core-js VS chromium

This is surprisingly common. The other example off the top of my head, a single maintainer of a very popular project who had to temporarily abandon it due to lack of funds, is Denis Pushkarev (zloirock) and core.js (https://github.com/zloirock/core-js/blob/master/docs/2023-02...).

The majority of OSS projects have most of their contributions by one person (the project leader), and the vast majority of OSS contributors don't do it for their job. It seems nearly every single popular OSS project is like this (one unpaid, maybe sponsored, volunteer doing most of the work); it's not even worth listing projects and names, because you can just pick a couple projects you know and I bet at least one will be an example. Fortunately, most of these people seem to be well-off (probably in part due to the quality of programming jobs), but every once in a while there's someone who's not so fortunate. It should be more common to sponsor maintainers, especially if they are asking for donations provided they can prove that they really need the money (the world we live in, some people who have plenty fake issues to solicit donations, then others who genuinely need and deserve the money are scolded and left unfunded because of them).

Funny you say that, I was just thinking earlier today back to the core-js drama.

In short: the creator of a NPM package that is used by approximately everyone, everywhere, was facing a legal battle. He had been developing this package full time for years and did not have the cash on hand to hire a lawyer. He added a console log that ran on installing his package that said something like "If you're using core-js please consider donating". Queue an absolute shitstorm of people screaming at him in the github issues and him going to prison for around 10 months. Luckily he seems to be back on the grind nowadays, with a decently robust cross-platform slush fund to boot (~200k USD across Pateron, Open Collective, Bitcoin).

It can be a rough world out there for the folks building for the "focus, productivity and anti-distraction" platform.

https://github.com/zloirock/core-js

I think everyone here knows that, at some point, the site would start costing a lot of money and would need to be funded in some way. I would love for the Wikipedia donation model to work for a site like this but everything I find points to that not being the case. Reddit gold not covering server costs and open source devs not tied to a corporation struggling to continue working on their projects being two prime examples. If anyone has anything that can convince me to give it a try, please let me know and I will switch this to a non-profit.

Open source developers are not being paid. They published under licenses that allow zero cost and businesses won't pay.

If you want to write open source code for living, you have to find a business model that works. In this case, it is even under permissive license.

* code freeze - code is under open source license only a certain time after commit/release. Maybe add "support", aka you get security fixes in timely manner.

* open core - put some features behind commericial door.

* go ImageSharp way of split license. That one is fun, because MS deprecated/killed (throws exceptions on attempt to use) official image/font library and that was was intended replacement. Rather blatant offloading of costs.

This has been rehashed several time (core-js recently https://github.com/zloirock/core-js/blob/master/docs/2023-02...).

The gist of it is: Companies are not going to pay if they don't have to. That is the reality and it's not going to change.

This is one of the few examples. https://github.com/zloirock/core-js/blob/master/docs/2023-02-14-so-whats-next.md

Open source: It sounds pretty nice. Open to everyone... But it sucks in general. People really don't care to contribute to open-source. (e.g. here). It is a really good resource for development but for people who don't know anything about development, it is not important. There needs to be some financial income / support for good open-source.

there is https://github.com/zloirock/core-js but is more or less a 1 guy team and he is grossly under paid and well just read this https://github.com/zloirock/core-js/blob/master/docs/2023-02-14-so-whats-next.md im shocked he still works on it

Choice is good to a point but at some point it becomes crippling. It still haunts me on Rails. Is it yarn, is it brunch, is it npm, is it webpacker, is it esbuild, is it import maps... plus personally the pad-left debacle left a bad taste in my mouth and this little nugget about core-js was heartbreaking. For me it's hard to pick JS for anything other than what I absolutely must.

There's a real story behind that (but the software is core-js, not nginx)

npm WARN deprecated [email protected]: core-js@<3 is no longer maintained and not recommended for usage due to the number of issues. Please, upgrade your dependencies to the actual version of core-js@3. \> [email protected] postinstall /home/daniel/src/test/node_modules/core-js > node -e "try{require('./postinstall')}catch(e){}" Thank you for using core-js ( https://github.com/zloirock/core-js ) for polyfilling JavaScript standard library! The project needs your help! Please consider supporting of core-js on Open Collective or Patreon: > https://opencollective.com/core-js > https://www.patreon.com/zloirock Also, the author of core-js ( https://github.com/zloirock ) is looking for a good job -)

One of the unexpected use of shadow DOMs for me was a document generated for image resource URLs [1], because the HTML standard apparently specifies the exact DOM structure of the generated document except for the `` element [2].

[1] https://github.com/chromium/chromium/blob/f02ca73/third_part...

