A lot of people will only do online polling, and it's by far the easiest way to cover a lot of demographics (need to supplement with other methods as well if you don't want a poll of "internet users" - but that is a far larger and varied group than most other methods would produce)

I think it also relates to how well the "cliches" fit, and how much sense they make. Ai loves to talk about how things "land" or "the X trap" when the concept just doesn't fit with that language. It's like clickbait articles saying "what happened next will astound you" when what happened is barely surprising or entirely predictable. The only thing worse than an overused cliche is an overused cliche used wrong.

Fundamentally to me, ai writing feels uncanny as it just doesn't know what it's saying. It uses the same tone, style and cliched construction regardless of the message. If someone told you, they got a promotion, were getting married, got laid off or lost their parents all in the same tone pacing and style, they'd come across as uncanny too.

- a CLAUDE.md file when Claude CLI is detected (disable with CLAUDE_CODE_AGENT_RULE_DISABLED env var) - a .cursor/rules/*.mdc file when Cursor is detected, which tells Cursor AI to use Bun instead of Node.js and npm

Is it by default if it only does it when you have the tools installed?

Account takeovers, deployment exploits whatever the root cause, given a few days it's incredibly likely maintainers will notice they've released an unexpected update and fix/sound an alarm. A lot of existing cases like this people realise pretty fast, but the packages might still be live for a few hours as NPM catches up. Cooldown entirely removes that 'updated at the wrong time' issue, an no-one even needs to actually look at the code at all.

For inactive or intentionally malicious maintainers, yes it relies on vetting. But it's hardly a mythical 'canary' - there are already a lot of companies scanning every popular npm package, auditing new ones, or just generally analysing threats. I can think of at least 4 such companies without even trying, I'm sure there's loads more.

And they'll continue because it's not warm hearted so much as promoting/testing their security scanning services and tools so they can get the kudos from being the first to spot X etc. Which often does hit the front of HN or reddit, but they don't need the massive cyber loudspeaker to be effective. Flagging the issue to maintainers, reporting to NPM security - with a cooldown in place the package can be voided before anyone really gets the chance to install it. This is literally how a lot of things are spotted already, just with that 'updated at the wrong time' issue catching unlucky people out.

Does it solve everything? No. Will it reduce the amount of problems that make it to end users? Obviously yes.

And for all the author's 'no one will do this', 'waiting for Godot' cries - what do they recommend? Running your own audits, using LLMs, static analysis and testing it yourself. Basically being the veter they claim no-one will be! Unless they don't intend to sound the alarm themselves, they are literally the canary they're looking for.

Cooldowns aren't magic, but they're not security theater either.

You could even make it a seperate item - buy one with/without the charger, then in 2 years you decide if you want the charger or an upgrade.

But there are some interesting issues with UK <> US english, things like 'quite' which works in different ways in each locale. I was also very surprised to discover the difference in what we consider a frown - which makes a lot more sense of the US 'turn that frown upside down'. Interestingly my uncle who'd lived in the US ~20 years had never uncovered that difference till I asked him about it.

So it's good to know differences - especially when you want communication to be clear.

And this article is such Ai slop. You see the sentences? All short. All 'punchy'. All with repetition. All for maximum 'impact'. Constant unrelenting impact.

And the lists! The lists, the rolls, the lineup, the rows, the enumeration, the catalogue of examples that goes on too long for comfort, logic, joy, readability or attention.

I'd love to know how many people actually read all of this. I suspect most started skimming as it's just awkward to read, the pacing is just so Ai-y it's exhausting.

I'm never really sure the author reads things like this - I think they wrote something, asked a Ai to punch it up then skimmed it and said 'lgtm'. If you care so little why should anyone else?

Name the physical places that would accept a plain government document that says only that you are over eighteen and nothing else? None will, not because 'age was never the point', or because every bar or casino is stealing your face - but because a plain document doesn't offer any proof you are it's owner. Photo ID has been standard as age verification because it's the best way to prove the official ID actually links to the person holding it.

There are more concerns in a digital world with giving your ID / face, but the idea that the demand for photo ID proves it's all a big data grab not remotely about age is a conclusion looking for evidence.

(Plus they acknowledge some sites have done age verification where all they want is your face to confirm you look over 18 - which they then ignore, claiming it's all really a ploy to get your documents. So why isn't the site 'Never give them your documents'?)

They already answered your situation in their post.

My boss was looking at them, but even the simple ones he was pointing claude at it and asked it to make a document explaining it. Then he'd send me the document and ask me to check if it was accurate. I added a line to the last page "this is an ai summary and may contain mistakes. Use the project readme for validated information" and told him it was grand.