jorams

> Then they replayed that because Google isn’t signing the “to” field.

Google is signing the To field (at least on all email they send me). The attacker didn't change that either, as displayed in the screenshots in the article. The attacker took an email legitimately sent from Google to them, then redirected it to the victim.

An equivalent real-world mail scenario would be me taking a letter from my bank to me, putting it in a new envelope, then sending it to you. Then your assistant takes it out of the envelope and puts it into your inbox. The letter in your inbox is a completely valid letter from said bank, intended for me.

There's two things in this article Google does badly: Allowing free input of an app name and putting it directly at the top of an email they send without preceding it with an indication what the email is about, and hosting user-managed websites on a subdomain of google.com.

> I’m not saying that a high price label guarantees high quality

I think that hints at part of the real problem: humans have very little ability to judge the quality of products. Marketing departments are very good at cosplaying quality. "Awards" on things like wine only tell you the manufacturer paid the owner of the trademark some money. Reviews are often fake or at least paid for by the manufacturer.

With price also not being a meaningful quality signal you're left with a choice: Buy the expensive product hoping the quality reflects the price, or buy the cheap product knowing the quality is probably not great, but at least you didn't spend a lot of money on something that isn't worth it.

> I use Linux and have learned not to touch AMD GPUs

The situation completely changed with the introduction of the AMDGPU drivers integrated into the kernel. This was like 10 years ago.

Before then the AMD driver situation on Linux was atrocious. The open source drivers performed so bad you'd get better performance out of Intel integrated graphics than an expensive AMD GPU, and their closed source drivers were so poorly updated you'd have to downgrade the entire world for the rest of your software to be compatible. At that time Nvidia was clearly ahead, even though the driver needs to be updated separately and they invented their own versions of some stuff.

With the introduction of AMDGPU and the years after that everything changed. AMD GPUs now worked great without any effort, while Nvidia's tendency to invent their own things really started grating. Much of the world started moving to Wayland, but Nvidia refused to support some important common standards. Those that really wanted their stuff to work on Nvidia had to introduce entirely separate code paths for it, while other parts of the landscape refused to do so. This started improving again a few years ago, but I'm not aware of the current state because I now only use Intel and AMD hardware.

It is a terribly designed website. The intro post points to the (top-)left menu, but that doesn't contain any links to pages. The maps are accessible indexed by publisher in the menu below the site title, which is in light gray over a light background and overflows into a "More…" option at the end.

I believe their intentions are good, and keeping functionality the same for different outputs to avoid fragmentation is good too. An alternative interpretation, however, directly in line with the fear expressed by GP, is that they're already crippling the open source CLI because they can't support the feature in the closed source web app.

> Where would one get these MP3 files? Not everything is on Bandcamp

A lot of music is still available for sale, if not through Bandcamp then through stores like Qobuz[1]. Sometimes I have to look around for a bit to find a store that sells what I'm looking for, but I can usually find it on Bandcamp or there. Occasionally it's not for sale, in which case I don't feel bad about torrenting or downloading from YouTube, but that's rare.

[1]: https://www.qobuz.com/shop

But it does apply to the bzip2 crate, which is the topic of discussion. Its new pure-rust implementation is libbz2-rs-sys, not bzip2-rs. The last sentence is irrelevant.

That article, and its many versions in other outlets, is a weird (successful) attempt at changing the narrative. The news that triggered all of it was that Microsoft cut off the ICC chief prosecutor's access to his email. Microsoft comes out saying "we did not cut services to the ICC, just its chief prosecutor". The media widely announces "Microsoft did not cut services to the ICC". That's not news, that's just marketing for Microsoft.

The original news, and the claims by Tuta, are still correct: Microsoft cut off the ICC chief prosecutor's access to his email due to US sanctions.

Bespoke version soup is unsustainable, but part of why people keep doing it is that it tends to work fine. It tends to work fine in part because OS-level libraries come from a different, much more conservative world, in which breaking backwards compatibility is something you try to avoid as much as possible.

So they can take a stable, well-managed OS as a base, use tools like mise and asdf to build a bespoke version soup of tools and language runtimes on top, then run an app on top of that. It will almost never break. When it does break, they fiddle with versions and small fixes until it works again, then move on. The fact that it broke is annoying, but unimportant. Anything that introduces friction, requires more learning, or requires more work is a waste of time.

