fweimer

37 ms·

571.
by fweimer 3y ago
Intel employees have been contributing RISC-V patches to GCC for quite some time, and continue to do so. Here's one from today: https://inbox.sourceware.org/gcc-patches/20231106141623.3076... Intel is also a membe
572.
by fweimer 3y ago
Some OpenSSL deployments use RSA plugins that do not contain the check—it's not in generic OpenSSL or OpenSSH code, so every engine plugin needs to implement its own check.
573.
by fweimer 3y ago
Note that in the OpenSSL case at least, this check is in the default engine/plugin, not in generic code. If you load a different plugin, you only get protection if the engine/plugin implements a similar check internally. (I expect
574.
by fweimer 3y ago
The additional restrictions in the SSPL apply also to unmodified versions. This is very different from the AGPL, which does not impose any additional over the burdens over the GPL if you use an unmodified version of the software, even if yo
575.
by fweimer 3y ago
I'm sure people have thought about it. Currently, spare lithium batteries are permitted in carry-on baggage only: https://www.faa.gov/newsroom/lithium-batteries-baggage There is an exception for batteries install
576.
by fweimer 3y ago
There aren't many other options if you want or need a system with physical access near your desk that is also designed to run GNU/Linux. I think the only other options are less-known SBC-based systems, or systems where GNU/L
577.
by fweimer 3y ago
But isn't that easily avoided by suitably scoping the license grant?
578.
by fweimer 3y ago
Certainly not for everyone. Even if you buy professional videoconferencing equipment for business purposes, you do not get a patent license for its commercial use. Those paid offerings typically come with terms similar to the ones Cisco in
579.
by fweimer 3y ago
I thought that with patents, each entity among the manufacturing chain potentially needs a license? There is no analog for the first sale doctrine, or neither a requirement for consistent enforcement (as is there for trademarks).
580.
by fweimer 3y ago
But it doesn't enable covert surveillance. Even without Certificate Transparency, the change in server certificate is visible to the client. Initiatives like Let's Encrypt could make it visible to server operators, too. The browse
581.
by fweimer 3y ago
Isn't the English (EU) layout close enough? I think it's basically the US layout with a Euro sign somewhere, but the physical key layout should be the same as a regular US keyboard.
582.
by fweimer 3y ago
Note that this specific aspect discussed here isn't about getting things working as such. Cross-compilation of RISC-V has been absolutely trivial for many years. For example, support for riscv64-*-linux-gnu architectures was added to b
583.
by fweimer 3y ago
I suspect it was just the conservative choice, mirroring the behavior of the predecessor browser extension (which also required deliberate user action to activate): http://paranoia.dubfire.net/2011/01/history-of-do
584.
by fweimer 3y ago
If the user installs a privacy-focused browser (NB: not sure if such things exist, marketing aside), one could argue that there is still user choice involved even though the browser sets DNT by default. The original Internet Explorer situat
585.
by fweimer 3y ago
GNU/Linux applications are typically quite portable across CPUs. Is Android really that different? I would expect that once you have ported it an NDK application to at least two architectures, the third one should be really easy. And w
586.
by fweimer 3y ago
It's more than that. C-the-language just doesn't have low-level concepts such as machine addresses, and its facilities for dealing with the types that the abstract machine ascribes to all objects are quite limited. Ada has System.
587.
by fweimer 3y ago
Any chance this is a clerical error? We see this sometimes in police crime statistics, where an obscure crime is recorded that seems rather unlikely to have actually happened, like detonating an atomic bomb.
588.
by fweimer 3y ago
It will be interesting to see if created sub-CNAs (CVE Numbering Authorities) will indeed allow upstream projects to get more control over the CVE assignment for their software. In theory, the existence of the sub-CNA should block assignmen
589.
by fweimer 3y ago
I'm a bit worried that we'll adopted an algorithm widely, only to be told “gotcha! here's how to break it”. After all, it would be a great way to prove once and for all that an algorithm selection process can be subverted.
590.
by fweimer 3y ago
I understand these cases are structurally different. I just don't see how a quasi-ban of hardcoded passwords could work, given current industry practices. And I'm not sure these client-side secrets/group passwords are entirel
591.
by fweimer 3y ago
Not going to happen. Most online services require applications that access them to embed hard-coded, obfuscated passwords in the binaries. That doesn't really work for open-source software, and Thunderbird's hard-coded passwords a
592.
by fweimer 3y ago
GOPROXY is enabled by default. “Since Go 1.13, the go command by default downloads and authenticates modules using the Go module mirror and Go checksum database.” https://proxy.golang.org/
593.
by fweimer 3y ago
It's unclear whether this matters, though. Some CPUs speculate through unconditional control flow as if it is never going to happen.
594.
by fweimer 3y ago
I don't know. It seems fairly common to use std::panic::catch_unwind as a top-level error handler. compiler/rustc_driver_impl/src/lib.rs has this: /// The compiler currently unwinds with a special se
595.
by fweimer 3y ago
These concurrency failures in transaction processing can be quite rare, but you have to fix them if you want 24/7 unattended operation. SQLite only has timeout-based conflict detection, so you basically have to decide whether you want
596.
by fweimer 3y ago
How does this AoVA data structure work in practice? Don't you lose index-based access, in the sense that arithmetic on indices is potentially no longer meaningful in the array sense? Iteration will not preserve insertion order. I think
597.
by fweimer 3y ago
No, the would-be contributors could work on something else. That's no longer about preferring contribution X from would-be contributor A over would-be contribution Y from non-contributor B.
598.
by fweimer 3y ago
But that equally applies to getting critical bug fixes for your particular usage scenario of SQLite. It's not just about the viability as a storage format. For the latter, because the stored data has such a simple format and the implem
599.
by fweimer 3y ago
I found the transactional aspect surprisingly difficult, especially with concurrent file access. SQLITE_BUSY handling was quite hard at the time. I know that serialization failures are expected in transaction processing, but for SQLite it w
600.
by fweimer 3y ago
> The maintainers decide whether something gets merged or not, and I've never seen a project that says "We'll merge anything that passes our test suite". Maybe I missed something here... Maintainers may not want to de

More ›