Hacker Newsnew | past | comments | ask | show | jobs | submit | jffry's commentslogin

The default behavior for the automated "add everything existing to the allowlist" is to include the specific version: https://docs.npmjs.com/cli/v11/using-npm/config#allow-script...

Together with a lockfile that does achieve "package xyz postinstall allowed with hash <1234>"


> "...we made the difficult decision to restructure Webflow’s team and operating model. As a result, many of our Webflow teammates are leaving the company today."

Leaving implies agency. You've fired these people. Using a euphemism that implies they had a choice in this matter is disingenuous and not "owning this decision"


"Some of our employees are taking a forced voluntary separation"


"dogme" is the Danish, Norwegian, and French spelling of the word "dogma"

https://en.wiktionary.org/wiki/dogme


Oooh. That explains my friend named Mathilde. Nice. Thanks.



tl;dr: autovacuum was seen to be active during an earlier incident, assumed to be at fault, and was disabled. It was never re-enabled. The long-term implications of disabling autovacuum were not actively considered.


I think the graph is getting cut off for you - for me it reads "Agent Teams"


"Workplace violence restraining orders" in California appear to be a type of restraining order that can be filed by an employer on behalf of an employee, to protect said employee from a third party

https://selfhelp.courts.ca.gov/WV-restraining-order


> We've been including product tips in PRs created by Copilot coding agent

If the PR is wholly authored by Copilot I get the spirit of this, although maybe not the best implementation. And "tips" like this that look like an ad for a product _definitely_ feel like an enshittification betrayal of the user, even if it was a genuine recommendation and not a paid advertisement.

In the OP's situation, where where Copilot was summoned to fix some thing within a human-authored PR, irrelevant modification of the PR description to insert unrelated content is specifically egregious. Copilot can easily include the tip in its own comment, so I'm curious why it was decided to edit the description of a PR instead.


Nah, PR text is a completely inappropriate place for a tip to appear. A PR description should describe the contents of the PR, not include unrelated, unsolicited advice. It’d be like submitting a bug fix, and saying “this PR fixes bug X, and also, have you considered using a different linter in this project?” Completely inappropriate.


To be honest, just a user here, it’s only recently (like a week?) you can ask Copilot to edit an existing PR, historically it’s had to open a new one (that merged back to original PR) or it had to make it to begin with, I can see this unintentionally happening as part of this improvement to edit existing PRs


It's unnecessarily splitting hairs.

> interaction data—specifically inputs, outputs, code snippets, and associated context [...] will be used to train and improve our AI models

So using Copilot in a private repo, where lots of that repo will be used as context for Copilot, means GitHub will be using your private repo as training data when they were not before.


No it isn't. Most people don't use Copilot, so this term change won't effect most people. You can reasonably be unhappy about it anyways (or unreasonably still be using Copilot in 2026), but it's still ultra-useful information for them to add to the discussion.


Next step they'll rebrand search as "Copilot Search" or auto enable pull-request AI reviews (unless you hear about it and turn each off) and we'll all be "users".

Boiling the frog with a Venn diagram.


Copilot, or "chat with Copilot" is a button that is available on every page right next to the search bar.

I don't have to be a Copilot user to click on it.

This change is malicious, and it doesn't only affect Copilot users. It affects everyone on the platform!


Again, this collects usage data. If you click the button by accident and don’t interact, they get no data.


So? This feature is available to everyone and you have zero idea how many people actually use it.

If I go to one of your GPL projects and I ask a simple question to find out what this project is about, you will be perfectly "ok" that this interaction (that includes most of the code that is required to answer my dumb the question) will be used for training?

This is not ok.


Nobody in this subthread is saying if it's OK or not. We're just saying that it's very useful to know that this is what they're specifically collecting. Jiminy.


It's automatically enabled for example the other day I did a commit directly on GitHub and AI generated commit popup it had to read the code to work


> Most people don't use Copilot

So why do any of this at all? You're putting a large part of your customer base on edge in order to improve a service that "most people don't use." The erosion of trust this brings doesn't seem like a worthwhile or prudent sacrifice.


You're asking me to explain Microsoft AI strategy? Your guess is as good as mine.


I don't use copilot, but somehow was subscribed... I probably clicked something long ago and it just remained active.


They "gift you" a free standard plan if you have above a certain (non-transparent) level of stars, I don't think you can even disable your "subscription" if you get it for free.


They're only training on interactions with Copilot, not with the full contents of repos that happen to be subscribed to Copilot.


Make it opt-in then.


Isn't this pretty standard, using your interaction data for training and making it opt-out? Claude Code, Codex, Antigravity etc. all do the same. Private repo doesn't make a difference as they have a local copy to work from.


Nope, it's pretty compact. The first image in CERN's photo gallery shows it being loaded into that truck: https://cds.cern.ch/record/2957407?ln=en

Of course, it's compact because it only has to last so long. CERN's press release discusses needing a generator and a cryocooler in the truck for longer trips: https://home.cern/news/press-release/experiments/base-experi...

This older article about the test they did with ordinary protons, indicates the outer frame measures "2.00 meters in length, 0.87 meters in width, and 1.85 meters in height" and comes in under 1000kg https://ep-news.web.cern.ch/content/cerns-base-step-leap-for...


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: