jim201

I used to dread this approach (it’s part of why I like Typescript monorepos now), but LLMs are fantastic at translating most basic types/shapes between languages. Much less tedious to do this than several years ago.

Of course, it’s still a pretty rough and dirty way to do it. But it works for small/demo projects.

The book Amusing Ourselves to Death by Neil Postman seems really relevant here. The thesis is that different modes of information are best suited to different tasks. Postman argues that television is best suited for entertainment. So the programs that do well on TV will naturally tend to be entertainment.

That book was written in 1985, but the core observations are also applicable to modern cellphones (which have become, for the majority of users, entertainment devices).

Postman then talks about how our communication systems have degraded as a result of entertainment being the strength of our current modes.

Fantastic read.

Looks like they’re positioning themselves as an open-source Roblox competitor. That would be awesome. Especially so if they follow through on the promise of standalone mode.

I’m interested in how they’re sandboxing C# code. Seems like an engineering problem full of pitfalls. I’ll definitely be peeking at this!

No excitement here for any “discount” announcements—just cynicism about our device freedoms being restricted by two duopolies.

Antitrust action is badly needed in this area. It is ridiculous that I need permission from my device manufacturer to install software on hardware I own. There is no viable alternative than to live in Apple and Google’s ecosystems. This duopoly cannot be allowed to keep this much control of the mobile platforms.

This is the way. It’s a pain to manually disable the checks, but certainly better than becoming victim to an attack like this.

Pardon my ignorance, but isn’t code signing designed to stop attacks exactly like this? Even if an npm token was compromised, I’m really surprised there was no other code signing feature in play to prevent these publish events.

“This undermines the entire point of the open graph protocol (at least for images). If you have to manually review every image that you include then what's the point in it being a machine protocol?”

Bingo.

Ianal but it feels like if you provide an image via an open graph link, you’re implicitly licensing that image to consumers of the Open Graph protocol to be displayed alongside a link/link metadata.

If the media company didn’t have the rights to relicense that image for consumption via Open Graph and/or the original licensor didn’t want their images appearing via Open Graph, that media company shouldn’t be using Open Graph.

That is such a frustrating situation. I hope the courts would have ruled in your favor but I understand why you chose not to test it.

I’m glad that there are distros catering towards less techy people. Linux needs this. But I take issue with selling open source projects that could otherwise be downloaded for free.

The $48 Pro version resells open source software (Blender is mentioned on their website) and slaps on a few themes. Even if legal, this just seems highly unethical.

I am concerned that the App Store has become the norm. For many young people, iPhones and iPads have been their only computer. Many have never seen a world where app developers can distribute independently. The NYT had an article out about ruling, and the number of people supporting the App Store was astounding.

I think Apple has done a great job marketing the App Store as the reason for the security/UX of their platform, when in reality, it's the OS. It's the OS that requires apps to get permission before accessing my location, it's the OS that isolates apps from each other, it's the OS that provides an easy way to install/uninstall packages.

The confusion between benefits of the OS/benefits of the App Store combined with many peoples' unfamiliarity with third party distribution has made it more difficult to convince people of the merit of these antitrust suits.

“Real developer” label or not, it is now easier than ever to dream up, build, and ship an app. And at the end of the day, that’s all that matters—-what you ship. Just seems incredibly gatekeepy to devalue someone’s work based on the tools they used to build their product.

Yes, “vibecoding” still has issues (and likely will for the forseeable future). I’m sure the next decade will be an absolute boon for security researchers working with new companies. But you shouldn’t dismiss people based on their use of these tools.

And other commenters are right that these expensive infra tools can be replaced later when the idea has actually been validated.

Author claims that this same hack is used widely, including by apps on the Play Store like Snapchat and Facebook.