SUCCESS = 0
  TOO_FAR_LEFT = 2
  TOO_SLOW_OR_TOO_LOW = 4
  TOO_FAST_OR_TOO_HIGH = 8
  MIN_ALTITUDE = 100
  MAX_ALTITUDE = 300
  MIN_SPEED = 200
  MAX_SPEED = 400
  MIN_SPEED_200_RANGE = 238
  MAX_SPEED_300_RANGE = 338
  MAX_HEADING_RIGHT = 8

  def landing_skill_check(
    altitude: int,
    speed: int,
    heading: int) -> int:

    if altitude < MIN_ALTITUDE:
        return TOO_SLOW_OR_TOO_LOW
    if altitude >= MAX_ALTITUDE:
        return TOO_FAST_OR_TOO_HIGH
    if speed < MIN_SPEED:
        return TOO_SLOW_OR_TOO_LOW
    if speed >= MAX_SPEED:
        return TOO_FAST_OR_TOO_HIGH
    if speed < 300:
        if speed < MIN_SPEED_200_RANGE:
            return TOO_SLOW_OR_TOO_LOW
    else:
        if speed >= MAX_SPEED_300_RANGE:
            return TOO_FAST_OR_TOO_HIGH
    if heading < 0:
        return TOO_FAR_LEFT
    if heading >= MAX_HEADING_RIGHT:
        return TOO_SLOW_OR_TOO_LOW

    return SUCCESS

Whereas with Python, even in the latest version, you're already looking at atleast 10x the amount of startup latency in practice.

Note: This is excluding the actual time that is made for the network call, which can of course also add quiete some milliseconds, depending on how far on planet earth your destination is.

This is not the case for most monoliths, unless they are structured into LLM-friendly components that resemble patterns the models have seen millions of times in their training data, such as React components.

In contrast, a poorly designed microservice can be replaced much more easily. You can identify the worst-performing and most problematic microservices and replace them selectively.

That's exactly my experience. While a well-structured monolith is a good idea in theory, and I'm sure such examples exist in practice, that has never been the case in any of my jobs. Friends working at other companies report similar experiences.

This is the equivalent of giving an author of a website remote code execution (RCE) on your computer.

I get the idea that you can download the script first and carefully read it, but I think that 99% of people won't.

Why trust un-signatured files hosted on a single source of truth? It isn't the 90s anymore.

    $ curl ${flags} https://site.io/install.sh | sh

    $ curl ${flags} https://site.io/tool > ./tool
    $ chmod u+x ./tool
    $ ./tool

Also, a lot of those install scripts do check signatures of the binaries they host. And if you’re concerned that someone could have owned the webserver it’s hosted on, then they can just as easily replace the public key used for verification in the written instructions on the website.

    pacman -Sy {tool}
    pkg_add {tool}
    apt install {tool}

Like apt, dnf, and others.

The default is more than a single source.

The issue is provenance. Where is the script getting the binary from? Who built that binary? How do we know that binary wasn't tampered with? I'll lay odds the install script isn't doing any kind of GPG/PGP signature check. It's probably not even doing a checksum check.

I'm prepared to trust an executable built by certain organisations and persons, provided I can trace a chain of trust from what I get back to them.

You see this in all the obvious examples of physical security.

In the case of software it's the installation that's the ritual I guess. Complete trust must be conferred in the software itself by definition, so people just feel better knowing for near certain that the software installed is indeed 'the software itself'.

The issue is not the specific form in which code is executed on your machine, but rather who is allowed by you to run code on your computer.

I don't trust arbitrary websites from the Internet, especially when they are not cryptographically protected against malicious tampering.

However, I do trust, for instance, the Debian maintainers, as I believe they have thoroughly vetted and tested the executables they distribute, with a cryptographic signature, to millions of users worldwide.

You have to go out of your way to make something like that run in an fhs env. By that point, you've had enough time to think, even with ADHD.

For the most part, installing packaged software simply extracts an archive to the filesystem, and you can uninstall using the standard method (apt remove, uv tool remove, ...).

Scripts are way less standardized. In this case it's not an argument about security, but about convenience and not messing up your system.

