HN user
I took a closer look; uv installs the inline required packages in it's cache directory `~/.cache/uv` (if they are not already there). So the packages will probably exist until the cache is cleared with for example `uv clear`.
It's not that the inline requirements make a new `.venv` directory or something, uv seems to link the packages to a central location and reuse them if already there.
Is Hacker News also affected by this act?
It does not make sense to value these kind of (web) bugs by their potential price on the grey market. I think its better to value these bugs by their potential impact, although that is hard to express in money.
In this case there were 4 billion email addresses on the line from being scraped, imagine if this was exploited and the data was leaked. The news would hit the headliners which would definitely be bad for Google's reputation and stock price.
However, the impact of the leak is not that high as it only consists of a channel <> email address mapping, and therefore I think 10k is a fair price
Sorry, I somehow made a typo in the quoted text, the RFC says
Verifiers MUST be able to validate signatures with keys ranging from 1024 bits to 4096* bits
I tested this last year, they properly reject mails signed with DKIM keys from <1024 bits
The latest RFC does require it though (RFC8301):
Verifiers MUST be able to validate signatures with
keys ranging from 512 bits to 2048 bits, and they MAY be able to
validate signatures with larger keys.