@flying_sheep@lemmy.ml avatar

flying_sheep

@flying_sheep@lemmy.ml

This profile is from a federated server and may be incomplete. View on remote instance

flying_sheep ,
@flying_sheep@lemmy.ml avatar

Yeah, if all those complainers want something more modular, they're free to push for protocols that allow to leverage existing components while also allowing for them to come from multiple vendors.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

Objectively, Apple is focusing on leveraging high DPI over subpixel tricks.

It makes sense that people who value sharpness on low DPI screens prefer subpixel rendering over grayscale.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

Good advice, bad biology: mushrooms aren't plants and therefore nor vegetables.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

I don't think a lot of people think that mushrooms are vegetables in any sense. If you check culinary lists of vegetables, they don't contain edible fungi.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

The both-sidesing was already telling. Sometimes the only “controversial or alternative viewpoints” are just idiotic conspiracy drivel and should be presented as such (or not at all)

flying_sheep ,
@flying_sheep@lemmy.ml avatar

In a good way. Using a non-verified bytes type for strings was such a giant source of bugs. Text is complicated and pretending it isn't won't get you far.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

You got it right, the person you replied to made a joke.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

Rust is faster than C. Iterators and mutable noalias can be optimized better. There's still FORTRAN code in use because it's noalias and therefore faster

flying_sheep , (edited )
@flying_sheep@lemmy.ml avatar

That was my immediate reaction here: one of the reasons the xz backdoor was possible is that nobody is going to question the idea of shipping a tarball to spare users from having to touch Autotools.

Of course I wouldn't think of manually hacking together Makefiles since I come from languages that have either the One True Build Tool or a standard for packaging and defining build backends.

I think the author's aversion to build tools trying (and apparently failing) to make everyone's life easier is more a statement about how much C/C++ have suffered from not having a standard for packages.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

Services are bash scripts?

Oh no. That's horrifying. I'll never go back to the bad old days where my system constantly has dozens of untestable buggy bash scripts running.

I currently have zero bash scripts running on my system until I open steam, and there's no world where I'd go back.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

POSIX shells are horrible unmaintainable bug factories.

shellcheck is not enough to make them safe programming languages. They are acceptable only in an interactive context.

Having anything encourage people to write POSIXy shell scripts is a design flaw.

flying_sheep , (edited )
@flying_sheep@lemmy.ml avatar

I don't think those are better or worse. My point isn't about some ancient far too limiting standard, but about how easy it is to wreck everything by not knowing some obscure syntactical rule. My issue is about implicit conversion between strings and arrays, about silently swallowing errors and so on. And the only shell languages that I know aren't idiotic are nushell and Powershell.

That KDE theme that nuked some user’s home directory? Used a bash script. That time the bumblebee graphics card switching utility deleted /var? Bash script. Any time some build system broke because of a space in a path: bash/ZSH/... script.

Why would anyone make an init system based on shell scripts these days?

flying_sheep ,
@flying_sheep@lemmy.ml avatar

I'm from Munich and followed that very closely when it happened.

The reality isn't lock-in. The reality is lobbyism. Ballmer literally interrupted his skiing holidays in the 2000s to offer the then mayor a better deal when that mayor started the Linux project. But Ude stood firm.

Then the next mayor came, and with him, a new opportunity. Microsoft was planning to build near Munich you see, and it would be a shame if that had to be cancelled. So they met the next mayor, Reiter, behind closed doors to talk about the building project, and a bit after that, the (by then already clearly successful) Limux project was undone.

Not cancelled, that would imply that they weren't done switching everything yet. They were. They just did the whole migration in reverse because Microsoft wanted them to.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

Yup! All of the following features were in CoffeeScript first: Modules, classes, arrow functions, async functions, parameter defaults, ...spread, destructuring, template strings.

So I'd say it was extremely successful in making JavaScript better.

