ddevault

63 ms·

661.
by ddevault 6y ago
If you put a nice lock on your door and leave your window open, then a crook can still get in. Wayland is a nice lock. This "keylogger" depends on having arbitrary code execution as your user, outside of a sandbox. The same tech
662.
by ddevault 6y ago
Okay, 2007 is pretty old, I can't fault them for not supporting these functions. However, this is a noticable trend with macOS. Their pace with modern Unix is severely behind, and I often get bug reports from macOS users lacking some
663.
by ddevault 6y ago
They were on OSX Lepoard, maybe that's not the most recent one? I don't use Mac. When were they introduced? In any case, it's a trend with Apple, even if this particular example is wrong. See also: Vulkan.
664.
by ddevault 6y ago
And while they're busy breaking their current set of APIs, they're dragging their feet on adding anything designed in the last 15 years. Someone just wrote to me with a complaint because my software doesn't build on macOS due
665.
by ddevault 6y ago
Cached version: https://web.archive.org/web/20210128223057/https://creativeg...
666.
by ddevault 6y ago
It's not that hard to compete with AWS. AWS is scatterbrained and provides a really bad UX and as-is integrations where the "is" is not great. You might lose some business to them, but the cases we've seen lately aren&#x
667.
by ddevault 6y ago
Open source is not a business model. You can make money in open source, but not by accident. You have to find a viable business which incorporates open source. One common approach is SaaS, where the software is open source and you provide v
668.
Use Open Platforms – Or Else(drewdevault.com)
5 points by ddevault 6y ago|0 comments
669.
by ddevault 6y ago
The story is that they're subservient to interests which are losing money from the GME shorts.
670.
by ddevault 6y ago
It's not Robinhood's responsibility to protect retail clients. They are not financial advisers. By doing this they have violated their mandate. Why? Maybe it's for their clients, but when you consider their incentives, that s
671.
by ddevault 6y ago
Robinhood explicitly disavows itself of that responsibility. Quoting from their literature: > If you are interested in opening an account where you do not receive recommendations or advice about whether to buy or sell investments or inve
672.
by ddevault 6y ago
Sometimes it makes sense to have different bug trackers for each sub-product, but also one for support, and one for your infrastructure issues, and a locked-down one for security tickets, and maybe another for packaging issues - any of whic
673.
by ddevault 6y ago
SourceHut has you opt-in to anything you want - bug trackers, mailing lists for patches, git or hg repos, etc. The source code repository isn't the singular source of truth for a project like it is on GitHub. You can have a project wit
674.
Elastic promises “open”–delivers proprietary(lwn.net)
4 points by ddevault 6y ago|0 comments
675.
by ddevault 6y ago
This is why I keep ringing the bell of open standards and protocols. This is why I still use IRC in 2021. This is why federation matters. Stop putting your eggs in someone else's corporate basket. Don't be duped by sparkly marketi
676.
by ddevault 6y ago
Rust is modernized C++.
677.
by ddevault 6y ago
Alpine Linux.
678.
by ddevault 6y ago
Right, but if it was within the specs, possible to craft a scenario for, and leads to a security vulnerability, then does it suddenly matter? A bug is a bug. If it doesn't matter for Rust then it doesn't matter for C.
679.
by ddevault 6y ago
You can do both! But because simplicity has a substantially greater impact than the language choice, I think it's better to focus on that. Right now, the ecosystem is focusing more on the language choice, and hardly talking about simpl
680.
by ddevault 6y ago
Perhaps indeed! But a crucial distinction is that I consider the complexity in the langauge, compiler, and standard library to all be influences on your program's total complexity as well. Using std::List (or whatever you call it) has
681.
by ddevault 6y ago
I don't run OpenBSD, for reasons that have little to do with security. In my opinon, OpenBSD is not agressive enough at complexity reduction (doas being an outlier, I think doas is quite a good size).
682.
by ddevault 6y ago
It's actually within spec, in this case. Still reasonable?
683.
by ddevault 6y ago
Yeah, but why the assumption that those things are an issue? We're talking about mature codebases. Rewriting it again in C would also give you a chance to start fresh with better tooling, lessons learned, paying back tech debt, etc. Ev
684.
by ddevault 6y ago
Threw together an example (untested, with obvious errors) to give you an idea of what it could look like: https://paste.sr.ht/~sircmpwn/3122d4a27a8e5312462e2329bf7ed6... Actually managed to get it to exactly 2 dozen li
685.
by ddevault 6y ago
Yeah, I would.
686.
by ddevault 6y ago
Lines of code is a poor approximation for complexity. Rust programs are shorter, but they are not less complex. The AST is similar and the graph of relationships between different parts of the code is much more complex than in C. Overall
687.
by ddevault 6y ago
>helps that a 10kloc c program getting riir'd probably won't be a 10kloc rust program, because c doesn't have libraries and rust does. What? Rust has so few libraries of significance that it still depends on C for security
688.
by ddevault 6y ago
Aye, I agree. But if we consider that case, a similar mistake could be made: hard-coding argv[0]. The result is different, in that the program just aborts, but it's still the Wrong Thing To Do, and in both cases it never leads to anyth
689.
by ddevault 6y ago
>Disagree, but the statement is really weak anyways, especially since 'complexity' is an ill-defined term. More features? Cyclomatic? I'm not sure of any definition of complexity you could appeal to which makes my argument
690.
by ddevault 6y ago
For what it's worth, PAM is also not invited to my parties, for all of the same reasons as sudo was shown the door. And what people want PAM for is mostly solved with SSH certificates. >writing separate tools would be the equal (or

More ›