536 karma · joined February 20, 2021
If I believe in your mission, I am open to engineering work. I prefer systems languages and deeply technical/mathy problems, but I'll write Typescript with minimal complaining for a good cause.
Why is it probable? Does it even need to continue to be rolled out for that damage to be possible? Two genuine questions which I know none of us really have the answers to.
A question being experimented on by what seems to be an alarming share of professionals who use social media. We'll see. I suspect it will depend on the context. If you weren't going to review a change anyway, and wanted the outcome, the team committing it won't perceive a negative outcome, whether it has been had or not. But hey, they'll be "using AI," and so will be compliant.
I love the subtlety of the dual-use closing-parenthesis here.
I don't think automatic updating is a good idea at all. It's just the honor-system, and trust is a security flaw.
> If you’ve added the package to your imported then odds are your next step is going to build it. Thus negating any benefit.
I actually think this is the benefit! I don't need to go to a website to see what changed, I can just have a look at the code. The best dependencies have a changelog. Ideally I can look at a diff.
> I think you’re being too charitable here. I think Russ Cox just didn’t want a package manager because C doesn’t have one. But ended up relenting after everyone nagged the Go team for years afterwards.
That's entirely possible.
> So how do you know if a Go package has been compromised when the only source of truth is the compromised origin?
Fair point, and probably worse in this future we're in now that NIST is drowning in CVEs and has turned away from some share of them.