I'm sure somehow it's George W. Bush's fault.
Not too different from the recently-announced Rust guidelines at https://blog.rust-lang.org/inside-rust/2026/08/05/rust-langr...
There is indeed a "draft" release (I think they call it a "deployment"), but AFAIK your choice is then to either publish it or delete it. If you review it and it looks good, you publish it and can't change it thereafter…
Yeah, I think that's the difference. In Maven, the entire set of files which compose a release is immutable. You can't add to or remove from the set of files once you've published. You have to release a new version if…
In the Java world, Maven has a "publish" step. Published artifacts (groups of files) are immutable, so publish == finalize.
Emergent product roadmap in action.
Do you mean A&E the television channel?
[flagged]
> Conservative bias in the media. Depending on how you count, something like 96%, 94%, 65% or 87% of mainstream media employees lean left. Of course this matters less and less as customers tune out and their influence…
Thanks for the link. However, a 7x size differential does not fully explain a 100x security incident differential -- although I'm sure it's part of it. Some of the root causes are very hard to address (e.g. a very…
Days since last malicious packages in NPM: 0 (evergreen) Days since last malicious packages in PyPI: 30 Days since last malicious packages in Maven: 120 I'm sure this isn't 100% accurate, and there are probably better…
We're halfway there!
New PR: revert GitHub software and infrastructure to version of June 1st, 2018. New PR: disable new user signups for 6 months HR initiative: all future KPIs automatically require three-nines availability; all bonuses…
[dead]
> The thing keeping maven safe for now is that most people pin [...] versions Yes, and also the signing of JARs that are uploaded to the repository, and the fact that most release processes are not fully automated, and…
Your example of security issues in Maven is... npm guys setting up processes to auto-publish infected npm packages into the Maven Central repository? Wake me up when the daily npm security breach headlines are…
There are npm supply chain exploits in the news every other day. I'm honestly surprised that something as decentralized as Go Modules is more reliable, but here we are. The fact that we're not seeing these stories about…
The future may be distributed quite unevenly here, as they say, with a divergence between a small amount of "responsible" code in systems which leverage AI defensively, and a larger amount of vibe-coded /…
They should have had the UTF-8 guys tackle IPv6. Talk about elegant.
> run your systems outside of Spain So much for digital sovereignty :-)
Disagree with so much here. But if, in your mind, the US is turning authoritarian, this is a "cut off your nose to spite your face" move. They should be taking the fight where it most needs fighting. They should not be…
> they have been silenced by the platform Where do you see that? All I see is a claim that it no longer makes sense from a financial standpoint (but no comparative numbers provided for the other platforms they are…
He's saying that they have ideological concerns beyond the ideological concerns you would tend to associate with the EFF (digital privacy, open source, patent trolling, etc). I for one am sad to see that this is the…
> this obviously doesn't make any sense That's debatable, but it's a moot point; it's pastiche, so it doesn't have the same goals or motivations as the original. https://en.wikipedia.org/wiki/Pastiche
I'm sure somehow it's George W. Bush's fault.
Not too different from the recently-announced Rust guidelines at https://blog.rust-lang.org/inside-rust/2026/08/05/rust-langr...
There is indeed a "draft" release (I think they call it a "deployment"), but AFAIK your choice is then to either publish it or delete it. If you review it and it looks good, you publish it and can't change it thereafter…
Yeah, I think that's the difference. In Maven, the entire set of files which compose a release is immutable. You can't add to or remove from the set of files once you've published. You have to release a new version if…
In the Java world, Maven has a "publish" step. Published artifacts (groups of files) are immutable, so publish == finalize.
Emergent product roadmap in action.
Do you mean A&E the television channel?
[flagged]
[flagged]
> Conservative bias in the media. Depending on how you count, something like 96%, 94%, 65% or 87% of mainstream media employees lean left. Of course this matters less and less as customers tune out and their influence…
Thanks for the link. However, a 7x size differential does not fully explain a 100x security incident differential -- although I'm sure it's part of it. Some of the root causes are very hard to address (e.g. a very…
Days since last malicious packages in NPM: 0 (evergreen) Days since last malicious packages in PyPI: 30 Days since last malicious packages in Maven: 120 I'm sure this isn't 100% accurate, and there are probably better…
We're halfway there!
New PR: revert GitHub software and infrastructure to version of June 1st, 2018. New PR: disable new user signups for 6 months HR initiative: all future KPIs automatically require three-nines availability; all bonuses…
[dead]
> The thing keeping maven safe for now is that most people pin [...] versions Yes, and also the signing of JARs that are uploaded to the repository, and the fact that most release processes are not fully automated, and…
Your example of security issues in Maven is... npm guys setting up processes to auto-publish infected npm packages into the Maven Central repository? Wake me up when the daily npm security breach headlines are…
There are npm supply chain exploits in the news every other day. I'm honestly surprised that something as decentralized as Go Modules is more reliable, but here we are. The fact that we're not seeing these stories about…
The future may be distributed quite unevenly here, as they say, with a divergence between a small amount of "responsible" code in systems which leverage AI defensively, and a larger amount of vibe-coded /…
They should have had the UTF-8 guys tackle IPv6. Talk about elegant.
> run your systems outside of Spain So much for digital sovereignty :-)
Disagree with so much here. But if, in your mind, the US is turning authoritarian, this is a "cut off your nose to spite your face" move. They should be taking the fight where it most needs fighting. They should not be…
> they have been silenced by the platform Where do you see that? All I see is a claim that it no longer makes sense from a financial standpoint (but no comparative numbers provided for the other platforms they are…
He's saying that they have ideological concerns beyond the ideological concerns you would tend to associate with the EFF (digital privacy, open source, patent trolling, etc). I for one am sad to see that this is the…
> this obviously doesn't make any sense That's debatable, but it's a moot point; it's pastiche, so it doesn't have the same goals or motivations as the original. https://en.wikipedia.org/wiki/Pastiche