Okay... but when "you" is a junior engineer on your team and now you are suddenly spending your entire weekend dealing with malware, it's kinda on you as well.
This doesn't require anyone placing anything deliberately on your machine (as in, needing to exploit it somehow ahead of time). It could be as simple as checking out a branch to review, where the author of the branch has added the .exe.
A lot of malware was delivered back in the day via Windows AutoPlay feature. Someone plugs a USB drive in and bam, they are immediately exploited. You could say it's always a problem if the USB drive is already full of malware. However, Microsoft disabled AutoPlay in Windows 7 (and backported this fix) specifically to address this vulnerability.
This exploit feels very similar to me. I don't know if there's a specific name for this classification of AutoPlay issues.
It has nothing to do with npm. However, a binary could be configured to extract your git/npm secrets using this exploit, which could then lead to a npm supply chain attack (or pip, etc. etc.).
That might be a loophole, but in this case I don't think it matters. The emergency powers let the president do whatever they want at this point. And even if there is a law preventing endless war, Congress is completely fine with it, and has been for decades.
Right, I'm thinking along the same lines as what Zoom offers. Except with the additional feature that the link is custom tailored to a known, pre-configured user. So you also skip the "log in as guest or create an account" step.
What would be really awesome is some sort of feature where, once self hosted, I can generate a package or link that will download + install + pre-configure the login. Basically a bespoke installer/setup script. that can be linked to a particular person. The goal being to make onboarding as frictionless as possible. This could have some security implications maybe (the link is shared by mistake), but for a small self-hosted instance, that seems like something that could be mitigated fairly easily. Maybe only works with local accounts or something.
That would really make it easy to send a friend a link, "hey come chat with me", without having to worry about a response such as, "I'm already on discord, I don't want to set up all that stuff".
There is an audience for this, and it's me and my friends.
I have a small group of close friends. We are on discord just about every day, but we really don't bother with anyone outside our group, other than the very occasional invitation to another friend/coworker to join for some games.
We don't care about network effect, social media features, engagement, etc. We just want a well made application for private text, voice, and video that we never have to actually think about.
Third party apps used to work fine without an account. They kept track of your settings and filters locally. My usage declined rapidly when reddit killed them.
I agree with your sentiment, but not your conclusion. The new boss is being paid millions to explain that 14 layers of management is a bad idea... I'm sure there are thousands working in the xbox division that could have told you that one for free.
I can share nearly my entire steam library (~23 years worth) with my kids. There is no way in hell Sony or Microsoft will ever allow that. In fact, I've had to re-buy Minecraft because their account migration was such a shit show. They cannot and will not ever come anywhere close to competing with Steam on this feature. For that alone, I will never buy a console. Just glad I built PCs for my kids before the AI boom...
Overwatch released in 2016, but the merger took place in 2008. I feel like overwatch was always more of an Activision game than a Blizzard game. Or at least, pre-World of Warcraft Blizzard would never have entered that genre of gaming.
> If they need to eat or something they should get a job, presumably.
The tone of this comment is quite different from the text of the open letter to which you refer. Specifically this section. I don't have any personal knowledge either way, but this stood out to me.
> As it was revealed by Roman @rtsisyk it wasn't unusual for the Shareholders to use project's donations as their own money e.g. Alexander @biodranik paid for his personal holiday trip expenses this way. At the same time all other contributors were consistently denied any access to any financial information (even to the totals of money donated/spent). (It's fine for developers to be reimbursed for their hard work, but it should be done in a fair, transparent and accountable way.)
I have a close friend who is an officer nearing twenty years. He has not had a tendency to criticize his job. However, he has been adamant that vaccines are incredibly important for the military and the policy changes have really angered him, specifically because of the damage it does to readiness.
Legacy expectations and requirements. It's not uncommon to see that there is a better way to do something, but be unable to do it because the customer assumes and/or expects the current way of doing things. They might even be on board with the new way, but trying to include that in any sort of project budget is a non- starter.