Shrugs. I have no issue with someone claiming that a company making drills used exclusively for oil drilling is in the 'oil business'. However, I would not call such a company an 'oil company', so I take your point...
Are the majority of Adobe's and Autodesk's customers game studios? Because that was the basis of the argument that was being made.
And just to clarify, personally, I would not describe JangaFX as a game company myself (as you pointed out, they aren't in the game business per se, but the visual effects business) - I'm just trying to clarify why the claim isn't completely outlandish.
Depends on what you mean by the term: Some companies are in the business of supporting game studios without being game studios themselves (eg animation companies you outsource your out-of-engine cinematics to). If all your customers are game studios, you could be argued to be a 'game (support) company'.
Phrased differently, they claimed that the entropy of the distribution of some quality metric tends to be higher on the domain of projects with vibecoded sites compared to the domain of projects with handcrafted sites.
But you seem to be arguing that having users compile their software themselves doesn't increase their security?
On the contrary! I gave examples where source files get generated. This happens in one of two places: Either when the maintainer publishes a new version, or every time an end user builds the package.
I'm arguing for the former, you're arguing for the latter. There are pros and cons to either approach. Some cons for the latter:
First, the build process becomes more brittle, as every end user now has to install the necessary tools. In case of the project containing RELAX NG schemas I alluded to, this would require a recent version of Perl, a Java runtime, and the Trang utility written in Java. The alternative? Just shipping a single XML file.
Second, the build process often doesn't become more, but less auditable: Instead of just reviewing the source files that actually get compiled, you now have to track down how they get generated, and review all the scripts that do so.
Sure - but running build scripts on an end-user's machine requires the user to have all relevant tools installed, and isn't exactly reducing the attack surface...
I still like the idea of shipping tarballs that include generated files instead of pulling input files from source control. As mentioned, the first thing that came to mind to make things easier to audit is to stick their contents into a community-controlled VCS.
it's far from a given that the tools (e.g. browsers) used to read it are safe from malicious documentation files
Generated HTML files are potentially easier to audit than the scripts/toolchains used to generate them on an end user's machine if you do not pre-generate them.
Off the top of my head, other things I've done is committing RELAX NG *.rnc files, but shipping *.rng files, or generating C header files for various types of data (think `xxd -i` in case of binary files, but also just large chunks of plain text that gets wrapped into a C string).
Why can't you store a (possibly shallow) clone of the repository in the "package" registry?
Yes, that would be an option.
As to your question, you generally want to version control input files, but distribute the generated artifacts. Some possible scenarios would be documentation, data tables in source or binary form, generated code including maybe even configure scripts if you cannot avoid it (though if I had to 'vendor' 3rdparty code that uses autotools, I think I probably would just unpack a tarball and commit the relevant artifacts).
Not sure this is the right solution for 2 reasons:
First, I'm uncomfortable with making a package creator's VCS provider part of the language's module infrastructure.
Second, not all files under version control necessarily belong in a tarball, and not all files in a tarball necessarily need to be under version control.
However, the point that there should be an easy way to track changes in your dependencies is well taken. One possible approach would be that publishing a packge boils down to importing the files that normally would go in your tarball into a community-controlled VCS.
It is an encyclopedia of topics that meet its standards of notability (ie there exists "significant coverage in reliable sources that are independent of the subject"[1]).
As I understand it, the Wikipedia model is that anyone may contribute, but the information has to be collected from sources that conform to certain formal criteria. There are no such sources for Odin.
When open online spaces gain popularity, the threat of devolving into a cesspool of bigotry and misinformation rears its head. Sadly, moderation isn't optional.
But how do you moderate? Do you establish your own ministry of truth? Only allow contributors with a university email address (shoutout to the arXiv)?
Wikipedia decided to externalize part of the vetting process by placing formal restrictions on the sources you're allowed to collect information from.
Sadly, there currently aren't any such sources for Odin.
Yeah, that reference section (odin-lang.org, jangafx.com, learnodin.org, c3-lang.org, odinbook.com, gingerbill.org) is probably not up to Wikipedia's standards...
Well, Casey Muratori argued github stars should be considered a metric of notability, and the Gleam repository has almost twice the number (21.6k vs Odin's 11k)!
Jokes aside, I'm not sure Gleam belongs on Wikipedia if Odin does not...
Per Wikipedia, at least at one point in time, it was supposed to be. Quote:
Prosecutors produced group chat logs showing that the participants had debated at length whether they should bring guns. The former reservist allegedly wrote that "Cops are not trained or equipped for more than one rifle, so it tends to make them back off." Other chat participants argued that a noise demonstration was low risk and the assumptions about how police would respond were "way over the top".
There's some overlap in the languages they were inspired by (eg Scheme, or the chains Modula -> Lua vs Modula -> Java -> Javascript), but as far as I'm aware, the original designs were made independently.
Now, the object systems do look similar, but that seems to be a case of convergent evolution: Javascript took direct inspiration from Self, whereas Lua's system is based on a more generic fallback mechanism for table access.
Note that by introducing the co-differential δ, you can write the Maxwell equations as a single expression (δ + d)F = J in the differential forms approach.
However, from the perspective of Yang-Mills theory, that's rather questionable as you're stitching together the Bianchi identity and the Yang-Mills equation for no particular reason.