Somebody (Mozilla?) should make a browser that just proactively blocks shit like this
I’m sure some Adblock addon could do it but at the browser level would be preferred. A browser vendor that just proactively does security and “correctness” tweaks to live sites would actually be in my interests as a user
> Shopify incorrectly formulated the very problem they are trying to solve.
That’s a bold overconfident statement. Cart abandonment is real. People never clear their carts they just walk away
Shopify purposefully chooses to do it at payment time because doing it earlier results in lost sales as people “reserve” items and then walk away causing other to see out of stock and then also walk away
Whoever puts up the money first gets the item
That’s the design constraint they chose you can’t just say “their solution is wrong because they solved the wrong problem”. Each design is a different user experience and I think it’s safe to say they chose which experience they want consciously.
that's why I mentioned active carts in my post, there are ways to define active cart to get rid of abandoned carts ( ignore carts where last user action was > N seconds ago).
Ok, let's accept the design goal that whoever paid first wins. You can use the same metric (how many milliseconds ago did user click PAY) and impose a global monotonic non-decreasing counter to distribute the scarce inventory. This is how order matching engines work at stock exchanges with HFT orders (FIFO logic).
the goal is to know with 100% certainty, before sending payment request to payment processor, who will have item and who won't, and you dont need to move mountains of rows for that.
the payment processor should be just a binary answer: payment succeeded or not, but currently it combines Inventory availability check & payment processing, which is the root cause of confusion. For clarity it is better to make that stage of order processing an explicit separage stage, instead of coupling it with payment stage.
some stores split payment into two stages: Payment and Final order confirmation. at the Payment stage you can pre-authorize money at cc and do inventory availability, and at final confirmation you capture $$
i dont know about the world, by authorize.net and Stripe, which work globally and work with global credit cards, they do support separate authorize and separate capture, which seems to be part of PCI standard
Looking at your solution, if i understand it, is instead of decreasing the inventory count for each sku as orders are processed, you are comparing the current warehouse quantity against the sum of all carts to see if there's availbale quantity.
You'll have to also include the sum of all completed orders so far.
Honestly seems almost worse? Arn't you trading contention on a single counter (inventory) for a large read across all pending and completed orders? Even indexed you're ingesting a ton more data? And you'll still need a lock here as you have to ensure two orders do this check at the same time.
Naive design
- Single inventory row per warehouse sku
- All orders compete on a lock for all inventory sku rows in their order to deduct/claim their items
Shopify design
- Unroll warehouse inventory to thousands of rows per sku
- Order processing races to find sufficient unlocked rows for all items in order
- If insufficient rows are found then orders block behind slower "restock" process that creates more rows
Your design
- Warehouse inventory row is static/read-only (restocking out of scope for now that's fine).
- Order processing computes the sum of all completed orders to ensure there is sufficient quantity
- This would have to be under a lock as well, otherwise two or more racing orders will think there is quantity left.
So sounds like in your solution, you still have a single point of contention for who is computing the sum of completed orders, and while holding that lock you are doing a sum of all completed orders for each sku in your order. That sounds... worse?
I think ultimately you still have to pay down tech debt eventually. Either through bankruptcy (throwaway the project) or servicing the debt (refactoring, rearchitecting etc).
It's not different than when coding by hand, often we take shortcuts by hand that we then have to pay for later. It really just becomes a judgement call on when to stop prompting new features and start service what you have.
I think with AI and vibecoding its tempting to assume the output is good and chase the dopamine hits of more features, more features, more features, but eventually you get stuck.
That being said AI is also a great tool at paying down tech debt. It's great at helping you read a codebase and can be great at making the mechanical changes you want. And I think there is some truth to the story that newer models will be able to pay down debt (fix the slop) of older models. But its all shades of grey, newer models are better than older ones, but can I emit slop with 5.6 faster than 5.7 will be able to fix it in the future? Nobody knows.
It's not like human projects are devoid of bad code, its all tradeoffs and shades of gray. But to be honest I haven't written a line of code by hand in a while.
Why Nix is great; you can run the IDE from within a Nix-managed dev environment and not have to teach the IDE about it. You can point a .desktop shortcut at it too.
Requires a different way of working with projects though, so understandable if that's not your thing.
don't you then have to keep your IDE config synced across them an open a whole instance for each project? Why even have an OS underneath it at this point?
