I've seen plenty bugs that were caused by USER_NAME vs USERNAME and similar in 2026. But if thats not a concern and you think the alternatives are clearer... nobody's forcing you.

The argument for : "${foo:=x}" is usually that you don't have to repeat foo, leading to less opportunity for errors and generally DRY.

True, but it will still reduce the chance of success to close to zero. If you assume your own users devices are compromised, there is nothing you can do to avoid exposure.

Not if your threat model is "bots that scan the internet for vulnerable installations of X".

Cleatext signing (having the signature and data in the same file) is broken in many ways. It is possible to put unsigned data at the top of the file in a way that sha256sum will use it. Watch the 39c3 GPG talk if your interested in the gory details.

The solution is to use detached signatures (checksum.txt and checksum.txt.gpg to verify that). This makes sure that all of checksum.txt is actually covered by the signature.

Sounds like it... https://blog.fermi.chat/blog/2026/04/26/theFuture/

Theres good reason to dislike cloud gaming in general, but the geforce flatpak is actually solid. Trivial to install, just works.

That's a different project...

This has nothing to do with meshcore as a protocol, the problem is that some HA addons don't treat untrusted input properly. The malicious name could have been transmitted via meshtastic or carrier pigeon, if another addon did the same dumb thing.

You see, our orphan crushing machine is ✨ made in europe ✨

Booking.com (at least in Germany) only useagic links for some time now. I hate it.

I really appreciate your marketing. You're good at this.