benregenspan

This seems like a really good example of Base CVSS scores not telling us much on their own.

For the Wordpress RCE (nominally CVSS 9.2), it looks like many standard deployments of WordPress would be affected, barring extra mitigations. But in the case of these Hugo ones (9.3), it looks like very specific circumstances (anti-mitigations, if you will) are needed. E.g. running arbitrary builds of untrusted user content without a sandbox; running it in a GitHub workflow against PRs from untrusted contributors, etc.

Parler was "ripped off the Internet" because it was delisted from app stores and dropped by AWS for violating their ToS due to having (If I remember correctly) approximately zero content moderation, which is not really compatible with the mainstream distribution model they wanted. The owners were not subjected to sanctions by a foreign government.

That part seems to qualify as an unsolved problem. But could anyone have taken the scanned data (or the GIF file) and used it to open a bank account in your friend's name? That seems like the main issue that is genuinely solved by correct implementation of this type of system.

Private entities get to use whatever name they want. In this case, there is the option to use the longstanding name that matches the one used by the other neighboring territory. Or to have a wait period after the name is changed unilaterally by executive order, because it'd be silly to change it back and forth. Or to put "a.k.a..." after it. Or to wait for the relevant government to update its own map and geographic names database first (https://edits.nationalmap.gov/apps/gaz-domestic/public/searc... is not yet updated as of now). Or to wait until local signage can be updated so it mostly matches the map (though I don't think Rochester will be in a rush to do this).

Being overly trained on comments in documentation could be one of the reasons why Claude models write frustrating comments (which often manifest as written justifications of how the code satisfies the prompt). A comment in a tutorial is going to be geared to explaining how the code relates back to the tutorial task or restating what the code does, rather than documenting the "why" of surprising code.

> Ben-Gvir is loathed by 90% of Israeli society...Trump still has 33% approval

Maybe that 90% number is for Tel Aviv. In national polls, they both have roughly the same approval rating.

I am not a lawyer, but this seems unlikely. Federal law prohibits "false advertisement" which is understood to include misleading advertisements. Regulators can and do restrict certain types of commercial speech, and this kind of restriction has survived First Amendment challenge.

> So if Elon decided to sell all his shares today (and likely destroy his companies in the process), he'd shoot to the top of the list? What's the point in that

It looks like the methodology involves subtracting the founder's entire net worth, so selling the shares would leave him in the same place.

There is a whole area of research on this. Prosecutors have significant discretion around charging and (suggested) sentence, and this allows bias to creep in. I've heard people debate the quality of specific research on the size of the bias, but not the mere idea that bias is possible at all.

I'd love for Google to figure out something comparable for the Drive API (currently it's not possible to grant read/write access to a single folder; you need to grant access to the entire drive!): https://issuetracker.google.com/issues/36760598?pli=1

I think the fact that the above issue has been open for a very long time is one indication of how difficult and sensitive this type of access control API is. The Google Drive API could be a proving ground for getting the UX right for this (including tricky details like how to manage persistent access to a folder with clear disclosure and user controls).

Well FWIW, all of my attempts to short have generated losses.

Is the "Jia Tan" XZ Utils compromise not a good example? That relied on code snuck into a release that was not in source.

(It was caught before being promoted into a stable Debian release, yes, but this sort of relied on a happy accident, too close for comfort)

The first octet of the IP it resolves to is "192", maybe someone implemented the check for private/internal range wrong and is only looking for that.

What I'm wondering is if this requires sending the full list of extensions straight to a server (as opposed to a more privacy-protecting approach like generating some type of hash clientside)?

Based on their privacy policy, it looks like Sift (major anti-fraud vendor) collects only "number of plugins" and "plugins hash". No one can accuse them of collecting the plugins for some dual-use purpose beyond fingerprinting, but LinkedIn has opened themselves up to this based on the specific implementation details described.