Sometimes it feels like I'm just being asked to install a real linux distro inside my linux distro so I can actually do things. Here's you nice shiny desktop and app store! Oh you want to do more than browse the web? Better install linux again in a VM.
Maybe i'm just stuck in legacy paradigms, but I kind of like just booting IntelliJ and picking the project i'm on today.
Or sometimes I want to move stuff between projects i'm working on, that's a lot easier if my one IDE instance can hit them all at the same time.
But if the job requires the best intelligence you can get with an LLM, then you use that.
Taking as an assumption that the quality of your product is a function of the quality of the inference you are using: if you use an inferior model because "what if it gets export controlled again" and your competitors don't, then your competitors are likely to win.
If you don't need frontier models for you job then this is all moot, but the thread started with
> You cannot build a business critical function on top of American SOTA frontier model
Which is silly. HN likes to roleplay bringing everythgin "business critical" in house because sometimes vendors mess up. Self host, don't use the cloud, run open models locally, built redundant supply chains in case of another covid, etc etc. Sometimes the risk is real, but most of the time the risk is rare and the cost of an interruption event is less than the cost of bringing everything in house or using lower quality vendors "just in case"
Beats which model in Claude? Whenever a "benchmark" doesn't put precise model numbers in their headlines I am immediately skeptical. Either they don't know the difference (bad) or they are benchmarking against weaker models (misleading, also bad).
It's like when studies say "AI is bad at X" and they used GPT-3.5 in current year.
Opus 4.8 according to TFA. Whether or not the safety guardrails were responsible for the difference is an open question but for a dev who wants to secure their software who doesn’t work at one of the blessed Glasswing companies it doesn’t really matter why, it matters what the best tool you actually have is.
They do. Mythos kicked ass while it lasted. And what we know of the scaling law curves promises us even more gains in the future.
"The future" being "whenever training and inference at increased scale becomes economical". Which is probably bounded by new generations of hardware, but might also be pushed forward by algorithmic advances.
The likes of Mythos show that the scaling laws are real, and you can x5/x2 the total/active params and get meaningful gains. If "inference per param" gets cheaper? Up the params and get more intelligence for the same price.
The conspiracy version of this is each bad windows release is purposefully extra bad so the next "good" version is perceived as artifically well.
It's a shame too, I feel like the underlying OS has some really good engineering in it, but the layers of cruft and anti-features on top make for a poor overall product.
Yes, I have also read / heard that Windows is actually very well engineered at the low level (despite the claims), and even surpasses Linux in some aspects. For example, Windows handles low RAM situations much better than Linux. During swapping Linux can become so unresponsive that even the OOM killer can fail and the only solution is hard reboot :(. But all I see people claim about Linux's superior memory management, which I think is believed largely because of the memory overcommitment. It can reduce the average RAM consumption because Linux, by default, maps the allocated pages to a read-only zero filled shared page, and allocates actual memory only when page faults occur during page writes. But this can make the worst case scenario much worse when no physical RAM or swap space is available.
Windows 10 was not as good as Windows 7 for its time (and even now). After 8/8.1 things started to go downhill. Windows 7 was a really good polished OS with beautiful and consistent UI. Windows 10 UI looks like a Frankenstein, and MS fired a lot of QA folks, now the testing is primarily done on the insiders and regular users. Also these privacy / telemetry / ad problems started from Windows 10.
I agree, but I think a better wager (and what GP probably meant) would be that all of these developers had their certificates revoked because Apple thought they were distributing malware. That's what the system is for.
>Is financial fraud consistent with our national prestige?
You're right, that may be all we have left to show for it if people can't come up with something better.
Whether it's Musk or anybody else who's a real example of outright fraud, in a top position where honesty and straightforward dealing mean more than anything.
The original Moon mission was masterminded by a literal card-carrying ex-member of the Nazi party (Wernher von Braun) and the American public back then didn't seem to mind.
All rocketry was, back then. You wanted ballistic telemetry? If you didn't know someone who worked on the V-2, you had to launch your own sounding rockets.
I think the parent's point stands. There's a lot more pragmatic concern with the damage SpaceX could do in 2026, versus the damage Nazis could do in the 1960s.
I’m sure some Adblock addon could do it but at the browser level would be preferred. A browser vendor that just proactively does security and “correctness” tweaks to live sites would actually be in my interests as a user