Earlier quoted context omitted.
Don't get me started
[flagged]
Don't do this here.
NPM won't publish packages containing the word keygen
211–220 of 269 posts
Re: NPM won't publish packages containing the word keygen
#212Earlier quoted context omitted.
That sounds completely different. Blocking the word 'keygen' accomplishes absolutely nothing and is clearly stupid. Blocking build scripts absolutely stops a major attack vector.
Malicious unchecked code in postinstall can just be moved to runtime so blanket blocking postinstall is as effective a solution to supply chain attacks as the solution of blocking npm packages with the word "keygen" in them is to the problem of .... js based keygens??? There are many legitimate purposes for postinstall scripts yet the anti-postinstall crowd acts like they solved security issues with this one easy ste…
Runtime can be anything from browser to quickjs to Node in a docker. In many such cases the only time code runs on your dev machine completely unsandboxed is install scripts.
Yes it is good to never install malicious NPM packages anyway but if you develop for any of those runtimes and you do not bother to check dep tree the anti install script crowd saved your ass.
Re: NPM won't publish packages containing the word keygen
#213Earlier quoted context omitted.
I don't see the problem, it's a perfectly cromulent word.
[flagged]
I mean, just to push one onto the stack...
> When disagreeing, please reply to the argument instead of calling names. "That is idiotic; 1 + 1 is 2, not 3" can be shortened to "1 + 1 is 2, not 3."
> Please don't post comments saying that HN is turning into Reddit. It's a semi-noob illusion, as old as the hills.
> Don't feed egregious comments by replying; flag them instead. If you flag, please don't also comment that you did.
Re: NPM won't publish packages containing the word keygen
#214Earlier quoted context omitted.
Postinstall scripts run without any interaction before the developer has any chance of reviewing the code. They are a very bad thing.
"any chance"??? I can't square this circle of someone being paranoid about postinstall script but at the same time thinks the first chance to review dependency code is after doing a `npm i`. Check the git repo of the library you are installing beforehand if you're so paranoid about postinstall. And above that, never install any library for which the source is not readily available. This is the most basic first line o…
[deleted]
Re: NPM won't publish packages containing the word keygen
#215I thought buttbuttination taught everyone how incredibly stupid this is 25-30 years or so ago already? But no. Just a few years ago I tried to enter an answer into a Hungarian Q&A site recommending to take the Algeciras-Tangier ferry and the answer was refused. https://en.wiktionary.org/wiki/geci
At the dawn of the search engine age I was in Japan, and so I spent some time not being able to learn about shitake mushrooms, as was a common western spelling at the time (they are not shi-ta-ke mushrooms, they are in fact shi-i-ta-ke mushrooms, hence the spelling change, even though we still pronounce them wrong). You couldn’t say shit on the internet. I mean what the fuck.
"shi-i-ta-ke" is not very accurate. It's a long vowel, and the word has three syllables.
But english mostly ignores long vowels, hence the alternate spelling.
Re: NPM won't publish packages containing the word keygen
#216Earlier quoted context omitted.
Everyone did, but Microsoft continues to be terrible. Replace Edge with GitHub or npm or vscode and see what a trap this is. - npm sends images you view online to GitHub - vscode bakes a VPN into npm and turns it on - The dark defaults of npm - vscode records editing (browsing) history in InPrivate mode Azure or OpenAI seem even worse. And Windows has a lot of Edge-like things built into it, including how it tries to…
Did you reply to the wrong comment?
[deleted]
Re: NPM won't publish packages containing the word keygen
#217Earlier quoted context omitted.
Thanks. That shader doesn't seem to play nicely with some GPUs and I'm still working on edge cases. If possible, could you look at your console logs and email me your specs? They should be logged. Email is in bio. It should be doing automatic categorization of the GPU to determine render quality, but maybe something's still incorrect there.
The pixel shader is cool, but consumes too much resources. On my 1080Ti, uses about 20% of GPU to render, which is too expensive for such a simple graphics. I’ve looked at the source, and it seems you’re doing too much computations there. Metaballs are usually rather simple, and they don’t require any trigonometric functions. Compute something like `sum( ball.z / length( pixel - ball.xy ) )` and apply the threshold.…
this works fine for me on mobile brave
Re: NPM won't publish packages containing the word keygen
#218Earlier quoted context omitted.
20+ years of this handle online without problems, and I found out trying to sign up for Stern Pinball Insider that "bint" is a dirty word: https://en.wiktionary.org/wiki/bint
Really isn't, it's about the same as calling a woman a cow.
Wrong.
Usage varies, but "bint" more commonly is akin to "b*tch", and is used in a very coarse and derogatory manner.
Love how you're trying to justify degrees of acceptable misogynist terms, though /s
Re: NPM won't publish packages containing the word keygen
#219Earlier quoted context omitted.
I don't see the problem, it's a perfectly cromulent word.
[flagged]
FYI, barking orders at people and swearing at them because you're personally offended by something said in humor, is much more stupid, and is arguably more unwelcome here than GP's comment.
Re: NPM won't publish packages containing the word keygen
#220Earlier quoted context omitted.
I remember a conversation with some using an in-house file transfer system “Oh you won’t be able to send more than X GBytes, at that point the chances that the base64 encoding contains a banned rude word become too high, and the transfer will fail”
Maybe it's time to convert base64 to high UTF8-areas. I guess there won't be any keyword-filter yet for ancient egyptian hieroglyphs. I'm curious whether there are already emoji-filters...
Matt Grey & Tom Scott had to build an emoji filter, I believe. https://www.youtube.com/watch?v=GsyhGHUEt-k