2,796 karma · joined December 27, 2012
Programs often invoke other programs through the exec* family of syscalls. For example, git is written in C but it ships with perl dependencies. It is not unreasonable to assume pass-cli added a runtime dependency on a program written in javascript. Regardless, we're talking hundreds of AUR packages have been compromised, I'd be shocked if none of them were javascript-based programs. Perhaps pass-cli was simply a bad example for me to choose.
> It changes the contributor email?
I think this is the 2nd most sus change, but even so, I have changed email addresses over the years so it isn't completely unreasonable.
> in /tmp?!
And yes, this is the most sus change.
[0] https://aur.archlinux.org/cgit/aur.git/commit/?h=pass-cli&id...
Simply reviewing the PKGBUILD is not enough for the same reason reviewing a Makefile is not enough: You need to review the source code for _everything_ that is being downloaded and executed on your machine. For AUR packages, that means not just the PKGBUILD but the full source code for the program it is building and the full source code for any of its dependencies.
Hypothetical example: you wouldn't have caught the xzutils exploit by reading the PKGBUILD.
About a decode ago when debugging networking issues in an office, we had the observation that Apple hardware holds onto access points for dear life. Everything else would roam fine, but Apple would stay connected to distant access points with awful signal as if Steve Jobs' life depended on it.
First, the rich have unimaginably more power in changing people's minds. This isn't sitting down at a bar and having a chat with hank to try to convince him to vote on prop 99. It is the wealthy putting their opinions on your phone, television, and billboards, reminding you of it multiple times per day. If politics is truly a contest of ideas, then the playing field needs to be level so that the ideas can be evaluated fairly, rather than it simply being a contest of who can buy enough ad space to brainwash people to vote against their interests.
Second, the wealthy don't have to change people's minds. They can purchase politicians by "donating" to them, going to million-dollar-per-plate dinners hosted by them, directly giving them money by staying in their hotels, etc. You don't have to convince a politician that they should vote on prop 99, you just need to pay them however much they want for their vote.
If the wealthy had exactly as much power in politics as a fireman or nurse, then I'd be all for their participation.
I don't think anyone would object to a rich person casting a single vote and maybe putting a bumper sticker on their car or a sign in their yard. The issue people take with the rich and politics is the outsized influence they wield in elections. The whole "one person one vote" thing falls apart when the rich can throw millions at advertisements and millions at the "charities" run by the politicians they bought.
> That's $12,777.92 to get the loan.
This is something I don't quite understand when people talk about homes: they just bought a $425,930 home. If they're getting a 30-year mortgage with a 20% down payment they will pay a total of $902k at current mortgage rates. The closing costs are such a tiny fraction of what you're spending. You wouldn't go into a store and refuse to buy a $40 item when you realize you need to pay $3 in sales tax, why would you be bothered by having to pay 3% of the home's value or 1.4% of what you will end up paying in the end?
Same thing with property taxes: my home-owning friends complain about property taxes like they're some huge imposition. OP is paying $515/month in property taxes. My rent has gone up by more than that in the past 3 years that I've been in my current apartment.
That being said, I appreciate this post for the breakdown of all the expenses. I'm considering becoming part of the land-owning elite, so this is useful.
And an American flag with the incorrect number of stripes. I wonder which 2 colonies they decided weren't worth including on their phone.
How long ago? Covid vaccine efficacy drops significantly over time so if you haven't had a booster recently, you are not vaccinated: https://www.nih.gov/news-events/nih-research-matters/why-pro...
Which that reminds me, I should schedule a booster since I'll be attending a party and a wedding soon.
With computers driving: traffic light turns green. All cars simultaneously start driving. It'd be like a train but without the efficiency.
Similarly, with human drivers: some jackasses drive into the box and the light turns red. Now perpendicular traffic is either fully blocked or must proceeed slower to maneuver around the jackasses. With computer drivers, they shouldn't intentionally break the law and they should have plenty of sensors to figure out that they cannot make it through the box.
SeatGuru shut down back in 2025.
[0] The 2nd chart on https://www.eia.gov/todayinenergy/images/2025.05.28/chart2.s...
If we manage to get enough solar such that energy essentially becomes infinite then the inefficiency would no longer matter. Otherwise, it would only make sense in vehicles that require high energy density like airplanes.
I just want to warn people who haven't heard server-grade hardware in-person before: this is only for people who can put a server rack somewhere unpopulated like a garage or basement. Servers will make you think "wow, leafblowers sure are quiet". They are not suitable for apartment dwellers such as myself. When I was setting up my 1U before shipping it off to a colo, I wrote scripts and had detailed plans of the things I needed to run so I could minimize the time it was making my ears bleed.
A significantly more complex hypothetical that I don't think anyone is doing yet: With digital price tags and customer tracking you could show different prices to different customers in-person. For example, when Alice goes to the eggs it could say $2 and when Bob goes to the eggs it could say $4. Then you just need to track the customer to the register to make sure you give them the price that was displayed. I believe the amazon "go" stores were doing the whole customer tracking thing so we already have the necessary tech demonstrated in real stores.