I think the point is that some of the extra words OP is complaining about aren't needless. It's on the writer to know their audience, but it's also asking a lot to tune a message in a PR review to the one particular person who demands bluntness, especially if they don't know that person well. If the majority of people in the organization respond positively to a certain style (which may involve some amount of phatic speech), then the person who is "over-writing" here is probably making a good decision.

Once I build rapport with someone, I tend to be more blunt, but still balance that with the fact that other people may be reading the interaction, and I don't want to model a rude communication style.

An organization can choose to promote a very direct approach to feedback (Bridgewater is famous for this), but it requires top-down work to get everyone on the same page, not just expecting one developer to mind-read another.

It seems like the goal of the default configuration is preventing script injection while being otherwise very permissive. Basically, "safer than innerHTML, even when used very lazily". But I would expect guidance to evolve saying that it almost never makes sense to use the default and instead to specify a configuration that makes contextual sense for a given field.

The default might be suitable for something like an internal blog where you want to allow people to sometimes go crazy with `<style>` tags etc, just not inject scripts, but I would expect it to almost always make sense to define a specific allowed tag and attribute list, as is usually done with the userland predecessors to this API.

This is what I'd say about someone who sold their extension today, but I don't think this business model was nearly as well-known 15 years ago.

> being the type of slurry that pre-AI was easily avoided by staying off of LinkedIn

This is why I'm rarely fully confident when judging whether or not something was written by AI. The "It's not this. It's that" pattern is not an emergent property of LLM writing, it's straight from the training data.

It's mystifying. A relative showed me a heavily AI-generated video claiming a Tesla wheelchair was coming (self-driving of course, with a sub-$800 price tag). I tried to Google it to quickly debunk and got an AI Overview confidently stating it was a real thing. The source it linked to: that same YouTube video!

I think they meant it has much larger % share of pickup market in Europe vs US, not necessarily higher absolute number of sales (https://media.ford.com/content/fordmedia/feu/en/news/2025/02...)

For anyone who takes doing their taxes seriously, this is a nightmare. Every pint ordered involves a capital gain (or loss) for the buyer. At a certain point you're doing enough accounting that you might as well be running the bar yourself (or just paying in cash)!

> Pop-ups are back, and they’re worse than ever

The article opens with a screenshot of genuine pop-ups, and they are clearly so much worse than the (still annoying) modals presented later in the article. In the past, sites spawned a mess of popups that extended out of the browser window and persisted even when the page was navigated away from. Now if you don't like what the page is doing, you can at least just navigate away.

Because the natural order of things is wild shih tzus hunting down cows?

It seems like their pet food business (where they were competing with input-intensive meat products) could genuinely have been sustainable, if they hadn't taken so much time to figure out that competing on livestock feed is hopeless.

They might be the "wrong" oil companies. (In the case of Empire Wind, the administration is probably at best indifferent about screwing over the Norwegian state oil company.)

Having seen similar patterns play out at other companies, I'm curious about the organizational dynamics involved. Was there a larger dev team at the time you adopted microservices? Was there thinking involved like "we have 10 teams, each of which will have strong, ongoing ownership of ~14 services"?

Because from my perspective that's where microservices can especially break down: attrition or layoffs resulting in service ownership needing to be consolidated between fewer teams, which now spend an unforeseen amount of their time on per-service maintenance overhead. (For example, updating your runtime across all services becomes a massive chore, one that is doable when each team owns a certain number of services, but a morale-killer as soon as some threshold is crossed.)

How would this apply to, say, public libraries?

This is a good example, because a "freeway" is free at point of use, but obviously understood to not be free of construction and maintenance cost. It is called "freeway" because "free-to-drive-on highway" would be too wordy.

I wouldn't call using the most commonly accepted (and concise) terminology a "sales ploy". If you want every service to be accompanied by a wordy explanation of how it works, then every article would need to mention that the current status quo involves complicated taxpayer subsidy in the form of dependent care FSA accounts and a host of state-level programs.

"Need" is a strong word. But I think the point is that if you expect wildly spikey traffic/don't want the site to go down if it receives a very sudden influx of requests, going static is a very good answer, much cheaper than "serverless" or over-provisioning.