Also see some excellent comments on Reddit: https://www.reddit.com/r/programming/comments/1aigom1/the_th...

This article is about how we process text before passing it to large language models, the problems with this approach, and an alternative solution.

Thanks for this. I've added a note to the post. "...consider having dedicated, lightweight pages for login and credit card collection that don’t ship any third party code (npm packages, advertising, analytics, GTM, etc.)"

I originally wrote "about half" but there was one too many words in the sentence. Also I figure for an eCommerce site max-traffic might be 7-9pm or something so even though there's more sleeping happening outside 7am-7pm, there might be equal traffic. Anyway ... close enough.

Yeah it’s a total nitpick, the point is still made.

Author here. Someone in a comment pointed out that you if you could get your code in express middleware (or something depended on by express middleware or similar) you could potentially alter any CSP header in the responses (if it's set in middleware before your's in the chain).

Indeed. Then the middleware could also inject exfiltration JavaScript in `text/html` or `application/javascript` responses, which would work even if the app doesn’t use npm modules on the frontend.

This applies to almost any backend web framework and package manager, but the culture of micro packages in npm suits itself well to this attack.

Clearly what we need is cryptographically-signed JavaScript and CSP pinning.

(I’m only half joking)

EDIT: oh, CSP pinning is actually a thing that’s been proposed https://www.w3.org/TR/csp-pinning/

Hey, I wrote that article :) - yes it was pure coincidence, I just decided with all the security stuff going on this week (Spectre/Meltdown, I hadn't heard about the npm stuff) I'd write and article about it.

I laughed out loud at that. I have improved the contrast now so they will have to find something else to hate. Probably kittens.

I've changed it to 400 now.

Thanks for the useful feedback, it's much appreciated. Buttons are now full background colors, looks much better. It also should now be easier to see which nodes have children.

Please have a look at this issue: https://github.com/davidgilbertson/know-it-all/issues/8

I need to have a think about (and see what other people think) how to deal with inheritance of 'scores'. If you click "I don't care" to WebGL, it should trickle down, but probably not for "I know it". So I need to cover the different scenarios but stay intuitive.

I also need to have a think about how to show some information about what's happening below an item in the tree. Maybe just a % unrated for each row or something.

Regarding flashcards, love the idea, don't love the amount of work it would be :) I left a reply to a comment on medium about this if you're interested.

There were legitimately exactly 10,000. The anarchist in me took out 15.