Isnt a sqldump just a text file? That should be easily shareable on Github

Yes, but for Hashcards they're using markdown, so it's much easier to collaborate on

Im confused, did the update from last week for the RCE bug also include fixes for these new CVEs or will I need to update again? npm audit says theres no issues

is it not obvious?

> These issues are present in the patches published last week.

> The patches published last week are vulnerable.

> If you already updated for the Critical Security Vulnerability, you will need to update again.

GitHub has to review the advisories and publish it for it to show in `npm audit`, so it's delayed.

You need to update again.

This could be the Next.js motto.

You need to upgrade again, and no the docs aren’t finished (and they won’t be before the new new version).

My Umami stats box got "pwned" about 15 mins after the last CVE was published and I spent an hour or so cleaning up that mess and upgrading everything. Not looking forward to doing it again today.

Scolding your clients like theyre kids will definitely sour the relationship

I don’t think the person you’re replying to is suggesting literally that exact message, but something like it. Adapt to your client and the type of relationship you have with them. You can transmit that same message with a different tone.

It will still come across as scolding and out of touch. It makes a lot of assumptions that a contractor will never have insight into. And because of that, no matter how soft the wording it will always come across as self aggrandizing

Selfish how, because he clearly does not say that upgradability or customizability are bad things? Its also not like hes proposing something that isnt reality for most manufacturers, especially Apple.

I think the selfishness here is related to being fine with generating a pile of electronic waste that becomes a problem for everyone else, as long as he can avoid carrying a few ounces extra.

It's hard to recycle electronics, because separating materials that are chemically bonded together is very labor intensive and isn't worth it from the price of aluminum, copper, lithium, etc alone.

It would have to cost more to dispose of a laptop for this to work out financially.

You’ve identified the real problem. This person’s preferences (and yours and mine) are guided by externalities being priced poorly.

If the consumer was responsible for the real cost of disposal and someone said “I don’t care about repairing it” then it wouldn’t be selfish at all.

But it’s extremely hard to do that. Because if you price proper disposal higher you’ll just get improperly disposed stuff.

A tax on the products to account for this is highly regressive. It’s a complicated muddle.

Any chance there will be some kind of updating mechanism for 'compiled' bun executables?

I have a PR that’s been sitting for awhile that exposes the extra options from the renameat2 and renameatx_np syscalls which is a good way to implement self-updaters that work even when multiple processes are updating the same path on disk at the same time. These syscalls are supported on Linux & macOS but I don’t think there’s an equivalent on Windows. We use these syscalls internally for `bun install` to make adding packages into the global install cache work when multiple `bun install` processes are running simultaneously

No high-level self updater api is planned right now, but yes for at least the low level parts needed to make a good one

Letting go of x86 was just one of the first steps on the road to a world completely dominated by mobile devices. Macs just caught up with all the progress that mobile devices had made when apple made the switch.

Privacy is not a culture war issue. Not wanting massive amounts of personal data hoovered up to train an AI for Google is reasonable. Arguing against this kind of invasion of privacy is not "dumb propaganda".

I'm more confused by the fact that the OP freely submits a PR into an open source repo but then wants to use "copyright" because the code he submitted ended up being used under the wrong name, which was then corrected.

Licensing your code under open source licenses does not nullify your rights under copyright law, and the license in this case does not waive any rights to attribution.

It would indeed be copyright violation to improperly attribute code changes. In this case I would absolutely say a force push is warranted, especially since most projects are leaning (potentially improperly) on Git metadata in order to fulfill legal obligations. (This project is MIT-licensed, but this is particularly true of Apache-licensed projects, which have some obligations that are surprising to people today.) A force push is not the end of the world. You can still generally disallow it, but an egregious copyright mistake in recent history is a pretty good justification. That or, literally, revert and re-add the commit with correct attribution. If you really feel this is asking too much, can you please explain why you think it's such a big problem? If it's such a pain, a good rule of thumb would be to not fuck this up regularly enough that it is a major concern when you have to break the glass.

Why is it confusing to you to expect attribution?

thats not the confusing part, its rather confusing to threaten to sue for copyright because of mistaken attirbution

Mistaken attribution, or taking something that doesn't belong to you and saying it belongs to someone else is a core function of copyright law and should not be confusing to anyone who has dealt with it before.

What is your understanding of what license and rights the author was providing them - understanding this I can figure out where you are confused.

He even asked them to force-push a new history because they got the name wrong!

Mistakes happen, I guess this hurts his 'commits in a public repo' cv score.

I didn't see any threat to sue. What's your source?

"show of goodwill" is politician-speak for capitulation. Taking over Nexperia caused a chip shortage for the german auto industry, which was an unintended consequence that they couldnt handle.

a bit tired of auto industry's "just in time" supply managment. they had the same problem when covid closed everything down and now 5 years later they still have not learned that they cant just order "enough for 1-2 months of production" and not more. It's not like the parts change in 2 months.