[2] https://html.spec.whatwg.org/multipage/document-lifecycle.ht...

Recently my favorite open source mouse gestures extension SmartUp Gestures was taken over by some shady entity (with github no longer being updated of course).

I opened Chrome ticket that they should ask to re-enable extension when ownership changes. They just closed the ticket replying with this link:

https://chromium.googlesource.com/chromium/src/+/main/extens...

:(

Hmm. It looks like files with the .lnk or .pif file extension can only be downloaded on a user gesture: https://chromium.googlesource.com/chromium/src/+/39841e54180...

So it can't be done silently. Although, I do wish the type was marked "DANGEROUS" a la dll files.

On Linux, Chromium uses setuid or user namespaces to restrict the access of sandboxed components and seccomp-bpf to reduce the kernel attack surface.

Check out the Chromium docs on this topic: https://chromium.googlesource.com/chromium/src/+/HEAD/docs/l...

You can also disable JIT in Firefox by setting javascript.options.baselinejit to false in about:config, although you won't get CET.

[1] https://github.com/chromium/chromium/blob/12c232c43ce7324d30...

Chromium targets iOS already: https://chromium.googlesource.com/chromium/src/+/main/docs/i...

For the sake of completeness, I've traced the evolution of the notice over time:

From 2008-07-26: "Going incognito doesn't affect the behavior of other people, servers, or software. Be wary of: / • Websites that collect or share information about you / • Internet service providers or employers that track the pages you visit / • Malicious software that tracks your keystrokes in exchange for free smileys / • Surveillance by secret agents / • People standing behind you" (https://chromium.googlesource.com/chromium/src/+/09911bf300f...)

From 2013-12-07: "Going incognito doesn't affect the behavior of other people, servers, software, or people standing behind you." (https://chromium.googlesource.com/chromium/src/+/c5e36c57178...)

From 2013-12-13: "However, you aren't invisible. Going incognito doesn't hide your browsing from your employer, your internet service provider, or the websites you visit." (https://chromium.googlesource.com/chromium/src/+/70821506825...)

From 2014-02-27: "However, you aren't invisible. Going incognito doesn't hide your browsing from your employer, your internet service provider, governments and other sophisticated attackers, or the websites you visit." (https://chromium.googlesource.com/chromium/src/+/ab54bd65701...)

From 2014-04-29: "Going incognito doesn't hide your browsing from your employer, your internet service provider, or the websites you visit." (https://chromium.googlesource.com/chromium/src/+/eb09a62ef40...)

From 2016-01-15: "However, you aren't invisible. Going incognito doesn’t hide your browsing from your employer, your internet service provider, or the websites you visit." (https://chromium.googlesource.com/chromium/src/+/b7dac1a6a79...)

From 2017-02-27: "Your activity might still be visible to: / • Websites you visit / • Your employer / • Your internet service provider" (https://chromium.googlesource.com/chromium/src/+/cfe102adddc...)

From 2017-03-29: "Your activity might still be visible to: / • Websites you visit / • Your employer or school / • Your internet service provider" (https://chromium.googlesource.com/chromium/src/+/7ca3ccf74e8...)

(Note that some of these were behind a feature flag for a few months.) Also, it looks like they've been intending to modify the new-tab page text for Incognito windows for some time, as part of the "Revamped Incognito NTP" project. You can view the modified text with 'chromium --enable-features=IncognitoNtpRevamp':

From 2021-08-13: "What Incognito doesn't do / Incognito does not make you invisible online: / • Sites know when you visit them / • Employers or schools can track browsing activity / • Internet service providers may monitor web traffic" (https://chromium.googlesource.com/chromium/src/+/e6ae57ba385...)

From 2022-01-25: "What Incognito doesn't do / Incognito does not make you invisible online: / • Sites and the services they use can see visits / • Employers or schools can track browsing activity / • Internet service providers can monitor web traffic" (https://chromium.googlesource.com/chromium/src/+/8b349f6c984...)

Blink can now be compiled for iOS, but without JIT or WASM:

https://chromium.googlesource.com/chromium/src/+/main/docs/i...

https://bugs.chromium.org/p/chromium/issues/detail?id=141170...

I think its weird that Vercel has this limit. There is no practical reason I can think of for having such a limit on URL characters that is so small. Chrome suggests a 2MB limit[0] for example. The platform itself doesn't have one, and Firefox I believe if memory serves (I can't find the source for this claim atm) is 1 MB effectively, and I don't think Safari is any lower than that either (and may well be more inline with Chrome on this, at 2 MB)

[0]: https://chromium.googlesource.com/chromium/src/+/master/docs...