A "source-available" license that says you can't fork the project, which means it is illegal to click the fork button on GitHub (which is a violation of the GitHub ToS) and also makes it impossible to create any pull requests without push access to the original repo. Source
Oh yeah, I remember that whole fiasco from a few months back.
The collaborative sharing nature of these platforms is a big advantage. (Not just VS Code Marketplace. We have this with all extension and lib and program package managers.)
Current approaches revolve around
reporting
manual review
automated review (checks) for flagging or removal
secured naming spaces
The problem with the latter is that it is often not necessarily proof of trustworthyness, only that the namespace is owned by the same entity in its entirety.
In my opinion, improvements could be made through
better indication of publisher identity (verified legal entities like companies, or of persona, or owned domain)
better indication of publisher trustworthiness (how did they establish themselves as trustworthy; long running contributions in the specific space or in general, long standing online persona, vs "random person", etc)
more prominent license and source code linking - it should be easy to access the source code to review it
some platforms implement their own build infrastructure to ensure the source code represents the published package
Maybe there could be some more coordinated efforts of review and approval. Like, if the publisher has a trustworthiness indication, and the package has labeled advocators with their own trustworthiness indicated, you could make a better immediate assessment.
On the more technical side, before the platform, a more restrictive and specific permission system. Like browser extensions ask for permissions on install and/or for specific functionality could be implemented for app extensions and lib packages too. Platform requirements could require minimal defaults and optional things being implemented as optional rather than "ask for everything by default".
Minification is a form of obfuscation. It makes it (much) less readable.
Of course you could run a formatter over it. But that's already an additional step you have to do. By the same reasoning you could run a deobfuscator over more obfuscated code.
Very interesting. A trove of experience and practical knowledge.
They were able to anticipate most of the loss scenarios in advance because they saw that logical arguments were not prevailing; when that happens, ""there's only one explanation and that's an alternative motive"". His ""number one recommendation"" is to ensure, even before the project gets started, that it has the right champion and backing inside the agency or organization; that is the real determiner for whether a project will succeed or fail.
I love Nushell in Windows Terminal with Starship as an evolution and a leap of shell. Structured data, native format transformations, strong querying capabilities, expressive state information.
I was surprised that the linked article went an entirely different direction. It seems mainly driven by mouse interactions, but I think it has interesting suggestions or ideas even if you disregard mouse control or make it optional.
They're claiming this being representative of the rust space and that rust is being pushed to drive out expense seniors. You think that's a valid point to make?
How am I supposed to remember those?
On word boundaries? But that would be way too predictable!