Others would instead look for a solution to stop it from breaking ever again. This solution is allowed to introduce friction, require more learning, or require more work, because they consider the problem important. These people want Nix.

Most people are in the first group, so a company like Railway that wants to grow ends up with a solution that fits that group.

Nebula[1] is an alternative to YouTube for and by youtubers. I'm fairly certain it's much bigger than Floatplane. It has ad-free versions of the creators' youtube videos, early access for new videos, and exclusive content. It seems to be pretty successful.

It is also, like Floatplane, totally irrelevant without the pull from YouTube, because that's where the audience finds these creators in the first place.

[1]: https://nebula.tv/

For reference I just typed "sls free toothpaste with fluoride" into a search engine and all the top results are good. They are SLS-free and do contain fluoride.

The price you quote seems to be for 5 PiB of storage, not 5 TB. The $96,000 covers the first 400 TiB, and after that it seems to be, or at least start at, $20 / TiB per month. If I understand it correctly that means it costs roughly the same as the major cloud providers, except you also have to supply your own hardware. Very much not aimed at small business.

KDE, starting with Plasma 6.2, shows a notification once per year[1] and indeed it works[1]. They make donating[3] very easy.

[1]: https://pointieststick.com/2024/08/28/asking-for-donations-i... [2]: https://pointieststick.com/2024/12/02/i-think-the-donation-n... [3]: https://kde.org/donate/

I haven't used it and you might already be familiar, but I've seen people mention fooyin[1] as similar enough to foobar2000 for them to make the switch. Might be worth checking out.

[1]: https://www.fooyin.org/

> Search "io" on Google right now and see what comes up...

I don't know about you, but neither of them comes up. Google I/O has always been something you have to search for including the "Google" part and this news is all about Jony Ive, not the nondescript company name.

The reason the send button on the old design is hard to see seems to me to be that it doesn't stand out in any way. The only difference to everything else on the screen is that it's blue instead of black, but the contrast isn't big and it's between two less important icons.

Here's a 30-second edit of the first picture that undoubtedly breaks material design guidelines, but also solves the problem without introducing any new problems: https://kappa.lol/7Zuuc8.png

The problem with a text button in a case like this is that the translation of "Send" is longer in most languages and even much longer some languages.

> …which is totally understandable… if the hiring manager had communicated that.

I agree that the hiring manager could have handled it much better, but as a rule: If at any point during any hiring process you feel like you need to spend even close to a full time week of work on anything without being very explicitly told so, you are wrong.

> These changes will apply to operations like cloning repositories over HTTPS, anonymously interacting with our REST APIs, and downloading files from raw.githubusercontent.com.

Or randomly when clicking through a repository file tree. The first time I hit a rate limit was when I was skimming through a repository on my phone, and about the 5th file I clicked I was denied and locked out. Not for a few seconds either, it lasted long enough that I gave up on waiting then refreshing every ~10 seconds.

For what it's worth the questions can't really be answered by a simple FAQ, because history has shown that those answers aren't worth the page they're written on. Many companies that get bought talk all about the fact that nothing is going to change.

Something is always going to change, almost always in a way that impacts customers. In the best case it's something simple like a different name on the bill, other times it will leave customers scrambling for an alternative before a ridiculous deadline. It could happen within weeks, after a month, or it might take a year. The answers at the time of the announcement are the same regardless.

That is not an example of a power tripping moderator, it is a moderator doing their job. The question is bad.

The message is telling you something is going to happen. You already figured out what that something is. You already figured out you are not in the 1% on which it is being tested. You are asking whether something that doesn't affect you somehow affects you anyway. The included screenshot tells you how to test what it otherwise would have done.

> I find that stuff like methadone is really quite strong, and I don't see how it isn't addictive. I figure it's to keep addicts alive while they get treatment instead of them getting a hot shot somewhere and ending up in a grave.

I am not an expert, but yes Methadone is addictive. It is drug replacement therapy, and Methadone is still a drug. The primary criticism of its use in addiction treatment is that it replaces dependence on one drug, like Heroin, with dependence on Methadone. A benefit of its use is indeed that it's a well regulated drug whose composition is known.

