lunar_mycroft

10 ms·

121.
by lunar_mycroft 10mo ago
They mean that you don't need to write JS, you can just add a script tag to your page
122.
by lunar_mycroft 10mo ago
> We're very close to invokers being baseline, and that will take care of plenty of what htmx was designed to do. From what I've seen, invokers without extra code are designed for client side interactivity (e.g. showing a mod
123.
by lunar_mycroft 10mo ago
If the JSON protocol in question supports arbitrary behaviors and styles, then you still have an injection problem even over JSON. If it doesn't support them you don't need to support those in an HTML protocol either, and you c
124.
by lunar_mycroft 10mo ago
> My hypothesis (based on observations when personally involved) is that this is exactly what allowed offshoring to boom. Offshoring did happen, but if you were correct that only the quality control process impacted final quality, the s
125.
by lunar_mycroft 11mo ago
> if at all realistic numbers are mentioned, I see people claiming 20 - 50% IME most people claim small integer multiples, 2-5x. > all the largest studies I've looked at mention this clearly and explain how they try to address it
126.
by lunar_mycroft 11mo ago
Some ( partial ) counter points: - I think given public available metrics, it's clear that this isn't translating into more products/apps getting shipped. That could be because devs are now running into other bottlenecks, bu
127.
by lunar_mycroft 11mo ago
I have no reason to think you're lying about the first part (although I'd point there's several ways that metric could be misleading, and approximately every piece of evidence available suggests it doesn't generalize), b
128.
by lunar_mycroft 11mo ago
It "obviously" does based on what, exactly? For most devs (and it appears you, based on your comments) the answer is "their own subjective impressions", but that METR study ( https://arxiv.org/pdf/25
129.
by lunar_mycroft 11mo ago
> Right...so you fix it from the safe code, because the safe code is in charge of using from_raw_parts correctly. No, you fix it from the unsafe code (just not your unsafe code, since the API you're trying to expose is not possibl
130.
by lunar_mycroft 11mo ago
> How would you fix this by only editing the code inside the unsafe block? In this case, the solution is to mark make_slice as unsafe. This should make sense if you think about it for a second, because it's a thin wrapper around an
131.
by lunar_mycroft 11mo ago
> It's fine to disagree on the costs/benefits and where you draw the line on supporting the removal, but fundamentally it's just a cost-benefit question If browser makers had simply said that maintaining all the web standa
132.
by lunar_mycroft 11mo ago
> The fact that you put "contract" in quotes suggests that you know there really is no such thing. It's in quotes because people seem keen to remind everyone that there's no legal obligation on the part of the brows
133.
by lunar_mycroft 11mo ago
I want to start out by noting that despite both the linked article the very comment you're replying to pointing out that the security excuse is transparently bad faith, you still trotted it out, again . And no, it really isn't a
134.
by lunar_mycroft 11mo ago
The fact that people didn't realize that a site used XSLT before the recent drama is meaningless. Even as a developer, I don't know how most of the sites I visit work under the hood. Unless I have a reason to go poking around, I
135.
by lunar_mycroft 1y ago
"effecting something else" (i.e. escaping the sandbox) is the core issue. JavaScript (and WASM) engines have to be designed to defend against the user running outright malicious scripts without those scripts being able to gain
136.
by lunar_mycroft 1y ago
Yes and no. It's true that if you had to pick one to support and were only considering security, it would virtually certainly be better to go with XSLT. However, browser makers basically _have_ to support javascript, so as long as XS
137.
by lunar_mycroft 1y ago
I look at it more like "the fact that we can't align humans/human institutions strongly suggests we won't be able to align something as alien as AGI is likely to be"
138.
by lunar_mycroft 1y ago
> Literally this. Microsoft used to ship a free web browser. Then they stopped. That's not something anybody can object to. There is a fundamental difference between ceasing to make a browser and continuing to make a browser, whi
139.
by lunar_mycroft 1y ago
And it's a very small maintenance burden at that. Shipping the polyfil would technically still be a dependency, but about as decoupled a dependency as you can get. It's only interaction with the rest of the code would be through
140.
by lunar_mycroft 1y ago
The license would be relevant if I'd claimed that removing XSLT was illegal or opened them up to lawsuits, but I didn't. The obligation they took on is social/ethical, not legal. By your logic, chrome could choose to stop s
141.
by lunar_mycroft 1y ago
Maintaining web standards without breaking backwards compatibility is literally what they signed up for when they decided to make a browser. If they didn't want to do that job, they shouldn't have made one.
142.
by lunar_mycroft 1y ago
Chrome and other browsers could virtually completely mitigate the security issues by shipping the polyfil they're suggesting all sites depending on XSLT deploy in the browser. By doing so, their XSLT implementation would become no les
143.
by lunar_mycroft 1y ago
iIRC, all of the proposed workarounds involved updating the sites using XSLT, which may not always be particularly easy, or even something publishers will realize they need to do.
144.
by lunar_mycroft 1y ago
It seems clear from the context that what's being discussed is not "can a country enforce it's laws on a foreign citizen within it's borders" but "can a country enforce it's laws on a foreign citizen outs
145.
by lunar_mycroft 1y ago
Note that for this example you can get the same behavior (assuming the endpoint hit isn't using using SSE, which IMO Datastar over emphasizes) in HTMX via a combination of formatting your response body correctly and the response header