eXpl0it3r

I know there are different culture around TV usage, with some families having the TV always on and some not even owning a TV. But if not using the TV while the baby / toddler is in the same room is too costly in investment and energy requirement, I personally would spend some time reflecting on my TV usage habits.

If the device renderings are fetched from assets.openlogi.org, it's technically not telemetry free, though I guess we can trust the author to not track every call?

A local runner would certainly help, but only to some extend. When you need to support multiple OS (Windows, Linux, macOS) and architecture (x64, arm64), not everything can be tested locally.

Hardly anything malicious ... yet and even that's debatable.

Yes, when you proxy anything through Cloudflare (CF) you give up on having your contents encrypted as CF terminates the TLS endpoints, but going from this to changing the content of the served site and injecting JavaScript is quite a big step and likely not what a lot of people would want nor expect. Your JavaScript-free site becomes a site that ships JavaScript without you knowing or having done anything.

Additionally, this introduces additional tracking of users, which a lot of people don't want.

And finally, there's the slippery slope. Today it's RUM, tomorrow it's ads or something else? Once CF starts modifying the user's content, what's stopping them from doing it more and more?

If you navigate to the domain itself, then to Analytics > Web Analytics there's a Quick Action for the RUM Settings.

Are CVE really a good thing for open source projects?

No doubt is it a good thing to have issues reported and fixed, but CVE feels a bit like blackmailing maintainers - either you fix the issue or we get your project flagged with "security scanners".

I guess, my distaste mostly originates from randomly assigned high CVE numbers that don't reflect the actual threat. And the fact that it gives the companies which use the code "AS IS" an imaginary stick to hit open source maintainers, until they fix the issues for the company (for free of course).

If it's an open source project that has been used by others, please consider giving out maintainer access to others (now or later).

It's sad, when projects are abandoned and a whole bunch of users would be willing to (partially) maintain it, but the key holder implicitly or explicitly decided that nobody else should have access.

Forks are not he same: It's very hard to get enough traction with existing users and the discoverability is terrible.

As maintainer I won't be able to give you an unbiased response. The biggest difference is, that SFML is a C++ library.

What motivates me to work on SFML is, that we're building something separate from SDL. I don't think, we - as in the general developer world - do anyone a favor in consolidating everything into one library (why use X, when Y does the same?). Additionally, I think it's a very interesting "field" of trying to provide a common API across different OS; and sadly it seems to be an area where few resources exist and fewer developer actually understand it, as "everyone" just uses SDL. Finally, I really like the open and welcoming community we've built over the years and at the same time, I'm happy we're not getting as much attention/pressure as SDL.

Yeah, then again most people haven't experienced this and are happy to just enable "track changes" in Word and send the document back and forth, maybe if you're lucky, it's hosted on SharePoint or OneDrive.

OnlyOffice, Nextcloud OPffice, Collabora might all have free offerings to a degree, but you'll end up at the mercy of the companies behind those tools and OnlyOffice comes with Enterprise offering that does also cost money.

Costing money isn't necessarily bad, but it's also hard to beat free & libre.

Since this uses Direct2D, is this Windows-only?

How much of the code was vibe-coded?