My understanding of why it helps in addiction treatment is that it triggers the same receptors as the drug it replaces, therefore satisfying the addiction, but it produces less intense effects and stays active for much longer, with less severe withdrawal symptoms spread out over a longer time period.

Thanks for the link. That is specifically about LibGen and Anna's Archive, and links to the general agreement that when a court orders one ISP to block a pirate site, others will also block it. I suppose in situations where Sci-Hub forwards you to LibGen (does it still do that?) that means you'll be blocked regardless of the blocking status of Sci-Hub itself.

I am still unable to find any news about court orders relating to Sci-Hub in particular. The biggest ISPs appear to not publish their block lists unfortunately. I did find that Delta publishes their list[1] of blocked sites which includes only sites for which I can also find news about court orders, and does not include Sci-Hub.

I queried the KPN DNS servers and they return a KPN IP address for LibGen, but a DDOS-Guard IP address for Sci-Hub, so that leads me to believe KPN doesn't block them either at least.

[1]: https://www.delta.nl/geblokkeerd/

It is certainly not true that all ISPs and phone companies in the Netherlands are blocking Sci-Hub. Both my home ISP and my phone provider don't, and I'm also not aware of, nor can I find any, legal requirements for ISPs to block it. Dutch ISPs aren't in the habit of blocking things without being legally required to. Which provider are you on that does block it? That would normally be significant news and get picked up by various publications.

I agree with the core of your sentiment, but I don't think moving the framing from the company to the person is the answer. It makes it too easy for a company to put the blame on an individual that has conveniently been fired (either for the relevant reason or any other) and then act like the problem is solved. The individuals most responsible should face personal consequences. The company should also face consequences. As they say: One bad apple spoils the bunch. (no pun intended)

It uses a lot of very specific terminology, but the linked pages like the one on "G-nonadjacent" do a lot to clear up what it all means. It is a lot of reading.

Essentially: The configuration claims "Snapshot Isolation", which means every transaction looks like it operates on a consistent snapshot of the entire database at its starting timestamp. All transactions starting after a transaction commits will see the changes made by the transaction. Jepsen finds that the snapshot a transaction sees doesn't always contain everything that was committed before its starting timestamp. Transactions A an B can both commit their changes, then transactions C and D can start with C only seeing the change made by A and D only seeing the change made by B.

Even if they were, they have absolutely no incentive to tell you their expert analysis. A16Z spent the cryptocurrency mania years pumping and dumping shitcoins. They weren't telling the world these scams were revolutionary because they had any inherent value, but because saying that made them the most money. They are just people with money trying to turn it into more money.

> I don't think Emacs has directional focus

It does, but I don't think they have default bindings. The commands are windmove-{left,down,up,right}. I've had them bound to C-S-{h,j,k,l} for years and it makes moving around much more fluid and predictable than C-x o.

I like this post and agree with a lot of what it says. Shipping Bun at this stage is probably not a great idea, particularly with overly-optimistic CPU requirements, and the complexity of the stack is very far from ideal. At the same time some of that criticism seems slightly mistargeted. Bun didn't drop support for your hardware arbitrarily: your OS vendor dropped support for your hardware. Your "computer with 128GB of RAM and 6 CPU cores" is obsolete according to the manufacturer.

This is bad, and it should not be an acceptable situation, but a relatively short support cycle is a choice you made by buying their product. I'm not sure it's right to then blame others for following along.

I'm not sure about netcup, but Hetzner and OVH are very large, very popular hosting providers that have been in this game for decades.

As someone who has finally found a way to increase productivity by adding some AI, my lesson has sort of been the opposite. If the initial response after you've provided the relevant context isn't obviously useful: give up. Maybe start over with slightly different context. A conversation after a bad result won't provide any signal you can do anything with, there is no understanding you can help improve.

It will happily spin forever responding in whatever tone is most directly relevant to your last message: provide an error and it will suggest you change something (it may even be correct every once in a while!), suggest a change and it'll tell you you're obviously right, suggest the opposite and you will be right again, ask if you've hit a dead end and yeah, here's why. You will not learn anything or get anywhere.

A conversation will only be useful if the response you got just needs tweaks. If you can't tell what it needs feel free to let it spin a few times, but expect to be disappointed. Use it for code you can fully test without much effort, actual test code often works well. Then a brief conversation will be useful.