If you only take the bottom (lowest) 1% of all frame rate measurements (and average them)

I don’t think that is the methodology. I think it is taking the 99th percentile frame time. So basically if took the time it took to generate every single frame this is the time that 99% of frames were faster than and 1% were slower than.

If this number goes down it means that the worst frames are less bad. This is a pretty important part of the experience as even if you have good average frame time (and decent FPS) having a few slow frames really makes the game feel choppy and can make precise inputs difficult.

Yes. Atom is very much a derivative of RSS. IIUC there was sort of a split between RSS v3 (which never really ended up landing) and Atom hence one had to pick a different name. If the world was a perfect place Atom probably would have been called RSS v3 and people would not be as confused. But at the time it probably wasn’t clear which spec would end up succeeding.

Atom is always better. The one exception is podcasts, as Atom isn’t always supported. But for non-podcast feeds always do Atom.

The main benefit is that it removes ambiguities that cause client incompatibilities and mean your feed looks different to different users. Using Atom just removes the issues. There are no downsides.

I wrote about this here: https://kevincox.ca/2022/05/06/rss-feed-best-practices/#formats

In theory it is safe. When a Nix package is built it isn’t “installed”. Unless root is running/installing random packages out of the Nix store there is no problem. As long as the user’s aren’t added to the trusted-users option they shouldn’t be able to cause any problems for other users.

However like any multi-user system you are sharing a Linux kernel. A kernel is a very complex piece of software with a huge attack surface. Privileged escalation vulnerabilities are commonly found. (This also applies to the nix-daemon, but it is a bit smaller attack surface but vulnerabilities are still occasionally found.) So you shouldn’t assume strong security isolation. I would say that a setup like this is acceptable for mostly-trusted people like coworkers or friends that are not expected to actively exploit vulnerabilities but definitely wouldn’t let random unknown users use the system.

So if you want strong isolation use a VM or separate hardware, but then you won’t be able to share the builds and packages defeating the point in this case.

This is my vote. I don’t know why the tax rate stops at 50%. Making your second million is easier than your first million, you should take home less of it. IMHO it should approach 100% as you make more and more. And the more money that you have the less valuable it is to you so we can put it to better uses for the society.

Apple is a lot better than Windows but slowly getting worse. They keep pushing their own services more and more aggressively while the quality of their software drops over time. Not to mention that iOS is so locked down that they don’t have to worry about things like pushing Edge because they just don’t allow any other browsers.

Oh, right. The OP is wrong it appears and I didn’t think much 😆

2026-06-27 to be unambiguous. (About two hours in the future from time of posting)

Edit: Actually 2026-07-27, OP has the wrong date.

I understand that this is frustrating but it is arguably the right option. If the correct owner can recover the account without TOTP then the TOTP isn’t really protecting the account.

Of course there are various ways to authenticate and it can make sense to have authentication to be (username + password + OTP) OR (email verification) but for a lot of people that email verification is a weaker link. It is more secure to only allow the former.

What I wish is that more sites would document their account recovery procedure. Often times they ask for a phone number for verification or notifications and that silently becomes a backdoor into the account. Even better would be if users can select what authentication combos are supported on a per-account basis (there are a few companies with “lockdown” settings that are a simplified version of this).

Of course it then becomes important to make it clear to the user “if you ever loose you X your account is forever lost”. It shouldn’t be surprise.

This advice feels like “Have you moved to the surface of the sun? Make sure to drink lots of water.” It’s not wrong, but also not particularly helpful. The only solution is to stop buying these things. Ideally take them back and get a refund if it isn’t too late.

Please explain what you mean and how this could be abused. What does “real” mean in this context? They both have the same code. It would probably help if you can provide a specific attack that could actually cause harm rather than just stating facts that have unclear risk.

It doesn’t mutate history. It just creates a new branch of history in their own fork. Just like any new commit would do.

I don’t understand. Why does having two commit IDs with the exact same code cause problems.

A green “Verified” badge on GitHub is supposed to mean that a trusted author signed it

The author did sign it. It is the exact same code.

An attacker can reissue the same signed code under a fresh ID that’s still verified to slip past.

To split past what? At best it seems that they would be able to have a different ID for the exact same code, which seems harmless? Slightly confusing at worst.

Nix also doesn’t use PGP signatures, it requires a separate hash of the resulting commit (the files with the .git directory stripped by default).

I’m a little confused by what this is saying. It seems that you can create a basically identical commit with a different signature and thus a different (hashed) ID.

So basically you can take a Signature S1 and produce a valid Signature S2 over the same data that is not identical.

This doesn’t seem like a very useful exploit primitive to me. Not nothing, but doesn’t seem like a big deal. I feel like I am misunderstanding something.

Yeah, carbon capture doesn’t math. I think the saying is that an ounce of prevention is worth a pound of cure.

The only reason why it is promoted is because the fossil fuel cartels push it as it moves the blame and focus from them to someone else’s problem. Then a bunch of garbage “carbon credit” companies start up and make a lot of noise while doing basically nothing. All the while they can keep pushing for fossil fuel projects because “it’s fine, carbon capture will solve it”.

Wow, the quality of that official video really looks like “maybe you just don’t care”. Why is all of the text weirdly pixelated, often not aligning to the lines and they couldn’t even bother to make it actually stroke out, just left to right wipe.

It does say “I agree to pay the above total amount” so it is pretty clear.

What is the price compared to last year? I would be surprised if the prices weren’t raised in expectation and an 82% occupancy rate at higher prices seems like a good place for them to be.

Because every three letter acronym means more than one thing. There are only 17 576 TLA so they are going to be heavily duplicated.

You should almost always spell out acronyms on the first use.

That’s good to know. But at this point I really don’t want to support this.