Apple would be 100% right to say "they're not our phone, we didn't make them, the branding was a lie."
Of course if Cursor actually has a direct connection with Anthropic, and Anthropic lost control of their keys... it's a different story and their employee is just obfuscating up there.
- Ordinary term used more than once in the same comment
- “svc-telemetry key found” appears 2 times
- “No key found; machine not impacted” appears 2 times
------
Check whether you are impacted
The malicious extension appends the attacker's public key, labeled svc-telemetry, to your SSH authorized keys. To check for it:
On macOS, run:
grep -qs svc-telemetry ~/.ssh/authorized_keys && echo "svc-telemetry key found" || echo "No key found; machine not impacted"
On Windows, run in PowerShell: $files = "$HOME\.ssh\authorized_keys", "C:\ProgramData\ssh\administrators_authorized_keys" | Where-Object { Test-Path $_ }
if ($files -and (Select-String svc-telemetry $files)) { "svc-telemetry key found" } else { "No key found; machine not impacted" }
------[1] https://cursor.com/blog/claude-code-extension-security-notic...
- Cursor (obviously) is not using MSFT vscode extensions library - Cursor (apparently) is not using Open-VSX either! - Cursor uses it's own "Cursor's marketplace" which is not public, no one knows what it is exactly, and looks like it is proxying open-vsx marketplace (?) - THAT "Cursor's markeplace" is what was compromised today.
So. I would really really love someone from Cusro's team to step in and explain WTF just happened! (pardong the language)
- Ordinary term used more than once in the same comment
- “Claude Code for VS Code” appears 2 times
* "Cursor Editor" is a fork of VS Code
* The "Claude Code for VS Code" extension, v2.1.313, was compromised specifically on the Cursor Editor extension marketplace / distribution system
* The "Claude Code for VS Code" extension for regular VS Code on the official VS Code extension marketplace was not affected
Followup question: was a v2.1.313 also published on the official VS Code marketplace? If so, your statement is that that version was not compromised?
> Note: This delay does not apply to extensions from trusted publishers such as Microsoft, GitHub, and OpenAI. These extensions continue to update immediately.
You can't even configure which publishers you "trust"...
- Quoted phrase in the opening sentence
- Opening quote: “security through obscurity.”
This is a full infosec emergency unfolding here. No matter how grinding it is to motivate a team to invest in protection or resilience (and it is grinding): We gotta get ready. Stat! The AI-accelerated attacker apocalypse has begun. It's boom, boom, boom, thanks for everything, on to the next. They have us sighted and are firing for effect.
So credential rotation, tripwire secrets, DFIR on standby, solid vulnerability and intrusion detection, real listening to that signal, minimized blast radius, spending caps and time limits and tight scoping on credentials, fast incident alerting... We need to get on a real war footing here.
- Quoted phrase in the opening sentence
- Opening quote: “nicer to use”
Azure would beg to differ.
There's no amount of "nicer to use" that can replace security, at least certainly when selling to enterprises
- Quoted phrase in the opening sentence
- Opening quote: “AI native”
What works: - Empowering engineers. Giving engineers more trust, ownership and product decision-making leads to more engaged engineers vs. micromanaged tickets. Engineers who are treated like owners tend to notice cross-cutting problems and push to get them cleaned up. - Hire for diversity. Not race or gender, but diversity of thought. Different ages, backgrounds, approaches to AI, focus on frontend/backend, etc. Race/gender diversity tends to come along for free. This is a huge edge because every LLM is spinning up the same next token prediction, so approaching problems from different perspectives gives more robust coverage across your codebase. - Flat org structure, low ego. Interns and 20 year vets work side-by-side and teach each other things - hire for openmindedness. - Communicate about product. What should it do? How do we want a feature to work, and how to handle certain edge cases? If the product is well understood, the code follows. In-person/hybrid is valuable. - Architecture matters more than ever, but it is easier than ever to fix. Listen when engineers mention tech debt. Notice when a simple change touches 27 files. Senior engineers shine for this, because they tend to have a better nose for code smell. - Reviewing still matters. Anthropic may throw tokens at reviewing, but it is a great way to share ambient product/code knowledge across the team. 200 engineers throwing code against the wall is chaos and leads to YOLO codebases. You can move fast AND keep a rough mental model of the codebase intact.
