github.com/brokenpip3/pre-commit-hooks/blob/f01df657...


You would still be exposed if you had renovate or dependabot make a PR where they update the hash for you, though. Here's a PR we got automatically created the other day:

-uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3 +uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3

and this PR gets run with privileges since it's from a user with write permissions.


I don't think you should ever allow dependabot to make direct commits to the repository. The only sane setting (IMO) is that dependabot should just make PRs, and a human needs to verify that and hit merge. My personal opinion is for any serious repositories, allowing a robot to have commit access is often a bad time and ticking time bomb (security-wise).

Now, of course, if there are literally hundreds of dependencies to update every week, then a human isn't really going to go through each and make sure they look good, so that person just becomes a rubber-stamper, which doesn't help the situation. At that point the team should probably seriously evaluate if their tech stack is just utterly broken if they have that many dependencies.


Even if you don't automerge, the bots will often have elevated rights (it needs to be able to see your private repository, for instance), so it making a PR will run your build jobs, possibly with the updated version, and just by doing that expose your secrets even without committing to main.


From security standpoint, automating GitHub action hash updates defeats the purpose of pinning them in the first place.


Pretty surprised not to see SNAFU [1] on that list. Very comfortable to use, kind of a mix of thiserror [2] and anyhow [3] I think.

[1] https://github.com/shepmaster/snafu

[2] https://github.com/dtolnay/thiserror

[3] https://github.com/dtolnay/anyhow


In the Budapest Memorandum USA promised not to attack Ukraine if it gives back Russian nukes to Russia. They kept the promise.

In the same memorandum Russia promised the same thing. They broke the promise. Repeatedly.

Nonetheless, I agree that more countries should develop their own nukes. Especially the ones like Poland, Baltics and Nordics. Not because it's a good thing to do, but because the world is what it is.


The memorandum also said they would provide assistance, they are not keeping that promise.


The Budapest Memorandum basically only required the USA to bring any violations to the UN Security Council, which we did in 2022. I think we have a moral obligation to continue providing military aid and diplomatic assistance but there is no legal obligation to do anything more.

https://en.wikipedia.org/wiki/Budapest_Memorandum


That's right. And let's not forget that Europe and USA have been helping directly for a few years now anyway.

It's really disappointing how much misinformation gets reiterated on the Internet with regards to this memorandum, given how short the document is and how easy it is to verify its contents oneself.

PS. NATO's Article 5 is also worth a read. It does not guarantee what is commonly claimed.


Let's not go there.

In the history of the Alliance there is only a single country that invoked article 5, and it was the US with 9/11 that lead to the United Kingdom, Canada, Germany, Australia, Italy, New Zealand to send resources and troops to help with Afghanistan.

And managed to get people involved in Iraq namely United Kingdom, Australia, Poland.

And this situation was way worse and way less called for than the Ukrainians defending themselves...

EDIT/NB: I listed just the major contributors, some other countries participated in different ways and at different levels, but still this is important to mention here...


> Let's not go there.

I genuinely don't know where's "there".

It is a fact, that NATO Article 5 doesn't guarantee anything regardless of other countries' response to USA triggering it, just as it is a fact, that the Budapest Memorandum was mischaracterized in this thread and that both the Europe and USA did help Ukraine. Should we not go where the facts are?

If you're about that the USA should continue helping Ukraine, then I did not question this point of view at all. Pointing out factual errors is not equal to taking a stance.


The implication that I read from what your wrote suggested that the US could offer "assistance" or sit it out, which is not an acceptable stance to hold, by history and the assistance that was provided in need.

Friendship among nations sometimes involves transactions that transcend the pure material considerations, and this shift in alignment is not desirable by anyone.

That's what I meant by "let's not go there".

But I see that basically we are in agreement and I also agree that article 5 interpretation could be dicey.


There was a lot more nations in Afghanistan than those listed, including many non Article 5.

When the US requested assistance, Europe provided.


Yes, it was a non exhaustive list and I should have mentioned it...


relevant, Ukraine also joined the "Coalition of the Willing," a U.S.-led multinational force in Iraq


Thank you for that addendum which, indeed, is critically relevant to the current situation.


I've searched the text of the Memorandum[0] for that promise and couldn't find it there. Can you help?

[0] https://treaties.un.org/doc/Publication/UNTS/Volume%203007/P...


Point 4

> ... seek immediate UN Security Council action to provide assistance to Ukraine ... if they should become a victim of an act of aggression or an object of a threat of aggression in which nuclear weapons are used

This seems like the passage which would cover it. The UN is able to authorize use of force by member states against the aggressor. Though it looks like it hasn't done that - probably because of Russia's permanent position on the UN Security Council which would veto any such measures.


Action was sought, as required.

Russia vetoed it, as expectged.

https://news.un.org/en/story/2022/09/1129102


I've read that point, and in my view it contains an obligation to call for a UN Security Council meeting and to seek a certain action by it.

The GP said:

>> The memorandum also said they would provide assistance

The memorandum does not contain an obligation to "provide assistance". "Providing assistance" and "seeking UNSC action" are very different things.

>> they are not keeping that promise.

They are not keeping promise to "provide assistance" because they have never made that promise.


Just for the record, the proper spelling is "gówno". ;)


This is the reason it is recommended in Poland to call it Królewiec, apart from it being under Polish rule for some time too.


I had the same problem, but it turned out to be a missing dependency: my webkit2gtk was 4.0 instead of 4.1. Another one, to my surprise, was xdotool.

Why does a Linux webview app built with Dioxus require it? I'm asking, because software inserting simulated HID inputs to arbitrary windows is not exactly my cup of tea. ;) And xdotool doesn't work on Wayland anyway, by design. Apparently there are similar programs for Wayland, but AFAIK they require the user to belong to the input group, which in turn gives any app run by such user access to /dev/uinput - a security risk.

In general, though, Dioxus looks interesting and I wish you all the best in your endeavour!


Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: