SpaceManiac

require that the crate content match the [commit] hash.

If you want to audit a crate, you don't need to require that it "matches" anything else, you can just audit the crate. Download the source tarball from the same URL that Cargo would and audit it. I think the problem with crates.io is that it just gives you the GitHub link (possibly misleading - bad!) and doesn't just give you a button to download or browse the tarball that Cargo actually uses (what you see is what you get).

Defining "matches" and enforcing it against a remote Git repository is non-trivial. It gets worse with NPM because those packages are sometimes the output of the Typescript compiler or Webpack, so now you need reproducible builds (a huge task) and a CI infrastructure to validate them. Nuget distributes .dll files, which often aren't even open source. There's no hope to enforce a correspondence with a Git repository there. A developer who wants to audit a Nuget package has no choice but to decompile it.

NPM clearly has a malware problem, and Cargo will eventually have one because it really wants to be like NPM. I'm not convinced that what you propose is the solution.

I think I remember discussing this briefly in #rust with you. It's clearly not the case that "everyone understands" how these package managers actually work, but I'd rather see the reality become more obvious than give up and shackle these package ecosystems to Microsoft even harder than they already are.

The situation is unfortunate, but the grievance is legitimate. I regularly have to provide tech support to users when shell scripts fail with a terse "Permission denied" trying to invoke Python because the Windows Store launcher is higher on %PATH% than the Python that they just installed.

Your macro can expand to line!() or file!() calls as needed, which will reflect the call site.

By serving a JPG file rather than an HTML document.

It seems like in practice the biggest problem is "it got deleted", and everything else is about either preventing others from deleting your stuff or preventing yourself from deleting it out of laziness or frustration.

Deploying a web site with (S)FTP works as well as it ever did... and is just as obscure to non-technical people as it ever was. Ease of use means loss of control.

To be pedantic, the Unicode standard disrecommends the use of a BOM in UTF-8-encoded documents rather than declaring it invalid.

Antialiasing (nominally) makes text easier to read. Motion blur makes everything it's applied to harder to see.

This is the case. With an addon that deletes most but not all homepage items or sidebar recommendations, YouTube does some noticeable spinning trying to fill the space which keeps getting emptied.

In this scenario you'd be losing all your backlogs and user registrations anyways, so why re-use the existing client with a stapled-on redirector over switching to something you can actually deploy yourself?

I've been meaning to write a proper blog post for a while, but in the meantime here is a gist with notes[1] and the code in context[2].

[1] https://gist.github.com/SpaceManiac/79a507858fbe3946a0c40e99...

[2] https://github.com/SpaceManiac/HamSandwich/blob/emscripten/s...

I recently ported an early-2000s 2D game to WebAssembly and old Asyncify was too clunky and the Emterpreter was too slow to be useful. To get things working comfortably I ended up porting the game loops to use Clang's support for the C++ coroutines TS, with a simple scheduler that yields control back to the browser after every screen flip. I will have to see if this new Asyncify can do any better.

MSYS2 has been distributing a native Windows port of bash for years; it's completely stable and works great (it's the one used in Git Bash). "Maturing quickly" refers to the reverse-Wine/integrated VM situation that MS is developing in WSL.

purely because the internet companies are also content companies

I have no doubt this is a reason, but most ISPs also oversell their bandwidth. If every customer with a 10Mbit line is only using it 10% of the time, your upstream lines only 'need' to be 10% of 10Mbit * the number of customers (plus whatever margin for spikes).

It's senseless to store files that don't have user-facing meaning in My Documents. I know games that use it varyingly for web caches, shader caches, binary config files, debug logs, Lua scripts, downloaded mods, and even executables. And while arguably most gamers understand what save files are, they can't be double-clicked to open them, so I don't consider them documents (Maybe this is pedantic).

All this kind of stuff is what Appdata\Roaming and Appdata\Local are supposed to be for.

DVDs have region locking. The United States and Canada happen to be in the same region, and there are bypasses, but technical controls against importing digital goods are already normalized, and I doubt this analogy will convince policymakers.

I'd argue that it's the practice and not the principle of auto-updates which is unsound. Automatic security patches make a lot of sense in the current security climate, but once that infrastructure exists it is irresistible to use it for random feature creep and marketing.

The author means making compute time on the hardware available to run CI builds on their service. If you care about porting your software to RISC-V enough to want to test that software there, hardware is probably a more accurate harness than qemu.

Most YouTube copyright complaints are not actually DMCA complaints. The complainant is just asking YouTube nicely (whether that be manually, automated on their side, or automated on YouTube's side) and YouTube is complying of its own volition. 4J of their terms: "YouTube reserves the right to discontinue any aspect of the Service at any time."

This is basically what Netflix used to be before the existing distributors realized they wanted in on the new action. The same pattern is playing out in games as well, though slower. Origin, Uplay, Battle.net, and most recently Epic are all trying to cut in on Steam's dominance and using exclusives as leverage to do it.

I imagine most people don't want to see everything, but want to see ten things which are split across five different streaming services (with five different bills, five different user interfaces, and five different sets of quirks) by nothing but licensing. Television is not necessarily fungible.

10 characters each is a depressingly low limit. Many usernames and project names exceed it with no problems. Imposing such a nonsensical sanction on someone for lighthearted fun also seems... odd, to say the least.

The "survey ship" in the Galactic Civilizations series looks pretty much exactly like the USS Enterprise.

In my experience, keeping software and firmware aggressively up to date is far more likely to randomly break functionality and workflow and require my time and effort to fix than doing nothing and crossing my fingers I'm not subject to a zero-day. I can't even imagine how annoying this would be for someone without technical know-how. I think manufacturers who seem desperate to trick users into installing updates could go a long way by reducing the associated dread.

Yes, I can't speak to when but Twitter displays a very obvious "You have been blocked by this user"-type message instead of their tweets if you attempt to view their profile.

"Honeypot mpaa operatos could sue torrent users more easily"

Irrelevant, since Comcast already hands this information over to such parties willingly.

Reminds me a bit of a process I've been wrestling with to redeem a "rebate" (gift card to a chosen retailer from a list) on an online textbook, negotiated between the professor and the textbook company after the semester start. The stakes are a little lower ($15 rather than a car) but the hoops they make you jump through, and the personal information they want, for what is ostensibly your money definitely make it feel just as scammy.

Thanks for the tip. Maybe if I complain with just the right tone I can get them to stop injecting "you have used 75% of your monthly bandwidth" popups into my HTTP responses >:(

This was the original reason for the language choice: native compatibility with Bukkit plugins.

This is the big one. Glowstone was designed to be a native implementation of the Bukkit API (back when it was still on top), and I assure you that that API, and thereby every plugin built against it, makes some heavy single-threadedness assumptions.

Even if you conceive an API from scratch, Java hasn't the tools to prevent plugin authors from doing things they shouldn't in this regard.