Hacker Newsnew | past | comments | ask | show | jobs | submit | netvarun's commentslogin

I think they refer to: IB - investment banking PE - private equity HF - hedge funds or High Frequency trading (?)


Tangent: Did Windsurf actually get acquired by OpenAI? I would have imagined some sort of announcement from OpenAI at the very least? Bloomberg was the one to break that news too, but haven't seen any follow up.


Does anyone have insight into Neon's financials - specifically their revenue, COGS, and gross margins? I'm trying to understand what made Databricks value them at $1B. Was it strong unit economics, rapid growth, or mostly strategic/tech value?



Dagger (https://dagger.io) recently seems to have reinvented/rebranded itself as some llm agent platform.


Oh no...this must have been recent. DevOps is hitting peak enshitification. I didn't have a plan B.


ah too bad! I wanted to use it!


@dang: The original URL (from Step Security, the company that discovered this flaw) is a better source for this:

https://www.stepsecurity.io/blog/harden-runner-detection-tj-...



Comments moved thither. Thanks!


Agree - that’s what we use too.


This looks cool - will give it a try (hah!) Curious on why you picked starlark instead of cel for the conditional scripting part?


All right, let me tell you the history of recur to explain this choice. :-)

I wrote the initial version in Python in 2023 and used simpleeval [1] for the condition expressions. The readme for simpleeval states:

> I've done the best I can with this library - but there's no warranty, no guarantee, nada. A lot of very clever people think the whole idea of trying to sandbox CPython is impossible. Read the code yourself, and use it at your own risk.

In early 2024, simpleeval had a vulnerability report that drove the point home [2]. I wanted to switch to a safer expression library in the rare event someone passed untrusted arguments to `--condition` and as a matter of craft. (I like simpleeval, but I think it should be used for expressions in trusted or semi-trusted environments.)

First, I evaluated cel-python [3]. I didn't adopt it over the binary dependency on PyYAML and concerns about maturity. I also wished to avoid drastically changing the condition language.

Next in line was python-starlark-go [4], which I had only used in a project that ultimately didn't need complex config. I had been interested in Starlark for a while. It was an attractive alternative to conventional software configuration. I saw an opportunity to really try it.

A switch to python-starlark-go would have made platform-independent zipapps I built with shiv [5] no longer an option. This was when I realized I might as well port recur to Go, use starlark-go natively, and get static binaries out of it. I could have gone with cel-go, but like I said, I was interested in Starlark and wanted to keep expressions similar to how they were with simpleeval.

[1] https://github.com/danthedeckie/simpleeval

[2] https://github.com/danthedeckie/simpleeval/issues/138

[3] https://github.com/cloud-custodian/cel-python

[4] https://github.com/caketop/python-starlark-go

[5] https://github.com/linkedin/shiv#gotchas


Wow that had been quite a journey - thanks for the detailed response. We’ve been using cel internally in a golang codebase and been pretty happy with it. I’ve only know about starlark in the Bazel context - I’ve learned a couple of things from your post. Thanks :)


There's not yet a Python implementation of Starlark (which, like Bazel, is a fork of Skylark FWIU)?

All that have tried to sandbox Python with Python have failed. E.g. RestrictedPython and RPython


No, there is no pure-Python Starlark. So far there are only Python bindings for the Go and the Rust implementation: https://github.com/laurentlb/awesome-starlark#getting-starte.... I thought about porting the Go implementation to Python. Doing it as a subgoal for porting recur seemed a little like scope creep. (Tokei says there are 16792 SLOC in the latest d4d7611 commit of starlark-go and 899 in recur 67b38c1.)


I believe Starlark was renamed Skylark, even internally. Bazel is a build system that uses Starlark as a configuration language, not a fork of Starlark.


Bazel is an open source rewrite of Blaze (which introduced Skylark)


Less a rewrite, more a variant: a majority of the source is common to both.


Congrats to the team. IIRC their CTO was the creator of RocksDB.


RocksDB is a fork of LevelDB created by Jeffrey Dean and Sanjay Ghemawat at Google.


LevelDB was like their hobby project and was built mostly for Chrome's Indexed DB. RocksDB brought it to a much higher level with a lot of dedication.


Very slick interface and implementation! This is why I love coming to HN!


Thank you!


Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: