Well. That's what a merge commit is.

Your approach is nearly identical to creating a merge commit, except the pointer to the second parent (the "original branch") is indirectly recorded via the PR link, instead of directly inside git.

If you create merge commits, then you have your "clean main branch" (via git log --first-parent), as well as the extended history with all the source commits (via git log). And as a bonus, merge commits are supported by every git host, and they work the same in all of them.

I think the whole "squash merge vs merge commit" discussions would be a lot less prevalent if --first-parent would be how git and git hosts displayed commit histories by default. :(

Let's say the attack becomes hugely succesful and the worm spreads to thousands of devices. GitHub/NPM could just revoke all compromised tokens (assuming they have a way to query) stopping the worm in its tracks. But because of the Dead Mans Switch, they'd know that in doing so, they'd be bricking thousands of their user's devices. So it effectively moves the responsibility to revoke compromised tokens from a central authority that could do it en-masse, to each individual who got compromised, greatly improving the worm's chances of survival.

Is Google that organization? Because they themselves have decided that they are. I think what people are worried about is that Google is positioning itself to be the judge, jury, and executioner within such a licensing framework, not necessarily the licensing itself.

> This is just to address malicious code.

Yes, and if Google had shown that it's capable of identifying and rejecting malicious code distributed via its own app store, then maybe their proposed expansion of that security program to the entirety of the Android app ecosystem would carry some weight. But as it stands, their Play Store is full of user-hostile and often malicious apps[1].

> If you publish software for a private group of people, there should be no restrictions. If you're publishing it on a platform that would expose your software to billions of people, get a license after id verification

But that's exactly the opposite of what Google is doing, here, and why people are mad. Google isn't adding a new policy to their app distribution platform (the play store that grants exposure to billions of users), but rather they are forcing ID verification on any form of app distribution: If you want any regular user to be able to install your code, no matter how small the audience, you'll need to first give your identity to Google, and obtain a (paid[1]?) license. So the restrictions do apply to "a private group of people" too.

The crux, and what has people up in arms I think, is the overreach of Google's peoposed licensing policy to cover not only their own app distribution ecosystem, but all others targeting Android.

Many technical users of Android consider it to be a general purpose computing platform, and they want to retain the freedom to install and run whatever software they trust.

Google should focus their supposed concerns about regular user's safety on the user-hostile apps that they allow to exist in their own app store, rather than grasping for broader control that they'll "probably use at some point but only for good things like user security".

1: https://f-droid.org/en/2025/09/29/google-developer-registrat...

The goal is to linearlize unary function application, not to make all code look better.

All we're asking for is the ability to rewrite that as `2 |> Math.sqrt`.

What they're afraid of, my understanding goes, is that people hypothetically, may start leaning more on closures, which themselves perform worse than classes.

However I'm of the opinion that the engine implementors shouldn't really concern themselves to that extent with how people write their code. People can always write slow code, and that's their own responsibility. So I don't know about "silly", but I don't agree with it.

Unless I misunderstood and somehow doing function application a little different is actually a really hard problem. Who knows.

We wanted a pipe operator that would pair well with unary functions (like those created by partial function application, which could get its own syntax), but that got rejected on the premise that it would lead to a programming style that utilizes too many closures[0], and which could divide the ecosystem[1].

Yet somehow PHP was not limited by these hypotheticals, and simply gave people the feature they wanted, in exactly the form it makes most sense in.

[0]: https://github.com/tc39/proposal-pipeline-operator/issues/22... [1]: https://github.com/tc39/proposal-pipeline-operator/issues/23...

  Technologies: Functional Programming, React, Node.js, Linux, NixOS, JavaScript, TypeScript, Haskell, fp-ts, io-ts, effect-ts, rxjs, Deno, Docker, Git, CouchDB, MySQL, PostgreSQL, ElasticSearch, Fluture, Sanctuary, Ramda
  GitHub: https://github.com/Avaq/
  Résumé/CV: https://altshift.win/
  Email: aldwin/at/altshift.win

I can design and/or build you a system, offer consultancy and code reviews, or coach your development team to improve development processes and code quality.

  Location: Rotterdam, the Netherlands
  Remote: Yes
  Willing to relocate: Unlikely
  Technologies: Functional Programming, React, Node.js, Linux, NixOS, JavaScript, TypeScript, Haskell, fp-ts, io-ts, effect-ts, rxjs, Deno, Docker, Git, CouchDB, MySQL, PostgreSQL, ElasticSearch, Fluture, Sanctuary, Ramda
  GitHub: https://github.com/Avaq/
  Résumé/CV: https://altshift.win/
  Email: aldwin/at/altshift.win

  Location: Rotterdam, the Netherlands
  Remote: Yes
  Willing to relocate: Unlikely
  Technologies: JavaScript, TypeScript, React, Linux, NixOS, Haskell, Node.js, fp-ts, Deno, Docker, Git, CouchDB, MySQL, PostgreSQL, ElasticSearch, PHP, Laravel, Fluture, Sanctuary, Ramda
  GitHub: https://github.com/Avaq/
  Résumé/CV: https://altshift.win/
  Email: aldwin/at/altshift.win

I've been leading small teams for the last eight years, focusing on developer enabling work such as process management, devops, software architecture, and coaching.

I'm very passionate in particular about functional programming, and I'm hoping to coach teams when it comes to the cross-over between functional programming and software architecture - something a lot of developers who are new to FP struggle with.

Although I have been involved in a huge variety of software types, I'm particularly well-experienced when it comes to real-time, offline-first web-applications and real-time data processing.

I'm looking for (ideally) part-time (up to 28h) freelancing opportunities.

[1]: https://github.com/fluture-js/Fluture

This question really got me thinking, because I've always envisioned a plot as well, but the phrase always made sense to me.

I realized that I think of x being "mastery" and y being "knowledge required". On such a plot, you'd see a steep curve if one needs a relatively large amount of knowledge to progress to the next level of mastery.

I've never thought of it differently, and so never realized that the phrase is ambiguous until reading the article. Upon reflection, it makes much more sense plotting time on x and mastery on y when talking about learning.

What's more surprising is to see copyleft advocates positioned so strongly in favour of giving copyright that kind of reach. I think that in a different context, some of the cases you refer to would be used by these same copyleft supporters as examples of why copyright needs to be more weakly enforced, not more strongly.

If you are using it to mix a snippet of code (from a sufficiently large code base) into a large code base of your own, then you are just remixing. That is not infringement. In music, there are entire genres based on remixing. You could even take it a step further and ask yourself: what is not a remix?

Comments URL: https://news.ycombinator.com/item?id=15116722

Points: 9

# Comments: 2