The feedback form was open for some amount of time and closed as scheduled, there are only so many things to be said about the draft after all. All of the things mentioned in the blog post have been said hundreds of times over by this point
Where are you getting that they might accept the draft from? That seems like a particularly uncharitable reading of the follow up post
TrustedLen will mean it can safely take the upper bound, but Vec for example will still use the lower bound of the hint when something isn't TrustedLen
The idea is you read the PKGBUILD/install files so it's no longer arbitrary code, they're usually very short files. On updates you can review just a diff. AUR helpers present this to you so it's not a manual process
Many packages are compiled from source rather than using prebuilt binaries, but when binaries are fetched it is something you'd see in the PKGBUILD itself. The binaries aren't included in the AUR itself, they'd usually be from the first-party of the software you're installing. For example google-chrome[1]'s package fetches the .deb from Google's server and unpacks it
None of these scriptlets would break if a site uses WASM, they're utilities for things like adding/removing/mutating elements from the DOM, modifying localStorage, stopping alert()
executesitefunction.js could arguably be effected, but that relies on a site installing a particular function on window, which isn't required when using JS, and could be still done where the function is backed by WASM
uft8mb4 does not use more bytes than utf8mb3, for anything representable by utf8mb3 the size in uft8mb4 is identical. Anything that would be 4 bytes in uft8mb4 is not able to be stored in utf8mb3
utf8mb3 is definitely a broken subset, it's deprecated at the very least
Jumping to definition works with typescript projects correctly when this is turned on, but it's still not a solution for JS projects with definition files
The browser will start displaying the contents of a response before it has entirely downloaded. So in this case the browser sees it as a really slow server (you can see the loading icon is still there in the demo) that sends a bit of content every so often
There is quite a large downside to app bundles, that is that it requires you (the developer) to hand over your app signing key to Google. The fact that updates from the play store are signed end to end is pretty great in my opinion, this doesn't apply so much if you give away your signing key.
As far as I can tell it's not a technical reason why they ask for your key - bundletool [1] supports generating a set of signed APKs (.apks, APK set archive) in the same way the play store would from an app bundle. Android Studio's GUI could just as easily generate that to upload directly to the play store instead of an app bundle. This would net the same benefits to the end users and the same level of convenience to the developer, all whilst keeping your private keys private.
I would recommend avoiding adding your own global types if you can avoid it, for example TypeScript has a full type definition for Array.prototype.find [1]. You can enable it without changing the target and breaking things by adding es2015 to lib in your tsconfig compilerOptions
Yeah you should be able to, the minimum typescript version required and the one they test at is 2.8 for now but the LibraryManagedAttributes type is present [1]. On 2.8 and 2.9 it has no effect but if you're using 3.0 you should see it working.
Sort of - there's a jQuery API that does content sniffing called .data(), it's for storing and retrieving arbitrary data on elements. The problem was that they used this API to read from an element where they should have used .attr(), which returns a string.
Where are you getting that they might accept the draft from? That seems like a particularly uncharitable reading of the follow up post
https://foundation.rust-lang.org/news/rust-trademark-policy-...