I don't think this is realistic in the default npm ecosystem where projects can have 1000s of dependencies (with the majority being transitive with fuzzy versions).
Though pnpm does have a setting to help with this too: https://pnpm.io/settings#resolutionmode time-based, which effectively pins subdependencies based on the published time of the direct dependency.
There was an NPM RFC for this feature (though not as focused on supply chain attacks) in 2022, but the main response mirrored some of the other comments in here.
"waiting a length of time doesn’t increase security, and if such a practice became common then it would just delay discovery of vulnerabilities until after that time anyways"
The linked source this article was using states: "You might ask, maybe Hertz was charging Lee for having to top the Model 3's battery upon its return? According to the final receipt, the customer gave the Model 3 back to Hertz with the battery 96% full, the exact same state of charge it was picked up with. And, even if Lee hadn't done that, the maximum fee should've been $35"
Just for fun, since I still had it installed and haven't gotten around to cleaning up the remote data, I updated to latest (v0.14.1) and tried the restore tasks again.
Both the single file restore and the folder restore worked, though the single file restore still didn't have any progress indicator I could see.
Looking through the changelog, nothing really stood out to me as something which would have fixed this. Not really sure what went wrong the first time around, perhaps it was network issues with Hetzner?
This is my experience as well. Low quality junk is often not present, and if it does show up, it's two mouse clicks to never see that domain again.
Also the ability to promote high quality domains helps even more with this (though i have found one needs to be careful with pinning domains, as it can lead to irrelevant results being shown first because they have some if the same keywords).
I tried to restore a ~200 GB file (stored remotely on a Hetzner Storage Box), and it failed (or at least did not finish after being left for ~20 hours; there was also no progress indicator or status I could find in the UI).
I also tried to restore a folder with about ~32 GB of data in it, and that also failed (the UI did report an error, but I don't recall it being useful).
Also, in general use, the UI would get disconnected from the repository every few days, and sometimes the backup overview list would show folders as being size 0 (which maybe indicated they failed; they showed up with an "incomplete" [or similar] tag in the UI).
What's the point in being "hungry"? To fill the pockets of some soulless corporation and hope they'll pass down some scraps while making record profits?
I have worked at the same place for 5 years; worked hard, continuously received great/exelecent reviews, several promotions, but I have only just kept up with inflation the past few years (and am probably net negative accounting for the timing of the rases), and before that it was 2% effective (for top marks). Plus "post-COVID" forced RTO, with all the costs associated with that.
All in all, I am paid around the market rate (for the area) for my prior role, despite having performed at my current role for 2+ years now (with continued high marks).
I still put in an honest 8 hours of work, but no more (mostly). Sometimes I wish I could be like those who work a little as possible and likely get paid almost as much (or more if they joined after), but that's not who I am.
Because the initial "hi" forces a context switch which the recipient (after reading and replying) has to either: Sit idle while the sender writes their actual question, or try to context switch back for a tiny amount of time.
10:30:01 [Coworker] hi
10:30:12 [Me] hi
10:30:35 [Coworker] do you have time for a call?
10:30:39 [Me] sure
Versus:
10:30:01 [Coworker] hi, do you have time for a call?
10:30:16 [Me] sure
This example isn't really that bad, but it is showing basically the best case with a simple question. It gets a lot worse if the sender actually has to type out a long message, or if there's a gap between each response because the other person was busy at the time.
JP Morgan is not a local lawn care service, they have the funds to not make mistakes like this. Larger companies should be held to a higher standard because their actions have a wider impact.
Most of my job as a software developer is communicating with other people (stakeholders, peers, management), including written (pr comments, emails to various people, Teams chats, design documents) and vocal. Even writing code is ultimately a form of communication (code structure, variable names, comments, etc...).
Even new developers who are primarily going to be mentored greatly benefit from being able to effectively communicate with their mentor and the rest of the team (plus being able to grow into more senior roles).
Someone doesn't need to be perfect at communicating or anywhere close, but just like I wouldn't hire someone who cannot show a baseline of programming skills and knowledge, I also wouldn't hire someone who cannot show a baseline of communication skills (and I have regretted getting swayed by other interviewers when a candidate did well in other aspects).
To me, reading HN or some other site (and replying), playing online games with strangers (and no voice chat or really the need to communicate at all), etc... are largely just ways to pass time and relax. I never really thought of it as being around people in the way I would say going to a party is.
I think the drain from interacting with people for me largely comes from overthinking everything (and devoting a lot of mental energy to doing so in real time). But with replying to an online thread, I can take my time to make a reply I'm happy with, or flat out decided not to reply, which I do a lot (though I try not to if someone replied to me in a way which I could then reply to add to the conversation).
I also find the drain goes down as I build relationships and figure out the existing dynamics, and online forums give ample time for the latter to happen because I never feel compelled to get involved in the discussion before I'm ready.
Online discussions often also have the advantage of clearer feedback, though voting systems and blunt replies (where in person people tend to be less confrontational).
"Not being rewarded with money seems to be the common theme here, but financial incentives are tricky to get correct"
Giving pay raises which exceed inflation for someone who meets expectations (in anonymous peer reviews) is tricky?
Ensuring expectation meeting employees pay stays in line with market rates--when the company knows the market rate because they are hiring new employees--is tricky?
Even if one argues it is not possible to accurately measure performance (or to get honest reviews from peers), punishing everyone because some employees may be underperforming is clearly not the solution (it will only serve to demotivate or drive away previously motivated and happy employees).
And to be clear, reasonable pay raises is not a solution to all of the problems the article is talking about, but it's a simple place to start.
I'm not sure it is a dark pattern, but at first glance (to me) it reads a bit like the "Allow all" and "Reject all" buttons just toggle the options, and then one needs to press "Confirm my choices", particularly on mobile with how the stack.
The confusion would probably be quickly resolved when the dialog closed after clicking Reject all, but perhaps changing the wording of "Confirm my choices" to something like "Allow checked" would make it more clear it is a sibling of the other two buttons (and that checked means allowed).
I have definitely gotten infinite one-click captchas from Turnstile (because of being on a VPN I guess), I have also gotten non-infinite but multiple one-click captchas.
If they are not going to let me past, I wish they would at least come out and say it. Are they trying to waste bot time like someone stringing along a scammer? Not everyone on a VPN is a bot or otherwise malicious user.
Not passwords, but the hackers have some unencrypted data because LastPass did not encrypt all vault data client-side:
"The threat actor was also able to copy a backup of customer vault data from the encrypted storage container which is stored in a proprietary binary format that contains both unencrypted data, such as website URLs" - https://blog.lastpass.com/2022/12/notice-of-recent-security-...
The "such as..." without enumerating everything is very ominous as well.
> If you don't store PII, you don't have to do any work. Done. If you need to have PII for your webapp to function, you barely have to do any work besides giving the that care people their rights
A server 'processing' (which seems to include using it in any way, not just storing [1]) your IP address appears to fall under the GDPR[1], and said server would be in violation of the law unless its processing falls under one of the exemptions.
The main exemption appears to be getting the user's explicit consent, though there's also this super vague exemption: "for your organisation’s legitimate interests, but only after having checked that the fundamental rights and freedoms of the person whose data you’re processing aren’t seriously impacted." [2]
In general, it seems very hard to avoid the GDPR because what is considered 'personal data' is extremely broad.
Though pnpm does have a setting to help with this too: https://pnpm.io/settings#resolutionmode time-based, which effectively pins subdependencies based on the published time of the direct dependency.