HN user

eurleif

3,600 karma

Founded Omegle.com. (The original; no affiliation with any current service using the same name or a similar one.)

Posts3
Comments1,197
View on HN

You seem to have the restrictiveness backwards? The MIT license (uutils coreutils) is less restrictive than the GPL (GNU coreutils), and the AGPL is more restrictive than the PostgreSQL license.

And it doesn't violate the PostgreSQL license to license the rewrite more restrictively. That's part of what makes MIT-style licenses less restrictive than the GPL or AGPL: they allow for more-restrictive relicensing.

I had to drive a rental car for a bit recently, after getting rear-ended, and I was shocked to discover that it defaulted to recirculation mode every time it was turned on, regardless of whether you'd turned it off the previous time. I felt light-headed in it a few times before I realized I needed to manually turn recirculation off every time. Horrible behavior, and I don't doubt that it's responsible for many accidents.

To go even deeper into the weeds: this is only true of "simple" requests[0]. Requests that aren't "simple" always require preflight approval. This is based on which requests a <form> or link could already create without approval; since the dawn of time, <form method="post"> could submit a potentially-destructive request, and sites needed to protect themselves against that via XSRF tokens; so CORS could allow submiting the same class of requests without preflight approval, and not introduce any new attacks. But there's no <form method="delete">, for example, so CORS would have created attacks against previously-secure sites if it had allowed DELETE requests without preflight approval.

[0] https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/COR...

The part you may be missing is that cookies exist.

User visits A.com, types in their username and password, and a cookie is set in their browser. The browser will send that cookie back to A.com with all subsequent requests, and A.com's server will use it to enable access to the user's account.

Now the user visits B.com, which makes a request to A.com/private_user_data. The user's cookie is sent with this request, so A.com will respond with (and B.com will receive) the user's private data without the user consenting to this at all (not even in a "misguided" way).

The part that would violate guarantees in JavaScript is not function objects being kept alive longer, but function objects which should be distinct not being so.

    function foo() {
        return function() { };
    }
    console.log(foo() === foo()); // This must log `false` in a compliant implementation

The linked Google policy states:

We won’t give notice when legally prohibited under the terms of the request.

The post states that his lawyer has reviewed the subpoena, but doesn't mention whether or not it contained a non-disclosure order. That's an important detail to address if the claim is that Google acted against its own policy.

A very long time ago, I had the idea to set up a joke site advertising "SpamZero, the world's best spam filter", with a bunch of hype about how it never, ever misses spam. When you clicked the download link, the joke would be revealed: you would get a file consisting of `function isSpam(msg) { return true; }`.

Apparently that's not a joke anymore?!

The documentation doesn't make this entirely clear, but I think these are two separate things: the original `edit` command which is built into Windows 11 (and has been built into prior Windows releases), and a replacement written in Rust that can optionally be installed.

Note that my link is dated 2023, whereas Wikipedia says that Microsoft Edit was first released in 2025: https://en.wikipedia.org/wiki/MS-DOS_Editor