I don't self host anymore, as it really is a pain, but use Fastmail instead (while my wife uses Protonmail). I would never rely on Google for, well, anything if I can help it.

I have been self hosting E-mail for close to 15 years now, and apart from the occasional and very rare delivery problem, it's not really a pain at all. Get a dedicated IP address not on a spam blacklist, don't spam, and it's pretty much set and forget. Well worth it to not have your very identity hanging off an account that you might one day be banned for for reasons you can't figure out.

I think an interesting side of this conversation is how the Google employees are jumping in with DARVO attacks, trying to accuse people of spreading misinformation when they're literally quoting the ToS.

This is something I've seen happen a lot with Google- their employees (especially the director+ folks) are absolutely rabid on social media when it comes to defending their products, and they don't let little things like "facts" get in the way.

Google needs to get a better social media policy because they look like clowns when they do this.

Googlers expect the consumers of their products to be Googlers who can just read up on the internal info or ping someone etc

they don't understand the concept of external users being a thing

that's the impression I've gotten

There have been cases in which friends or family of Google employees have gotten the Google Death Penalty. In those cases they were internally stonewalled about this for weeks. Google's risk department works like secret police[0] and I would not be surprised if there is internal disinformation about what the policies actually are in there too.

Also keep in mind nobody reads the TOS. The TOS is pure Wilhoitism: it exists to protect Google and bind you. There is plenty of shit that gets put in there that Google never intends to do to 90%+ of their customers, but they have to reserve the right to do this anyway. You can infer the general shape of business policy from the the TOS but not the exact details.

The only people who actually know anything about Google's business policies are the people in the risk department doing enforcement. The CxO level might have be consulted about specific policies, but a lot of stuff isn't going to rise to their level until it blows up and becomes a PR disaster.

[0] I call this the "Maoists in the Risk Department": in general, there is a tendency of all businesses to independently reinvent Maoism when enforcing rules with their customers. You actively discourage "edge-touching" behavior from your customers by making the rules murky and incomprehensible.

There are a ton of advantages to using uv over pip. I don't use UV because it's faster, although I do appreciate that. I use it because it's smart enough to manage virtual environments for each environment and tool, it can isolate to different python versions trivially, and it handles locking in a way that is actual sane.

Seriously, even as well paid as many devs are these are not machines that are affordable for personal use. Their market is people slapping down millions on frontier model training.

>Indeed, the broad backlash against Flock has grown so strong that the surveillance company last week announced mandatory new audit controls and lower default data retention periods for US users.

I'm a bit disappointed that they didn't call out how much bullshit was in that statement. They are just changing the default settings for new customers. That's it. All the deployed cameras remain the same, and new customers can just toggle those settings off of the defaults. It is so obvious that they were attempting to get credit for doing nothing, and reporters should call that out.

Vote with money, and spread the info about this cancer far and wide so everybody else votes with money. Its not a minor technical issue, the whole concept of how they operate their devices is amoral and/or unlawful in many parts of the world.

Thats the only stick with carrot these companies follow, rest is just empty PR not worth anyone's time.

This, like all of their dashboards, is complete bullshit. As a GitHub enterprise user i am absolutely affected by the outage today, and have been affected by all of the GitHub Cloud outages.

There is no separate enterprise platform unless you buy their self hosted server product.

Their CISO literally acknowledged it and then they all continued ignoring it again. This isn't just bad process, this is a broken security organization.

Most automated analysis isn't dependent on just behavior, but rather suspicious things in the code itself. You have a popular open source package with files that exist on pypi but not github then that's a big flag, or if a similar package suddenly has some base64encoded garbage that runs through an obfuscated exec call. In other words the simple fact that the project has obfuscated code is enough to flag for further attention.

That said if the only issue is time, researchers will just run their automated analysis through machines with dates in the future alongside their normal tests.

A package I maintain once ended up in exactly this state because of a sync script.

> I'll keep a log of system time to detect any "jumps" and then "behave normally" if I detect this.

This makes no sense, the system clock would be set before the suspect package is even pulled down. There isn't a "jump" just a reboot and system start at a "totally real" point in time.

And the premise is that this package can evade detection of its suspect code by using an ever-increasing amount of odd code? Yeah, that's a hard strategy.

A cat and mouse game at least raises the bar for the exploit. The status quo requires no attempt at obfuscation at all. It also makes it harder for such an exploit to turn into a worm, since developers have time to notice their credentials have been stolen and pull any malicious packages pushed using them. (and such worms hitting popular packages have so far been how most people have been exposed to this risk).

ok, but your package still contains obfuscated code that we can read

China is releasing open weight models you can simply run yourself.

Yup, this is one of the many reasons why I prefer OpenCode as my agentic harness of choice. If I'm confused about something I can just read the source code.

I found it really eye opening to understand the flow of how the harness instructs the model and then consumes the crafted JSON response that comes back so you can better understand the split and where a fix may need to go; such as better harness logic, different prompt or perhaps another model.