Hacker Newsnew | past | comments | ask | show | jobs | submit | allset_'s commentslogin

Your ISP can snoop on upstream requests. It is likely less private than Quad9 or similar services where you can mix requests with a large crowd.

Large companies use more than one language.


> Removed 17532 outdated packages, in an effort to keep the package set maintainable and secure.

Thanks for this! I appreciate the acknowledgement that more software in nixpkgs is not necessarily better.


Presumably, not paying out for these bugs which often take weeks of research to find.


Who in their right mind bets on bug bounties to cover their basic needs? They should be highly employable with these kind of skills.


> Who in their right mind bets on bug bounties to cover their basic needs?

Someone with a vulnerability worth as much as a two bedroom apartment?


If you take the statement at face value, that does not appear to be the case. If you don’t take it at face value, the underlying presumptions might be a lot of why they may not be employable.


Someone who doesn't have better options?


If you have those sorts of skills with a computer, you will have other options


Really depends on your background doesn't it? You could have convictions, be sanctioned, have visa problems, or all kinds of things that are not easily solvable.


Indeed, and this guy's personality seems a little "difficult" which might make the interview process short. I've known people with insane skills who have such weird personalities that they never get hired. Doing remote bug bounty stuff is a blessing for them.


To say nothing of mental health issues.


Or poverty. Or addiction.

Or that entire holy trinity.


Please let me know when finding a job in software engineering in 2026 is feasible for everyone with ‘computer skills’.


The guy doesn’t just have „computer skills“ if he found this.


Good luck convincing a HR automaton not looking at your resume for the job unposting of that.


Come on, with these skills you could convince someone to give you a job if you’re on the streets otherwise. You might not be a senior engineer in the exact thing you want but you won’t be on the streets.


It's not about your skills. It's about how well you can play the HR metagame. This inversely correlates with actual job skills.


Convincing someone, especially an HR person, has very little to do with computer skills.


Good with computers and good with people/job search/finances are not the same thing, and are often inversely correlated.


King Terry was living proof this is not true.


Oh hell, no. Does anyone remember Sandboxescaper/Polarbear? Very skilled researcher, but also crashouts and mental problems.

Had a job at MSFT once, but is now struggling to earn money at all and is posting heart breaking stuff on Twitter. https://x.com/WeirdQuadratic

Hope she finds a way out and a more stable and fun job in the future.


Then you pay him since you see the value he’s creating so clearly.


This is a strange argument. I don't have the capital, desire, or skills to employee this guy, or anyone really.

Me not hiring someone doesn't mean the skills aren't valuable.


We are, quite notably, in a huge hiring crisis where vast numbers of programmers and researchers can't even get interviews. It really is not that simple


people with values different from yours, presumably


This is one it those answers that seems on the surface like it contains insight but on closer inspection it’s vacuous.

This could be rewritten as “because they aren’t you”, which is true but not a meaningful or educational answer.


Sure sounds like rhetorical questions or attacking the messenger. Someone can think the bounty industry is going to reward them for actually being exceptional and not look soon enough for other options then pivot to a stance that should give them some quick job offers. If I thought I found an intentional back door I would not engage with an embargo system from the same vendor but I am also not them.


> Someone can think the bounty industry is going to reward them for actually being exceptional and not look soon enough for other options then pivot to a stance that should give them some quick job offers

Sure. And that’s a meaningful answer to the question.

“people with values different from yours, presumably” is a condescending nonanswer.


This entire thread is generally weird.

If someone has this kind of exploit and can't get a bug bounty for it, and desperately needs the money, he can sell it for 100k+ in a shady black market


It was about as meaningful as the question it was answering.


Maybe they don't have any openings at this time.


Even then, that's only immutable for the workflow config. Many workflows then go on to pull in mutable inputs downstream (eg: default to "latest" version).


If only they offered dedicated in the US.


There are plenty of other dedicated server providers that do.


Which comparable US dedicated server providers do you prefer?


I tend to mostly use dedicated servers from Hetzner for my own projects and for my client's projects. Whenever they explicitly want US servers, I tend to go with Vultr's dedicated servers which been serving us well for many years.


OVH has dedicated in USA and Canada


I've read several reports from customers saying that their customer service is really bad. Difficult to know with online reviews of course. Does anyone have positive stories to share? I am looking at Australian hosts specifically and Hetzner doesn't have any data centers here.


We use them heavily for test boxes and running experiments. Standard off-the-shelf machines are provisioned almost instantly, and never had any problems.

More custom stuff (eg 100Gb/s NICs) takes a bit longer, but they've always been super responsive and quick to sort out any issues!

The price / performance you get from something like their AX162 is just crazy, although unfortunately with the whole RAM / NVMe shortage the setup fee has gone up quite a lot.


Using them for production for years, never dissapointed.

What you should be aware of is their new exploration of s3 storage. I mean, the s3 works and everything but it's still too eaely - the servers are kind of slow and sometimes fail to upload/download. They are still tuning out the storage architecture. The api key management is kind of too primitive (although much more headache free than configuring aws), and the online file browser is lacking

But for vps servers - they are battletested veterans


No.


DNS literally would not work if they did that.


I can only comment about the one I work for, but yes. It's also discussed publicly to some degree.

https://cloud.google.com/blog/products/storage-data-transfer...


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: