I believe the reason is, at the frequencies these CPUs are talking to RAM, the reflection coefficient[1] starts playing a big role. This means any change in impedance in the wire cause reflections of the signal.

This is also the reasoning why you can't just have a dumb female to female HDMI coupling and expect video to work. All of such devices are active and read the stream on the input and relay them on the output.

[1]: https://en.wikipedia.org/wiki/Reflection_coefficient

See also RF insertion loss and how that's dealt with, PCIe retimers, etc.

Above certain frequencies, you start running into major issues with signal integrity, and fixing them is very difficult without any extra circuitry.

Have you tried anubis?

https://github.com/TecharoHQ/anubis

Anubis is affective against certain kinds of bots and abuse, but wouldn't be that affective against large scale DDoS attacks. And it does have a negative impact on usability, as users have to wait for the browser to do the proof of work, which may or may not be worse than cloudflare's captchas.

Anubis is a partial mitigant of DDOS attacks, since it's less resource intensive to serve the Anubis page than the origin[1].

Cloudflare's captchas are only convenient for a subset of users, I'll bet there'd be decent money in one of the competing CDNs (Fastly maybe?) including an Anubis-like captcha.

[1] : https://news.ycombinator.com/item?id=43864108

Yes, it's a partial mitigator, but it isn't as complete of a solution as a CDN, for a number of reasons. For one thing, with Anubis your server is still responding to requests, so a full scale DDoS could potentially take you down without having to actually complete the PoW, they just have to make enough requests.

Using a CDN for DDoS typically has multiple levels of protection:

- caching reduces load on your server

- In the event of a (D)DoS attack, the cdn can absorb the attack traffic with their much higher capacity than your server(s)

- The CDN can block certain kinds of attacks, especially low level (D)DoS attacks without the traffic ever touching your servers

- Since the CDN fronts many sites, it can have more information about which IP addresss, and user agents are more suspicious. This one is a little controversial, because there is a conflict between getting an accurate profile of how suspicious a request is, and preserving the privacy of users.

- It may have built in support for some kind of bot detection, such as captcha or a proof of work. IDK about the free tier of cloudflare, but for paid offerings at least, this is usually optional.

In short, Anubis could be part of a DDoS mitigation plan, but if you are worried about a targeted attack, it probably isn't sufficient. And critical services are potentially a valuable target for attacks.

I tried to figure it out for about 5 minutes, and decided that it probably wasn’t possible on my shared hosting.

My house also came with a nest, and I also never connected it to my network, but for me nest was a terrible dumb thermostat.

It constantly tried to infer schedules and change the temperature on its own. I would set the temperature, come back an hour later to find that it changed itself back to what it thought it should be.

Also, there was no way to just activate the fan. I live in a very temperate climate and I generally like to keep a few windows open but run the fan to circulate air through the house.

I sold the nest and now a $15 dumb thermostat from the local hardware store now lets me set a temperature and it won't randomly change it when it feels like it. And it has a switch to turn on the fan.

I managed to disable the scheduling system, as even that was too smart for me (I had similar troubles as you). All it does now is: set temperature; allow switching between heat, cold, both, or none; allow turning on fan-only for X hours. Maybe yours wasn't wired correctly for the fan? No idea.

I agree this is the ideal situation, but as it stands CAHSR is planned to terminate at union station in LA, quite far from LAX. Ideally LA metro or metrolink would build a direct connection between union station and LAX, but that hasn't begun to be planned and unfortunately it's very difficult to get transit built in LA. For instance the Sepulveda line— one of the most important lines for LA— is at risk of being killed because ticket master's ex-CEO doesn't want a train line running under his house.

I currently run LineageOS and am constantly frustrated with its limitations every day.

On desktop linux I can quickly write up a program to do most anything I want in pretty much any language, and in my text editor of choice. I don't know anything about android development and I don't really want to invest time in learning Google's proprietary GUI toolkit when QT/GTK, or even raw OpenGL is more portable. I once looked into it and gave up when it seemed like it was going to be very painful to write an app outside of android studio (why is there not just a CLI tool to compile these things?). On vanilla linux I can whip up most things in under an hour in C, Rust, or even Bash.

I think it's painful to write an app inside android studio, it's just pain you accept if you want to do android development. Professional pain so to speak, you're paid to suffer.

Right, but that is still severely limited in my experience.

Like I can't bind these programs to run on keyboard shortcut (or I guess the mobile equivalent would be a button on the home/lock screen?)

I can't do basic UI-- even if I don't write a QT/GTK app sometimes I want to pipe to imv, mpv, present a list of options via dmenu/rofi, send a notification to dunst/mako via notify-send, copy strings to the system clipboard, write a script that calls wtype to emulate keystrokes, etc.

I don't have access to the whole filesystem too, right? Last time I tried writing a script in termux I couldn't access the photos my phone took.

One concrete example: I use music player daemon to play music throughout my home. On the phone the answer is to download an app that implements the protocol, but the app isn't great. Instead, I wish I could bind dmenu to open up when I press volume up for example that just shells out to mpc. These are the types of things that I like to set up on my desktop to get a really ergonomic experience tailored to my workflow, but on mobile I'm at the mercy of what apks are available.

