esrauch

9 ms·

91.
by esrauch 11mo ago
One problem here is that CVE scoring is basically entirely bugged, something scored 8.7 could be an RCE exploit or a "may be able to waste CPU" issue. That's the difference between "it may or may not be that there's
92.
by esrauch 11mo ago
This program discloses security issues to the projects and only discloses them after they have had a "reasonable" chance to fix it though, and projects can request extensions before disclosure if projects plan to fix it but need m
93.
by esrauch 1y ago
That doesn't sound right to me; its legitimate topic that a package where the core use-case is X, that package has obscure feature Y, and the mere existence of Y can cause security issues for a user even when the user never intended to
94.
by esrauch 1y ago
> Given that the author works at an AI accelerator company I actually believe he works at Buf.build and his resume is stale, the author previously posted about their Go Protobuf parser hyperpb which is a Buf project. Maybe still "au
95.
by esrauch 1y ago
The question isnt whether such cases exist, but instead whether they actually need c++26 and what the downsides are to everyone else if c++31 or whatever is still constrained by it.
96.
by esrauch 1y ago
It's model=2.5 weights=202509
97.
by esrauch 1y ago
It is, Google Books did it over a decade ago (bought up physical books and scanned them all). There were some rulings about how much of a snippet they were allowed to show end users as fair use, but I'm fairly sure the actual scanning
98.
by esrauch 1y ago
The reason is that the uniform distribution is very rare. Nearly no real world scenario were something is equally likely to be the values 2, 0 and -2, and where it's literally impossible to be -2.01. It exists but it's not the nor
99.
by esrauch 1y ago
> But why one would complain about YaML's whitespace? It is not obligatory. The problem (as felt by me and also as identified by the person you replied to) is that you can't copy-paste/munge some stuff into the right spot
100.
by esrauch 1y ago
It doesn't seem weird at all to me: standard is essentially the consensus of the major browser vendors; a spec which all of Chrome, Safari and Edge don't implement is really just a hypothetical. The origin story of whatwg is that
101.
by esrauch 1y ago
Even if all wire format encoding is utf8, you wouldn't be able to decode these new high codepoints into systems that are semantically utf16. Which is Java and JS at least, hardly "obsolete" targets to worry about. And even Sw
102.
by esrauch 1y ago
Yeah, WTF-8 is a very straightforward "the spec semi-artificially says we can't do this one thing, and it prevents you from using utf8 under the hood to represent JS and Java strings which allow for unpaired utf16 surrogates, so i
103.
by esrauch 1y ago
Play Store also does this now and it's a fundamentally radical departure from the era where if you give the company your card info directly theres a high chance you aren't going to be able to get out of it without paying at least
104.
by esrauch 1y ago
Are you sure you mean .5km? That's only 0.3 miles, 1500 feet. That is the distance if you drive to a Walmart supercenter and park in the center of the parking lot and walk to the door.
105.
by esrauch 1y ago
This page is a promo page of the ux design language people as created by UXD/UXE role people. It's basically like looking at a Figma export and complaining about the performance of it; any actual implementation would be done for a
106.
by esrauch 1y ago
> wrong about amyloid plaques Sorry... you think that Trump is doing this because of suppression of dissent about amyloid plaques?
107.
by esrauch 1y ago
I did; it explicitly demanding an audit of employees and students political views, the forced hiring of more professors who are sympathetic to the current administration's politics. That doesn't sound authoritarian to you? Can you
108.
by esrauch 2y ago
When you use that syntax it looks like you are calling out an explicit quote; you may think that it's a reasonable paraphrase but I think most readers will see what you did as a strawman instead of a paraphrase. Better to write inline
109.
by esrauch 2y ago
Everyone just uses Gmail/Hotmail/iCloud/Proton which just don't have the port problem as carriers because you don't have any reason to port since there's no fees and no physical network, you can just accrue mor
110.
by esrauch 2y ago
I sometimes wonder if the name "ogg vorbis" hampered its uptake. MP3 is admittedly a pretty jargony name too but isn't otherwise "weird", compared to Ogg Vorbis is just Klingon-esque.
111.
by esrauch 2y ago
> You probably roll your eyes when someone tells you they don't have time for some activity you deem valuable. There's a few categories where it makes sense to roll your eyes, like if they say they have no time to shower or hav
112.
by esrauch 2y ago
It can actually be both. At least on Android the browser itself can lack the rights to listdir and only gets access to file you picked via the system picker, rather than the browser having unlimited access and only delegating only some of t
113.
by esrauch 2y ago
Except file, no one is giving the browser full access to their files so that it can render a shitty file picker
114.
by esrauch 2y ago
> Google specifically serves a worse version of Search on Firefox for Mobile. I don't think Google owning Chrome is really a factor here, but just a raw traffic question where FF Mobile has basically zero uptake. The experience they
115.
by esrauch 2y ago
That seems no different than any other optimization: very directly tons of optimizations would reduce stack usage which would then change a given input from a stack overflow to a successful execution. Similarly anything that reduces heap me
116.
by esrauch 2y ago
What I meant is that the comment said that you can learn soldering in a weekend and described only the physical aspect of getting solder onto some components. I spent a number of weekends trying to get any intuition over basic circuitry com
117.
by esrauch 2y ago
I think a relevant gap you may be underestimating is "if you finish your solder job and it just doesn't work, what now"? Just getting some melted metal onto a thing is really ~none of the skill cap that makes it "scary&q
118.
by esrauch 2y ago
I think "routinely" is overstating it, billions people are running arbitrary JS on a daily basis and no meaningful number of them are being infected by malware. Browser surface attracts the most intense security researcher scrutin
119.
by esrauch 2y ago
Defeating access control by using credentials that aren't yours is fraud. Like, if you found a company badge laying around, go to that office and flash the badge to the security guard and go in. You've committed fraud by tricking
120.
by esrauch 2y ago
They probably have a reverse proxy in front of all their http endpoints and that is still up and able to show the unicorn if the backends aren't responsive. The static content on the error page might also be on akami or cloudflare side

More ›