Hacker Newsnew | past | comments | ask | show | jobs | submit | robszumski's commentslogin

I commented elsewhere but our team built a custom static analysis engine for JS/TS specifically for the dep update use-case. It was hard, had to do synthetic execution, understands all the crazy remapping and reexporting you can do, etc. Even then it’s hard to penetrate a complex Express app due to how the tree is built up.

Totally hear you on the noise…but we should want to auto-merge vs ignore, no? Given the right tooling of course.

We could just skip some steps and I could send you a zip file of malware for you to install on your infra directly if you’d like.


We’ve built a modern dependabot (or works with it) agent: fossabot analyzes your app code to know how you use your dependencies then delivers a custom safe/needs review verdict per upgrade or packages groups of safe upgrades together to make more strategic jumps. We can also fix breaking changes because the agents context is so complete.

https://fossa.com/products/fossabot/

We have some of the best JS/TS analysis out there based on a custom static analysis engine designed for this use-case. You get free credits each month and we’d love feedback on which ecosystems are next…Java, Python?

Totally agree with the author that static analysis like govulncheck is the secret weapon to success with this problem! Dynamic languages are just much harder.

We have a really cool eval framework as well that we’ve blogged about.


Are y'all aware your agent's name clashes with an established and rather popular streaming bot/tool, https://fossabot.com ?

That would explain why I tried to get vulnerability notifications and instead all my code was streamed to Twitch.

Spitballing some alt names

Fossadep

Fossacheck

Fossasafe


Fossamatta

Fossahappenin

Fossagoinon



Would love to see this for Rust!

I think python and go could be great use cases

Thanks for sharing, really helpful to see your thinking. I haven't fully embraced FaaS myself but never regretted it either.

Curious to hear more about Renovate vs Dependabot. Is it complicated to debug _why_ it's making a choice to upgrade from A to B? Working on a tool to do app-specific breaking change analysis so winning trust and being transparent about what is happening is top of mind.

When were you using quay.io? In the pre-CoreOS years, CoreOS years (2014-2018), or the Red Hat years?


no, but still being super impressive. CEO of a company rebuilding a CAD rendering engine because they put an LLM on top of it. So you describe the mechanical specs of the part you want and it models it. Takes all the tedium out of modeling stuff. Super cool and many applications.


Oh cool! That looks like a super interesting product.

https://zoo.dev


They had to do CAD while working on Oxide and realized that it sucked. So she went off to solve that.


that's taking yak shaving to another level!


Same author talked about adversarial license plates that trick these cameras with a sequence of black blocks, discussed here in original form [1]. He is interested in breaking both the plate detection (ideal) and character recognition (good). The examples are pretty cool looking.

[1]: https://youtu.be/Pp9MwZkHiMQ?&t=1428


In most countries, this is prohibited by law. While it might be interesting from a technical perspective, it does not help in practice.


Yep, and the overwhelming majority of people using them are not principled cypherpunks, but parking fee dodgers and habitual dangerous drivers.


Instead of a sticker like in the video make a stencil and spray diluted mud through it. Plausible deniability!


Are you also going to spray your car with mud too? Going to have a hard time explaining a spotless car that only has mud on the license plate.


Many police cars now have ghost graphics.

https://gdigraphics.com/police-car-ghost-graphics/

There were laws in many places where you could fight a traffic ticket because you couldn't plainly recognize a police vehicle, especially when a taillight or headlight is out, but now we pay for graphics to make them more invisible. "If you have nothing to hide, you have nothing to worry about." I like the plausible deniability angle, myself


My car is 'self-spraying' so much I'd like it to be less so. Country life I guess.


Not a problem, the TPMS will give you away.


Get it while it's hot, cuz it's already illegal in some states, and will be in more soon!

You will be tracked and you will be happy about it.


Flock data retention is defaulted to 30 days, but can vary up to a year or longer depending on the terms of the municipality contract.


Is this retention period configured in Flock’s data lake by camera? Or by entity or agency the camera is assigned to?


exactly. standard move when you aren't going to get a second shot.


