howdydoo

Yeah, you're probably right. But a guy can dream, can't he?

https://archive.is/0Oihx

A random outsider couldn't do it obviously. But imagine if you had standing to sue, i.e. you signed up and paid for ZenDesk based on this advertising, and then later realized they were lying.

When a company lies in their advertising, typically you can take them to court and get relief.

If a car dealer advertises "free floormat with purchase", and they don't give you a floormat, you sue them. If it makes it all the way to the courtroom, it's an open-and-shut case.

Based on this advertising, I bet someone with the right lawyer could compel ZenDesk to release their source. In fact I hope this happens, then maybe companies will think twice before making false claims like this

Libreddit still works

https://libredd.it/

They should also get a royalty on cameras, because someone might take a photo of copyrighted cover art. Oh, and also a royalty on pens and paper, because someone might use them to write down copyrighted lyrics

I use youtube-dl to download Cracking the Cryptic videos. The RIAA does not own those videos. In fact there are quite a few videos on youtube the RIAA doesn't own.

I haven't heard any, but I haven't gone looking either. I'm just saying there's at least literally one reason to use webpack for new code.

> literally zero reasons

What about module federation? Has any other bundler implemented that?

I think the difference is the rent-seeking.

Imagine a web developer gets hired to build a landing page for a product. Yes please, charge twice as much for your work, sure. But say they tried to charge an ongoing 30% of all future revenue for that product. Do you think HN would be behind that?

And a tilt sensor that cuts power if the chasis is moved

When can we expect a browser extension that restores the original titles? :)

Socks are in fact immutable infrastructure. When your EC2 instance crashes, you shut it down and provision a new one. When your socks get holes, you throw them out and buy new ones. This isn't 2010 anymore, you really think people debug their servers and mend their socks?

> My project will still get 1.0.2, so it will still have the security hole.

Right. To mitigate that you would regularly run `npm audit` or even just `npm upgrade` – and test afterwards of course.

I'm not completely sold, but I do think it's a very interesting idea.

> Can I ask for a warning if I'm getting two different versions linked into the same binary?

Yes. That was the lint I linked in my last post. Alternatively, you can run `cargo tree --duplicates`.

> "I really, really don't think think you should be using 1.0 any more"

That's called "yanking". Personally I think it has limited usefulness, but it exists.

https://doc.rust-lang.org/cargo/commands/cargo-yank.html

> And what happens if both versions get pulled in, but the package in question uses an external data file whose format changed between 1.0 and 1.1?

If it uses something like `include!`, both copies will be compiled in (and maybe optimized later by the linker). If it's truly "external" like hosted on some website outside the package manager, then it just means the author broke their package. Maybe I misunderstood your question.

> one of my dependencies constructs a foo using X 1.0, is that value of a different type than a foo constructed by X 1.1?

I believe they are always different types. Cargo encourages but doesn't enforce semver, so anything can change between versions, including private fields or enum variants behind non_exhaustive, etc. So they're treated as different and you need to convert between them. Although this might only be true for major versions; I don't know off the top of my head.

To work around it you can convert the types at crate boundaries, or the package author can use the so-called "semver trick" [1]

[1]: https://github.com/dtolnay/semver-trick

Web of trust just means "If A trusts B, and B trusts C, then A trusts C." Nothing to do with distributed databases/ledgers.

Read it again. Any one dependency, or the root project, has the power to pull in the latest version. One laggard dependency does not stop that.

For your second question, yes, Rust handles that well. If you depend on ">=1.0" and ">=1.1", you end up with a single copy of 1.1. If you depend on "=1.0" and "=1.1", you end up with both copies of the library. Every crate uses the version it requested. You can argue whether that's good or bad, but at least it's principled. There's a lint if you dislike that behavior.

https://rust-lang.github.io/rust-clippy/master/#multiple_cra...

Let's say you have two dependencies each requesting colors:

colors@1.0.1-1.0.3

colors@1.0.1-1.0.4

With npm, you'll end up with 1.0.3 because it satisfies all constraints. OP wants to end up with 1.0.4 if at least one dependency tested with 1.0.4 (and reject 1.0.5). I don't know of a way to do this with npm today.

A blockchain isn't needed for that. Authentication needs "crypto"graphy, but not "crypto"currency.

This wouldn't be a complete thread without someone mentioning Rust, so I'll do it. cargo-crev is a nice web-of-trust type code review system for Rust crates. https://github.com/crev-dev/cargo-crev

Summary:

The author argues that version bounds should be treated as a maximum rather than a minimum, like Go does. e.g., if the latest version of colors is 1.0.3, and you have dependencies that request 1.0.1 and 1.0.2, you would end up with 1.0.2. The end result being, the exact resolved version will have been tested with at least one of your dependencies.

I must admit I like the idea.

AIUI, old cars are usually grandfathered in to these laws based on the model year. So cars manufactured before 1965 don't have to be retrofitted with seatbelts. And your Model T doesn't have to meet modern emission standards.

On emissions, a quick google gives me this:

> most states provide some type of exemption specific to older cars.

https://www.hagerty.com/media/archived/emissions-and-your-co...

But classic cars are not a big interest of mine so I don't know the details.

[2] says:

> illicit transactions making up less than 0.5% of Bitcoin’s yearly volume in 2020

No adding required.

[1] throws a lot of numbers including/excluding different categories of drugs/etc. You can squabble about 7% or 12%, but the point is it's an order of magnitude higher than 0.5%.

Are you suggesting that healthcare-as-a-market would start working if externalities were priced in? How would that help?

12% of the USA's economy is illegal activity. [1]

0.5% of Bitcoin's volume is illegal activity. [2]

When will this crime meme finally die?

[1]: https://www.investopedia.com/articles/markets/032916/how-big...

[2]: https://ciphertrace.com/2020-year-end-cryptocurrency-crime-a...

We'll hold off on our bitcoins if you hold off on your football stadiums and christmas lights. Deal?

Who cares if people "scoff"? The point of a tax is not to affect someone's emotions. The point of a tax is to affect their behavior and collect their money. If that tax affects their planning and finances (aka they recognize it as a cost of doing business), then you achieved your goal.

Big difference: the government did not outlaw the Model T. Instead better cars were introduced and people switched voluntarily.

You've made a giant gaffe.

In 2021, DDG handled 35 billion searches. Google first reached that level in 2002 (if this source[1] is accurate).

I have no conclusion, just thought it was an interesting stat to look up.

[1]: https://www.internetlivestats.com/google-search-statistics/

If you really want to know, the answer is right at the top of the article. I won't do your homework for you. Maybe someone else will.

Auto-banning an account is a violation of GDPR Article 22

https://gdpr-info.eu/art-22-gdpr/

> The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

Quote this and maybe it will get you escalated, but who knows? A lot of companies seem to just ignore GDPR entirely.

Then what do you do when Slack bans your account?