The key is to understand that computers exist to serve human needs, and the less code / UI / hoops to solve a problem the better, and to think end-to-end. If you are able to do that, most systems built by committee have a lot of low-hanging fruit that can be improved without much sacrifice. In practice, political realities and operational concerns may come in the way, but I firmly believe this is the only way to successfully operate as an engineer, and it will only become more important in the age of AI.
Whatever, I drove down to this set of huge industrial warehouses with trucks coming and going by the dozen and found the customer service office.
“That’ll be half an hour, I recommend waiting at the cafe.”
“Half an hour for what? Aren’t all the packages right here?”
“They are, but looking up the package ID in the system takes at least 30 minutes, maybe 33.”
“33!? Wait… don’t tell me, let me guess: it has been getting slowly and steadily worse over years? Predictably taking longer and longer, right?”
“Yeah, six months ago it was 27 minutes! How did you know?”
“Umm… isn’t this a bit of drag on your operations?”
“Absolutely! Everything takes forever, every shipment is delayed, … <long rant> …”
“I… bet. Why hasn’t anyone fixed it!? It’s a one line fix!”
“No budget!”
This was one of the biggest logistics companies in the country about to undergo a multi-billion-dollar merger.
Their core business software was missing database indexes even on primary key columns!
Madness.
These new tools only exacerbate this issue.
Earlier, I reviewed code that does way more than specified scope, changes public API and introduces new behavior. I had to almost redo the whole thing.
I thought to myself, no way I am going to ship the code as written without actually reading through it (or as some people put it, only looking at the "intent"). I'll get more complaints from users while having absolutely no idea what's going on with the code or actual behavior.
It's a puzzle to me how these orgs can pull it off.
i will say, at least this article says "we merge 5x more and our revert rate has stayed the same." so thats at least a metric i can start to respect
It describes a team spending 30x payroll on tokens - $3,000,000 in token spend per month - building a multiplayer game where incidents and bug reports from users are passed directly to Fable 5/5.1 agents who then act on them and deploy the changes to production.
"We consider it an outage if we don't ship every hour"
It's worth reading because it's either a complete disaster or a glimpse of the future, or quite possibly both.
- Ordinary term used more than once in the same comment
- “AI-native” appears 4 times
To me, true "AI-native" engineering will be one where questions regarding how humans will do things like review code are irrelevant. You explicitly throw away any concept of typical software engineering and, instead, differ to the AI. Your job, as a human, is solely to do what the AI can't physically do. That's not the same as closing gaps between what AI is currently capable of doing and what you'd need it to be capable of doing. It's literally enforcing that anything an AI is able to do is treated as correct in itself, and you, as a human, only support it by being a human.
If that sounds outlandish, that's because it is. We don't have such capable AI systems yet. It's possible we never will. But that's beyond the point. The reality is trying to make an "AI-native" engineering org by just layering AI on top of existing processes and systems is futile. If your expectation is that AI will continue to improve in capabilities at an accelerating rate, then these stop-gaps are pointless. You might as well just ignore AI altogether until it is able to completely take over, because that's the inevitable goal, right?
If you're willing to buy that will be possible, then my guess is that it will occur in the form of small scale startups and actual mavericks rather than someone trying to run an existing business who will simply be too risk adverse to go all in when the time comes. Some guy in his basement is more likely to leverage AI "properly" to build an actual "AI-native" engineering org because that person won't have much to lose.
I was like "nice Halloween costume" and he responded "Halloween? I just wore this for Patrick Stewart." I almost teared up.
- Quoted phrase in the opening sentence
- Opening quote: “Tapestry”
- Quoted phrase in the opening sentence
- Opening quote: “The measure of a man”
Perhaps it is uncomfortable for people to think about now.
- Quoted phrase in the opening sentence
- Opening quote: “hacks.ycombinator.com”
Summary of n°I-1358:
- It's a tax on internet "content", but they haven't defined what that means exactly, so by default it would apply to all internet traffic.
- Bytes delivered to French users by ISPs are taxed (but not user uploads).
- ISPs are responsible for tracking exactly where every GB originates from and will have to report the names to the government.
- The "content provider" then has to pay 0.055 EUR per GB that they sent.
- No explanation for how user-to-user traffic is handled. No explanation for what ISP -> user means (e.g. does P2P count)? No details on how ISPs will track the upstream source. About a million other similar questions are unanswered.
- The amendment was adopted today, and the assembly will vote on it as part of their full budget (but there are still many stages left before it can become law). Even by government standards this is way too idiotic to actually come into effect.
You only need a handful of occasions of creating massive billing errors for your customer's customers before they will slag you to all their CTO friends and pull the plug. Imagine Stripe began double-charging every third transaction once a week, and couldn't fix it after two months of thrashing because no one there has any understanding of how anything works anymore. They are simply done at that point, all the value of their brand lost.
If you don't ride your bicycle for years and years because you can just write "drive yourself"
Then your skills are atrophying. Typing isn't a skill
If AI can handle it, great! We have a new tool -- let's make the tool better.
Let's figure out how to use AI to make us detect and resolve issues faster, and even better, prevent issues. I've always said we can't consistently hit 5 9's without automatic detection and remediation. We are there now.
Let's get everyone to 5 9s with AI!
The autopilot does not do "almost all critical work", not even close. It only does some of the routine work (definitely not all of it). But the real critical work is when stuff goes wrong, dealing with emergencies.
The inherent complexity of aviation means that there are so many different failure modes and combinations thereof that no traditional system could ever handle all possibilities and edge cases.
I'm not going to claim that an AI could never do it. But as of right now, with current technology, well-trained pilots are absolutely critical to safety in even the most advanced airliners.
Also, the survivorship bias argument runs against you. Most events where pilots save the day are completely invisible. Like catching an incorrect clearance, a misconfigured approach, dealing with a technical malfunction, etc.
And even when disasters happen, it is very rare that simply engaging the autopilot would have saved the day. In fact, there are plenty of examples where the opposite is the case, and dropping to a lower level of automation would, in hindsight, have been better.
"Security is for losers"
> Andy Yen, the CEO of Proton, had a message for an employee in the company’s security Slack channel who urged the company to at least take a few days to pentest newly written code before pushing it live. “That’s bullshit and loser thinking. Of course it’s possible to be fast and secure,” Yen wrote in the channel at the end of August. “Stop thinking always of how to be slower, and focus more on how to be faster.” In a follow-up message, Yen reiterated his point: “only losers think like that.” His ultimate message for the team was to “stop lovingly handcrafting all our code and use AI more.”
Proton CEO Andy Yen: "This will be the last year that we hire engineers." - https://news.ycombinator.com/item?id=50295112 - October 2026
Manifestos, Fear, and 'Loser Thinking': Inside Proton's AI Reckoning - https://news.ycombinator.com/item?id=50289692 - October 2026
Good luck.
Edit: There appears to be some consequences for acting like this and those actions being made public.
Proton's CEO Cancels AI 'Re-Interviews' - https://news.ycombinator.com/item?id=50307183 - October 2026
- Quoted phrase in the opening sentence
- Opening quote: “DevOps”
- Quoted phrase in the opening sentence
- Opening quote: “peak gaming”
Once PS3 and Xbox 360 came in picture, things changed slightly since they relied more heavily on their network services… albeit, PSN back then was free for online gameplay. These were on the same generation as Wii, but Wii was a winner for casual playing.
It would be more efficient to ban cars in favor of mass transit. It would be more efficient if people only lived in apartment complexes rather than standalone houses. Tons of things can be more "efficient" if you take away people's desire for privacy and ownership.
- Opening sentence uses a quote to challenge or distance a term
- Opening sentence challenges the term “your computer isn't idle sometimes”
What they did was to say "hey, we can leverage your idle computer to help process this".
Different perspective.
Also, I'd be very surprised if the current rush to build datacenters everywhere is optimal usage of resources. How many companies are building datacenter commons and sharing with other companies to optimize resource usage?
> Two statements can be true
As I general point, because I keep seeing this line on HN: Of course they can in the general case, but more often than not, the reason why this line is written is because there is some tension or contradiction between the statements. In that case, understanding where the tension lies is IMO more useful than shrugging and deciding to "hold two contradictory thoughts in your head" like in 1984.
Sometimes it feels like a rhetoric device to "rescue" an opinion when the opposite opinion is hard to argue against.
That doesn't mean anything. All of the code in a browser is "automation" -- normal users aren't hand-crafting the hundreds of HTTP requests the browser makes to render a single web page. Meanwhile there is a human somewhere telling the scrapers what to scrape.
