It was Gemini Flash, probably an even faster variant optimised for immediate response on search pages.

Showing overseas based workers of Microsoft as another company name on caller ID is a phishing risk.

Showing workers of companies other than Microsoft as Microsoft on caller ID is a phishing risk.

It might take a large org several years to migrate off core systems like VMWare. If you think the customer is likely to churn within a few years anyway it makes economic sense to hike their fee.

At any one time, something like 90% of all enterprises are engaged in at least one multi-year strategic move away from an abusive vendor. In the tech world, these might be Oracle, Broadcom, (formerly) IBM, or (even more formerly) Computer Associates.

Typically you're looking at a year or two of discovery, audits and planning, another year or two to cover the main transition, and then up to five years of mopping up.

There are other near-ubiquitous vendors (eg. Microsoft and Cisco) who manage to be tolerated as annoying rather than outright abusive. I guess they take a slightly different view of how hard to squeeze their customers.

used to work at a company that was tied to literally all of those. life was miserable.

then oracle cut costs on next gen exo-data stuff and agreed to waive some license costs this time and bam just doubled down on them again. ugh.

I did a gig at a Fortune 500 that had actually succeeded in entirely eliminating Oracle. Life was still miserable.

They lived in fear of something slipping through the net. So print servers were switched off because they contained an embedded Oracle JRE. And deployment pipelines that used Hashicorp's Packer had to be rewritten to eliminate the VirtualBox plugin (despite it not being used). Office coffee machines were looked at with suspicion.

Every vendor had to be queried, every piece of software had to be tested and have appropriate controls put in place. There were pre-emptive audits and endless compliance procedures.

There was so much work involved that any cost savings must have been fairly minimal.

This in turn introduces a lot of economic inefficiency, for no good reason. I think regulation would be useful here.

> I think regulation would be useful here.

Or vendors just abiding by contracts they've already signed!

Contrast one regulation vs. thousands of litigations by companies who don't always have the expertise or budget to pursue complex legal procedures.

If you have a contract that says the price is $1k, pay them $1k and don't answer their calls. They can sue you and they'll lose.

If you have a contract that says they can change the price at any time, and you're a business, that's on you.

As the article mentions towards the end, AWS EKS, GCP GKE, and other competitors have made k8s setup turnkey. You can deploy a new cluster with all the controllers you mentioned in a single click / Terraform.

AWS ECS and GCP Cloud Run are this. Run a container on abstract compute. But they aren't "without all that complexity" because it turns out all that complexity is required for even simple use-cases. Load balancing with SSl certs, cloud API keys, deployment pipelines, sidecars, etc.

Those are hosted services? Completely different class of solution.

If the real credentials owner was running the agent, why do it from a new GitHub account?

Someone's bug tracker account was hacked.

So far it looks like just their previously legit Fedora account got taken over & the other accounts (GitHub) then generated on demand as needed for whatever it was trying to achieve, right ?

BTW, any idea what are the current requirements for creating a new GitHub account ? That could provide some information about if there was actually a person controlling thing thing at that moment to say provide wahtever was necessary to get the new GitHub account.

Firstly, none of this post is the contract people are signing. So it's merely a summary.

Secondly, like all contracts I'm sure there will be exceptions for holding data longer than 30 days with reasonable cause, eg a legal hold.

This reply does not make sense.

I did not claim it was the literal contract people would sign?

NPM is getting all the attacks and attention because it is the biggest. But there's nothing language specific to this class of attacks.

Yes, that is clear. But in this particular instance the tanstack packages are downstream of a ton of other packages.

Tanstack infected a bunch of other packages; then resolving their issue doesn’t fix the widespread issue

So what if they’re the biggest? They haven’t taken any meaningful steps to stop these attacks. The primary culprit for the sorry state of the npm ecosystem is npm inc, or actually their corporate overlord microsoft. They could be doing a lot more than they are.

I’m sort of reminded of how back in the day windows was swiss cheese and people kept saying “it is because they’re the biggest”, and then microsoft started caring about windows security and it improved enormously. When will microsoft start caring about npm security?

Nice. It would have been interesting to dive into the exact differences in components. Are higher wattage PSUs in a series just using higher rated components or does the quality go up too?

Not really a fixed relationship between the two. Sometimes the entire blueprint of the PSU is from a different OEM. Corsair did this back in the day for a while where their HX750/HX850W PSUs were all made from a CWT design, their 1000W PSU was made from a different CWT design, and their 650/620W PSUs were a Seasonic design. I think this is less popular these days, but I think that's about as extreme as the difference gets.

At the component level, the focus is often on the sourcing and tolerances of the capacitors, which are used to clean up transients (very important) and power flow correction, among other things. I think the next most important components are the AC/DC conversion and the voltage transformers. Specifically for higher wattage PSUs vs lower wattage PSUs, the major difference is the amperage along the 12V rail.

A rough chain is: Outlet -> transient clean up circuit -> AC-to-DC conversion -> power factor correction -> PWM circuit (pseudo DC-to-AC) -> 3.3V/5V/12V transformers -> AC-to-DC conversion -> power delivery circuit (separate for 12V/5V/3.3V) -> power to components. The biggest difference between the wattages (if you keep the design fixed) would likely be in the power delivery circuit

I agree that many skills are overblown and unnecessary. But there's a lot of value in giving AI the right process. See how much more effective Claude can be for moderate or large changes when using the superpowers skill.