jorams

I love it, at least with the right group, because while you basically never get reliable information, you do get a large amount of it. Some will be contradictory, some will match, most will need to be expanded on. You piece together narratives matching the evidence, poke holes in these narratives, offer alternative explanations, determine probabilities that multiple people are both speaking the truth. It's not that nobody knows anything, instead everyone knows something and will need to decide when and what to share with others. You might be able to get someone killed with a random accusation, but you're just as likely to reveal yourself to be a liar to someone in the process.

Yes, all the big search engines respect that meta tag. Some of the big abusive AI crawlers do too, kind of defeating the (stated) point of the tarpit.

> Cloudflare free plan's outside of Pages have never offered "unlimited free bandwidth" but "generous free bandwidth with conditions".

To be clear, Cloudflare's pricing pages have definitely included statements like "we never charge for bandwidth" for the free plan of the CDN. Here's a snapshot from exactly 10 years ago[1].

They removed it after a while, probably because it's just not true, and I don't think they make any such statements on their increasingly complicated pricing pages any more.

[1]: https://web.archive.org/web/20150116071824/https://www.cloud...

0.04% is a few times higher than I'd expect it to be, but if it were actually that bad I'd expect some form of previous report about it to be findable on the internet. I did some searching but couldn't find anything. It would be a significant bug on Google's part, but stranger things have happened.

What's astonishing to me is that apparently all these big service providers did notice, and then they decided to disregard the one identifier Google tells them to use? Fundamentally that's the security bug being reported here, it's just being reported to Google instead of those service providers.

A stable alternative for the hd claim would of course be a good idea. It would provide a more complete way to deal with the inherent security issue of allowing domain-based signup without further authorization steps. But given the above I'm not convinced these service providers wouldn't start ignoring it after the first time somebody re-registers a domain with Google Workspace.

Note that training is not even relevant here. Downloading copyrighted content you don't have the right to download is illegal. Distributing content you don't have the right to distribute is illegal. Meta did both. They did so knowingly, very deliberately even. It is unambiguously copyright infringement, on a massive scale.

> this is a safe space for me to say unpopular things and not get labeled as a conservative

The first one is confusing. The US is a very conservative country. It just elected a very conservative president. Statistically like 40% of voters call themselves conservative.

The article describes the "hunters" as more focused, so I am fairly certain that statement refers to the "hunters" instead of the "busybodies".

> Isn't payment processing just single digit percents?

It is usually a fixed component + a single digit percentage. For larger payments the fixed component becomes largely irrelevant. For small payments it can eat up most of the money involved.

As a quick example, Stripe's standard price for a credit card transaction in the US is 2.9% + $0.30. For a $5 payment that's almost 10% in direct fees, which is just about low enough that this is often where saas pricing starts.

This assumes you do tax calculation yourself (or ignore it until you're big enough) and handle fraud detection yourself. If you pay Stripe for these you're paying a significantly larger fixed fee.

There's also another significant risk at such low prices: In case of a disputed payment, which can happen a long time after the payment and will likely be more frequent if you don't pay to proactively deal with fraud, Stripe will charge you a $15 dispute fee regardless of the end result.

> on his english channel

That there's no separation anymore. YouTube added support for multiple audio tracks and since then everything goes to one channel again. The channels in other languages even redirect to the main channel.

> I was hoping for a list of shortest travel times between stations in Europe, as more of a thought/data experiment. Or put another way; which two train stations in Europe have the least distance between them?

That would not be very interesting. I live close to a train station that's less than 5 minutes (by train) away from the nearest other train station. The other train station is the city hub with many connections to other cities. There is nothing interesting about this connection, it simply replaces a 20 minute bike or bus ride. There are many such connections.

One rule that may be good, depending on how much of the mailing list email you receive is promotional, is to match "A header called List-Unsubscribe exists" and move that to Promotional. Then you could put any exceptions that it categorizes wrong above it.

Your comment is confusing because you start this one saying your inbox is full of spam, but respond to a suggestion to mark it as spam by saying it's not actually spam.

If something is not spam but you want it out of your inbox there's a few options:

- click Unsubscribe next to the sender. This should be possible for essentially all promotional email.

- click Actions -> click Block <sender>. Messages from this address will now immediately go to trash.

- click Actions -> click Add rule from message (-> optionally change the suggested conditions) -> check Archive (or if you don't use labels click Move to) -> click Save. Messages matching the conditions will now skip your inbox.

There's not much they could do to make that easier without magically knowing what you care about and what you don't.

The court order is at [1]. On page 41 and 42 it orders WP Engine's access to wordpress.org services to be reinstated to what it was on September 20, including all that entails. Thus he is now legally compelled to provide the wordpress.org services to WP Engine. He also provides those services to everyone else and used to provide them to WP Engine, but that doesn't make the statement false.

[1]: https://www.documentcloud.org/documents/25451524-wp-engine-v...

I'm confused why this statement stood out to you. Isn't that exactly what the court ordered? WP Engine could no longer be denied access to wordpress.org services, and thus he is now legally compelled to provide them with the services of wordpress.org.

