rcxdude

12 ms·

301.
by rcxdude 2mo ago
Sounds like a typical retention/signing bonus, except structured so that you get the bonus up front and pay the tax later. The main question I would have is whether people who took it understood what they signed up for (i.e. were they
302.
by rcxdude 2mo ago
I would guess you would owe some agreed value of the PC at the time you received it.
303.
by rcxdude 2mo ago
The question is, even if you identify who is the source of the traffic, are they even in a place where you can realistically sue them? The problematic traffic generally is not the bots that identify themselves, but the ones that are using r
304.
by rcxdude 2mo ago
Well, those companies have bots that identify themselves, and you can see what they're doing. Google especially have decades of experience of designing scrapers and seem to be able to the job of scraping the whole internet without caus
305.
by rcxdude 2mo ago
The point is that it's not a credible resource, and one or two point corrections from randos who can see some of the errors are not likely to change that.
306.
by rcxdude 2mo ago
The argument I think is that the share could be lower if the nuclear plants were kept running (broadly, based on your numbers, it could be less than 20% in 2025). Whether that would have made economic sense (especially in terms of redirecti
307.
by rcxdude 2mo ago
You can rephrase it as the demand curve times the price (i.e. total spend on something vs the price) sometimes has a slope of less than -1.
308.
by rcxdude 2mo ago
Not exactly, unless you still wind up eating the larger jars at the same rate as the smaller ones.
309.
by rcxdude 2mo ago
Maybe, but these thieves might do more damage than just needing to replace the phone. Some of them will attempt to use the information on it for extortion or blackmail (which is why such a feature exists in the first place).
310.
by rcxdude 2mo ago
Generally, other atomic clocks. The fact they they tick consistently compared to each other is the main thing (though at these scales, you need to account for time dilation!).
311.
by rcxdude 3mo ago
Eurocircuits is the closest equivalent I've used. Notionally 2 weeks PCB fab and assembly (but don't always meet this), and they can stock your parts in advance (though I don't know if this improves their lead times at all).
312.
by rcxdude 3mo ago
I would consider that more honest than more of a problem.
313.
by rcxdude 3mo ago
If you read the fine print of most commercial software you'll see some language to a similar effect. When's the last time Microsoft got sued due to an outage caused by a bug in Windows?
314.
by rcxdude 3mo ago
There's a lawyer in this thread explaining that quite likely a crime was not committed, because intent matters quite a lot in criminal law.
315.
by rcxdude 3mo ago
What exactly you are liable for in that case varies significantly with the details of the incident, both in terms of what you intended to happen and what you knew about what could happen.
316.
by rcxdude 3mo ago
Yes, but generally this falls below criminal liability.
317.
by rcxdude 3mo ago
Out of curiosity, which languages? The equivalent operations for C and C++ do generally involve a lot of arbitrary code execution to do the build, for example, they just don't have one central package manager and repository. I can&#x27
318.
by rcxdude 3mo ago
doesn't nixos still have execution hooks when you actually activate a package to use it? Arguably it's just separating the download and install steps (which I do agree, every package manager should have a 'safely download thi
319.
by rcxdude 3mo ago
>In most sane environments, like for example native languages, this is already the case. Installing a node package is much more like compiling a dll, not downloading it. The same is true for most package managers that exist for C and C++
320.
by rcxdude 3mo ago
idk, this kind of thing is a "what if everyone did it?" kind of thing. It just results in the whole channel turning to noise. But then I have developed pretty significant banner blindness despite using adblock such that attempts t
321.
by rcxdude 3mo ago
Always has been, arguably. Either way I don't think most people have their CI configured to automatically re-run when a dependency updates (imagine the thundering herd!), the compromises are more incidental to runs happening for other
322.
by rcxdude 3mo ago
Defence in depth is not just 'throw anything in that might improve security' though. The idea is to have multiple strong layers, not a hundred half-measures that are all easily bypassed. A stronger layer might be sandboxing, or se
323.
by rcxdude 3mo ago
If you need quick responses to such things, you're gonna need some intelligence in the loop regardless, even if it's just deciding when it's worth pushing a new release to prod.
324.
by rcxdude 3mo ago
What's your solution to using a library without executing the code in it?
325.
by rcxdude 3mo ago
You can also do the same for the build workflow, no?
326.
by rcxdude 3mo ago
That makes sense if it's actually a layer. You can create a thousand minor obstacles and it still won't be a very secure system.
327.
by rcxdude 3mo ago
Feel free to turn it off yourself, just don't be surprised when the attackers switch tactics. And don't make life harder for everyone else by pushing it as mandatory. (if you want a better mitigation: don't automatically upda
328.
by rcxdude 3mo ago
Neither is 'close the gate with no fence on either side of it'. If you want to run code, you either need to run it in a sandbox or trust it. Choosing to run only part of the code is not really a solution. (if you want to disable s
329.
by rcxdude 3mo ago
Redownloading and automatically updating to the new version are pretty orthogonal. You can have a solution which caches the packages but would still update to a new version or a solution which redownloads the (verifiably) same package each
330.
by rcxdude 3mo ago
The fact that it's not sufficient also largely means it's not necessary either, because the real solution is auditing and trusting the codebase as a whole. All you do when disabling install hooks is make a lot of situations much m

More ›