In sampling and statistics, I’m pretty sure there are terms for that. To account for the fact that not 100% of the population are being sampled. Hmmm, I wonder what that term is.

I ask the inverse. Why should you demand that every project that uses x.y.z versioning be a semver? A widely held standard only applies if you actually want to follow it in the first place. You know HTTP spec didn’t mention anything about the body in GET requests and so almost every web server just ignores body on GET? Yeah, some software decided to use that. And guess what? That software? It was Elasticsearch. People are free to do whatever they want with their software. If they decided to publish something non standard and you decided to use it, you can ask them nicely to follow standard, or make an adapter for it.

Whoa. Thanks a lot for the in depth explanation! I really appreciate it. I do come from a time when HTML didn’t even have a semantic tag and CSS was still having difficulty of styling combo box across browser. Good ol times of PHP “SSR” as the modern development calls it. I moved to more backend development stuff with occasional hardware/firmware so that’s why I am so rusty when it comes to web front end stuff. However, I am now opening my own company and I want to understand the technology that I will actually use even if I will hand it off to a front end person eventually.

Thanks a lot. One follow up tho if I may. How do you determine the markup and styling if the layout changes significantly from browser to desktop? Do you ship 2 different versions of the HTML and style them accordingly? My struggle is often about how to make the HTML and CSS so I don’t repeat anything if possible. One example is having a list of navigation links in HTML once should be enough and show correctly on desktop and mobile via CSS only. But that is how a lot of UI frameworks usually do it. They have 2 different navigation markup. One for mobile as a drawer and one for desktop as a navbar. Only one is active at a time. The navigation link list is usually defined as a JS object but I don’t feel like that’s the way to do it properly.

Woah, that’s very generous of you. I have a question tho. I have a dual screen setup. What is in your opinion the best DX to develop for both mobile and desktop at the same time? My current approach is having an editor + docs + devtool on one screen, the website on the other with full screen. When I need to check how it looks on mobile I turn on the mobile mode thingy but I always felt it is kinda jank

xz is a bit silly too. Someone maintain it alone and look what almost happened. He got peer pressured to almost hands the project to malicious actor (which probably also by social engineering)

V1.2.3 is not unique to semver tho. So it could really be anything like linux 7.1.2. To be fair, linux does predate semver by a long time. But the point is that not every software with #.#.# needs to be semver. And I think better-auth, from the issue linked, has stated that they don’t yet follow semver somewhere in their docs.

Damn, what’s the movie name again? With Tom Cruise cloned and all?

Edit: It was oblivion

Naah, I don’t really demand anything if the author breaks something on update. I just asked if the breaking changes are intentional and if there’s a workaround. Failing that, I revert and look for other libraries or roll my own. To me Open Source is always about making something you love without any obligation. Not even to follow semver.

I wonder if XSS, CSRF and other client side attacks are still common

So in other words, it is just his pleasure

*Badum, tsss

Honestly, the wave of system integrator and people making SFF build to compete with steam machine already puts steam at the advantage. They already released SteamOS for every other desktop, that means system integrator and pre built can also make SFF with console like experience

Do you even read the premise? The premise is that if they are subsidized. So imagine the same spec for 500-600

Is it? Or is that an advantage for office? Where people only need a browser, ms office suite, and probably adobe pdf. Heck, I bet software development work can be done there. Some light CAD (emphasis on light), and maybe even some graphic design work (not video editing tho). Office also cares about efficiency and with the right consumer it is appealing to have 150-200W power sip compared to 200-350W when you install 50-100s of them.

Read. The issue is if they are subsidized

The problem with valve subsidizing it, is that it will make it an attractive choice to those that are not buying it for gaming on steam. After all, it is still just a pc. You can literally do some real work there unlike a console. It may even fall into a company that provides pc leasing service if they are cheaper than some dell or HP or any other mid spec pre-built.

Sure reviewing changes is easy. But the problem is that it is still a review. You need to have an understanding of what exactly is being done and to account for any oddities that may or may not be because of the quirks of upstream. That’s why I mentioned that AUR trust models should be made like pacman for most helper. We trust the maintainer of Arch so why can’t we trust other people too? Take PPA, the trust model is exactly that. You trust the maintainer. At the very least make it an option that you can choose on first run

All of that wouldn’t have any effect if the aur helper mimics the model of pacman. Trust the maintainer, not the build script. By requiring users to review PKGBUILD every time it changes, it encourages laziness. But by requiring the review only once then trusting the maintainer, it helps a lot because the only way an attack can be done is directly attacking infrastructure (pushing malicious script bypassing the auth) or hacking the account (author turning malicious). Both of those are hard with a properly configured system or not worth it because it requires a long game (like those of xz attack)

I feel like with WebRTC API it is already possible to fingerprint the network so no need for BSSID. They just need the database of that instead of BSSID

Adding stuff is easier than patching existing implementations is probably the reason why. Because up until this point, the webserver can just ignore the GET body request but if the client starts sending with body then who knows what bug might surface that turns into security vulnerability.