Hacker Newsnew | past | comments | ask | show | jobs | submit | Already__Taken's commentslogin

the cve isn't a zero day though how come cloudflare werent at the table for early disclosure?

Do you have a public source about an embargo period for this one? I wasn't able to find one

https://react.dev/blog/2025/12/03/critical-security-vulnerab...

Privately Disclosed: Nov 29 Fix pushed: Dec 1 Publicly disclosed: Dec 3


Then even in the worst case scenario, they were addressing this issue two days after it was publicly disclosed. So this wasn't a "rush to fix the zero day ASAP" scenario, which makes it harder to justify ignoring errors that started occuring in a small scale rollout.

Considering there were patched libraries at the time of disclosure, those libraries' authors must have been informed ahead of time.

Cloudflare did have early access, and had mitigation in place from the start. The changes that were being rolled out were in response to ongoing attempts to bypass those.

Disclosure: I work at Cloudflare, but not on the WAF


imo everyone needs to try ChromeOS for the OOBE and living with sleep & instant reboot updates. Windows is a nightmare.

it's made me want to get into core boot and find Linux laptop hardware that hums along.


These aren't good because for 0-lists you have an empty parent containers so often you have a wrapping if outside all of that. More generally, template logic indent doubles up inside the indent levels of the template markup and I just find it ugly.

I like vue a lot more;

    <ul v-if={users}>
      <li v-for={some in users}>{some.name}
    </ul>


Agree with sibling comments on control flow vs elements separation. For your specific case though, I think a middle ground can be found here:

  <ul #if={users}>
    {#each users as user}
      <li>{user.name}</li>
    {/each}
  </ul>


In my completely uninformed opinion I think China is taking their toys and going home.

The UK gov stepped in to stop a Chinese firm closing our steel mill. Capitalism wasn't made to handle large strategic foreign investments closing their own company at nationally inopportune moments.

It feels like a slow burn of embrace, extend, extinguish but playing out on global critical technology and industry.


We didn't get locking until npm v5 (some memory and googling, could be wrong.) And it took a long time to do everything you'd think you want.

Changing the main command `npm install` after 7 years isn't really "stable". Anyway didn't this replace versions, so locking won't have helped either?


You can’t replace existing versions on npm. (But probably more important is what @jffry mentioned – yes, lockfiles include hashes.)


> Anyway didn't this replace versions, so locking won't have helped either?

The lockfile includes a hash of the tarball, doesn't it?


It does, the answer to my question was no.


vscode came along with a thriving extension ecosystem. That made up for any pitfalls really.


Reading how the keys trigger, I don't know if this is interesting or not but that how high end paintball markers work, with lots of adjustability.


> But it became a general purpose programming language pretty early, right?

IMO what we've seen learnt from ChromeOS and later their stab at firefox OS is the merit in treating the browser as the system. For that there was a lot of wisdom in making rust that capable. Seeing oxide make their stack is incredibly validating.


I just think £360 for an IP camera is too steep, half would be a no brainier over ring. Their new Lite switches replace stuff that was rack-mountable, not there's no ears are far as I can tell.

The gateways are awesome value.


I got into Ubiquiti due to their APs being effectively enterprise level features for consumer level prices. Their coverage and quality was a cut above the TP-Link gear I'd used previously (which was, in turn, better than the D-Link and Netgear stuff that I'd tried).

So I am confused by their Camera prices being so high.

I went with Reolink on cameras and NVRs and don't regret that decision. Probably spent a third of what it would have cost for Ubiquiti. There must be some benefit to the extra cost, but I don't think it's one I'll miss.


I have a couple sites with both types of cameras. And I really love all the customizability with my Frigate / Reolink site. But UniFi can command the premium on the camera hardware because of all the features they give you on the software side of their NVR. It's far better than what you get out of the box compared to something like Reolink in terms of detection and set-it-and-forget-it mentality.

I have a site that has 8 cameras and 2 of the 8 are original cameras that are >5 years old still getting firmware updates. Reolink does not do this and I have had much higher failure rate with them as well. Especially in outdoor cameras that have to handle snow/ice/extreme cold.


You have to get pretty high in their product range before you hit £360 for a camera. The G3 Instant is probably the closest to a Ring competitor (Wifi, 2K video) and it's £78.

The £360 camera is the G5 Pro, which is a 4K camera with 3X optical zoom. I'm not aware of any Ring camera with optical zoom. If you don't need the zoom, the G6 Bullet is a 4K camera without zoom for £190, and the G5 Bullet is 2K for £126. As far as I know, Ring's highest resolution camera is 2K.

But Unifi isn't really trying to be a Ring competitor -- Ring caters to home users with little knowledge of networking, Unifi is more for small businesses (who use an integrator to install their system) or prosumers with more advanced network knowledge.


Especially when they die after 2 years. Bought 3 G4 Pros direct from Ubiquiti and two are dead. Apparently it's just the POE daughterboard but my RMA requests were rejected due to being out of warranty. My cheap Lorex cameras have been running for 8 years now.


They have a lot of camera models, including a lot of cheaper models, starting at €180 for the G6 turret/bullet if you want 4k or €80 for the G5 turret if you want 1080p.


Looking at the various options, £360 is on the upper end (until you get into the insane DSLR lens one)


I'm baffled you can't clone internal/private repos with anything other than a developer PAT. They have a UI to share access for workflows, let cloning use that...


SSH also works, but I’d love to be able to just use git-credential-oauth [0] like for any other repo.

[0]: https://github.com/hickford/git-credential-oauth


I use GitHub apps for this, it’s cumbersome but works.


Use a GitHub app, that’s what it’s for.


what with actions/checkout@v4, hows that documented?

https://github.com/actions/checkout/issues/567#issuecomment-...

GH has a `permissions:` entry and this mechanism already for internal repo action sharing. And thousands of our dollars per month.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: