The difference between weight and volume measurements could easily be a 20% or 30% gap. I’ve measured two of my cups of flour before and they were off by roughly that amount.
Maybe I’m just bad at measuring, but it’s a lot more than 5%.
Soccer is extremely widespread and played by both boys and girls at a young age (up until puberty or so), but there definitely is a gender gap after that. I'd guess that there are a lot of other sports that are almost solely played by boys, so boys tend to drift away from soccer, while there are fewer options for girls. (Though there are some - lacrosse and softball for a couple examples.)
It certainly can matter for proper baking (which this recipe seems to be?), though for traditional pancakes I would never bother. But there's a reason that bakeries weigh their ingredients. It's more consistent and allows for different people to get more similar results.
As discussed elsewhere in this forum, these exploits are being found by security companies in the first few days after they're published, that's just already too late. For example, the auditor who made the very post that we're discussing! For another, many security-focused AI companies have automated checks on NPM packages. Many people are implementing it on their end by having their client wait seven days before pulling new packages, but that's O(N) rather than O(1), and it's not evenly spread.
If no one reviews it and it still gets out, then we can address it then, but that seems much less likely.
Ideally, the solution is that all of these language package managers need to get serious and have maintainers, but lacking that, at least having the waiting period be built into the server instead of the client is a clear win.
One easy change would be that before any package can be published, it has to wait a minimum of two weeks in a state where it can be reviewed but it can't be installed without jumping through several hoops with big warning signs, things like "INSTALL_INTENTIONALLY_DANGEROUS_PACKAGES_THAT_WILL_BREAK_MY_COMPUTER=1", selecting yes in a dialogue that asks if they want to install software that likely has viruses, and pointing to a different package repository URL.
If there's some change that must get out sooner, then there can be some fee to pay to npm to have their security team do their own review.
Critically, there must be time for someone to review before it's the default to be selected.
I'm sure there are issues with this, this was off my head, but it seems like a really easy step to at least stem the problem for now. And there are a bunch of ideas like this that would help, but NPM doesn't seem willing to take it seriously as an existential threat to the ecosystem, rather than taking trivial steps.
Pyramid schemes are defined by the price and structure. A business that sells knives is a fine business. A business that sells overpriced knives by promising that you can then find someone else to sell more knives for you at an even higher price is a pyramid scheme.
Selling tulips is a fine business. Selling tulips at an insanely high price by promising that the market for tulips will keep on expanding and increasing the price of tulips is a pyramid scheme. (Well, maybe not quite a pyramid scheme, the structure isn't right. But it certainly wasn't a sustainable business model.)
At least for my software job in the US, and other salaried jobs I’ve seen, there are explicitly no hours listed, and it’s supposedly based only on your output. In practice though, if your butt isn’t in the seat 40 hours a week or so, and usually more, the boss will be mad.
> The figures were almost universal across all categories: 62 percent of those surveyed across the five European countries said they favored or had considered replacing US data storage and payment services, while 59 percent of respondents said they would back a change from American video-conferencing companies like Zoom.
(Technically only five countries in the EU in this survey, but the five most populous countries, and presumably other countries generally agree)
If you want to do it occasionally, sure, whatever. I have a coworker who solely communicates in the form of screenshots of him asking Cursor my question, even when they’re questions that are interested in his motivation or plans, not the code base, and that Cursor does a bad job answering. I’ll ask a Slack channel “does anyone have experience with tools A and B, so they can suggest which matches our use case better”, and he’ll respond with a screenshot.
I don’t need him to pass on LLM answers. I can and do ask them myself. I’m asking questions because I’m interested in the experience my coworkers have beyond what AIs have trained on.
This is Java, but recently I had a case where one library depended on a version of an Apache Commons library, and another library depended on a different version of the same Apache Commons library, and neither version worked with both libraries. In my case, I was able to upgrade one of them to a newer version so that I could use just one Apache Commons version, but I got lucky there.
Speaking as someone who is a bit more familiar with your site, the variety of content you post is really valuable. I know multiple people, myself included, who have either gone from EA to Contra or Contra to EA thanks to both being on your blog.
More broadly, I love it when an author I trust in one area writes about other topics.
That’s exactly the benefit of a law - it’s a forcing measure to require businesses to invest in processes to understand open sourcing, and to go forward when otherwise no one would make a business case for approval.