Social media needs to be heavily regulated to the point where it's safe for everyone, or banned entirely. I don't understand why there's this belief it should have a right to exist when basically everyone agrees it's a net negative to society.

The point is that the onus is on you to do it, and if you don't then the consequences are yours to bear. Personal responsibility seems to be in short supply these days.

https://luxtorpeda.org/packages

That's basically Torvolds full time job?

> My first CTF was HCKSYD, a 48-hour solo CTF. I full solved it and won in 2 hours. I was completely hooked. That led me to win DownUnderCTF, Australia's largest CTF, with Blitzkrieg multiple times. Blitzkrieg was one of Australia's strongest teams at the time. I later joined TheHackersCrew, an international top-tier team that was consistently ranked highly on CTFTime, the main global ranking and event calendar the scene uses as its scoreboard. With them, I competed in some of the most prestigious CTFs in the world, consistently placing well within the top 10 until the end of 2025.

Are still completely nonsensical to even those that understand the acronym

I'd want to be pretty damn confident it won't cause any regressions before sunsetting the original codebase in favor of this one.

If Linux was measurably 5% slower on all benchmarks, would that mean you wouldn't do it even if you wanted to? Is every single nanosecond of performance really that important to you? I switched 10 years ago when things were a lot rougher than this, and in the end everything still worked well enough that I never cared to swap back.

1) Package owners will often realise they've been hacked quickly, since there are releases they never authorised. This gives them plenty of time to raise the alarm and yank the packages

2. Independent security researchers and other automated vulnerability scans will still be checking the latest releases even if users aren't using them

Yes it's not a perfect defense but it would help a lot.

That's a pretty big asterisk though. Taking on a supply chain risk in exchange for reducing developer friction is not worth it in a lot of situations. Every dependency you take increases your risk of getting pwned (especially when it pulls in it's own dependencies), and you seriously need to consider whether it's worth that when you install it.

Don't get me wrong, sometimes it is; I'm certainly not going to create my own web framework from scratch, but a web request helper? Maybe not so much.

That's great for you, and no offense, but what about developers who can't get buzz in a HN thread? Are they just doomed? Why is support only available to those who can raise a ruckus on social media?

Please don't reward these companies with money.

Ok, but why is this advertised to applications in the first place? It's quite literally none of their business that developer options are enabled and it's a constant source of pain when some government / banking apps think they're being more "secure" by disallowing this.