jorams

> I rent their 20GB VRAM instance GEX44, for which they now ask a 500 euro one-time setup fee

Along with the increase in monthly prices they've dropped setup fees back to more approachable levels, though not as low as they were a year ago. For the GEX44 it was €79 a year ago, now €114. Monthly price was €184 a year ago, now €234.

Hetzner doesn't offer dedicated servers in the US. They operate two of their own data centers in Germany and one in Finland. In the US and Singapore they offer only cloud servers, running on hardware in others' datacenters.

Packages in the AUR have some number of maintainers. When a maintainer no longer wants to maintain the package they can disown it, and when all maintainers do so the package becomes orphaned. An orphaned package can then be adopted by any user.

At any time there's a large number of orphaned packages in the AUR, and the attacker(s) targeted those.

> Guess I'll be switching to a new OS this weekend across multiple machines.

This is a bit of an odd response. Arch very explicitly separates the AUR from everything else and doesn't make it easy to work with, because its security model has always been fundamentally broken and requires you to do your own vetting. It exists to facilitate sharing of package recipes between untrusted users. You should treat it like a pastebin.

It's a bit buried, but it does:

> In contrast to conventional radial flux motors, the electromagnetic flux in an axial flux motor runs parallel to the axis of rotation. The key components are arranged in a disc‑shaped layout: two rotors sandwich the stator from the left and right. This design enables an especially compact motor architecture, high power and torque density, and new freedoms in drivetrain packaging. In the new Mercedes‑AMG GT 4‑Door Coupe, the motor at the front axle is just under nine centimetres wide; the two motors at the rear axle each measure around eight centimetres in width. The three axial flux motors are integrated per axle into so‑called High Performance Electric Drive Units (HP.EDU), where they are combined with a compact input planetary gearbox in a single housing.

My favorite example of bad Netflix subtitles is Suits (2011). The music during the intro is the same throughout the series, from the song Ima Robot - Greenback Boogie. The English subtitles for the lyrics are wrong every single season, and they're wrong in a different way for every one of those seasons. The lyrics are not at all hard to understand--they've pretty specifically cut together some of the lyrics that are easiest to understand--so it's extremely obvious, but somehow nobody at any point figured out that they could just do it right once and not look totally incompetent.

After the initial Netflix release of the first 3.5 seasons (might have been 4.5, it was a baffling cutoff) they somehow decided not to add the rest, so I pirated it. Every single pirated intro came with perfectly correct lyrics.

No. This is the equivalent of putting "echo 'rm -rf ~'" or similar into a test suite. The output of a test suite is not intended to be piped straight into your shell, and if you decide to do so anyway the consequences are entirely on you.

If your agent executes any random instruction in a piece of text, it behaves like a shell, and you should either fix that or bury it deep in a sandbox.

Something you'll see in real codebases is code that cares whether an input value is "empty", but it doesn't matter if it's null or an empty string. It's very easy to go for this:

    if ($input) {}

It'll work through every test case you try, and then someone enters a 0 into the field and it's also unexpectedly considered empty.

You didn't mention private repos in your comment, but I guess that was implied in the $7 thing.

That said: SourceHut has private repos and access control.

This is at least partially disingenuous. Zig is working on, and has already shipped for some situations, a faster compiler. Bun runs on an outdated version of Zig that doesn't include it.

Reproducible builds exist to reduce the need for trust, while commercial vendors are in the business of selling trust.

This is because of a deeply annoying default in Apache, where for "security reasons" the underlying script doesn't get to see auth details that might already be handled by Apache. At some point they added the CGIPassAuth directive[1] but all kinds of other workarounds are floating around on the internet.

[1]: https://httpd.apache.org/docs/2.4/en/mod/core.html#cgipassau...

The website uses the feature for its intended purpose. Adding random trash to the query string of another website assuming it'll ignore it is in fact a bad idea, always, even if you can usually get away with it.

The batteries regulation[1] doesn't contain such an exemption. The legal argument that iPhones may be exempt goes like this:

- The batteries regulation is a general regulation and article 11 specifically says the following:

> This paragraph shall be without prejudice to any specific provisions ensuring a higher level of protection of the environment and human health relating to the removability and replaceability of portable batteries by end-users laid down in any Union law on electrical and electronic equipment as defined in Article 3(1), point (a), of Directive 2012/19/EU.

- There is a different regulation, the ecodesign regulation for smartphones and tablets[2], that is more specific and therefore might supersede the batteries regulation on this front, which says:

> (ii) manufacturers, importers or authorised representatives may provide the battery or batteries referred to in point (i)(a) only to professional repairers if manufacturers, importers or authorised representatives ensure that the following requirements are met:

> (a) after 500 full charge cycles the battery has, in a fully charged state, a remaining capacity of at least 83 % of the rated capacity;

> (b) the battery endurance in cycles achieves a minimum of 1 000 full charge cycles and after 1 000 full charge cycles the battery has, in a fully charged state, a remaining capacity of at least 80 % of the rated capacity;

> (c) the device meets IP67 rating.

