Bug aside, it baffles me that it's a real person publishing rather than CI after tagging.

I don't know about their process, but I always make my release tags myself. I wouldn't want to give the signing key to any CI system.

That seems fundamentally backwards. The CI system should do the tagging. Allowing manual tagging introduces intentional or unintentional malfeasance in shared projects.

Manual tagging is the best way for most projects to do stuff like sign the package using an offline hardware key.

Putting your keys on CI makes you vulnerable to your CI being hacked, which anecdotally seems to have happened to several projects.

I am very reluctant myself, but I think at some point you have to compromise. You can self host and go the hard way, trust some 3rd party CI (reputation is key) or go, if available, with the one from your cloud provider. This is exactly why we went with Codebuild at some point. It's not great, but hey we are not giving it anything more they don't already have (we host everything on AWS).

I feel like this was doomed to happen sooner or later, but I wonder if this happening now has anything to do with the new KPN CEO being appointed last April.

In Italy, nodding upwards is a very passive aggressive and rude way of saying “no”. It’s accompanied with a quick lip smack rather than a drawn-in breath though.

I did something similar years ago for my BSc thesis, but for assessing quality. I’ll keep an eye on this.

I have been using Firefox again for a while now after completing my Google exit and I’m enjoying every single day with Quantum. The real game changer for me was the introduction of container though. I only wish they also had separated history.

My point exactly. Who would have thought that giving an extension permission to read and change all your data on website you visit would give the extension power to read and change all your data on website you visit.

most people who understand sandboxing would sooner assume that its bad copy text rather than believe google would allow literally anything anywhere.

Extensions (with permission to a domain) can inject elements and javascript into webpages, and javascript running in a page can use the DOM APIs (the same APIs that a webpage's own code uses) to see what's on the page, including form content.

Chrome extension sandboxing is mostly about controlling what webpages an extension can manipulate, not so much about how it can manipulate it. It's not obvious that there is a better sandboxing solution for the general case. (There are possibilities for specific uses though: Safari has APIs for extensions to use set up regexes to block images/ads without needing permission to run arbitrary code on sites.)

i can't speak for everyone, but if i could get a permission that was bookmarks/url only i would be pretty happy.

There's bookmarks and history permissions available: https://developer.mozilla.org/en-US/Add-ons/WebExtensions/ma...