dwheeler

10 ms·

91.
by dwheeler 2y ago
I've been a happy user of MuseScore, music notation software which has a gui, is cross platform, and is open source software: https://musescore.org/en I gladly recommend it to others. A Tex like approach is available v
92.
LFD 121 (Developing Secure Software)–and Why Every Developer Should Take It(openssf.org)
1 points by dwheeler 2y ago|1 comments
93.
by dwheeler 2y ago
LFD 121 ("Developing Secure Software") is the Linux Foundation’s FREE course on secure software development fundamentals. This post discusses a bird’s-eye view of the course and its topics; why every developer should take it; and
94.
by dwheeler 2y ago
Quite amusing! > Crafted from the finest plastic, the NotFriend will never go out of style. This is obviously correct since it was never in style. :-)
95.
by dwheeler 2y ago
In other words, they failed to do end-to-end testing in some cases. They tested pieces, but not the full system they released. If you don't test each config update, by definition you didn't test it. Rust has many nice properties,
96.
by dwheeler 2y ago
The Crowdstrike report explains why it crashed, but not how it passed final end-to-end testing. There appears to have been many tests of piece parts (unit testing), but that's not the same as testing the full system. I would think a
97.
by dwheeler 2y ago
This doesn't require all software used by Switzerland to be open source. Per the article: > This new law requires all public bodies to disclose the source code of software developed by or for them unless third-party rights or secu
98.
by dwheeler 2y ago
The encodings we use today have a surprisingly deep and complex history. For more, see: "The Evolution of Character Codes, 1874-1968" https://ia800606.us.archive.org/17/items/enf-ascii/ascii.pdf
99.
by dwheeler 2y ago
Crowdstrike released a change that should have been caught by automated testing. That does require an explanation, I think, and a change to prevent recurrence.
100.
by dwheeler 2y ago
Interesting article. It does remind me of an old joke about English conjugation rules. For example: I/we are persistent. You are obstinant. He/she/they are pig-headed.
101.
by dwheeler 2y ago
Awesome story! I love hearing about surprising and interesting solutions.
102.
by dwheeler 2y ago
Explainability is a wonderful property. However, as far as I can tell, the most accurate models do not support explainability (by accuracy I mean "most likely to give correct answer"). There are reasons other models are more pop
103.
by dwheeler 2y ago
> C was hardly a performance juggernaut in the 1980's, any junior Assembly coder could easily outperform the outcome of the C compilers. I think that's not especially relevant. The issue is that most other higher level progra
104.
by dwheeler 2y ago
I appreciate the direct nod to security. But as written I doubt it's enough. The goal is to "enable" secure programming, and C already meets that goal since it is theoretically possible. The problem is that busy human develop
105.
by dwheeler 2y ago
For a comprehensive set of recommended compiler options for hardening C and C++ programs, see this OpenSSF guide: https://best.openssf.org/Compiler-Hardening-Guides/Compiler-...
106.
by dwheeler 2y ago
No, you can bring GPLv3 code into software with other licenes such as the MIT license.
107.
by dwheeler 2y ago
I consider "posted on YouTube" the same as "posted on the Internet". Youtube is basically a comm channel, they don't vet for accuracy nor do they claim to. Look instead at the channel. Some channels make serious ef
108.
by dwheeler 2y ago
CGP Grey has a delightful video explaining this: "The Secret City inside of London Revealed" (2012) https://youtu.be/LrObZ_HZZUc Highly recommended.
109.
by dwheeler 2y ago
Ruby is packaged for all significant Linux distros. It isn't installed by default in many, but installing it is a trivial one-time command, and it takes relatively little space.
110.
by dwheeler 2y ago
This patch uses heuristics that seem dangerous to me: > The 9P filesystem protocol relies on stateful file opens which map protocol-level FIDs to host file descriptors. The FreeBSD vnode interface doesn't really support this and we
111.
by dwheeler 2y ago
It is an issue for Python, though this specific issue isn't the main issue for Python. More generally, it's even harder to routinely call programs while connecting them with pipes and ensuring that the programs run in parallel. It
112.
by dwheeler 2y ago
Thanks so much, that means a lot.
113.
by dwheeler 2y ago
> Has anyone actually found a good use for filenames containing newlines? They're great for attacking systems, because so many programs aren't prepared for them. Any program that uses filenames as keys (and there are many) can
114.
by dwheeler 2y ago
I suspect he's heard by now. :-) But I think it's worth clarifying why certain phrases are used. Saying "there is no dark side of the moon" is also wrong.. once you realize that "dark" has multiple meanings.
115.
by dwheeler 2y ago
I agree! You can blame me for some of those proposals :-), my thanks to the POSIX team for getting this out the door. The sed -E option makes it easy to portably use extended regular expressions. The find -print0, xargs -0, and read -d pr
116.
by dwheeler 2y ago
It's worth remembering that in the phrase "dark side of the moon", "dark" means "hidden" not "unlit". The dark side gets the same amount of light as the near-facing side. See dark OED definition
117.
by dwheeler 2y ago
I disagree. We still cannot combine the key theories of the quantum and relativistic world. We don't understand whatvwe currently call dark matter and dark energy. However, it's not clear how to make progress in these areas.
118.
by dwheeler 2y ago
Wow. At first I thought it was just rambling. Now I'm alternating between "that's amazing" and "get help".
119.
by dwheeler 2y ago
I've found that using a simple unique integer id as the key usually works well. Integers are easy to explain and are simpler to enter than uuids. There are always ttade-offs, but if there are no other compelling issues, simplicity is b
120.
by dwheeler 2y ago
I think that's automatically a dead end, then. People have inceasingly abandoned closed source compilers, they create a huge risk if the maker decides to stop maintaining it. Most languages that people pick up have an open source softw

More ›