gred

Emergent product roadmap in action.

Do you mean A&E the television channel?

Conservative bias in the media.

Depending on how you count, something like 96%, 94%, 65% or 87% of mainstream media employees lean left. Of course this matters less and less as customers tune out and their influence wanes.

https://ballotpedia.org/Fact_check/Do_97_percent_of_journali...

Thanks for the link. However, a 7x size differential does not fully explain a 100x security incident differential -- although I'm sure it's part of it. Some of the root causes are very hard to address (e.g. a very limited standard library which encourages dependency explosions), some are just hard (e.g. established cultural norms around version pinning and upgrades, well-established reliance on install scripts) and some are easier (e.g. small tool improvements like min-release-age). I'm personally not going to touch npm with a ten foot pole in the next year or two, but I'd love to see significant improvement, so that I have that option again in 2 or 3 years. Stay safe!

Days since last malicious packages in NPM: 0 (evergreen)

Days since last malicious packages in PyPI: 30

Days since last malicious packages in Maven: 120

I'm sure this isn't 100% accurate, and there are probably better metrics (average number of malicious packages per year, average number of developers affected per year, etc) but they aren't as easy as a quick Google News search.

We're halfway there!

New PR: revert GitHub software and infrastructure to version of June 1st, 2018.

New PR: disable new user signups for 6 months

HR initiative: all future KPIs automatically require three-nines availability; all bonuses are forfeited, regardless of accomplishments, if annual availability falls below target

HR initiative: fire CEO and CTO

The thing keeping maven safe for now is that most people pin [...] versions

Yes, and also the signing of JARs that are uploaded to the repository, and the fact that most release processes are not fully automated, and the batteries-included standard library which reduces the total number of dependencies, and the fact that a run-of-the-mill third-party library can't execute code at build time, and the very small number of people with credentials to publish new versions of major Maven plugins, etc.

Your example of security issues in Maven is... npm guys setting up processes to auto-publish infected npm packages into the Maven Central repository?

Wake me up when the daily npm security breach headlines are typosquatting stories, not RCE-on-build or RCE-on-upgrade.

There are npm supply chain exploits in the news every other day. I'm honestly surprised that something as decentralized as Go Modules is more reliable, but here we are. The fact that we're not seeing these stories about e.g. Maven is not at all surprising, given the limited need for third party libraries and the culture of careful upgrades in the Java ecosystem. If npm proponents want the ecosystem to survive, they need to demand / create better and stop making excuses.

The future may be distributed quite unevenly here, as they say, with a divergence between a small amount of "responsible" code in systems which leverage AI defensively, and a larger amount of vibe-coded / prompt-engineered code in systems which don't go through the extra trouble, and in fact create additional risk by cutting corners on human review. I personally know a lot of people using AI to create software faster, but none of them have created special security harnesses a la Mozilla (https://arstechnica.com/information-technology/2026/05/mozil...).

They should have had the UTF-8 guys tackle IPv6. Talk about elegant.

run your systems outside of Spain

So much for digital sovereignty :-)

Disagree with so much here. But if, in your mind, the US is turning authoritarian, this is a "cut off your nose to spite your face" move. They should be taking the fight where it most needs fighting. They should not be making donors like myself question whether we still share objectives.

they have been silenced by the platform

Where do you see that? All I see is a claim that it no longer makes sense from a financial standpoint (but no comparative numbers provided for the other platforms they are keeping, which is sus, especially given their presence on very niche platforms like Bluesky), and vague justifications based on identity politics and "community care" loci, which is either nonsense or deep argot unsuitable for the intended audience.

He's saying that they have ideological concerns beyond the ideological concerns you would tend to associate with the EFF (digital privacy, open source, patent trolling, etc). I for one am sad to see that this is the case. There are fewer and fewer organizations protecting civil rights without being dragged into left/right tribalism.

this obviously doesn't make any sense

That's debatable, but it's a moot point; it's pastiche, so it doesn't have the same goals or motivations as the original.

https://en.wikipedia.org/wiki/Pastiche

Three years too late, in my case. I've moved on.

Madrid, Spain. It's theoretically very EV-friendly. These days I tend to rent hybrids. I don't even care if the battery actually works. They check the "green" legal checkbox which allows you to go downtown without getting a ticket, and you can rely on the ICE engine to get you where you need to go.

Practicality beats enthusiasm for 95% of car use.

About two years ago I rented an electric car for a few days. I felt like I wasted a ton of time finding a charging station, jumping through phone app hoops to get the charging process started, and then waiting for the car to charge. I've stayed away from electric rentals since, even though they're often cheaper.

It's the Supreme Court that has expanded the powers of the President

Sort of, but Congress also wrote a bunch of pretty broad, vague laws, delegating a significant amount of power to the executive via agency rulemaking, and it turns out the agencies are part of the executive branch and have to do what the head of the executive branch says they have to do (within the limits of those broad, vague laws). If Congress can't get back to smaller, simpler, more specific laws, and they continue to pass the burden of this complexity over to the executive branch to figure out, the executive branch will continue to wield outsize power.

AbstractCommandlineParserFactoryBeanServicePatternFactory

...Locator

Thanks for the links.

Regarding "real presence", and speaking only for myself as a Christian who doesn't believe this -- my attitude to this is similar to my attitude to disagreements on creation in 6 days vs 6 eras, disagreements over where the end-of-times millennium will fall in the overall sequence of events of Christ's return, and disagreements on how or whether to celebrate Christmas.

For all of these topics I have a belief, and I'll argue it happily, but I also know that none of these are central to salvation. I'm not so sure about Mariology, which seems to veer dangerously close to idolatry and appears to cloud Jesus' central (and exclusive) role in salvation.

It's a little ironic to label a call to "stop adding new things" as a "new thing" itself, no?

Many Catholics believe that Mary was born without sin (immaculate conception), never died (assumption into heaven), can advocate to Jesus for believers (intercession) and has been crowned the Queen of Heaven. This goes well beyond "admiring" or "honoring". To complicate matters, many of these dogmas were only formalized by the Catholic church in the past 200 years. Quite a hard sell for the "sola scriptura" contingent.

I have a few really good hardware ideas, but I don't believe I could ever market them fast enough and far enough to make it worth spending the R&D to make them happen.

Isn't this why patents exist?

If the telephone replaces errand boys, should it also pay taxes?

Linux's DRM Panic "Screen of Death"

"There is no particular reason to do it in rust, I just wanted to learn rust, and see if it can work in the kernel."

https://www.phoronix.com/news/Linux-DRM-Panic-QR-Codes

Women: surgery to extract eggs

Men: wanking into a tube

I assume you're talking about malware uploaded to new artifact coordinates (possibly named so as to try to confuse users), not hijacking of existing artifact coordinates (group ID, artifact ID)?