nindalf

30 ms·

391.
by nindalf 3y ago
Please review https://news.ycombinator.com/newsguidelines.html
392.
by nindalf 3y ago
> Desperate to make ends meet, Stiegler turned to robbing banks to pay off his debts and feed his family. In 1978, he was arrested for armed robbery and sentenced to five years in prison. I can’t take writers like this seriously. So keen
393.
by nindalf 3y ago
> People on the side of The People always ended up disappointed, in any case. They found that The People tended not to be grateful or appreciative or forward-thinking or obedient. The People tended to be small-minded and conservative and
394.
by nindalf 3y ago
I hope this can become the new standard shell. https://xkcd.com/927/
395.
by nindalf 3y ago
I’m gonna cry survivorship bias here. How do we know how many similar attempts succeeded?
396.
by nindalf 3y ago
Jigar was the same person/group as Jia. They were the bad cop and Jia was the good cop. Banning wouldn't have changed anything. Even if Jigar had been banned, the maintainer would still have appreciated the good cop's helpful
397.
by nindalf 3y ago
The context of the conversation, which you seem to have missed, is that now that we have a POC, we need a way to check for vulnerable servers. The link being that a POC makes it easier for script kiddies to use it, meaning we're in a
398.
by nindalf 3y ago
> we live in a world with closed-servers and appliances Yeah but these servers and appliances aren't running Debian unstable are they? I'd understand if it affected LTS versions of distros, but these were people living on the b
399.
by nindalf 3y ago
It doesn't matter. The people with the private key already knew all of this because they implemented it. The script kiddies without the private key can't do anything without it. A POC doesn't help them in any way. A way to ch
400.
by nindalf 3y ago
> many of those things were outright obvious malice Yeah, exactly what I'm saying. As long as you put software out there in good faith, you won't be convicted of wire fraud. So just ... don't be malicious I guess? That see
401.
by nindalf 3y ago
Perhaps you should speak more about those consequences you’re afraid of? Take the xz incident from this weekend. No one is crucifying the maintainer who gave Jia Tan commiter rights. No one is prosecuting or persecuting them. Everyone under
402.
by nindalf 3y ago
The roadmap for Carbon [0] mentions wanting to have basic, non-trivial programs written in Carbon by the end of 2024. They're aiming for a v0.1 release in 2025. If it gains traction, they're aiming for a v1.0 beyond 2027. I don&#x
403.
by nindalf 3y ago
> I don't think your paraphrasings are a fair representation of what I actually said. I think their paraphrasing was a fair representation. You want to have it both ways. You said some incendiary victim-blaming thing, but now you&#x
404.
by nindalf 3y ago
If you’re implying that I used incomprehensible initialisms, I’d argue that they’re easily understandable in the context of an alleged state sponsored attack from China. I think your comment is facetious and adds nothing to the conversation
405.
by nindalf 3y ago
> What are you talking about? I’m talking about what happens in practice, which is shipping static binaries that contain all of their dependencies, except for libc.
406.
by nindalf 3y ago
Right now they’re worried that somewhere in those 700 commits added by the malicious maintainer there may be some subtle memory safety bug. So great is the difficulty of finding these bugs that they’re planning to discard all work since the
407.
by nindalf 3y ago
Well, Rust doesn’t support dynamic linking. So this particular attack wouldn’t be possible with Rust in March 2024. But it’s a moot point because there are undoubtedly other mechanisms a malicious maintainer could use to inject a vulnerabil
408.
by nindalf 3y ago
Everything looks obvious in hindsight doesn’t it? Several of the organisations you’ve mentioned have funded projects to rewrite critical internet infrastructure in a memory safe language - HTTP client, HTTP reverse proxy, DNS resolver, NT
409.
by nindalf 3y ago
At best there’s an account with a Chinese sounding name. I’m never going to carry water for the PLA or the CCP, but I’d need to see stronger evidence before agreeing it’s them.
410.
by nindalf 3y ago
> dwarfed by the 350M investment in Redis Labs It’s funny that you would use commits to quantify investment from AWS, but you’d use $ to buy shares in future profits to quantify investment from redis labs. Why not use the same yardstick
411.
by nindalf 3y ago
AWS, along with Google and others have created a fork already. It’s very rude of you to call someone a token hire when they’re high up in the contributors list (#7 all time). Denigrating their work for no reason other than to “win” an inter
412.
by nindalf 3y ago
Trusting trust Steve.
413.
by nindalf 3y ago
> how trustable each of them is I think this is the important point. They’ve removed clap (argument parsing library) as a dependency, but they continue to trust cargo (the rust build tool) that uses that library and is primarily maintain
414.
by nindalf 3y ago
Agreed with everything you’ve pointed out. There seems to be an implicit assumption that all dependencies are bad, even though it’d actually be better to refactor their own code to a crate under their maintenance. Almost as if they think th
415.
by nindalf 3y ago
Somewhat fortuitous that someone already forked yaml-rust and rewrote it in pure Rust to create yaml-rust2 ( https://github.com/Ethiraric/yaml-rust2/blob/master/document... ). Pretty cool that the fork ful
416.
by nindalf 3y ago
This isn't accurate. OP's article says they depend on yaml-rust ( https://github.com/chyh1990/yaml-rust ), which is now unmaintained. Simultaneously, serge-yaml was marked as unmaintained to prevent people from
417.
by nindalf 3y ago
Don’t know why it’s so difficult for some people to understand the paradox of tolerance. Allowing your media to be controlled by a foreign totalitarian adversary is a quick way to having your institutions and society undermined by them.
418.
by nindalf 3y ago
I'd have thought you'd be able to simply look at the egg and determine it, given your username.
419.
by nindalf 3y ago
> big boosts that comes with picking low hanging fruit, perhaps there isn’t any left. Optimization tends to yield lower results over time As the link I shared says > For the first time ever, I’m writing one of these posts without havi
420.
by nindalf 3y ago
> I wish all politicians had that. Even the politicians you disagree with? So for example, AfD in Germany making the radical, meaningful change for the better of the German people by removing non-Germans from Germany ... and telling you

More ›