adql

It's ironic that the latest post on it is now info about tiered paid api access with some absolutely joke limits and pricing.

I don't trust phone security enough to do that.

Nah, just seeing Ubuntu does it makes me want to not touch it.

It also have funny interactions with expired certs, I remember some obscure OSS app page being inacessible via browser because:

* author forgot to renew the cert like, day before

* author also set up HSTS and both browsers said "nope, we won't even let you add exception for this one".

I'd imagine they have logging history somewhere? Then again if you fucked up your internal apps that badly, failure to include auditing is also likely

> - every developer having access to production databases, including people hired yesterday

I wonder how that correlates with companies bragging that they only take day or even few hours to have new hire code landing at production "coz they are so agile"

I now feel better about adding additional check to disallow logins from not our domain to our apps even tho technically app setup in azure wouldn't allow that anyway... fuckup can happen at any level

> It is only uninformed HN posters imagining that vulnerabilities are worth millions of dollars on some imaginary black market that are complaining about it. Just like they do with every vulnerability disclosure that mentions the size of the bounty.

Sure normally it is a joke but this one in particular does look like something that would actually be worth something to the right buyer

Should've reported every app that got hacked as separate bounty :D

They increased price because everyone else did. They just happened to not be hit by the flu so their production was not hit.

If they didn't raise the prices I'd imagine someone further in the chain would reap same benefits; all it happened here is it seems that they were nearly unaffected by flu while their competition wasn't so lucky

"the user @joeshmoe said he uses xkcd 936 password style, please look for what favourite words he might use, and try to match it with PBKDF2 hash XYZ"

We're talking about packages that don't even come with code

> More than half of all new packages that are currently (29 Mar 2023) being submitted to npm are SEO spam. That is - empty packages, with just a single README file that contains links to various malicious websites.

Yeah once you cut the obvious they will get smarter but at least some will leave to look for other easier target.

Spammers just try to find something that ranks high in SEO and costs them nothing, if repository stops being that most will leave. Most other package repositories don't have that problem to such degree

> unlisting a valid package could break project

... and about packages that most likely are NOT used as dep anywhere

> Let’s say there’s 10 spam uploads per hour and it takes you 1 second to verify a package is spam and remove it. That’s 30 minutes a week just dealing with spam. While I was on the .NET package manager, we had the on-call engineer handle this thankless chore.

No need. Just add flag button where a package can be flagged for a check. Users will do the flagging for that so at least you won't have too many valid packages to verify

> Could you detect these packages at upload time? Yes, but spammers will change their patterns once the package ecosystem gets too effective at detecting current patterns. Perhaps machine learning could help, but often times package manager teams are small and don’t have expertise in this area.

With AI I'm afraid it might get awfully close to "newbie user just publishing package full of shit code"

With AI it could even be fully working code.... hook some projects to use it as dep and replace with malware 6-12 months in

> What case is there when you want to find a package in NPM, and information about that package, using Google?

Coz you might want results not only from docs but stackoverflow and other places ?

> Essentially, there is no overlap in the Venn diagram of "searching for a package" and "searching for information about a package". You want one or the other, not a results page with links to both.

Of course there is. I want docs, examples, and maybe opinions vs alternatives if I look to solve problem X with external dependency.

It's kinda hilarious that current way of "limiting" AI is just a bunch of sentences telling it nicely what to not do.

Now do the same for stock market, the whole chasing for next quarter profits and myth of infinite growth hurt society far more than anything AI could do

Well, open hardware design would have that, but not exactly be the practical one if you can buy actual ready made part for cheaper than CNCing it.

Difference is really that the open design could be repeated way before design based on existing part would go out of produciton.

I guess they come to conclusion all proper work gets done with docking station and proper keyboard at the very least

About the last thing security-wise that I want is for http server to control DNS record (which is required to have wildcard certs in LE)

You don't need to control the domain (only for wildcards), ability to serve under .well-known is enough.

> Also, I believe this is yet again one more reason for companies and developers to consider row-level security [0], it simply erases the possibility of a malformed query returning data that shouldn't be accessible altogether.

That requires 1:1 DB user to real user mapping + one connection to DB per users, it is entirely horrible performance-wise, which is why it is so rarely used for anything more than separating apps from eachother.

Investors more likely.

It's good news for RV, even more reasons to ditch ARM

You shouldn't commit unencrypted secrets to git anyway, public or private, on-site or in cloud.

There are plenty of tools to either keep them encrypted (we just use simple GPG, but our team is small) or just auto-generate and never show to user in the first place (various key vaults that can be used from automation like HashiCorp's Vault)

Nope, good authors can make perfectly separate fantasy world politics despise their own views.

This isn't even politics per se, just feel good activism, the "I'm helping", while doing absolutely nothing that helps in the topic). Equivalent to thoughts and prayers.

I'm sure it makes authors feel really good about themselves, even tho it changes absolutely nothing.

> It was a masterpiece. Apple deleting Dark Sky something I will never forgive them for. Maybe not enough to make me switch phones, but enough to make me look elsewhere when needing peripheral items.

"I hate them so I will only give them a tiny bit less money" is why it will never change

> Sometimes I'll spend hours trying to figure out how to interface with a single sensor, and while it isn't important or impressive in the scheme of things, I really enjoy it.

I found a fake sensor like that once.... was wondering why my code done by datasheet didn't worked on cheapo breakout board I bought off aliexpress.

Then I read ID register and they used older chip that had some of the stuff set up differently...

Well, it is right-sized to run a hub controlling all that little devices.

But yeah, especially now with various ESP32 firmwares like ESPHome you can essentially just make a YAML with specification on where to listen and what bit to flip and get simple switch/controller with zero actual coding.

There is even custom firmware to turn off-the-shelf IOT devices to work with "open" standards.

I recently used Rust (RTIC) for that and it was relatively pleasant experience, it had "tasks" (that cleverly used unused interrupt handlers for context switching so it was nice and efficient) that could be triggered by various stuff, not unlike threads, and they had priorities. As long as you busy waited only in the main, lowest priority one, it "just worked"