Interesting, it's as if it's lossy but in a different way. We gain DPI and lose accuracy, whereas a deterministic lossy algorithm might stay accurate per dot, but with a lower dot density (like a lower res scan). The focus on the facial expressions is fascinating.

Currently we're at meme status: cloudy.social/captcha

You might say the reason they needed to do a switch atomically is because someone said “if you remove him I’ll add him back.”

If someone says that to you, does that make it right to respond by using your power to move first to do it by force so you don’t have to answer the concerns being expressed?

I have also had this problem. It is very inconsistent. Maybe this is why.

Funny you should bring this up! I know some people that work on ruby packaging. I wonder if they need any help.

One takeaway is that the open source world is an amazing place! It's marvelous how well this usually works. This is distributed trust at scale via education and support (rather than control). All the work to help people learn security and provide best practices mostly seems to work. Wonderful!

Companies should scan their open source. Full adoption of trusted publishing could have foiled NPM’s Shai Halud. Fighting about shared ownership models is horribly destructive when it makes the people leave that understand these problems. That’s the real security vulnerability.

If all you need to make your supply chain secure is CLAs for devs and a non-profit administrative staff holding keys to the world, remember that most package managers still run untrusted code on install, packages go live with minimal scanning, and best practice publishing security adoption is low.

You might wonder, “how can a group of friends be sufficient for global enterprise software supply chain security?” The answer for me is that these people were there BECAUSE it was so important. RubyGems.org has had no major outage in 14 years. This is not a fluke.