If I may ask a question…

Nature’s flavors sells both extracts and concentrates that are water soluble. For a brown soda, like rootbeer, is an alcohol based extract preferred or should I go the concentrate route?

I’ve been toying with the idea of making commercial style rootbeer at home, and making soda from roots just doesn’t cut it (even if it’s pretty good). I’ve been eying Nature’s flavors for a while, but since I’m not in the US it will be VERY expensive.

There are no domestics providers of food safe wintergreen or sassafras.

Thanks, and cool career switch!

That’s a good question and it probably depends on the ingredient. Most of what we call flavors are a mix of volatile aromatic compounds. Some of those are fat soluble. Some water soluble.

Alcohol is great for extracting as it can pull out both.

The flavor extracted depends on what you’re extracting with and even the concentration.

So really, you’d have to buy it and try. I’ve only ever made root beer a couple times for my own experimentation with oil.

Nature’s Flavors is awesome though and you might ask them.

I think a lot of people feel like people who have one foot in a heavy regulated industry shouldn't have their other foot in the regulatory body that regulates that industry.

I think the general public has a MUCH better grasp on the potential consequences of crashing a car into a garage than some sort of auto-run terminal command mode in an AI agent.

These are being sold as a way for non-developers to create software, I don't think it's reasonable to expect that kind of user to have the same understanding as an actual developer.

I think a lot of these products avoid making that clear because the products suddenly become a lot less attractive if there are warnings like "we might accidentally delete your whole hard drive or destroy a production database."

Just FYI, you don’t have to use a USB stick, you can also use HSM like azure key vault and sign using azure signtool.

Azure Key Vault - even in the ‘premium’ HSM flavour can’t actually prove the HSM exists or is used, which doesn’t satisfy the requirements the CA has. In theory, it shouldn’t work - but some CAs choose to ignore the letter and the spirit of the rules. Even Azure’s $2400a month managed HSM isn’t acceptable, as they don’t run them in FIPS mode.

Is it ok if a tobacco executive downplays risks with smoking while at the same time forbidding their own children from smoking?

I think that’s a more accurate analogy, and I think it also would be reprehensible behavior.

Agree

I don't mean this to doubt you, it is a sincere question. Do you have any examples of that happening? It sounds very believable, but it would be great to have actual sources for future reference.

Anytime you see someone on HN lamenting that Safari is the new IE because it doesn't implement something, 99.9% of the time it's Chrome-only non-standards.

- All of hardware standards. WebHID's timeline is especially egregious https://github.com/mozilla/standards-positions/issues/459#is...

- Most of standards advertised on web.dev as "new exciting opportunities you can try now". E.g. WebTransport https://developer.chrome.com/docs/capabilities/web-apis/webt.... The status of that spec is "scribbled on a napkin", but somehow already released in Chrome.

- Other "standards" and "specs" here and there like web share target https://w3c.github.io/web-share-target/

Can I Use had to create a special UNOFF tag for all the web APIs that Chrome (mostly Chrome) ships. If you go to MDN and look at all APIs marked as "experimental", you'll find that most of them are already shipped in Chrome: https://developer.mozilla.org/en-US/docs/Web/API

push notifications, webgpu and webusb are examples of chrome being a reference implementation and using things for their services while simultaneously pushing the standard.

Push for mail, webgpu for maps (iirc) and I believe WebUSB is used for Android flash/debug.

WebGPU is the only one of those I’ve really followed, but hasn’t that had a huge amount of input and changes due to other voices in the working group? That seems to contradict the simplistic picture painted above of Google just dictating standards to the industry.

Would webgpu exist at all if Chrome hadn’t just pushed through with an implementation?

Who knows.

Not us, we’ll never know.

To add insult to injury, we probably would have gotten WebGL 2.0 Compute, which was initially done by Intel, if Chrome had not refused to ship it on Chrome, arguing that WebGPU was right around the corner, and it would take too much space, this was about 5 years ago.

And to those rushing out to point out the excuse part about OpenGL on Mac not having support for compute, WebGL already back then wasn't backed up by OpenGL on all platforms, see Windows (DirectX), PlayStation (LibGNM).

Also eventually Safari also moved their WebGL implementation from OpenGL to Metal, and Chrome did as well, replace their WebGL to run on top of Metal on Mac.

So not really that much of a problem regarding the state of OpenGL on Mac as "required" implemenatation layer for WebGL.

Not true about webgpu, but true about some APIs in Google's project-fugu

We had very few products that use the fugu apis., and I don't believe we were the first to ship them either in a production website.

If you're looking at fugu in particular (especially in the latter stages) we had external developers or businesses wanting the features.

Note: there are some apis that a Google customer wanted to use first.

But the other browsers objected yet Chrome still shipped them

QUIC. HTTP/3. WebP. And more in this comment thread.

Yep, QUIC is what I was thinking about when I wrote my additional comment, but there are many examples, as others have pointed out.

It happens every single time. This isn't some well kept industry secret

Is this maybe the play? Facebook has an aging user base, maybe it makes sense for them to target older people who have trouble using traditional computers or smartphones?

Isn't that the idea behind an alternative to DNS? I think OP meant that we need a similar system based on clear rules and international cooperation for social media, in addition to host names.

> Whoever was attempting to log in was using one of the newly created accounts that were used in the other DOGE related activities and it appeared they had the correct username and password due to the authentication flow only stopping them due to our no-out-of-country logins policy activating.

Explains this:

> why would DOGE be immediately leaking just-granted NLRB login credential

The implication is that the credentials were for more than this specific system. It's entirely feasible that a bad actor would immediately try to vacuum up as much data from as many systems as possible, it's just that this system had a geo block that made it clear this was happening.

I don't think we need to assume that this was a targeted attack on this specific NLRB system, just that this specific NLRB system was the one that caught the attempts.

So, what systems DIDN'T block authentication?

I don't think asylum seekers are typically considered illegal immigrants. I think that's more individuals who either don't seek legal status, or have tried to get a legal status but failed and stayed in the country anyway.

And I don't think Sweden and Germany are giving free housing to individuals that overstayed their visas.