> You are entitled to your own emails, posts, etc
Is that somewhere in the proposed text?
> but you are not entitled to crawl the internet for your own purposes without stating what they are and allowing websites an opt out.
"Stating what they are" buys you nothing when you have no way of verifying it, and you're still not providing any way to distinguish this from investigative journalism or e.g. a new competing search engine.
It does seem like this bill mostly affects normal users and is suspect with more surveillance being pushed. However the biggest problem is that the internet is global and the fees only apply to the US. If bots from Russia, China, India, or even France are scrapping then how would this even reduce the bots? Seems more like a new 'contempt of business model' is the purpose of this bill.
- Quoted phrase in the opening sentence
- Opening quote: “austerity”
What’s more fun is that while france is teetering on the brink, it’s hardly alone, and it’s collapse will tip the dominoes.
Something to look forward to, I guess.
- Quoted phrase in the opening sentence
- Opening quote: “Elements of Euclid”
(bottom of the readme)
This is to say, the stated goal and the target of the crypto enthusiasts are misaligned. To transcend the institutions represented by the fiat system requires far more than creating some alternative "currency", rather it requires creating an entirely new power structure.
1) unregulated gambling (a.k.a. "prediction markets"),
2) funding North Korea.
Heartening to see the beautiful web3 vision come alive.
This is to say, the stated goal and the target of the crypto enthusiasts are misaligned. To transcend the institutions represented by the fiat system requires far more than creating some alternative "currency", rather it requires creating an entirely new power structure.
- Quoted phrase in the opening sentence
- Opening quote: “losers”
Note how he says that he wants to 'acknowledge' things. Not apologize. Not that he is wrong about the re-interviews. He says he didn't use nice enough language to soften the blow. Basically, in simple terms, he didn't Lisa it up as temporary refund adjustment.
edit: and the passive voice is a cherry on top
edit2: I gotta say -- all those CEOs are getting a little uppity for people who likely use copilot for summarizing emails.
Have people completely lost their humanity? Is winning at whatever you’re doing that important we can’t be equally obligated to show each other decency?
"Manifestos, Fear, and 'Loser Thinking': Inside Proton's AI Reckoning" https://news.ycombinator.com/item?id=50289692 67 comments
"Proton goes all in on using AI" https://news.ycombinator.com/item?id=50296602 110 comments
"Proton to 'Re-Interview' Staff About AI to See Who Gets to Keep Their Job" https://news.ycombinator.com/item?id=50251062 48 comments
https://news.ycombinator.com/from?site=githubstatus.com
It's driven by aggregated user complaints, so it's pretty high-quality. Comment counts are a proxy for "how bad was the outage" + "how long was the outage thread topical for".
edit to add: Here's a scatterplot of the same,
It's a very typical failure mode for publicly-traded companies. For a CEO to have the incentive to do something that will kill their company, in a few quarters' time—in exchange for a one-off windfall that will boost the stock price, CEO compensation, &c. Short-termism at the "eating the golden goose" level.
> [May 2024] "In its IPO prospectus, Reddit revealed that it has contractual agreements to license its data to customers including Google worth a combined over $200 million. And, in its first earnings report as a public company, Reddit reported a 450% year-over-year increase in non-ad revenue, attributable mainly to those agreements."
> "Reddit stock was up 11% in extended trading following the announcement of the OpenAI deal."
https://techcrunch.com/2024/05/16/openai-inks-deal-to-train-...
Theres “big bets” and then there’s heavily leveraged bet the farm with leveraged debt. The first one hurts when it pops. The second one wipes people out.
Blackstone told investors Anthropic may not receive an investment-grade rating immediately after going public, a reversal from its previous guidance that would complicate the AI lab’s ability to finance its massive spending.
The private capital giant told investors in Anthropic’s latest $63bn chip financing deal that the start-up is expected to receive a “high” junk rating from major credit rating agencies after its initial public offering, according to people familiar with the matter.
Blackstone is acting as an anchor investor on the deal, known as “Project North Star”, and is working with banks that stumped up financing on selling the debt on to other investors.
Anthropic filed to go public on Monday, setting up what could be the largest listing of all time next month. The AI lab’s prospectus sketched out its “bold but sane” plans to spend more than $800bn on computing infrastructure between now and 2045.
