• 0 Posts
  • 29 Comments
Joined 1 year ago
cake
Cake day: July 16th, 2023

help-circle

  • NPM allows for code to be executed while you install the package which is different from maven or nuget and allows for easy exploitation paths

    This is the winner. Combine that with a vastly bigger group of inexperienced developers (and I’m willing to die on that hill), and you have a lot of people running node / npm as an admin / root user, who have close to zero idea what they are doing, hitting their project with third party dependencies left and right for no particular reason (left-pad, is-number, ansi console and similar useless crap), and then your dependency management allows for code execution. Also, from my personal feeling, it seems that npm simply cannot properly audit the packages due to the sheer mass. From a technical standpoint it’s close to trivial to put your malware onto npm, and then you just need to get someone to install your package, which is way simpler than in other package managers







  • x1gma@lemmy.worldtoTechnology@lemmy.worldUnofficial Reddit API
    link
    fedilink
    English
    arrow-up
    107
    arrow-down
    2
    ·
    4 months ago

    Please don’t take personal offense, but you have merely a project scaffold with an unrealistic goal that will be blocked and C&D’d into the ground, without any other projects created.

    It doesn’t matter how hard you’re working on your anonymity, this project will be ripped apart by a horde of lawyers in seconds. You’re not only doing something questionable or against ToS, you’re directly attacking and sabotaging their monetization. This will not be taken lightly by the legal team of reddit.

    You want to provide a better, cooler, more robust and other random buzzwords API than the own of reddit. So, you alone, want to provide a better API than the whole team of reddit does for their absolute core product, all by scraping. This is simply not realistic.

    While we’re at the topic of monetization, scraping, ETL into your own model and providing the API - for the amount of content that reddit has (quantity, not quality) this will be a highly resource intensive task. How do you plan to fund that, since your API will be better than the official one, I can expect at least the same performance as well, right?

    And also, most importantly, even if you magically achieve working around all that and get that working - why? Who is your expected user group? Pretty much every software using reddit moved away from reddit or simply has died. AI gen content is rampant, and most discussions seem like bots talking to bots. There is literally nothing to gain from an API to reddit - so why would anyone bother using it?







  • And so be mad at Sony specifically? But they are okay with Steam having their data and selling it? Do they also not use a smart phone? Do they drive a car made in the last 4 years? Do they use credit cards? Loyalty cards? The outrage over their data use by Sony specifically is ridiculous when everything else is also siphoning the same information for no benefit to them.

    Damn, you only missed the chance for the if you got nothing to hide argument.

    If I buy a smartphone, and choose to use Android and Google, I get the benefit of all the stuff Google provides me, by my choice. I can cancel my account, and buy an iPhone next. That’s fine for me, because I chose to do that to use the benefits. If I use a credit card for all my purchases comfortably in one place, then it’s my choice. I can swap to another payment method or bank anytime. That’s fine for me, because I chose to do that to use the benefits.

    If I’m forced to create an account that does absolutely nothing for me, then I’d be pissed. Not to speak about people in countries without PSN. Where’s that written, and why did they happily sell the game to people they knew they’ll lock out? Where’s the announcement that a refund policy will be implemented for such cases?

    There’s a HUGE fucking difference between your Sony bootlicking arguments you post in every thread about this, and the actual impact of Sonys actions.



  • If you use a dockerized environment, that will only work better on Linux. .NET8 is AFAIK natively supported on Linux, so there shouldn’t be too much of an issue apart from the usual clunkyness. Visual Studio will probably be more of a problem. The “easiest” way would probably be to switch to jet brains or vscode. If you are hardstuck on VS for whatever reasons, you probably should be able to do some voodoo with running it in docker and using the container as a remote desktop, but this will be PITA to setup and maintain.



  • The Hamas-led murderous rampage into southern Israel was the deadliest terror attack in Israel’s history, killing at least 1,200 people and abducting more than 250 others. Israeli attacks on Gaza have since killed at least 33,634 Palestinians and injured another 76,214 people, according to the Ministry of Health there.

    Jesus fuck, Germany is paying symbolic money to roughly as many genocide survivors in Israel as people have been murdered and injured by Israel committing genocide.

    The current German government is an absolute fucking joke, and they are doing everything to actually show it.


  • Again, you may quote the FSF, but there are too many users of open source, as well as developers, who got into it for the reasons I stated. I can assure you that they are not doing it so that corporations can profit off their software without giving back.

    If you are developing open source, you are not necessarily developing FOSS. If you are developing FOSS, you are also developing open source.

    FOSS is well defined by the FSF, and it has been for ages, and to be frank, therefore no one cares for anyone’s personal definition of it.

    What I am against is having the cake and eating it, as it’s being proposed with this licensing. Either you do FOSS, or you don’t. Either you do open source, or you don’t. Either you do proprietary software, or you don’t. It’s really that simple, because depending on your project, you take the terms that you see fitting and live with the consequences. The whole goal of this proposal was to be taken more serious as open source developers and projects, and to ensure funding for further development. Cherry picking the best parts of every model, and making irrational demands does not achieve that.

    As I said, I’m absolutely on board that open source licensing and open source development being taken for profit by corpos absolutely sucks, and the usual licensing models have not aged well with the much wider adoption and usage of open source, and there is a need for change - as it’s being done e.g. by elastic, redis and others with their dual licensing.


  • It doesn’t matter how hard you want to call it FOSS, but with this licensing terms you describe it is not FOSS, period. And to be honest, you calling out various people for not getting what FOSS is, while you fully ignore the agreed on definition by people who are actually doing FOSS is you discrediting yourself.

    You haven’t found a license like this, because your model is flawed: A licensing like this will disqualify you from any kind of usage in an actual FOSS licensed environment. Personal users, which will not be providing revenue, will not be really affected by this, and are irrelevant for your point. Corporate users, which you will mostly target by this new license probably won’t be able to use your funky new license because they will need to check with legal, and your software will need to have a lot of USPs for someone to bother with that. A 1% corpo-richness-tax will not be approved by any kind of bigger company, because it’s a ridiculous amount from the perspective of your potential customers.

    You’re taking yourself way to important. Open source software is not replaceable as a whole, but individual projects are. If you want to earn money with your project, that’s good on you, license it accordingly, but do not try to upsell it as FOSS.

    And I fully get your point, and I’m currently working on the same problem in my in-development project, and I’m not sure yet whether to dual-license it, for similar reasons you stated, and live with the consequences of providing OSS, but non-FOSS software, or do FOSS and provide it for actually free.

    Edit: Also, the xz backdoor has nothing to do with funding. Any long time maintainer (as in not just a random person contributing pull requests) going rogue can happen in funded scenarios as well.