Lightnews — Scholar-powered news

@siygle

@sylee.dev

又炎上啦

是說我現在都是 summary 看文真的是很糟糕（漏掉很多參與炎上的機會 #誤

不過姑且不論這邊的論述，搬過去的 Codeberg 我也是 BlueSky 上面才知道這個更偏向開源組織的 git repo 服務，不過 atproto 還有一個更有趣的 tangled.org 😁

src: x.com/ohmypy/statu...

November 27, 2025 at 6:01 PM

Reposted by @siygle

Socket

@socket.dev

New research from Socket: We uncover how North Korean hackers are using npm, GitHub, and Vercel together to spread OtterCookie malware, adding 197 malicious npm packages.

socket.dev/blog/north-k... #JavaScript #malware

Inside the GitHub Infrastructure Powering North Korea’s Cont...

Socket Threat Research maps a rare inside look at OtterCookie’s npm-Vercel-GitHub chain, adding 197 malicious packages and evidence of North Korean op...

socket.dev

November 26, 2025 at 9:15 PM

@siygle

@sylee.dev

Inside Google's Aluminium OS: What the future holds for Android on desktops | Android Central https://www.androidcentral.com/chromebooks-laptops/googles-aluminium-os-could-be-androids-big-desktop-breakout

希望這次可以專心弄一個然後把它作好，好嗎 🥺

ChromeOS isn’t dead, but Google’s new Aluminium OS might be the future

Aluminium OS is probably the internal codename for Google’s next-gen desktop OS built on Android.

www.androidcentral.com

November 26, 2025 at 4:53 PM

@siygle

@sylee.dev

最近誤入 Warhammer 40k，覺得這是個巨坑阿 😅

November 26, 2025 at 5:42 AM

Reposted by @siygle

Feross

@feross.bsky.social

More malicious Chrome extensions.

Stay vigilant!

Socket @socket.dev · 2d

🚨 Socket researchers uncovered a malicious Chrome extension that injects hidden #SOL transfers into Raydium swaps, quietly siphoning fees to an attacker wallet.

Full analysis → socket.dev/blog/malicio... #Solana

Malicious Chrome Extension Injects Hidden SOL Fees Into Sola...

Socket researchers identified a malicious Chrome extension that manipulates Raydium swaps to inject an undisclosed SOL transfer, quietly routing fees ...

socket.dev

November 25, 2025 at 7:57 PM

Reposted by @siygle

Socket

@socket.dev

We have updated this list to include more than 500 packages and 700+ affected versions, as well as a technical analysis of the attack. socket.dev/blog/shai-hu....

cc: @campuscodi.risky.biz @typescript.fm @bleepingcomputer.com @theregister.com

November 24, 2025 at 5:19 PM

Reposted by @siygle

Socket

@socket.dev

🚨 A new wave of the Shai-Hulud supply chain attack has hit npm, impacting packages across widely used projects from AsyncAPI, ENS, Postman, PostHog, and Zapier. Attackers added a malicious preinstall script following account compromise. The investigation is ongoing:

socket.dev/blog/shai-hu...

Shai Hulud Strikes Again (v2) - Socket

Another wave of Shai-Hulud campaign hits npm.

socket.dev

November 24, 2025 at 1:38 PM

Reposted by @siygle

焦糖烤布蕾 🍮

@haha1313.bsky.social

😆

November 23, 2025 at 10:47 AM

Reposted by @siygle

麻糬和木火

@bicolorcat2077.bsky.social

高雄！！Ｏ(≧▽≦)Ｏ

四種不同類型、不同場地規模大型音樂活動同時登場，估計單一週末帶動觀光產值將超過3億以上，也顯示了高雄場地的多樣彈性和交通疏運能力，這樣的城市綜合策展能力，並不是「短暫的活動效益」，而是長期軟硬體建設的綜合成果。

圖：高雄市政府

高雄捷運今日(11/22)運量初步統計超過35萬人次,已經超越幾次跨年運量。

TWICE 《THIS IS FOR》世界巡演高雄場在世運主場館開唱,吸引場內外超過6.8萬名ONCE參與,明天還有一場。

除此之外,伍佰&China Blue 《Rock Star 2》巡演今晚在高雄巨蛋開唱,同樣明天也還有一場。

海音今天則舉辦孫淑媚《MAY好三十》演唱會, 衛武營戶外劇場則在今天舉行《2025交響派對: 重返經典》。

四種不同類型、不同場地規模大型音樂活動同時登場,估計單一週末帶動觀光產值將超過3億以上,也顯示了高雄場地的多樣彈性和交通疏運能力,這樣的城市綜合策展能力,並不是「短暫的活動效益」,而是長期軟硬體建設的綜合成果。

圖:高雄市政府

November 23, 2025 at 2:18 PM

@siygle

@sylee.dev

Siren Chen - 這幾天，當台灣爭論著中配能否擔任公職，菲律賓馬尼拉北部一位市長郭華萍（Alice... | Facebook https://www.facebook.com/share/p/1FmMjgAxdd/

這本來就不是一場公平的競爭，無奈這個方法很有效

November 23, 2025 at 4:09 AM

Reposted by @siygle

Alper Cugun

@alper.nl

Servo is a massive achievement. One of the more unknown but potentially very impactful things about the project is that its modular nature allows parts of the web rendering stack to be embedded elsewhere (in game engines and such).

blogs.igalia.com/mrego/servo-...

Servo: A new web engine written in Rust

Detailed description slide by slide of my Servo talk at GOSIM Hangzhou 2025.

blogs.igalia.com

November 22, 2025 at 4:39 AM

Reposted by @siygle

二手青春

@frankegobluebird.bsky.social

唉

立院三讀恢復公投綁大選
news.kagi.com/s/dvcdad

立院三讀恢復公投綁大選

台灣立法院會於11月21日三讀通過《公民投票法》第23條修正，規定公投案公告成立後3至6個月內投票；其間若有全國性選舉，應同日舉行，等同恢復「公投綁大選」。本次修法逆轉2019年公投與大選脫鉤，由民眾黨團與國民黨立委提案推動，在野陣營聯手通過，民進黨團則表達批評。熟悉選務的官員憂心2018年曾出現的排隊與「邊投票邊開票」亂象可能重演；中選會回應將審慎研議選務、依法辦理，維持運作安定，相關預算循往例...

news.kagi.com

November 22, 2025 at 1:47 AM

Reposted by @siygle

jacky5233.bsky.social

@jacky5233.bsky.social

本來我只是拒喝大苑子的人，從現在開始，我也要加入「呼籲大家抵制大苑子」的行列！
其實我從2019的「源自中國」事件，就再也不喝大苑子了，因為大苑子起家是以台灣新鮮水果為招牌，而且有獲得台灣政府創新研發的補助，喝台灣水賺台灣錢，卻公開說品牌來自中國，完全無法認同。
但這一次真的太太超過，跑去跟石虎柳丁的農家拍影片，然後大打廣告聲稱產品使用農業友善的石虎柳丁，卻被抓到沒有跟農家採購石虎柳丁，而是用其他柳丁替代。

November 21, 2025 at 5:27 PM

@siygle

@sylee.dev

網紅賓賓哥台中校園演講開直播女校長當場出面制止要求道歉 | 中小學 | 文教 | 聯合新聞網 https://udn.com/news/story/6898/9151285

網紅文化真的是毒瘤無誤 🤷

當然有好的沒錯，但亂七八糟的數量更是驚人

網紅賓賓哥台中校園演講開直播女校長當場出面制止要求道歉 | 聯合新聞網

台中市中山國中昨邀請魔術師王元照演講，未料網紅賓賓哥（江建樺）中途以神秘嘉賓身分被介紹出場，且未經同意直播，校長王蒲寧當...

udn.com

November 20, 2025 at 4:39 AM

Reposted by @siygle

David Buchanan

@retr0.id

• web browser
(noun) a fork of chromium

• text editor
(noun) a fork of vscode

November 18, 2025 at 7:42 PM

Reposted by @siygle

Socket

@socket.dev

🚀 Day 2 of Socket Launch Week:

Today we’re introducing a major shift in how developers fix vulnerabilities: Socket Certified Patches.
One-click, safe-by-design remediation for vulnerable dependencies.

November 18, 2025 at 7:39 PM

Reposted by @siygle

Rob Palmer

@robpalmer.bsky.social

ECMAScript excitement 😉

Congrats to my coworker @ashley-c.bsky.social at TechAtBloomberg on advancing Await Dictionary to Stage 2.7 at TC39 today 🎉

Promise.all returns positional results as an array. Promise.allKeyed allows named results inside an object 👍

github.com/tc39/proposa...

const {
shape,
color,
mass,
} = await Promise.allKeyed({
shape: getShape(),
color: getColor(),
mass: getMass(),
});

November 18, 2025 at 6:33 AM

Reposted by @siygle

Cloudflare

@cloudflare.social

On November 18 Cloudflare experienced a service outage. Here's a detailed breakdown of what happened. https://cfl.re/43Bw8AI

Cloudflare outage on November 18, 2025

Cloudflare suffered a service outage on November 18, 2025. The outage was triggered by a bug in generation logic for a Bot Management feature file causing many Cloudflare services to be affected.

blog.cloudflare.com

November 18, 2025 at 11:49 PM

Reposted by @siygle

Nicolò Ribaudo

@nicr.dev

I bought a prusa core one 3d printer two weeks ago, and now they emailed me "Hey we announced this new cool version right after that you bought the previous one. Fill this form to get a free update kit".

I love when companies care about customers this way.

www.prusa3d.com

Original Prusa 3D printers directly from Josef Prusa

Eshop by Prusa Research a.s., company founded by Josef Prusa, one of the RepRap core developers. We're selling Original Prusa 3D printers (incl. Prusa MK4, Prusa XL), filaments (especially our in-hous...

www.prusa3d.com

November 18, 2025 at 4:41 PM

@siygle

@sylee.dev

Steam請你幹死微軟！宇宙苦微軟久矣。 - YouTube https://www.youtube.com/watch?v=qEO97PU88wA

我是沒這麼樂觀，畢竟要用戶轉換是超級難的一件事，不過如果能捲起一點漣漪也很讓人期待

是說如果能更簡化 *nix 生態的開發，看今年的 steam、Omarchy，是不是真的可以期待起飛了 😂