PNG/JPEG have strong support (nearly everywhere). I think of them almost as the modern TIFF - relatively simple, and almost everything supports one or both of them (few to no issues).

JXL may eventually get there (that indeed seems to be its goal), but for now I wouldn't drop e.g. PNG or JPEG support in favor of JXL now.

And arguably, perhaps never drop support; its such a prevalent format, even if all software (prevalent or otherwise) supports the format in 10 years, there will be such a huge stockpile of JPEG/PNG that something will need to be used to read/convert.

Meanwhile, a template (maybe a couple KB) costs less than a couple cents to store and run. Large Languages Models are not really interesting, (smaller) LLMs that only contain "what you need" are.

Sorry, no.

Again, hashes are by definition, insecure. I.e. you don't have a guarantee that the hash references the same commit, just a (very, very strong) probability that it does.

> Everything else would just be a crazy invitation to make supply chain attacks uncircumventable.

What? Uncircumventable? Logically equivalent, I read your statement as "So if all cars are not blue then they must be red"? This does not follow...

I like the last part of the article, which proposes a (very reasonable sounding) extension for people who care (more) about their code-sec. You should be able to swap out your hash algo without having to rebuild your content addressing system.

Separation of Concerns, people...

I don't simply mean to be disparaging - its important to security that the people making the decisions are a) competent b) can read, otherwise any "security" decisions they are making are at best probably insecure, and at worst, causing active harm and insecurity, DOS, etc...

Generally, I think you didn't read (or at least comprehend) the article:

1) Your assertion is factually incorrect. Practical proof of concepts are not "CVEs exploited in the wild". The article is not claiming that SHAttered is not correct, it in fact references it.

2) I don't think you read the article. The article claims the exact opposite, and in fact addresses the issue WRT to distribution.

3) Your sentence here is very confusing - I'm going to give you the benefit of the doubt and presume that you mean to say that the problem here is in the security of the naming. HTTPS itself has nothing to do with distribution security, that would be DNS/SecDNS (IFF you are using git+http protocol, then HTTPS is relevant, but not to git otherwise). But this is exactly what the article was talking about, the distribution is the security, not the hashing algorithm.

Possibly, it's worse than useless, even harmful now.

It's neither one you raised, nor one I was arguing...

> for the one I originally raised ("how its information and narratives are governed in practice")

Except, that's not what your comment was about at all...

Your comment pertained to your (dislike of) use of wikipedia in contrast to the relevant site (X.com).

My comment pertains to both of the relevant websites you had related (wikipedia is no more related to x.com than governments, neighborhoods, etc. that you have brought up), and to the specific reason why x.com came to be (it's current "authorship"), and how the directly related collary (grok) is not the thing you randomly brought up...

Which if there were a red herring here, it would be wikipedia (as it is not a site whose primary purpose is as a commentary website, nor it used in the same fashion)...

But for the topic you specifically brought up, this is entirely relevant, namely, your dislike of another website, and it's direct relation to the general topic at hand.

As for the rest, further nonsense. I can just as easily flip the subjects in each statement and they will remain true...my (factual) statement stands.

That's what Grok as for.

Apples and Oranges...

Everyone using something was never a (good) reason to use it.

Apologism at best. People have been bemoaning this issue for a while now..., pre-AI even.

First time I'm seeing this defended from an "oh you're just anti AI" perspective (which, ironically, is exactly the sort of bare minimum a couple comments over was bemoaning)

There's no need for pushback, there was no technical information realy shared in the OP (no work shown or explained).

And I think the fact that the work was done by the aforementioned slop machine is telling....

But how dare I point this out, time to grab the pitchforks... bemused smile

When you outsource to the slop machine, you don't have anything interesting to say (usually).

I think AI bots are perfectly capable of replicating arbitrary barriers to entry, they can and will decide which (real or not) CEOs to interact with.

Of course, people are a part of the problem, never said they weren't. But when you ask how did Bobby from marketing commit murder, it's pertinent if he used a crowbar or a glock. Sure, neither are "evil" on their own, and I'm not saying that bootstrap is bad.

It's just the footgun that made it that much more likely...

If you want a "why" for the human side of the equation, well I'm not a marketing guy, the TV show Mad Men seems to offer an interesting perspective as to what makes a marketing department "good", vs just another latte drinking "vibe" shop. My hypothesis being, I have a strong suspicion certain parts of that culture no longer exist, and have mostly been replaced with number-seeking.

Bootstrap.

That framework did more damage to web design than any other framework. Yeah, its nice that you can spin up a page in a second that looks like every other page on the internet, wait a minute...

Technical answer:

CSS

It was a nice idea, and it sure beat hand-designing each and every page (wait a second, weren't/aren't we doing that all over again?).

It did/does too much, and was mostly in lieu of a common repository of UI stuff, so people found One Way that it would work reasonably well on most browsers/devices, and so bootstrap was born...

Its not to say that its not impressive, but its fairly isolated to a specific family of processors from 2013.

Its been long documented that these systems are attempting to monitor you, even if you did not sign up for the service or interact with it.

I.e., you are categorically incorrect.

When did you agree to be sold without representation and a contract, again? Something about malicious contracts nobody reads? Pretty sure that behavior remains...criminal.