Xe Iaso

I joined Vlang GitHub organisation after I was invited. I was aware of the "V for Vaporware" articles [1] that already existed, but at that point they were more than a year old, so things had probably changed. It didn't take long for me to disagree with the way things were moderated, with many negative responses by the moderators to the people with criticism (often valid). I'm talking about moderators calling people "idiots" in the general publicly available chat.

I loved the idea of simplicity, autofree, the UI framework, the browser, Volt app, GitHub alternative, operating system and so much more. But it just didn't seem to go anywhere. The syntax however was simple, I really admired it and by 0.3 they would have a syntax freeze, but I do see that some major syntax has changed after 0.3 multiple times. I left the same day another developer did, and having talked with multiple V developers shortly after, four of them said they agreed to my criticism about moderation and broken promises. Alex (the creator) wrote to me personally, but denied all the criticism which was mentioned in the "V for Vaporware" articles.

In the moderator channel Alex mentioned that autofree wouldn't be delivered in 0.3 and this became my main criticism in the DMs. He could not see why I found it important to notify the community about this, while also telling me to "grow up" for not supporting offensive language, referencing some of the ways Linus Torvalds has written responses.

Shortly thereafter…

> If the site really was static before, and no JS was needed

One does not imply the other. This forum is one example. (Or rather, hn.js is entirely optional.)

> Another great solution? Just ask users to login (no js needed). I'll stand pretty firmly behind "If you aren't willing to make an account - you don't actually care about the site".

Accounts don't make sense for all websites. Self-hosted git repositories are one common case where I now have to wait seconds for my phone to burn through enough sha256 to see a readme - but surely you don't want to gate that behind a login either...

> My take is that search engines and sites generating revenue through ads are the most impacted. I just don't have all that much sympathy for either.

...and hobbyist services. If we're sticking with Anubis as an example, consider the author's motivation for developing it:

> A majority of the AI scrapers are not well-behaved, and they will ignore your robots.txt, ignore your User-Agent blocks, and ignore your X-Robots-Tag headers. They will scrape your site until it falls over, and then they will scrape it some more. They will click every link on every link on every link viewing the same pages over and over and over and over. Some of them will even click on the same link multiple times in the same second. It's madness and unsustainable.

https://xeiaso.net/blog/2025/anubis/

> Functionally - I think trying to draw a distinction between accessing a site directly and using a tool like…

> It can lock down free and open computing and this is far greater than the threat by trojans that I didn't have in the last 20 years.

I see this claim made over and over, yet we are still to see an actual "act of aggression" (modulo incompetence of an individual vendor - slip ups happen[0]). Every single PC system I ever heard of, allows either enrolling your own keys, or just disabling secure boot; most accept the MS-signed bootloader shim found in common desktop distros; I think this is even mandated in MS' specification that it must be possible for the users to bypass this.

If you haven't had a trojan in the last 20 years, you have been diligent and/or lucky. Scattershot malware (cryptolockers, miners) is incredibly common, one of our customers was hit several times (on systems we weren't managing). More sophisticated attacks are an everyday thing against high-value targets[1][2]. Exploiting computer (in)security is a multi-billion dollar business, platforms far more locked down than PC are being routinely targeted and exploited. Real people, fighting for IRL freedom - journalists, activists, opposition politicians - are in danger.

Please stop spreading the FUD against secure boot, and please back your claims with facts.

[0]: https://mjg59.dreamwidth.org/59931.html https://news.ycombinator.com/item?id=32023868

[1]: https://techcrunch.com/2023/01/14/circleci-hackers-stole-customer-source-code/

[2]: https://xeiaso.net/blog/spearphishing

As far as I heard the V programming language is largely considered to be Vaporware (see eg. https://xeiaso.net/blog/vlang-update-2020-06-17, and other articles by Xe).

I agree that I (in theory) quite like some of the design decisions, but as far as I know nothing of this actually works in practice. Like, it's not even close to being production ready, and people are seriously doubting whether the language will ever even come close to being a viable option.

I'm not up to date on all of the issues (in the code or in the community), but the last thing I heard is that the developers of V are still working on the "auto-free" memory management model (which is supposed to infer when 'free' needs to be called), but it's not working (and afaik proven to be undecidable in general).

Edit: Another reason why I'd be rather skeptical of this language is the claims it makes on the 'Compare' page: https://vlang.io/compare

It starts off stating that "V was created because none of the existing languages had all of the following features:" and then goes and lists an incredibly ambitious list of features, which essentially amount to "As safe as Rust, but Go's simplicity and fast-compilation time, and a small compiler with zero dependencies", and more. These are hard problems, especially if you're also working on developing an experimental memory management technique.

There seems to be some speculation that this is credit card details being hacked. Firing your _entire_ security team sounds like the sort of action taken if basic security practices are not being done. Until we know more, hold out on hiring these people.

Xe has commented on this and is suggesting to simply enable 2FA to deal with security concerns [1], as apparently a more measured response to security issues at Patreon. This seems to be more self-serving advice rather than good advice [2], the better suggestion would be to simply move to one of the many alternatives.

The assumption is that the login system is somehow insecure, instead of the bank details themselves being stored insecurely. (Hypothetically) If you suffered a large leak of payment details, when payment processing is your _main_ income revenue, and you find out your security team of X people at probably $100k+ a year for N years have done nothing to secure payment details, you too may fire them on the spot.

Until Patreon explain why they fired their _entire_ security team, the best advice is to remove your card details immediately. You can always add it back at a later date, or use an alternative payment processor.

[1] https://xeiaso.net/blog/patreon-happening

[2] https://www.patreon.com/cadey

(Edit: As pointed out, Xe didn't mention credit card details.)

https://xeiaso.net/blog/2025/anubis/ links to https://pod.geraspora.de/posts/17342163 which says:

> If you try to rate-limit them, they'll just switch to other IPs all the time. If you try to block them by User Agent string, they'll just switch to a non-bot UA string (no, really). This is literally a DDoS on the entire internet.

My gut is that the switch between IP addresses can't be that hard to follow. That the access pattern it pretty obvious to follow across identities.

But it would be non trivial, it would entail crafting new systems and doing new work per request (when traffic starts to be elevated, as a first gate).

Just making the client run through some math gauntlet is an obvious win that aggressors probably can't break. But I still think there's probably some really good hanging fruit for identifying and rate limiting even these somewhat rather more annoying traffic patterns, that the behavior itself leaves a figure print that can't be hidden and which can absolutely be rate limited. And I'd like to see that area explored.

Edit: oh heck yes, new submission with 1.7tb logs of what AI crawlers do. Now we can machine learn some better rate limiting techniques! https://news.ycombinator.com/item?id=44450352 https://huggingface.co/datasets/lee101/webfiddle-internet-raw-cache-dataset