To be fair, he did a lot of experimentation and that builds up his pantry and spice rack over time. His latest video about eating for $10 a day basically limit his spice selection too. And again, the takeaway from him is always to learn how the flavor actually combines rather than specific recipe. So you know when it is fine to substitute beef with pork for example and when it is not

This is why I like Ethan Chlebowski. He advocate to not learn recipe for home cook but straight to the basic. How to combine and mix ingredients so you can eat well with whatever you have. After you have build up those basic, then you can look at recipe so you know what can be substituted with what you have, and what you really need to have and buy new. Along the way, hopefully you’ll also be more proficient in using your knife which constitutes most of the prep time

Contractual obligations cannot override laws does not mean the law is not legally binding. It just means that a contract cannot be put on an equal pedestal as a legal basis since a law can override it. Say a consumer protection law states you have a warranty that is tied to the device and not the purchase. But then the manufacturer put ToS/contract clause stating the warranty that comes with the device must be accompanied by sales receipt as well as the warranty card. Those clauses are not legally binding and if the company doesn’t honor the warranty, you can sue them for breaking said consumer protection law instead

Because whether you agree or not, sandbox is a necessary for banking app. No other app should ever be able to EASILY (emphasis on easily) perform arbitrary read on the banking app data.

Until web standard can agree to have device bound session, it won’t happen. Cookie stealer malware is just too dangerous to perform financial transaction. So maybe for read only stuff it is fine

Coming back here from another discussion, I do find it funny now that a legal entity can choose to not pay taxes but a human cannot avoid that in any reasonable way

Hmmm, I guess it depends on what you mean by capital. Because The Linux Foundation certainly has assets that they could donate to other FOSS project

That is a good point

Why? The proof that linux exists under capitalism already proves your point does not hold

I’d say FOSS is not more political than paying taxes. FOSS is just another way of using the copyright law enforcement without which FOSS cannot exist. If no copyright law enforcement is in place, then the GPL license wouldn’t have power. So FOSS is just another way a law abiding citizen may use their rights/entitlement and perform their obligation with copyright law like how they have right/entitlement and obligation from taxes.

I only need ORM to have the flexibility of DSL table modeling for repeated fields. Think, createdAt, updatedAt, id (and the PK that comes with it), etc. After the migrations are written, I prefer to use a query builder

Every *-git package also fetch it from the repo. The apt analogy is someone haven’t been maintaining the nixpkg and then it gets adopted by someone else. Now that someone else change the build script to be malware. So it is no fault of the upstream

I know where you’re coming from when you say they are different. But I disagree on that because at the end of the day you’re still trusting other people would not act maliciously or get their account compromised. The selection process doesn’t make it any more special as demonstrated by xz in my example.

Anyone can be an AUR submitter and maintainer. Act in good faith and never become an Arch maintainer. Someone can be an Arch maintainer and be good for a few years then something happened and their account got hacked or bad blood made them act rashly.

That’s precisely what I mean when I equate AUR maintainer to the distro maintainer. To the package management system, they are both trusted. Not in the sense of how special they are or how strongly you can trust one but not the other.

Yes, and that is no different than distro maintainer that maintains the infrastructure and package. Anyone can volunteer. That’s how xz is compromised. The point is that aurto trust models mimic those of other package managers. Trusting the authors implicitly trust the code. The only other special things from distro maintainer is their PGP signatures are required to perform release on the main repo. This is better because as I stated earlier, reviewing PKGBUILDS would encourage people to just skip it. Not everyone has the time for that. But when a maintainer changes? Aurto removes the package for you to perform that first trust again on the new maintainer. This is no different than if you update the arch keyring just more manual

Well, it is just like a distro maintainer account anyway. If the maintainer account is compromised then gg for the whole distro. That’s what happens with other supply chain attacks as well and yes, I do think we need a way to fix that without compromising on ease of usability

Yeah, use and promote aurto instead. They require you to trust the maintainer and would remove the package from the local repo if the maintainer is changed

Better than bricking your installation like a certain desktop OS

It was meant for low effort cleaning. Like, “you go to work without needing to clean” cleaning

Oh god, especially true for ERP when things got out of hand

He means to ask if you tool is open sourced. If so, he wanted to look at the code