https://www.bbc.com/future/article/20260218-i-hacked-chatgpt...

Any gotchas or regrets?

Haven't used it in many years and now considering going all in on making it (scaffolding of) next DE. So looking at the same move.

Does anyone know if the SwissMicro models support operating on larger numbers than 16 bits, ideally up to 64?

LLVM IR is a better example.

https://en.wikipedia.org/wiki/Intermediate_representation#La...

https://en.wikipedia.org/wiki/Intermediate_representation#La...

netsurf

Would you mind sharing the source code?

> Copy API keys

...yeah, I think that'd be a hard requirement. I don't think there is value in a cliboard-as-a-SaaS that is not self-hostable or even auditable.

I think you are putting the cart before the horse and putting your users at risk by integrating credit card payments before sorting out the basics.

There is certainly a balance there. If every function inside your code is now considered part of your API contract, almost anything is a breaking change and you can basically forget about ever meaningfully refactoring that codebase.

Many times making things private or marking them as internal-only is the right call.

I'm not really intimate enough with libsodium to judge if they made the right cut there or not in hindsight.

This is not true but it would be nice if it was.

https://news.ycombinator.com/item?id=46443199

I just installed fresh chromium and firefox in a clean Linux VM and typed "google.com" (and a few others) in the URL bar with tcpdump running and they both initiated with TCP port 80. Can confirm that the https-only setting is disabled for both when looking in settings/preferences.

> HTTP is only used as a fallback.

Separately, using HTTP as fallback makes the whole thing mostly pointless security-wise. If an attacker can MitM port 80 it is very likely that they can also interfere with 443 to silently force a protocol downgrade. STRIPTLS.

SMTP STARTTLS has the same problem. ISPs and authorities have been known to harvest email traffic by the same technique.

We don't really need HSTS to address most scenarios. Just have browser not attempt http:// for addresses in the address bar unless explicitly specified. Have it try https:// without falling back to http://.

HTTPS-by-default with fallback is not a good default setting since it's vulnerable to the above attack. Strict HTTPS-only is not a good default setting since it prevents legitimate http traffic on internal networks. HSTS adds problematic edge-cases. It's hard to fathom that none of the major browser vendors seem to have figured out the obvious solution to just stop inferring http:// unless asked for.

One benign example of something that can break after merge even if each branch is individually passing pre-merge. In less benign cases it will your branch merged to main and actual bugs in the code.

One reason to not allow "unclean merges" and enforced incoming branches to be rebased up-to-date to be mergable to the main branch.

You probably want to run the checks on each commit to main in CI and not rely on them being consistently run by contributors.

You do you but I find rebasing my branch on main instead of merging makes me scratch mybhead way less.