I also haven't found any great solution for setting up a phone declaratively. On desktop I can use NixOS to codify my configuration, on mobile, flashing a new OS means pecking around settings/fdroid like a point and click adventure game for an hour to get everything to a somewhat usable state.

Perhaps this is all just user error and everyone else has figured out how to do these things, or they just suck it up and build their own android apps. But for me, this is really what I'm asking for when I say I want Linux on mobile.

> Plus, ART is open-source and works great for GUI apps.

This requires writing the app in java and building it in android studio, right? Is there an easy way to just compile an apk from a non-android project?

Also if I invest a lot of time in learning ART and building apps for android, I will have a much worse experience running these apps on desktop linux (for example under waydroid) which is where I spend a vast majority of my time.

I agree the syntax isn't perfect, but in case you're actually confused there's really only 3 places where semicolons go, and I would argue that two of the places make a lot of sense— as a terminator for attribute sets, and a terminator for `let` declarations.

Unfortunately it is also used with the somewhat confusing `with` operator which I personally avoid using. For those of you who aren't familiar, it works similar to the now deprecated javascript `with` statement where `with foo; bar` will resolve to `bar` if it is in scope, otherwise it will resolve to `foo.bar`.

I actually prefer `with`, since it fits better with the language:

- It uses `;` in the same way as `assert`, whereas `let` uses a whole other keyword `in`.

- It uses attrsets as reified/first-class environments, unlike `let`, which lets us do `with foo; ...`.

- Since it uses attrsets, we can use their existing functionality, like `rec` and `inherit`; rather than duplicating it.

I've been using Nix for over a decade (it's even on my phone), and I've never once written a `let`.

(I agree that the shadowing behaviour is annoying, and we're stuck with it for back-compat; but that's only an issue for function arguments and let, and I don't use the latter)

Interesting, are you saying that instead of reaching for `let foo = bar; in expr` you usually use something like `with { foo = bar; }; expr`?

> Since it uses attrsets, we can use their existing functionality, like `rec` and `inherit`; rather than duplicating it.

`let` supports `inherit`, and is always `rec`. Or is that your point, that it is needlessly duplicated functionality?

Yes and yes :)

Functions with default arguments are also very useful; especially since `nix-build` will call them automatically. Those are "always `rec`" too, which (a) makes them convenient for intermediate values, and (b) provides a fine-grained way to override some functionality. I used this to great effect at a previous employer, for wrangling a bunch of inter-dependent Maven projects; but here's a made-up example:

    {
      # Main project directory. Override to build a different version.
      src ? pkgs.lib.cleanSource ./.
    
      # Take these files from src by default, but allow them to be overridden
    , config ? "${src}/config.json"
    , script ? "${src}/script.sh"
    
      # A couple of dependencies
    , jq ? pkgs.jq
    , pythonEnv ? python3.withPackages choosePyPackages
    , extraDeps ? [] # Not necessary, but might be useful for callers
    
      # Python is tricky, since it bakes all of its libraries into one derivation.
      # Exposing intermediate parts lets us override just the interpreter, or just
      # the set of packages, or both.
    , python3 ? pkgs.python3
    , choosePyPackages ? (p: pythonDeps p ++ extraPythonDeps p)
    , pythonDeps ? (p: [ p.numpy ])
    , extraPythonDeps ? (p: [])  # Again, not necessary but maybe useful
    
      # Most of our dependencies will ultimately come from Nixpkgs, so we should pin
      # a known-good revision. However, we should also allow that to be overridden;
      # e.g. if we want to pass the same revision into a bunch of projects, for
      # consistency.
    , pkgs ? import ./pinned-nixpkgs.nix
    }:
    # Some arbitrary result
    pkgs.writeShellApplication {
      name = "foo";
      runtimeInputs = [ jq pythonEnv ] ++ extraDeps;
      runtimeEnv = { inherit config; };
      text = builtins.readFile script;
    }

> now deprecated javascript `with` statement where `with foo; bar` will resolve to `bar` if it is in scope, otherwise it will resolve to `foo.bar`.

Technically, in JavaScript it's `with (foo) bar`.

Source: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Refe...

This is exactly what the tool bubblewrap[1] is built for. It is pretty easy to wrap binaries with it and it gives you control over exactly what permissions you want in the namespace.

[1]: https://github.com/containers/bubblewrap

You can do this with vanilla Firefox using policies.json[1]. Check out `DisableAppUpdate` attribute.

If you're using Firefox from nixpkgs this is already disabled by default[2].

[1]: https://support.mozilla.org/en-US/kb/customizing-firefox-usi...

[2]: https://github.com/NixOS/nixpkgs/blob/nixos-24.11/pkgs/appli...

I don't think it really addresses the issue because it still requires an account at one of the predetermined identity providers. With email I just need a domain and I can self host the rest if I really cared to.

It would be so much nicer if there was a federated way where I the user could specify any OAuth identity provider (even if it was e.g. a self hosted one) rather than the predetermined list dictated by the relying party.

Funnily enough someone recently asked me if I could comment on a Product Hunt post and I was unable to do so since they only allow sign in with Google, Twitter, Facebook, Apple or Linked in; I have none of these accounts and would rather not create any of them. Oh well.