They're also still available from Vultr. I just checked the wayback machine and the only thing that seems to have changed since their introduction in ~2017 is that the included SSD was reduced from 20GB to 10GB in early 2019.

I don't know if you missed the news but the board removed him and he retired[1] about a week before this tweet.

[1]: https://news.ycombinator.com/item?id=42296067

It's been a few months since I saw the video, but from what I remember all of her expectations should have been realistic when taking into account the price of the experience. This was an extremely expensive experience, and she was comparing it to things done way better at way lower price points.

They do have a fair use policy on the 1GBit uplink. I know of one report[1] of someone using over 250TB per month getting an email telling them to reduce their traffic usage.

The 10GBit uplink is something you need to explicitly request, and presumably it is more limited because if you go through the trouble of requesting it, you likely intend to saturate it fairly consistently, and that server's traffic usage is much more likely to be an outlier.

[1]: https://lowendtalk.com/discussion/180504/hetzner-traffic-use...

But overages from Hetzner are $1.05 per TB, which is significantly less than $6, so you can just get whichever instance you need and let it roll.

This is a confused and frankly worthless article. It is malware made in Godot. It is not targeting users of Godot, it is not distributed through Godot-related channels, nothing got "hijacked" (except perhaps the infected systems).

The researchers talk about the possibility that data packs for real games could be infected in the future, but this malware just includes its own copy of the game engine.

Post by the researchers: https://research.checkpoint.com/2024/gaming-engines-an-undet...

Statement by Godot: https://godotengine.org/article/statement-on-godloader-malwa...

I'm not sure what math you're basing this on, but it's far from correct. They include slightly less transfer in the instances, but their overage pricing is about 10% of DO and their instances are so much cheaper that you'll be paying much less even after adding a few TB.

For example compare the CPX11 to the cheapest similar offering from DO:

CPX11: 2vCPU, 2GB, 40GB storage (NVMe), 1TB transfer, ~$5 per month

DO Basic: 2vCPU, 2GB, 60GB storage (non-NVMe), 3TB transfer, $18 per month

Add 2TB more transfer at Hetzner and you're at ~$7 per month. Still a bit less storage though, let's also compare it to the CPX21:

CPX21: 3vCPU, 4GB, 80GB storage (NVMe), 2TB transfer, ~$9.50 per month. Add 1TB of transfer and you get more of everything for ~$10.50, ~40% less than at DO. And bandwidth overages at DO are about 10x as expensive.

We can also compare a higher tier:

CPX41: 8vCPU, 16GB, 240GB storage (NVMe), 4TB transfer, ~$32 per month

CPX51: 16vCPU, 32GB, 360GB storage (NVMe), 5TB transfer, ~$63.50 per month

DO Basic: 8vCPU, 16GB, 320GB storage (non-NVMe), 6TB transfer, $96 per month

A comment on the OSM community thread notes, and I can confirm based on the map you linked, that it contains many POIs that used to exist but haven't for a while, which nevertheless have a date_refreshed from this year.

This comes up rather often, and on the last significant post about it I saw on HN someone pointed out that the certification is kind of meaningless[1]. macOS poll(2) is not Unix-compliant, hasn't been since forever, yet every new version of macOS gets certified regardless.

[1]: https://news.ycombinator.com/item?id=41823078

The author didn't update all dependencies, they just tried running it on a newer version of Node itself. That is definitely a use case included when most people talk about an ecosystem compiling and running fine after several years.

That does seem quite obviously better. Even when insisting on checking coordinates why use the coordinate system carried by the event that you have the least control over. Why not .pageX/.pageY, which can't trigger the failure case as long as you make sure the element isn't in the far top left.

They're close to as cheap as they come for CDN bandwidth list prices without minimums, especially for CDNs with their level of global coverage. Competitors in this space in particular are often much more expensive, like Deno Deploy's $0.50/GB.

Cloudflare is effectively impossible to compare because it's all "free until you get an email from sales".

> I suspect that people operating Web sites have no idea how many legitimate users are blocked by CloudFlare.

I sometimes wonder if all Cloudflare employees are on some kind of whitelist that makes them not realize the ridiculous false positive rate of their bot detection.

The diff contains two (identical) changes that aren't just ripping out upgrade notices for the pro version: Two functions that stop callbacks from accessing $_POST now also stop them from accessing $_REQUEST, which also contains everything in $_POST. Also confirmed by WP Engine's update notice[1].

I honestly don't see why anyone would treat this as a security issue. Everything involved is PHP code that can do whatever it wants, not in any kind of sandbox.

Edit: And even if it were this update doesn't fix the problem. POST variables can still be accessed:

    filter_input(INPUT_POST, 'name');

[1]: https://www.advancedcustomfields.com/blog/acf-6-3-8-security...

The pro version of the plugin is a separate install, this just rips out the upgrade notices.

> It's quite similar to how Fextralife embeds twitch streams to farm viewer counts.

Fextralife notably stopped streaming almost a year ago after Twitch announced that embedded views would no longer be counted. The solution is in the incentive, but unfortunately on the modern internet those generally don't favor the user.