behindsight

> I always have to manually copy/paste the credentials.

I really hope you clear your clipboard history entirely after doing your copy/paste method because your credentials would otherwise persist for any other application with clipboard perms to just exfiltrate (which has already been exploited in the wild before)

Reminder, you can audit all your npm packages to see if they provide provenance attestation with:

    npm audit signatures

you can use this to also provide a gentle reminder to package authors to consider setting one up (or replacing those that can't/won't)

Additional resources:

- Trusted publishing via OIDC [1]

- Requiring 2FA for package publishing [2]

1: https://docs.npmjs.com/trusted-publishers

2: https://docs.npmjs.com/requiring-2fa-for-package-publishing-...

> How is it possible that this code (line 9 of the index.js) isn't present in the source github repo, but can be seen in the beta feature of npmjs.com

You may also be interested in npm package provenance [1] which lets you sign your npm published builds to prove it is built directly from the source being displayed.

This is something ALL projects should strive to setup, especially if they have a lot of dependent projects.

1: https://github.blog/security/supply-chain-security/introduci...

probably late but for future reference the reason why HN redirected to the localhost was because you set it as your canonical reference on your site's page.

Might wanna fix that

> <link rel="canonical" href="http://localhost:4321/blogs/cargo-check-slow.mdx/">

Relying on their own policy does not mean they will adhere to it. We have already seen "rogue" employees in other companies conveniently violate their policies. Some notable examples were in the news within the month (eg: xAI).

Don't forget the previous scandals with Amazon and Apple both having to pay millions in settlements for eavesdropping with their assistants in the past.

Privacy with a system that phones an external server should not be expected, regardless of whatever public policy they proclaim.

Hence why GP said:

> so effectively you can only guarantee a single use stays private

From what I have gathered their main differentiator is taking the approach of assigning each discrete data point its own "entity" definition that is independent but can be extended for each data provider.

So since its all represented by entities, you could treat them like any other vectorised data in your vector data store and use vector search.

It's a nice technique, but probably tricky if they ever venture into encapsulating endpoints in realtime for rapidly changing b2c applications (ratelimits/cronjob latency)

not sure what exactly that has to do with prebuilt versions of Windows that come with bloatware/adware or other nonstandard customisations?

> People did not buy the game with that requirement

That requirement/disclaimer was present on the Steam store page the entire time the game was actually available for purchase.

The main issue was that it was not actively enforced due to server issues at the time - which the studio CEO acknowledged:

> I do have a part to play. I am not blameless in all of this - it was my decision to disable account linking at launch so that players could play the game. I did not ensure players were aware of the requirement and we didn't talk about it enough. We knew for about 6 months before launch that it would be mandatory for online PS titles.

https://twitter.com/Pilestedt/status/1787076609188483254

Nvidia's revenue is ~$60 billion dollars.

But in all honesty, the box office numbers aren't as impressive as the longtail licensing and merchandising.

That's where the real money is made for the movie franchises.

Yes, I am wondering if this post contains any new information not previously discussed.

Also it is not the first time they have posted a similar related post to it [0]

Their previous justification for the dupe was:

> It has more context and information, that would be beneficial to HN users.

Which I believe could have been added as supplementary comments in their first popular thread instead of posting 3 different threads on the same general topic.

0: https://news.ycombinator.com/item?id=39402057

Minor heads up for that site admin, typo of posters at the bottom:

> Top 25 Poasters

It seems the 2nd EU link of gatekeepers in my original comment is no longer loading as it was before, but this link with "_en" suffixed to it does; can't edit my previous comment though.

https://digital-markets-act.ec.europa.eu/gatekeepers_en

In there you will find pdfs for each entity with not only the qualifiers/assessments, but also the counter arguments they presented.

For example, here is one from Alphabet that also brings up your point in the counter argument

https://ec.europa.eu/competition/digital_markets_act/cases/2...

You might be interested in the upcoming Digital Markets Act by the EU that is built to address this among other things.

https://digital-markets-act.ec.europa.eu/index_en

Notably you can check out their list of gatekeeper services

https://digital-markets-act-cases.ec.europa.eu/gatekeepers

Been using https://grep.app for that

Original HN Discussion: https://news.ycombinator.com/item?id=22396824

Sourcegraph works too: https://sourcegraph.com/search

> you deserve what you get

Seems unnecessary to add that as not everyone would've been aware of the PSL.