We built and launched this product about 2 months ago, HN thread here: https://news.ycombinator.com/item?id=45439721

Totally agree that AI is great for this, it will work harder and go deeper and never gets tired of reading code or release notes or migration guides. What you want instead of summaries is to find the breaking changes, figure out if they matter, then comment on _that_.


If a giant chunk of the constellation can act as a truly huge antenna, what can you get from that? Super high resolution? Seek/dwell time on a target that is effectively infinite?


And we are going to put that in the hands of Elon musk? Are you fucking kidding me?


Nobody is discussing putting anything in Elon's hand. We are discussing what he already has in his hand, or can grab for himself if he chooses to.


Is there a viable alternative?

SpaceX is the only launch provider and satellite operator that is progressing at a rapid pace and driving costs down.


No need for the satellite manufacturer to be the same as the launch provider, and there's nothing at all special about short-lived commodity satellites for LEO constellations. SpaceX is going to be cost-effective at building them given their experience with Starlink, but cost isn't typically a major concern of the US govt, and certainly not a higher priority than concerns about the satellite operator frequently suggesting that access to his satellites might be contigent upon his views on a particular conflict.


> but cost isn't typically a major concern of the US govt

tell that to any project that has had their budget slashed or out right canceled because somebody thought their project was a waste of money. every contractor is bidding unless your name is Halliburton. what's the famous astronaut quote about sitting on top of a rocket built by the lowest bidding contractor?


> tell that to any project that has had their budget slashed or out right canceled because somebody thought their project was a waste of money.

Their contracts aren't in defense...


Chinese companies seem to be in process of cloning Falcon 9 and even Starlink (Thousand Sails and other constellations).

In the west the Rocketlab Neutron partial RLV and planned Stokes Space full RLV stand out.

And maybe in a few decades even Arianespace will end up with a Falcon 9 class vehicle! ;-)


> Is there a viable alternative?

Always a good answer. ;-)


2/3 of Falcon 9 launches are for Starlink. No outside revenue. SpaceX continues to require new investment rounds. So the whole "driving costs down" thing might only work until investors expect some actual free cash flow.

There have been 11 test launches of starship. You might've missed the last one because it didn't do anything new, except shedding parts and exploding less. There's a pretty good chance that program will never beat the cost of Falcon Heavy, or that the technology, like multiple refueling flights to get beyond low Earth orbit, is ever made workable.


The last Starship launch was indeed unspectacular because it didn't try pushing the envelope particularly hard. The previous launches were much more precarious, with many fire balls. But I'm a strong believer in iterative development. It's bad PR when everyone can see every failed prototype, but the "design it once, simulate, and make sure the first prototype flies without issues" boxes you in to conservative design decisions.


They did push Starship hard enough on reentry that, reportedly, it ended up with multiple holes burned through the metal hull and into the tanks.

It survived that - did that entire "simulated landing" burn and all.


Well, if 2/3 of SpaceX's current launches are for Starlink (which deploys satellites in LEO), isn't a two-stage, fully reusable vehicle optimized for LEO deployment the thing SpaceX would want to build?

In terms of "free cash flow" expectations, are you aware that approximately 90% of "space" revenue and profit comes from satellite telecom services, with launch services accounting for about 10% of the mix? SpaceX's development of a telecommunications constellation (Starlink) is highly consistent with historical industry patterns of what makes profit in space.

https://brycetech.com/reports/report-documents/global_satell...


If SpaceX only had contract money as revenue, they'd be fine but they probably would not be innovating as fast. The investment rounds are to pay for Starlink build-out and Starship.


You're more worried about that than having it in the hands of the US government?


How could you even think the opposite to be a better option?

The US does suffer from a serious amount of issues politically (I'm 100% convinced that presidential republics are flawed) but it's still an organization with plenty of checks requiring popular mandate.

No single private individual should ever hold this kind of influence imho, not even if it is Gandhi or a saint and Musk is quite the other end of the spectrum.


It requires you to go deep in both the code analysis and the research, which is expensive at their scale

And, as someone who's start up (EdgeBit was acquired by FOSSA recently) wrote a new JS/TS static analysis engine, it's just hard to get correct.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: