theodorejb

The Big Bang is an almost infinitely malleable story, contorted to comport with almost anything we observe. But how is this useful? The predictions of this theory continually fail. The farther we look, the more we see stars, galaxies, black holes, and other structures that shouldn't exist according to this model.

What if the universe doesn't have a naturalistic origin, but was created by God? How much greater would our understanding of the world be if more scientists focused on studying present phenomena rather than trying to fit stories about the past with observed data?

Instead of questioning whether the Big Bang assumption is true, astrophysicists prefer to perform endless "gymnastics" to try to make the mounting contrary data fit their theory about how the universe began.

Only if the union is against the unethical request. In some cases the union may be for it, which makes it even harder to push back.

You don't need to join a union to push back against unethical feature requests.

I've been building PHP Handlebars, a spec-compliant implementation of Handlebars in pure PHP:

https://github.com/devtheorem/php-handlebars

I've also been developing Cropt, a zero-dependency JavaScript image cropper which works great for cropping and scaling profile images before upload:

https://devtheorem.github.io/cropt/

This can be done with curl_multi_exec(), or with $client->getAsync() in Guzzle.

https://www.php.net/manual/en/function.curl-multi-exec.php

https://docs.guzzlephp.org/en/stable/quickstart.html#concurr...

In my petrol-powered Prius I average 52 MPG, so at the current price of gas ($2.60/gallon) I pay $0.50 to drive 10 miles - less than the listed cost to drive an electric car the same distance.

How would the photosensitivity and wiring to muscles come about at the same time?

What benefit is an eye unless there is also the capability of processing and using the information? How would both evolve simultaneously?

According to the timeline it took more than a week just for Filevine to respond saying they would review and fix the vulnerability. It was 24 days after initial disclosure when he confirmed the fix was in place.

My guess would be so they don't have to embed an IP address or hostname in the malware to send secrets to, which could then be blocked or taken down.

Someone could be tricked into giving their npm credentials to the attacker (e.g. via a phishing email), and then the attacker publishes new versions of their packages with the malicious diff. Then when the infected packages are installed, npm runs the malicious preinstall script which harvests secrets from the new machine, and if these include an npm token the worm can see which packages it has access to publish, and infect them too to continue spreading.

I can testify that steamed stingy nettles with gomasio (toasted sesame seeds and salt) is very delicious.

One option to make it a little safer is to add ignore-scripts=true to a .npmrc file in your project root. Lifestyle scripts then won't run automatically. It's not as nice as Pnpm or Bun, though, since this also prevents your own postinstall scripts from running (not just those of dependencies), and there's no way to whitelist trusted packages.

Bun also doesn't execute lifestyle scripts by default, except for a customizable whitelist of trusted dependencies:

https://bun.com/docs/guides/install/trusted

I would expect to be able to download a package and then inspect the code before I decide to import/run any of the package files. But npm by default will run arbitrary code in the package before developers have a chance to inspect it, which can be very surprising and dangerous.

Human cognition was basically bruteforced by evolution

This is an assumption, not a fact. Perhaps human cognition was created by God, and our minds have an essential spiritual component which cannot be reproduced by a purely physical machine.

Yes it does, since the ignore-scripts option is not enabled by default.

Many people have non-JS backends and only use npm for frontend dependencies. If a postinstall script runs in a dev or build environment it could get access to a lot of things that wouldn't be available when the package is imported in a browser or other production environment.

In my experience, packages which legitimately require a postinstall script to work correctly are very rare. For the apps I maintain, esbuild is the only dependency which benefits from a postinstall script to slightly improve performance (though it still works without the script). So there's no scaling issue adding one or two packages to a whitelist if desired.

It's crazy to me that npm still executes postinstall scripts by default for all dependencies. Other package managers (Pnpm, Bun) do not run them for dependencies unless they are added to a specific allow-list. Composer never runs lifecycle scripts for dependencies.

This matters because dependencies are often installed in a build or development environment with access to things that are not available when the package is actually imported in a browser or other production environment.

It absolutely matters. Many people install packages for front-end usage which would only be imported in the browser sandbox. Additionally, a package may be installed in a dev environment for inspection/testing before deciding whether to use it in production.

To me it's quite unexpected/scary that installing a package on my dev machine can execute arbitrary code before I ever have a chance to inspect the package to see whether I want to use it.

Note that since PHP 8.0 the ternary operator is non-associative, and attempting to nest it without explicit parenthesis produces a hard error.

The exploit requires pages to load instantly.

How so? The page with the double-click prompt immediately changes the parent page behind it to the target location, and it can easily show a loading indicator for a couple seconds to wait for the target page to render before prompting the user to double-click.

What evidence would it take for more scientists to recognize that perhaps life didn't evolve through some evolutionary process, but was intentionally created? It seems like few ever consider that their starting presupposition may be wrong.

Property hooks are the headline feature, but they seem like something I'd rarely use in practice. It is nice to have the option available though, in case I need to add extra logic to a property without breaking everywhere that it's accessed.

I wouldn't consider all the new features small, but even many small improvements can result in a major improvement.

This is such a nice feature in PhpStorm. I hope VSCode and other editors will add support for it too.

Why did people assume that strata were deposited over eons and represent different ages? Many of these layers can be viewed in the Grand Canyon, and there is a notable lack of erosion between them. As I see it, these paraconformities are a strong evidence that there were not large gaps of time between the strata - they must have been laid down rapidly over a relatively short period (e.g. by a great flood).

Not to mention greater wear on the road and increased particle emissions from brakes and tires due to heavy batteries in EVs. https://nypost.com/2024/03/05/business/evs-release-more-toxi...