Sometimes you see curl -sSLfO. Please, use the long form. It makes life easier for everybody. It makes it easier to verify, and to look up. Finding --silent in curl's docs is easier than reading through every occurrence of -s.

   curl --silent --show-error --location --fail --remote name https://example.com/script.sh

> for-docs "ls -lrth /mnt/data"

ls -l --reverse -t --human-readable -- /mnt/data

(I'd put in an option to put the options alphabetically too)

Kind of like positing a master `dry-run` command as opposed to different commands implementing `--dry-run` arguments.

I did something like this:

  _command="sed" _option="n"
  man -- "${_command}" | sed --quiet --expression  "s/^       -${_option}.*, //p"

Dumb trick: Search prefixed with 2 spaces.

  man curl
  /  -s

The shorthands are for when typing it at a console and the long form versions should be used in scripts.

also, putting it out long-form you might catch some things you do out of habit, rather than what's necessary for the job.

EDIT:

> Due to this incredible demand, we've hit our current budget limit and need to temporarily pause the service.

There you go.

[1] Various HN posts regarding Hetzner vs AWS in terms of costs and perf.

3x EX44 running Patroni + PostgreSQL would give you 64GB of working memory, at least 512 GB NVMe of dataset (configurable with more for a one-time fee) at HA + 1 maintenance node. Practically speaking, that would have carried the first 5 - 10 years of production at the company I work at with ease, for 120 Euros hardware cost/month + a decent sysadmin.

I also know quite a few companies who toss 3-4x 20k - 30k at DELL every few years to get a database cluster on-prem so that database performance ceases to be a problem (unless the application has bad queries).

I want to like Hetzner but the bureaucratic paper process of interacting with them and continuing to interact with them is just... awful.

Not that the other clouds don't also have their own insane bureaucracies so I guess it's a wash.

I'm just saying, I want a provider that leaves me alone and lets me just throw money at them to do so.

Otherwise, I think I'd rather simply deploy my own oversized server in a colo even with the insanely overpriced hardware prices currently.

edit: And shortly after writing this comment I see: "Microsoft won't let me pay a $24 bill, blocking thousands in Azure spending" https://news.ycombinator.com/item?id=46124930

Compare that with AWS, where login is slow and unreliable (anyone else got an error message after every login and has to refresh to get in?), the website is a giant mess collapsing under its own weight, and slow like it's still running websphere.

Over the last 10 years, I've certainly lost way more time working through aws paperless bureaucracy than complying with Hetzner paper bureaucracy. And I'm not even using aws for that long.

But basically after the initial paperwork I had some issues with my account getting flagged even though I wasn't using it 99.999% of the time. It's not a huge deal for me because I wasn't trying them out for anything serious. I just questioned how often that might happen if I was actually using it seriously and what kind of headaches it could cause me while re-verifying everything with them.

From people I know if everything is going good then their service is great. Server performance is good, pricing is good, etc.

I had more trouble onboarding AWS SES, with a process that felt more like me begging. With which I said fuck it and went with self hosting ever since (on a bare metal server no less)

I remember a time in France for instance, about 15years ago, it was mandatory to provide your ID when bying a mere prepaid sim card. No seller would actually check, and a coworker of mine who used to work for one of the largest french telcos at the time told me that once they ran some stats over the customer database and noticed that most names where from popular comics and TV show. They laughted and moved on. These days, the seller would at least ask for some ID.

aka circling the cattle.

Then the bureaucracy you mention which is just a reflection how they work internally as well.

That’s been my experience with Hetzner.

A lot of people get butthurt that a business dares to verify who they’re dealing with as to filter out the worst of the worst (budget providers always attract those), but as long as you don’t mind the reasonable requirement to verify your ID/passport they’re hands-off beyond that.

I guess my concern on the bureaucracy is if you are unlucky enough to get flagged as a false positive it can be an annoying experience. And I can't really blame them too hard for having to operate that way in an environment of bad actors.

You're definitely right that the budget providers do attract the types of people trying to do bad things/exploit them in some way.

Firstly, FreeBSD already supports x86 Mac Minis. Servers? M-series Minis and Studios are very good servers. Lastly, FreeBSD has an Apple Silicon port which has stalled.

https://wiki.freebsd.org/AppleSilicon

I'll ignore your last point.

Impatience and lost skills is why it’s not a mainstream player.