Viewing profile — insanitybit

It's not that companies won't pay for it, it's that it is banned . Legal teams at these companies set the policy.

The issue is that AGPL is flatly banned at many companies, so now any company that even wants to test this database out is going to have to seek a contract, which they won't.

People have rapidly adopted far less tested databases when the dbs have claimed to solve real problems.

Sure, that seems reasonable enough. I'm pretty skeptical that it will happen, but it's not like it's impossible.

I'm not debating you at all. I'm asking what the model looks like since you've stated (and I've agreed) that a language model wouldn't work. I think it would make sense to explain …

And I'm asking you to describe the model.

It's unclear what you are talking about then. Because the idea of training "ciphertext -> plaintext" for language models is absolutely bonkers, so what are you suggesting?

I'm referring to the first selection process.

How much am I expected to charitably interpret the joke? They said "only", I'm taking it at face value because it's obviously intended to be commentary and the obvious implication …

> No way to prevent this says only package manager where this regularly happens "only"

Only if the jury believes in nullification, which isn't common. The jury is instructed to follow the law. The selection process asks "even if you think they were right, if it's aga…

That axiom is clearly false. AI can interact with external systems, which means it is not just compressed knowledge - it has the ability to access new information.

left-pad is totally irrelevant to this conversation.

Yes, it has nothing to do with the design of npm (relative to similar languages/ repositories) and everything to do with the popularity.

I just don't think that this is that unique to javascript, it's absolutely not about npm, and I don't think that this is well supported as a relevant feature that leads to these at…

Yeah, my point is just that other package managers aren't in a great spot. NPM even lets you separate out "publish" and "release" now where you can publish to the registry but you …

No build script control though.

162k vs millions. That's not even getting into package update velocity, authorship, the totally divergent goals, etc. I just think it's utterly pointless to compare.

Debian's scale for package distribution is tiny and explicitly curated by maintainers. Everything funnels through Debian. The goals are completely different. Debian packages what's…

I think that's barely meaningful. Which of the compromised packages would have been part of any reasonable stdlib?

Ruby is worse. crates.io is arguably worse.

I don't consider these comparable in any way that's worthwhile. The scale and goals are completely different.

Arguably crates.io is worse. NPM has cooldowns and has for a while, it has had Trusted Publishing for longer, it has human-approved releases that separate CI/CD from actual publish…

Yep, I'd recommend it.