I believe it’s 1% for access to the “entire post-open ecosystem”, rather than 1% per project which would be unreasonable. So you could use one or thousands of projects under the Post-open banner, but still pay 1%.
It will take years to develop the post-open ecosystem to be something worth spending that much on.
This really got me, thank you!
I would be curious how this actually works in practice. What counts as “in progress”? Encounters? Plot points? Knowledge that a goblin has? If all of those things are “in progress” and you can only have so many things in the “in progress” column, I feel like you’d very quickly have to break that rule and then everything becomes “in progress”.
Literally just bought what I believe to be last generation’s X13 on ebay for half the price of the new one. It’s been great so far, especially with the power efficiency of Ryzen CPUs. My one complaint is the soldered RAM, which judging by the new lineup is getting phased out, thankfully.
My specific point here was about how this friend doesn’t trust the results AND still goes to Google/others to verify, so he’s effectively doubled his workload for every search.
I’ve had this argument with friends a lot recently.
Them: it’s so cool that I can just ask chatgpt to summarise something and I can get a concise answer rather than googling a lot for the same thing.
Me: But it gets things wrong all the time.
Them: Oh I know so I Google it anyway.
Doesn’t make sense to me.
I’ve been programming for too long, my brain just autocorrected the typo so initially didn’t get the joke…
Lancer, I need to finish my Curse of Strahd campaign first…
It still works here. I for one have been avoiding prepping my next session for over 8 months now because of this!
Again, this existed before AI. Typo squatting, supply chain attacks, automated package uploads, CI pipeline infection, they’re all known attack vectors. That’s not to say this isn’t a concern, just that it’s a known risk and the addition of “AI” doesn’t, to my eyes, increase that risk. If your SSH keys don’t require a password, you have taken the decision to make those keys less secure but more convenient to use. That’s pretty much always the tradeoff in security.
The risk here is slightly overblown or misrepresented. Just because a fork exists doesn’t mean that anyone has even read it, let alone run it on their system. For this to be a real threat they would have to publish packages with identical or similar names (ie typo-squatting) to public package repositories which this article didn’t have any information on but which is a known problem long before AI. The level of obfuscation and number of repos affected is impressive but ultimately unlikely to have widespread impact to anyone besides GitHub.
Personally I rename them to something meaningful and they get merged if there are no other references. PayPal is especially bad for completely meaningless rubbish in the payee field and they tend to be ad-hoc purchases so I don’t fiddle with them much. The category is the most relevant bit for me.
Bit of an alarmist headline here. The vulnerability has been patched in the most common clients (openssh) and it was because the protocol wasn’t being implemented correctly. To say that the SSH protocol “just got a lot weaker” is just not true.
I agree with those saying mailing lists are intimidating. I don’t know if others are using dedicated tools or something but I find web based mailing list UIs just incomprehensibly bad and difficult to navigate.
The self-contained electron app works better for most people I think.