The parent post bringing up PSL was a helpful addition already.

Most likely related to the recent discussion about Cloudflare's DNS handling 1.3T queries/day [0]

You tend to get a few echoes relating to popular posts (or comments from those posts that suggest alternatives and/or pros and cons)

0: https://news.ycombinator.com/item?id=36984419

Beaten a year later in 2022 by GCP once again

https://cloud.google.com/blog/products/compute/calculating-1...

Are you using Cloudflare DNS?

This is a known issue that archive.is (and its variants) block cloudflare [1][2]

1: https://news.ycombinator.com/item?id=19828317#19828702

2: https://twitter.com/archiveis/status/1018691421182791680

Is there an equivalent to the AML/CFT regulations?

Might be referring to the concept of a lifestyle business [0]

> A lifestyle business is a business set up and run by its founders primarily with the aim of sustaining a particular level of income and no more; or to provide a foundation from which to enjoy a particular lifestyle.

0: https://en.wikipedia.org/wiki/Lifestyle_business

Alternatively, these lists and comparison sites can be useful when trying to do market research of your competitors and see the current sentiment/mindshare they have, especially as a new entrant trying to narrow down the niche.

I guess the key thing is not to take the comparison ratings at face value, but moreso use them as a reference point to do your own weighted comparisons

I agree with the general sentiment, but if you do want to unpublish there is a policy available [0]

Key points being either:

- published within 72 hours and without any dependents

- no dependents, < 300/week downloads, single owner

Of course even with all that said there was also precedent for having it removed if you emailed them directly and it was up to their discretion (I believe this was prior to their acquisition so not sure if that still applies).

0: https://docs.npmjs.com/policies/unpublish

> but to yourself, you don’t see any change

This hints to me that you might be thinking of the concept of invariant vs relativistic mass[0]

> i.e some sort of integral of moving matters between a distance, with respect to time.

It might be easier if you intuit it as total energy (encapsulates the relativisic aspects) - but that description you wrote seems to be another way to rephrase the curvature of space-time analogy; you could say that what you are describing is retreading how "steep" the bend is, yes?

0: https://en.wikipedia.org/wiki/Mass_in_special_relativity

Do check out Drew DeVault's blogpost back when he ran an image host[0]

0: https://drewdevault.com/2014/10/10/The-profitability-of-onli...

hi dang, I propose a universal solution for similar instances like when a site was down or when another issue has been sorted out: the use of "[resolved]" appended to the title.

This will save you any future issues of having to find ways to reword a title to indicate an issue has been resolved while also allowing for a way for anyone who wants to analyse resolved problems an easy [resolved] tag to filter for.

I hope you don't mind this suggestion if it's feasible to standardise.

Out of curiosity, are you using Cloudflare DNS? It seems to be a conscious decision on the part of archive.is

A previous discussion can be found here[0] with the statement by archive.is here[1]

0: https://news.ycombinator.com/item?id=19828702

1: https://twitter.com/archiveis/status/1018691421182791680

> Except there is no mechanism

Have you considered the Higgs mechanism [0]?

Perhaps an adjacent theory? I am fascinated with such a concept but I am by no means an expert at all.

I would appreciate if you could expand more on your comment, thanks!

0: https://en.wikipedia.org/wiki/Higgs_mechanism

AGPL is compatible with the OSI's definition of "open-source".

Those other two licenses you listed are either fully non-commercial (polyform) or have a clause preventing cloud hosting SaaS (timescale).

I am not going to get into discussion about who has the right to define "open-source", but having the right to commercially profit off of the software is one of the key OSI defined tenets which those two licenses lack.

In the end, AGPL may be able to achieve the same goal of preventing parasitic SaaS solutions that don't contribute back into the community.

Although I understand the rationale, lumping vague probability words like "may", "could", "might" as antagonyms (auto-antonyms) doesn't seem valid.

Whether you use "may" or "may not" would indicate the leanings of your null hypothesis / default assumption.

Call it a flash discount/sale/promotion for new/existing customers.

Adjust the terms as needed.