cube00

GitHub really needs something finer-grain then just pretending the repo never existed during these incidents. [1]

The bad package version has also just disappeared from crates.io [2] with no indication its been yanked. There's no security advisory there either [3] "No advisories found for this crate."

I feel crates.io was unprepared for a security incident like this since they're managing the response [4]

[1]: https://web.archive.org/web/20260820145918/https://github.co...

[2]: https://crates.io/crates/arrayref/versions

[3]: https://crates.io/crates/arrayref/security (I'd give an Wayback link but that's also broken https://web.archive.org/web/20260820150747/https://crates.io...)

[4]: https://github.com/rustsec/advisory-db/issues/3161#issuecomm...

It's weird their promotional video repeats "you can do <million things> without installing dependencies", if I want headless browser testing is that wrong to install a project that offers that?

Why would I want everything reimplemented in this massive binary? Why would Bun be anymore in touch with nuances of all these different technologies then individual projects dedicated to their own speciality?

JS Runtime, Package Manager, Test Runner (both unit and headless browser), Bundler, JSX, PosgreSQL/MySQL/SQLite drivers, S3 client, Redis client, Formatter, Linter, etc.

Not to mention parsers for YAML, TOML, Markdown which are easily three separate projects worth of complexity in their own right.

I guess one clear downside is to get all these great features they're pushing for 1.4 you needed to wait until everything was ready. Given 1.3 was pushed out in October 2025, a 10 month release cycle across so many large technologies is tough. Before you give a pass because of the Rust rewrite Bun 1.2 was released in January 2025

I have to respect Jarred knows how to work the algorithm, 10 carefully crafted X teaser posts for this release spaced out over 72 hours https://xcancel.com/jarredsumner

> There should be bounties

There are https://bounties.fulu.org

> our attempt to give it an honest look.

Oh no, what are we hiding?

> introduces bugs you already fixed.

Isn't this why every bug fix gets a unit test?

I appreciate rewrite isn't always the answer but it's a strange post when the authors should be giving constructive ways forward so we move to Rust and then use their 1k star Django clone they link to.

Instead anytime a question is posed it falls back to "sometimes" and little detail after that.

Citing a nine year old paper instead of something newer or doing their own benchmarking wasn't ideal either.

> Claude will keep burning credits trying new approaches until something sticks. That's a huge advantage in a field where most of the things you try don't go anywhere.

Unless you're on consumption billing.

> even if someone can prove that they didn't

Only a whistle-blower could, it'll all be locked down as trade secrets because it's (allegedly) giving their AI the edge over the competition.

Unfortunately the whistle-blower will never work in big tech again if they do so I don't see it happening.

Not that it really matters, data breaches are happening more then ever with no consequences and data brokers are legal companies.

> My understanding is that it's based entirely on self-reporting by developers.

I look forward to the bans and/or automated deductions issued when Apple's automated system believes you're lying, there's money at stake here so they'll be strict about it.

> why should I not be able to do so on my phone? Why would one computing platform be different from the other?

If Microsoft had its act together PCs would have been just as locked down as phones are today and we wouldn't be questioning a difference.

It still happens to me from time to time, and Postmaster tools don't help either (honestly what more do you want from me Google!)

I'm still refusing to give up the good fight.

> Dictionary-based classification has a ceiling, and I want to be honest about where it is.

I stopped here, anytime an author (or likely AI) feels the need to tell me they're being honest or "genuine" I don't need to read any further.

I'll assume honesty but the minute you explicitly tell me, you've probably got an angle that I'm too dumb to see, but I'm not dumb enough to keep reading.

Especially someone who stands to gain if they only need to get cozy with two email providers to deliver their spam.

(Blog author) runs the email infrastructure measurement project at Live Direct Marketing

Google offers "mail merge in Gmail to send personalized email campaigns, newsletters, and announcements to a wide audience." [1]

Based on how much @gmail.com spam I used get within GMail I can only assume they treat mail from their internal accounts much more favourably then us dirty self hosters.

[1]: https://support.google.com/mail/answer/12921167

I personally can't trust OneDrive to handle my irreplaceable data, switching on silently, takes your data if you try and turn it off because it swapped out your files for "online only" stubs, randomly files just end up not coming back down silently, sync fails silently.

Plenty of horror stories out there, eg. https://news.ycombinator.com/item?id=37408794

If you could run OneDrive with debug level logging I can only imagine the flood of errors they must be ignoring.

It also never takes "no" for an answer: https://www.thurrott.com/windows/windows-11/331890/hell-free...

Plastering a "Back up now" pill over the top of every photo (not a header, I mean it actually covers the photo) was always a favourite of mine.

Example (doesn't show it covering the photo but view a portrait photo and you'll see it): https://media.zenfs.com/en/android_police_756/2ba414b46f9732...

> For me, I want to use Google Photos exclusively to see my past backups but never back anything up again.

Get out while you still can, it's only a matter of time before your account gets locked by their automated "abuse" systems. Cloud only is not a backup.

The Whatsapp's restore process if you're not on Google Drive is unreliable too. I keep a separate backup but also have to keep the Google Drive backup on because it's too risky now I've seen it fail to restore and was only able to rescue it using the Google Drive backup I had also. If it just had my backup I'd have lost the lot.

I didn't realise you could do this but it's worth a try, it'll probably just change to nagging you to sign in instead now.

It's under your profile icon in the top right.

https://support.google.com/photos/thread/256212140?hl=en&msg...

Their AI bot is just as grim

Me: when's the bike booster available to purchase?

ASUS AI: For the most accurate and up-to-date product release information, we recommend following our Facebook and Instagram channels. We share all our launch announcements there first, along with exciting product previews.

Hilarious advice given both Meta products are notorious for not showing everything from the accounts you follow.

>the Listener rejects any handshake from an unknown key.

It never responds, there's no indication of rejection.

The client can't even be sure a service is actually there or they've hit a default drop firewall rule.

You were still tested on and your outputs messed with even if you didn't click on either button.

If everyone does it they lose the memory savings they're getting by expiring the cache.

More unannounced testing on paying customers.

>Work places also have electricity.

Only households can access the free electricity window. If you're not on a free plan you can get reduced rates during the solar peak window but business accounts aren't allowed to access those either.

You pay a higher daily supply charge and more per kWh outside this window so it's more like free (conditions apply)

The supply charge is 6% higher for the Solar Sharer plan, while the peak rate is 92% higher. Solar Sharer’s peak rate is almost double the flat rate. The off-peak rate is 17% lower than the flat rate.

https://www.solarquotes.com.au/blog/solar-sharer-plans-compa...

"It's a big club and you ain't in it."

Fine, but I get to vibe next week's markdown editor.

The lengths they go to avoid calling it an "outage"

Namecheap.com: undergoing emergency maintenance

Hilarious they link to a Knowledgebase article for details on how to send a support email which is also on namecheap.com so it can only show the "maintenance" page.

Blog with link: https://web.archive.org/web/20260813144639/https://www.namec...

KB: https://web.archive.org/web/20260813151320/https://www.namec...

Bonus points for breaking the Wayback machine version by automatically reloading the live page if you try and access it via the archive.

> We are pushing tons of code and now our CPU usage has grown exponentially over the past year because the bad engineers just ship whatever Claude gives them and do not think about the consequences.

Sometimes this can be a death by a thousand cuts. Any individual change may not impact performance to a noticeable degree but when they're pumping out a 10x increase in commits it can be a slow decline.

Just look at how they're merging ~300 commits a week into bun.

https://github.com/oven-sh/bun/graphs/commit-activity

The algorithms do love a loneliness influencer https://www.theguardian.com/society/2026/jun/08/loneliness-i...

Interesting to a see a Windows 7 machine in the picture captioned "Andrew Jones in the boring machine’s control room."

I'm not sure people seeing "Made for Apple silicon" will expect an Electron app.