An investment-grade credit rating is central to those ambitions, enabling Anthropic to borrow at lower rates to finance its AI infrastructure projects. The group has cash and equivalents of more than $112bn, and investors anticipate it could raise about $100bn more in the IPO. Sign reading "Blackstone" outside the Blackstone headquarters in New York, with pedestrians and city lights reflected in the glass. Blackstone’s funds have invested in $9bn of the junior debt at a lucrative yield of more than 10% © Angus Mordant/Bloomberg
While Blackstone had told its investment partners in recent months that it was expecting an investment-grade rating for Anthropic before year-end, it has recently signalled that a rating in the double B range or above is more likely given the guidance it has received from major credit agencies, the people said.
Such a designation would limit the pool of capital that Anthropic could tap because many insurance and pension funds are restricted from taking large positions in junk-rated borrowers. As a result, the company might need to continue to rely on its suppliers with high credit ratings to support its debt-raising efforts.
US tech stocks slid to session lows on Friday following the FT’s report on Anthropic’s rating, with the Nasdaq 100 down 3.7 per cent in afternoon trading. Markets were sharply lower prior to the report after earnings from Amazon and Intel worsened fears about the sustainability of the AI boom.
“It’s all about access to credit, it really matters . . . if [Anthropic] isn’t investment grade, the cost of credit goes higher, that’s not good for anyone,” said a US tech-focused portfolio manager.
“It’s a bloodbath out there,” they added, referring to the sell-off in stocks.
Wall Street banks earlier this week closed the North Star deal, which provides the financing for Anthropic to lease 1.5 gigawatts of Google’s semiconductors. More than $42bn of the senior loans is guaranteed by Broadcom, which co-develops the chips and has an investment-grade rating, while $18bn of the junior debt is backed by the AI start-up’s lease payments.
Institutional investors covet senior debt because it takes priority over junior loans in the case of a default. Broadcom’s high A-tier credit rating was an important factor in allowing Anthropic to secure the financing.
Blackstone’s funds invested in $9bn of the junior debt at a lucrative yield of more than 10 per cent, the FT previously reported. Bankers for Anthropic and rival OpenAI have also lobbied the largest rating agencies to grant the AI labs investment-grade ratings after their IPOs.
Project North Star’s $18bn junior debt, which exposes lenders more acutely to Anthropic’s credit risk, has been assigned a double B plus rating with positive outlook from Kroll Bond Rating Agency, a slight improvement from stable outlook in a similar deal known as Project “Big Sky” four months ago. It also received a double B rating from Morningstar DBRS, the people added.
The big three credit agencies — Fitch, Moody’s and S&P — which have bigger influence on companies’ borrowing costs, have not officially issued any credit ratings for Anthropic.
Anthropic, Blackstone, KBRA, Morningstar DBRS and S&P declined to comment. Fitch and Moody’s did not respond to requests for comment.
One musing: I did run into my first "issue" with federated Git hosting the other day while setting up Neovim on a new machine. One of the plugins I use is hosted on Tangled and I guess its backing Knot was down. This was awkward for two reasons:
1. It as unclear to me from the Tangled website the backing knot was the issue (for a while I thought it was something on my end)
2. I really had no backup plans for something like a Neovim plugin's source forge being down and, clearly, neither did the Neovim package manager as it just kept showing an error on every session I started with no way to fix it :).
I suppose in the long run we really shouldn't be assuming that code storage is just Always There or easily cached somewhere, but I anticipate some growing pains in the mean time. ATProto doesn't seem to have the benefit ActivityPub has where if the instance I wanted to view content on was down I can usually find some other instance that's gotten the messages.
The advice today is the same as it has ever been, though. Always assume that any networked computer is or may become compromised. Do not do anything critical on a networked computer, because it is or may become compromised. You can still use computers, but assume that a bad actor may take control at any time, and plan for that eventuality.
For example, if you are hooking up a networked computer to your town's water supply system, ask yourself "what would happen if Iran got complete control of this system?" If you're putting your school system's students' mental health data into a networked computer, ask yourself "what would happen if all of this data became public?"
- Quoted phrase in the opening sentence
- Opening quote: “Actually, no, we're going to police what kind of programs you can compile”
They need to decide of AI is a technology or an ideology. We cannot afford to blend the two, or we're going to end up as some kind of perverted global theocracy.