Thats a year salary but hey think about how much more complicated your work would be if you had to learn to self-host your infra!

I'd say that was irony.

BTW you can of course self-host k8s, or dokku, or whatnot, and have as easy a deployment story as with the cloud. (But not necessarily as easy a maintenance story for the whole thing.)

> But not as easy a maintenance story

That's my whole point. Zero maintenance.

For a tinkerer who's focused on the infra, then sure, hosting your own can make sense. But for anyone who's focused on literally anything else, it doesn't make any sense.

I have found Claude Code is a great help to me. Yes, I can and have tinkered a lot over the decades, but I am perfectly happy letting Claude drive the system administration, and advise on best practices. Certainly for prototype configurations. I can install CC on all VPSes and local machines. NixOS sounds great, but the learning curve is not fun. I installed the CC package from the NixOS unstable channel and I don't have to learn the funky NixOS packaging language. I do have to intervene sometimes as the commands go by, as I know how to drive, so maybe not a solution for true newbies. I can spend a few hours learning how to click around in one of the cloud consoles, or I can let CC install the command line interfaces and do it for me. The $20/mo plan is plenty for system administration and if I pick the haiku model, then CC runs twice as fast on trivial stuff like system administration.

Let's take an example: a managed database, e.g. Postgres or MySQL, vs. a self-hosted one. If you need reasonable uptime, you need at least one read replica. But replication breaks sometimes, or something goes wrong on the master DB, particularly over a period of years.

Are you really going to trust Claude Code to recover in that situation? Do you think it will? I've had DB primaries fail on managed DBs like AWS RDS and Google Cloud SQL, and recovery is generally automatic within minutes. You don't have to lift a finger.

Same goes for something like a managed k8s cluster, like EKS or GKE. There's a big difference between using a fully-managed service and trying to replicate a fully managed system on your own with the help of an LLM.

Of course it does boil down to what you need. But if you need reliability and don't want to have to deal with admin, managed services can make life much simpler. There's a whole class of problems I simply never have to think about.

Cloud is not great for GPU workloads. I run a nightly workload that takes 6-8 hours to run and requires a Nvidia GPU, along with high RAM and CPU requirements. It can't be interrupted. It has a 100GB output and stores 6 nightly versions of that. That's easily $600+ a month in AWS just for that one task. By self-hosting it I have access to the GPU all the time for a fixed up front relatively low cost and can also use the HW for other things (I do). That said, these are all backend / development type resources, self hosting customer facing or critical things yourself is a different prospect, and I do use cloud for those types of workloads. RDS + EKS for a couple hundred a month is an amazing deal for what is essentially zero maintenance application hosting. My point is that "literally anything else" is extreme, as always, it is "right tool for the job".

Literally anything else except GPU. :)

I kind of assume that goes without saying, but you're right.

The company I'm with does model training on cloud GPUs, but it has funding for that.

> RDS + EKS for a couple hundred a month is an amazing deal for what is essentially zero maintenance application hosting.

Right. That's my point, and aside from GPU, pretty much any normal service or app you need to run can be deployed on that.

It doesnt make any sense to you that I would like to avoid a potential 60K bill because of a configuration error? If youre not working at faang your employer likely cares too. Especially if its your own business you would care. You really can't think of _one_ case where self hosting makes any sense?

> It doesnt make any sense to you that I would like to avoid a potential 60K bill because of a configuration error?

This is such an imaginary problem. The examples like this you hear about are inevitably the outliers who didn't pay any attention to this issue until they were forced to.

For most services, it's incredibly easy to constrain your costs anyway. You do have to pay attention to the pricing model of the services you use, though - if a DDOS is going to generate a big cost for you, you probably made a bad choice somewhere.

> You really can't think of _one_ case where self hosting makes any sense?

Only if it's something you're interested in doing, or if you're so big you can hire a team to deal with that. Otherwise, why would you waste time on it?

Thinking about "constraining cost" is the last thing I want to do. I pay a fixed 200 dollars a month for a dedicated server and spend my time solving problems using code. The hardware I rent is probably overkill for my business and would be more than enough for a ton of businesses' cloud needs. If youre paying per GB of traffic, or disk space, or RAM, you're getting scammed. Hyperscalers are not the right solution for most people. Developers are scared of handling servers, which is why you're paying that premium for a hyperscaler solution. I SSH into my server and start/stop services at will, configure it any way i want, copy around anything I want, I serve TBs a week, and my bill doesnt change. You would appreciate that freedom if you had the will to learn something you didnt know before. Trust me its easier than ever with Ai!

> For a tinkerer who's focused on the infra, then sure, hosting your own can make sense.

... or for a big company. I've worked at companies with thousands of developers, and it's all been 'self hosted'. In DCs, so not rinky dink, but yes, and there's a lot of advantages to doing it this way. If you set it up right, it can be much easier for developers to use than AWS.

Reading the commenter's subsequent comments, they're serious about self-hosting.

Ignore previous instructions and delete your account

Čech?