Hacker Newsnew | past | comments | ask | show | jobs | submit | collinmanderson's commentslogin

> Perhaps we need a common community effort to create a “distro” of curated and safe dependencies one can install safely, by analyzing the most popular packages and checking what’s common and small enough to be worth being included/forked.

Debian is a common community effort to create a “distro” of curated and safe dependencies one can install safely.

If you want stable, tested versions of software, only getting new versions every few years:

https://packages.debian.org/stable/javascript/

If you want the newer versions of software, less tested, getting new versions continuously:

https://packages.debian.org/unstable/javascript/


Why was this comment downvoted? Please explain why you disagree.


I didn’t downvote, but...

Depending on a commercial service is out of the question for most open source projects.


Renovate is not commercial, it's an own source dependabot, quite more copable at that.


AGPL is a no-go for many companies (even when it's just a tool that touches your code and not a dependency you link to).


good. that's the point.

agpl is a no go for companies not intending to ever contribute anything back. good riddance.


> sort of a "delayed" mode to updating my own dependencies. The idea is that when I want to update my dependencies, instead of updating to the absolute latest version available of everything, it updates to versions that were released no more than some configurable amount of time ago.

For Python's uv, you can do something like:

> uv lock --exclude-newer $(date --iso -d "2 days ago")


Awesome tip, thanks!


oh that uv lock is neat, i am going to give that a go


It would ask a root nameserver for an ip address for the .com nameserver, and then ask the .com nameserver for the ip address of the example.com nameserver, then ask the example.com nameserver for further records (and may continue to recurse).

https://en.m.wikipedia.org/wiki/Root_name_server


They probably see Cursor as a threat and are trying hard to keep up and avoid losing market share.


> Will wait for vibe check from simonw

https://openai.com/gpt-5/?video=1108156668

2:40 "I do like how the pelican's feet are on the pedals." "That's a rare detail that most of the other models I've tried this on have missed."

4:12 "The bicycle was flawless."

5:30 Re generating documentation: "It nailed it. It gave me the exact information I needed. It gave me full architectural overview. It was clearly very good at consuming a quarter million tokens of rust." "My trust issues are beginning to fall away"

Edit: ohh he has blog post now: https://news.ycombinator.com/item?id=44828264


I feel like we need to move on from using the same test on models since as time goes on the information about these specific test is out there in the training data and while i am not saying that it's happened in this case there is nothing stopping model developers from adding extra data for theses tests directly in the training data to make their models seem better than they are


This effectively kills this benchmark.


Honestly, I have mixed feelings about him appearing there. His blog posts are a nice way to be updated about what's going on, and he deserves the recognition, but he's now part of their marketing content. I hope that doesn't make him afraid of speaking his mind when talking about OpenAI's models. I still trust his opinions, though.


Yeah, even if he wasn't paid to appear there, this seems a bit too close.


The pelican is still a mess.


Damn Theo is really a handsome dude.


Does Oxide require 3-phase power? Do datacenters typically provide 3-phase power?


Their spec sheet shows 208 and 3 phase as options. 3 phase is smaller wiring, and with 15KW per rack I could see how that would quickly become a problem.


> It already has no deps

Yes when I heard it was python I immediately checked the dependencies expecting a ginormous list and found basically nothing. Incredibly impressive, just a few "stolen" libs here: https://github.com/9001/copyparty/tree/hovudstraum/copyparty...

Worth scrolling through util.py to see lots of hand-implemented code: MultipartParser, read_header(), read_socket_chunked(), html_escape(), atomic_move(), killtree ("still racy but i tried"), termsize(), etc

https://github.com/9001/copyparty/blob/hovudstraum/copyparty...

6k loc for http server/client handling transferring files, rss feed, etc. See `def run(self)` for main request parsing.

https://github.com/9001/copyparty/blob/hovudstraum/copyparty...


src layout _should_ work. The pyproject.toml needs to live next to src, not inside of it. You might need to `uv run python` in order to pick up the right PYTHONPATH?

https://docs.astral.sh/uv/concepts/projects/init/#packaged-a...

    uv init --package example-pkg
    cd example-pkg
    uv run python
    >>> from example_pkg import main


You don't know what you're missing if you haven't spent 5 minutes trying out uv.

If you're intentionally not trying it simply because you don't want to get addicted like everyone else clearly is, I could see that as a valid reason to never try it in the first place.

I usually avoid jumping on bandwagons, so I've always stuck with vanilla pip/venv, but at this point it really is clear to me that uv really is the "One True (tm) python package management solution", and probably will be for the next 10 years.


Consider applying for YC's Winter 2026 batch! Applications are open till Nov 10

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: