kernelbugs

To be fair this behavior + extra-index-url definitely allowed for dependency confusion attacks. Now it's a bit silly for the CVE as written, but IIRC this was before you could use index-url to point exclusively to an internal package host so there were (and in other ecosystems still are) dependency confusion attacks going on in the wild where attackers are publishing "internal-package-a@999.9.9" on any public package host (NPM, PyPi, etc) to try to compromise companies that have internal packages of the same name.

Why not LoraWAN - has built in encryption (via preshared keys) and receiver stations + processing software already exists (Chirpstack).

Mind sharing your solution a bit more - how do they trigger actions from each other for instance (or is that prompted by you asking them to read from each other)? Asking because OP is interesting but seems a bit overambitious for my own usecases (two pairs of claude + codex agents such that each pair should talk between each other but not across pairs; all running on the same machine).

Cool effort! I appreciated the background into the why, as initially I thought this would have to do with optimizing animated GIFs and didn't realize there was a usecase for single frame GIFs anymore.

Could this be used for LTE roaming? My parents live out in the middle of nowhere - no cell tower reception, but Starlink works so they have internet. I'd love to get them local LTE coverage for cell phone calls and text messages.

Are you still using outdated GitHub Oauth apps for this, or have you swapped to GitHub Apps? GitHub Apps are newer and have Oauth flows, but have a fine-grained permissions model instead of the Oauth permission model.

More info: https://docs.github.com/en/apps/oauth-apps/building-oauth-ap...

More-over, can you document the GitHub permissions needed and which GitHub App(s) this tool uses? Are you using device-flow, online oauth-flow, etc? And where are the Oauth tokens stored if so? Is there any server-side component where you might be storing tokens?

Thanks!

I believe parent comment was about `env -S` not being portable rather than `uv` being portable.

I'll say, I am as pessimistic as the next person about new ways to do X just to be hip. But as someone who works on many different Python projects day to day (from fully fledged services, to a set of lambdas with shared internal libraries, to CI scripts, to local tooling needing to run on developer laptops) - I've found uv to be particularly free of many sharp edges of other solutions (poetry, pipenv, pyenv, etc).

I think the fact that the uv tool itself is not written in Python actually solves a number of real problems around bootstrapping and dependency management for the tool that is meant to be a dependency manager.

Amazing to see the progress of JPEG XL here. Been following the effort for a while, and despite the adoption difficulties (i.e. Chrome), they're making great progress regardless.

I'd imagine illegal for environmental reasons, however, rather than financial losses of some other party.

Those extensions were just glorified api clients / web browsers. This is akin to a company threatening the developer of a torrent client.

Also a S10e user here. I've been eyeing the Asus Zenfone 10, but it's unfortunately not available in the US for most mobile networks here. Truly a shame that not many are making small phones, and those that are are not paying attention to the US market.

What service did you use, and anythings to stay away from / definitely try?

This is a strange take for me to see, maybe OP doesn't have the context that the US government has been funding Ghidra development for years now (before ultimately open sourcing it), and will no doubt continue to do so for years to come.

This is the software used by NSA and contractors to analyze malware. From a UI perspective I get that it's clunky, but from a capabilities perspective I doubt there is much lacking.

Looks like they are just a reseller of Hetzner and Leaseweb?

Any tips, tricks, or resources for getting started using Fargate for one-off or recurring jobs? I have terraform setup and managing AWS resources, but every time I look into Fargate it seems like guides point towards running webapps instead of diverse jobs.

Like with IoT devices, this seems to be a place where there is a massive lack of care or understanding in how to build a secure product. The repercussions of which, however, are potentially much more severe. Perhaps this will get the ball rolling on some much needed regulations for the security of internet-connected products (especially cars).

Would have loved to see more of the technical details involved in spinning up Firecracker VMs on demand for Github Actions.

The trick in this case was to search Nvidia AIBs.

> Nvidia Add-in Board (AIB) partners ... The list includes Inno3D, MSI, ASUS, Palit, Colorful, PNY

Is there a way to subscribe to these technical notes postings? I (and I assume others) would be quite interested in being alerted when a new one is posted!

Another native speaker chiming in. This is my first time encountering f.x. and it took me quite a while to figure out (essentially guess) what it meant. Most people I know and situations I've encountered use e.g. (possibly without even knowing what it means). In common usage e.g. is "for example" just like etc. means "and additional things" or i.e. means "that is".

I've been using jmp.chat and have been pretty happy with them. But I haven't tried using them as 2fa provider, they may be blocked by places that block common voip providers.

> 1L Zen 3 Ryzen 7 PRO APU

What computer is this, if you don't mind sharing? Sounds great for getting 1 or 2 and hosting a lot of VMs.

It's Singapore, as mentioned in the description (and the prices are quoted in SGD).

You can register a .no domain through a broker similar to how whois privacy at most registrars works: the broker is the registrant but then affords you full control of the domain.

> Just about any unused animal part was used.

I can't logically see this particular aspect as anything but a pro rather than a con. Shouldn't we make use of every bit of an animal and reduce waste as much as possible? A video essay talking about Jamie Oliver's War on Nuggets [1] makes an argument better than I could about why this specific point against mechanically separated meat might not at least be consistent. Not to say there aren't other valid reasons to be against mechanically separated meat (or meat as a whole).

[1]: https://www.youtube.com/watch?v=V-a9VDIbZCU

Here's a great breakdown I saw linked on twitter when Townscaper came out: https://observablehq.com/@severo/every-other-pixel-is-a-line

I think the JP to US prices increased specifically, and more than any other price increases Japan post might have made. Japan Post removed the US from an existing shipping zone and marked it as its own shipping zone with higher prices. I have a statement from a US shipping provider (PirateShip) about the increase of outgoing USPS shipping prices that likely also explains the increase of incoming international mail as well:

> In late 2019, the US government threatened to pull out of the "Universal Postal Union," which is the international treaty that sets what postal services pay each other to trade mail & packages. This started a negotiation where the USA required the ability to "self-declare" the shipping rates it would charge other countries, instead of them being set by the treaty. This resulted in other countries "self-declaring" rates, too... all of which made international shipping through USPS way more expensive than it already was.

Have you considered setting up a distributor/forwarder in the US? The only relatively fast services I know of operating from Japan to the US right now (DHL + FedEx Priority Intl) are expensive for sure, but the prices become more economically feasible at larger parcel sizes and weights. Shipping one large batch to the US and then splitting packages there might be an option. (Japan Post Seamail is also an option (as the only available offering right now from JP), but currently takes 2-3 months to arrive).

I import a good number of items from Japan as a small business. Happy to chat more about the little context I have about both JP->US shipping and US domestic.

b: The author did file a DMCA takedown notice. The issue in this case is that the GitHub user filed a DMCA counter notification which states they have a good faith believe the takedown is incorrect or invalid (under penalty of perjury). I am not a lawyer, but it seems to me that the GitHub user may have perjured themself.

d: One does not need to file any documents in order to have a copyright over a work in the US, it is an automatic right given to creators over their original works. Authors do, however, need to file with the Copyright Office before suing for copyright infringement.

In this case, the author did submit a DMCA takedown request, but the Github user then submitted a DMCA counter notification stating that, under penalty of perjury, they have a good faith believe that the takedown is invalid.

As I understand it (and I am not a lawyer, this is not legal advice), the only next step available is to use the US court system to sue for copyright infringement and perjury.