[1]: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

[2]: https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...

A recall means the manufacturer shipped a faulty product. If you can prove you received a faulty product such requirements also don't apply.

> I am not allowed to replace it on my own as it would invalidate the five year long guarantee provided by the manufacturer. Why is this stuff not considered as well?

They're the ones paying for repairs, so it doesn't seem that unreasonable? That said: If you can prove the car is being maintained according to the manufacturer's specifications they can't require you to go to a brand dealership. That's just not necessarily easy to prove.

> facilities were purchased for between 1 million yen and 5 million yen and resold to Chinese buyers for between 40 million yen and as much as 100 million yen depending on location

Those prices seem weird. They were buying entire care homes and hotels for less than the price of a car? I understand they come with obligations, but these businesses were apparently financially ok before the acquisition.

And I assume this[1] is the reference to Backblaze? Notably not Hindenburg and more recent, but I believe there is some team overlap and there doesn't seem to be anything else.

[1]: https://www.morpheus-research.com/backblaze/

> So it's very unlikely we'll see developers build sites that are gated on this API existing.

I think this is an oddly optimistic outlook from someone who until recently worked at Google. A company that has shipped, and probably still ships, lots of sites and versions of sites gated behind "does your user agent say it is Chrome".

> It sounds like it has some security vulnerabilities that the maintainers aren't taking seriously

It may, and they may or may not, but the author hasn't actually reported any. They're explicitly ignoring the security policy and vagueposting instead.

This is a weird post to be honest. You've found a whole bunch of serious security issues, filed two PRs, one of which is adding some quotes because

> Those aren't exploitable XSS, but it doesn't hurt to have a second layer of defense.

The other suggests breaking clients that aren't using the more secure version of an OAuth method because

> I can't think of any OAuth client that would like to [use it]

That second one is a good idea, but the maintainer is also right to ask for some discussion before introducing a breaking change.

But crucially: neither of these are the kind of significant security issues you've found. Maybe lead with an actual bug?

What it means is here[1]. Anthropic is paying €240k a year and in return they get some marketing in the form of a press release and a website mention, as well as someone to talk to.

[1]: https://fund.blender.org/corporate-memberships/

I see your point for most of these but why rutracker? It is entirely in Russian.

So far you've only gotten responses to "how can a worse product win?", and they are valid, but honestly the problem here is that Mercurial is not a better product in at least one very important way: branches.

You can visit any resource about git and branches will have a prominent role. Git is very good at branches. Mercurial fans will counter by explaining one of the several different branching options it has available and how it is better than the one git has. They may very well be right. It also doesn't matter, because the fact that there's a discussion about what branching method to use really just means Mercurial doesn't solve branches. For close to 20 years the Mercurial website contained a guide that explained only how to have "branches" by having multiple copies of the repository on your system. It looks like the website has now been updated: it doesn't have any explanation about branches at all that I can find. Instead it links to several different external resources that don't focus on branches either. One of them mentions "topic", introduced in 2015. Maybe that's the answer to Git's branching model. I don't care enough to look into it. By 2015 Git had long since won.

Mercurial is a cool toolbox of stuff. Some of them are almost certainly better than git. It's not a better product.

--no-ignore-vcs

Or some combination of --no-ignore (or -u/--unrestricted) with --ignore-file or --glob.

Literally type "webhosting" into a search engine and every single provider that comes up will do that all-in-one. They'll also throw in a database and PHP, probably with an automatic installer for things like WordPress. There's a good chance your registrar will even try to upsell you the whole package.

These things are not the hard part.

Small correction: .nl is a ccTLD, or country code TLD. Not a gTLD, or generic TLD.

Your account has almost certainly been assigned a new username already. From the same link:

> Starting March 4, 2024, Discord will begin assigning new usernames to users who have not chosen one themselves. If your username still has a discriminator (username*#0000*), Discord will begin assigning you a new, unique username as soon as March 4, 2024. We will try to assign you a unique username that is similar to your current username.

Notably Discord stopped using that format two years ago, moving to globally unique usernames.

Their stated reason[1] for doing so being:

> This lets you have the same username as someone else as long as you have different discriminators or different case letters. However, this also means you have to remember a set of 4-digit numbers and account for case sensitivity to connect with your friends.

[1]: https://support.discord.com/hc/en-us/articles/12620128861463...

> What did they do last year? There is no annual public report of their activity.

There is[1][2][3], the one for 2025 just isn't out yet.

[1]: https://thephp.foundation/blog/2025/03/31/transparency-and-i...

[2]: https://thephp.foundation/blog/2024/02/26/transparency-and-i...

[3]: https://thephp.foundation/blog/2022/11/22/transparency-and-i...