- Ordinary term used more than once in the same comment
- “Dictator” appears 2 times
Then day | light break | …… [And] WILD | MAN make | of he | mouth a | shape… he say | to DIC | TATOR ‘Listen | to the | dream I | dream in | the night The sky | god | + + + the | war god | the god | of know | ledge and | the sun | god all | meet to | gether | in the | great court | of the | sky… And the | sky god | AN + + + | say to | the war | god… “Because | they kill | the MAN | COW of | the sky | + + + and | because | they kill | TREEGUARD the one* | who cut | down the | hard wood | tree on | the moun | tain side | must die”
It shouldn't be your first read of Gilgamesh, but its a fun, insightful second.
- Quoted phrase in the opening sentence
- Opening quote: “the invention of a barbarous age”
Also, we did a long-term fix for a 2007-style crisis already with Dodd-Frank. Government can now invoke "orderly liquidation" before a crisis happens. When commercial banks failed a few years ago, FDIC solved it in a matter of weeks with no outlay of money from Congress.
- Quoted phrase in the opening sentence
- Opening quote: “It's pure puffery”
- Opening sentence uses a quote to challenge or distance a term
- Opening sentence challenges the term “It's pure puffery”
How exactly are House Democrats supposed to revoke the Exchange Stabilization Fund or change the Defense Production Act when they don't have a majority in the House? All they can do is signal what they intend to do if they regain the majority.
- Ordinary term used more than once in the same comment
- “current directory” appears 2 times
So if you have ffmpeg.exe in C:\Program Files\FFMpeg\bin, and you have some source files in D:\SourceVideos, and you want to process them in ffmpeg and output them to E:\Output you can do:
C: (to navigate to the C: drive)
cd "C:\Program Files\FFMpeg\bin"
E: (to navigate to the E:\ drive)
cd D:\SourceVideos (you remain in E:\, but the "current directory" for D: has been changed).
cd Output (to enter E:\Output)
You can now do C:ffmpeg.exe -i D:scene1.mp4 output-scene1.mp4
and Windows accesses the files in the "current" directory on each drive letter.
What next? words.horse which is just Wordle?
> Andy Yen, the CEO of Proton, had a message for an employee in the company’s security Slack channel who urged the company to at least take a few days to pentest newly written code before pushing it live. “That’s bullshit and loser thinking. Of course it’s possible to be fast and secure,” Yen wrote in the channel at the end of August. “Stop thinking always of how to be slower, and focus more on how to be faster.”
https://www.404media.co/manifestos-fear-and-loser-thinking-i...
- Quoted phrase in the opening sentence
- Opening quote: “the largest crypto theft on record”
Any company losing 10 months of revenue overnight is a BIG fucking deal. Doubly so in a speculative asset that you’re holding for others “securely”. The financial hit has only just begun for them.
That said yes the trading volume has huge.
- Quoted phrase in the opening sentence
- Opening quote: “only”
For another narrative, it was 83,038 a month ago on Sept 29th, so is down 5% in one month. And one year ago it was 112,562 on Oct 29th 2025 - down over 30% in one year. Well into "bear market" territory.
Using "traditional" market indicators and definitions for things like bear/bull markets doesn't feel sensible for such a volatile market.
- Quoted phrase in the opening sentence
- Opening quote: “black list”
So USDT is not truly decentralized and your money can be frozen for any reason or no reason at all.
Back in 2016 a then-huge Ethereum smart contract called "The DAO" [1] had a loophole that let an attacker extract a third of all the funds.
But a lot of the developers and miners had either lost money themselves, or had friends who'd lost money, or felt the embarrassing incident was devaluing their own Ethereum holdings. So they decided to allow takesies-backsies.
There's probably a philosophical lesson there about power and who the rules really apply to.
- Quoted phrase in the opening sentence
- Opening quote: “fiat money”
I get it, they can only benchmark so much. But I'd rather have a benchmark of how the model is actually used and offered to customers rather than the best case scenario for it.
This just seems to me like (1) not wanting to learn new things, (2) a logical fallacy because the conclusion that those changes are to "stay relevant" and not to make the life of any future mantainer easier, and (3) fear of the new (https://en.wikipedia.org/wiki/Neophobia)
For example - what guarantee do I have with something like: " This publisher has verified ownership of cursor.com" - when I'm looking at the WSL extension. Are there any guarantees it's not been replaced with some other extension?