Everything that is wrong about bullshit webpages that are SoMe optimized: I could not zoom because eyeballs so I couldn't see what was in the image.
But daaaaamn. I could see that footer all the time. Lucky I was not able to zoom.
675 karma · joined August 3, 2011
But daaaaamn. I could see that footer all the time. Lucky I was not able to zoom.
Whataboutism. Relative comparisons don't address absolute risk. I checked three random packages: prism pulls 22, remark pulls 51, pixijs 179! So that's 250+ transitive dependencies just from those.
> Features like Bases and Canvas were implemented from scratch instead of importing off-the-shelf libraries. This gives us full control over what runs in Obsidian.
Full control? There are still hundreds of dependencies.
> This approach keeps our dependency graph shallow with few sub-dependencies. A smaller surface area lowers the chance of a malicious update slipping through.
Really? Again, this is just one package: https://npmgraph.js.org/?q=pixijs
> The other packages help us build the app and never ship to users, e.g. esbuild or eslint.
Build tools like esbuild don't ship to users, but a compromised build tool can still inject malicious code during compilation. This is supply chain security 101.
> All dependencies are strictly version-pinned and committed with a lockfile
Version pinning is, I would hope, standard practice in any professional development team years and years ago. It prevents accidental updates but doesn't stop compromised existing versions.
> When we do dependency updates, we: > [snip]
While these practices are better than nothing, they don't fundamentally address the core issue.
> That gap acts as an early-warning window: the community and security researchers often detect malicious versions quickly
According to whom? Heartbleed, a vulnerability in a package with far more scrutiny than a typical npm module took what, 2 years to be found? The "community detection" assumption is flawed.
I'm not trying to put Obsidian down here - I sympathize, aside from implementing everything themselves, what can they do! I'm trying to point out that while their intent is good, this is a serious problem and their solution is not a solution.
Of course, it's the same in any project with dependencies. It's the same in other languages as well - if they have a convenient package manager. Like Rust and Cargo.
This problem came with the convenience of package managers and it should be fixed there, not by every application like Obsidian. I'm not sure how but maybe once a package is starting to become popular, additional security measures must be put in place for the author to be able to continue to commit to it. Signing requirements, reproducible builds, 2fa, community reputation systems, who knows.
Individual applications can't solve supply chain security through wishful thinking and version pinning.
Package managers need to solve this at the infrastructure level through measures like mandatory code signing, automated security auditing, dependency isolation, or similar system level approaches.
Obsidian's practices are reasonable given the current tooling limitations, but they don't eliminate the fundamental risks that the package managers bring to modern dependency ecosystems.
Sway, exwm etc are for power users.
If you aren't in that category, you may not like it or may find it to be not worth the time investment in.
10/10 gatekeeping buddy.
No one ever closes emacs.
What? She shut down nuclear power plants to ramp up coal and Russian dependence.
Idolizing people is rarely helpful.
In what world? Some small percentage up or who knows, and _that_ revolutionized art? Not a few years ago, but now, this.
Wow.
And they wrote their comment using Chrome or some skin. Which they have used for a decade. Because the button on the left seemed off on Firefox compared to Chrome (always something). So fuck Firefox.
On hacker news.
Crazy.
(4 got just minor damages, miraculously)
1: https://www.theguardian.com/world/2024/oct/29/tram-derails-a...
I can model a spacecraft that will take me to Alpha Centauri with "questionable" untested dynamics in Maya. But I am pretty far off from building it and sending it into interstellar space.
Pretty (and imaginitive) drawings though.
iD software would never have become anything of note, of course. Obsessing over his emacs config, but missing C, and so becoming the master of the C core. We would probably never have heard of anything like "long lines mode".
Growing up with the iD games, I am not so sure what I would prefer anymore. Actually I think I would have preferred the latter. Which is almost sad. A wild testament to emacs, to be sure.
(yes I know these posts predate it)
Bravo!
https://github.com/zachcurry/emacs-anywhere https://github.com/cknadler/vim-anywhere
The board should be responsible. You don't get to make $200m a year and just brush hundreds of lives off as a whoops.
Sometimes on another computer I would think "what was that URL again..?" and just SSH into that computer and execute the command.
[1]: https://github.com/bergheim/dotfiles/blob/a525b216c7404a4332...
and if so, how big is your luggage? :)
It was slow, things didn't work, and weird. I totally understand that people would use gnome or kde and call it a day, because it is much easier to get going with. But if you think you should invest time into your interface I would say try other things as well.
Still lots of other good things from the kde project though!
One of my best memories growing up. RIP.
Emacs did not invent the mouse cursor interface.
> It was “bloated and slow”.
This comes from not understanding how emacs works. Yes, it has games, no, it is not loaded until you load it. It means nothing, it does not mean bloat.
> I think we’re just missing each other here. The best features of eMacs spread to other editors.
I think we might - it's Emacs not eMacs.
> As for the scenario, I don’t see that as a hellish situation. I’ve been using vim for a while. Im actually ok at it.
Great! I love vim. In fact I used it for 15 years before switching. I would not be using emacs as my everything if evil-mode was not a thing.
> Do I regret learning it? Hell yeah. Lol. But at least I got vim mode to soothe the wound a little
Sometimes I think the same thing.. Everytime there is no vi mode I get annoyed. I try to be open to new software, but cua-mode (or default emacs keys) is not it for me.
Imagine spending 8 hours a day for the rest of your life and you still want a cursor based popup telling you what you might or might not want to do instead of having muscle memory of what you do.