Question for the devs in here...something I've been thinking about a lot recently. So I see that OP linked out to a public github repo...but when downloading the actual bundle, what's a quick way for me to determine that what I'm installing on my mac is actually the same as what's in the public repo? It's always seemed like a loophole to me ready for (potential) exploitation.
>> Ship project.
>> Link out Github repo on the static site somewhere
>> Gain trust instantly as users presume the public repo is what's used behind the scenes
Disclaimer: I'm a web dev and don't know a single thing about native MacOS software
I sign my binaries on macOS with Apple codesign and notarize - and with Microsoft's Azure trusted signing for Windows. Both operating systems will actually show you a lot of warning dialogs before running anything unsigned. It's far from perfect - but I do wish we'd get more into the habit of signing binaries, even if open source.
I'm relatively new to the world of node. Is there anything objectively wrong or should I say nefarious with that this Jon person is doing? I guess, what's the issue here, from your perspective, if he's creating package (that albeit are simple) but some some amount of utility?
In my view it is objectively wrong to create trivial npm packages yes. If we look at the npm ecosystem as a commons, that person is polluting it. Of course you could say it's namespaced to one account, so what's the harm? In my view, plenty:
- package searches will show these packages due to the inflated usage from transient deps.
Each dependency causes work for any serious use. You got to check license, got to check for updates, risk supply chain attacks (package disappearing, package replaced with bad code, ...) etc. which causes longer term cost.
In addition abstraction of trivial checks, makes it harder to see the limitations of said routine. How well does it work on numeric strings? How well on large numbers where float properties cause issues?
I am VERY curious to see how this recursion plays out, but I'm seeing the below error.
RuntimeError: This app has encountered an error. The original error message is redacted to prevent data leaks. Full error details have been recorded in the logs (if you're on Streamlit Cloud, click on 'Manage app' in the lower right of your app).
I work for a YC (S21) company, as an employee and not as a founder, so I immediately sent the article to one of the cofounders to gauge his thoughts on Oleksii's experience, purely out of my own curiosity.
Being the kind of mentor that he is, Colton sent me a highly detailed, point-by-point analysis on everything Oleksii touched on.
I loved it and told him that instead of having his perspective exist merely in our private discord DM, he should put it in a twitter thread and share it publicly, since a second perspective is always useful, thus this post.
According to CNN sources Russian government officials requested adding Vadim Krasikov to Griner/Whelan prisoner swap ("Krasikov was convicted in December of murdering a former Chechen fighter, Zelimkhan "Tornike" Khangoshvili, in Berlin's Kleiner Tiergarten in 2019 and sentenced to life in prison.")
We have a little over 550 wallets on Hedgehog, but if you see a wallet missing from the site, let us know. Takes us about 10 minutes to add a new one into the system
