I have a silhouette cameo 4 I'm pretty happy with. Silhouette studio works, it doesn't handle svgs very well so when importing I tend to render svgs as a black bitmap and then trace that in silhouette studio. Being able to print registration marks and have the cutter align itself against those is invaluable. I've done clones of paper craft kits, perfectly cut out iron on transfers forct shirts, 3d trading card art, and trading card proxies on mine
> so it took a few Amazon returns until I found the right one
This a pet peeve of mine. If you buy the wrong $2 part don't return it. If you don't eat the loss the seller will and the part will wind up in the landfill.
If it was actually a $2 part, I'd agree with you. But it's enough that it's probably worth returning, especially since he had to try a few to get it right, and then he can return them all at once.
It's not his fault if it ends up in the landfill. That's on Amazon. Also, they have discount stores they ship returned stuff to before it hits the landfill.
> since it's the only package manager that I know of that allows for package authors to essentially run arbitrary post-install scripts silently package install
Are you sure? I'm pretty sure .deb and .rpm packages both allow that
>Are you sure? I'm pretty sure .deb and .rpm packages both allow that
Learned something new today. Thanks.
I think the other significant issue with the NPM ecosystem that makes it bad in particular is NPM's dependency management is genuinely the worst out of any package manager because of phantom dependency is the default: you can be using a package without ever knowing that you are using it because it is imported implicitly, and the JS ecosystem dependency is so weird that taking down a small package that that a major project depends on cripples the entire JS ecosystem, as shown in left-pad, and launching a cyberattack via npm can be as easy as putting malicious code in any small package that large, popular packages depend on and watch it propagate. This is not hypothetical, it has been done, repeatedly in fact, over the years.
TS is a good programming language, however NPM is a security nightmare, and somehow the collective reaction of everyone depends on the JS/TS ecosystem seems like a shrug and "oh well, what can you do".
I wrote this in response to the recent AUR attacks. The problem isn’t really too many dependencies - it is that most users cannot be auditing everything they install and we need mechanisms that help users where they are.
I audit my AUR pkg builds, and I would have likely caught any malware. But so would a Dependency Cooldown or a third-party threat feed. Package Managers should make it easy to build this tooling via hooks.
Both certainly do. My own hypothesis on why this isn't a more widespread problem is the speed, or lack thereof, of these ecosystems. By the time a package hits debian stable, it's usually been under scrutiny for a year or more.
vira28: It looks like nearly all of your responses to comments/questions here are flagged/dead. Probably because they all look AI written. Are you actually responding or do you have an agent answering questions for you?
The future of gas stations