XZ Hack - "If this timeline is correct, it’s not the modus operandi of a hobbyist. [...] It wouldn’t be surprising if it was paid for by a state actor." ( lcamtuf.substack.com )

Thought this was a good read exploring some how the "how and why" including several apparent sock puppet accounts that convinced the original dev (Lasse Collin) to hand over the baton.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

Arch was never affected, as described in their news post about it. Arch users had malicious code on their hard disks, but not the part that would have called into it.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

Backdoor only gets inserted when building RPM or DEB. So while updating frequently is a good idea, it won't change anything for Arch users today.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

Time to change that tarball thing. Git repos come with built in checksums, that should be the way to go.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

In this case I think that's just Fedora and Debian Sid users or so.

The backdoor only activates during DEB or RPM builds, and was quickly discovered so only rolling release distros using either package format were affected.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

Since you didn't build a RPM or DEB package however, your didn't compile in the backdoor.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

No, read the link you posted:

Arch does not directly link openssh to liblzma, and thus this attack vector is not possible. You can confirm this by issuing the following command:

ldd "$(command -v sshd)"

However, out of an abundance of caution, we advise users to remove the malicious code from their system by upgrading either way.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

I think it needs to be

  • rolling release (because it was caught so quickly that it hasn't made its way into any cadence based distro yet)
  • using the upstream Makefile task to build a RPM or DEB (because the compromised build script directly checks for that and therefore doesn't trigger for a destdir build like Gentoo’s or Arch’s)
  • using the upstream provided tarball as opposed to the one GitHub provides, or a git clone (because only that contains the compromised Makefile, running autotools yourself is safe)

Points 1 and 2 mean that only rolling release RPM and DEB distros like Debian Sid and Fedora are candidates. I didn't check if they use the Makefile and the compromised tarballs.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

You're right, there's more parts to it, especially social engineering. Maybe there's other ways to hide a payload, but there aren't many avenues. You have to hide the payload in a binary artefact, which are pretty suspicious when you don't do it in a (well scrutinized) cryptography lib, or a compression lib.

Then that payload has to be executed for some reason, which means you need a really good reason to embed it (e.g. something like widevine), or have to modify the build script.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

No, because the kernel has a different goal than most other software. Linux agrees that breaking the userspace from userspace is sometimes necessary.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

I have a pixel 6 and notice some lag in scrolling. Could it be that you don't use srcsets but instead huge screenshots no matter the device screen?

flying_sheep ,
@flying_sheep@lemmy.ml avatar

I greatly respect the way Vietnam has put things like stable rice prices over Western money. As far as I understand it, this allows for a society where nobody lives in abject poverty. But it also prevents people from getting rich quick by milking their own people. So if I got all of this right, it's not surprising that some people encountered the idea of getting rich quick through the Internet and try that now.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

Damn, I guess there's multiple ways to do that.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

Yeah, I think the only thing I really believe about it is that it was a good move to decline the world bank's conditions for giving Vietnam a loan. Those conditions would have involved allowing international investors to buy land and speculate with food. I think having the ability to fix e.g. rice prices as a government can be very beneficial to a country.

But I don't want to have an illusory view of how things really are if that's also wrong.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

Thanks! Yeah, I've been there a few years ago and it was lovely. I definitely want to come again some time.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

Outer Wilds can get similar when you have transcended beyond the existential dread of lonely death in space. It's spooky at times, but death is cheap, so you just look forward to the next attempt.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

How is Arch “making things difficult for oneself”?

I set it up once 8 years ago and have since migrated my install across several SSDs.

Still runs like butter.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

They might not actually require them, but simply display this message if some features detection code fails

flying_sheep ,
@flying_sheep@lemmy.ml avatar

Rockbox was the shit.

Breathed so much life into my iRiver. And I always had to defend the thing: “it's older than iPods! It can't be an rip-off”

flying_sheep ,
@flying_sheep@lemmy.ml avatar

That's wild!

flying_sheep ,
@flying_sheep@lemmy.ml avatar

That's true, but it also wasn't fair to be a Wayland detractor then.

Nvidia needed to do stuff to make that combination viable, and their delay in doing so wasn't anyone's fault but Nvidia’s

flying_sheep ,
@flying_sheep@lemmy.ml avatar

Owned by Facebook, which is a giant US company.

Of fucking course it has backdoors.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

Well then do it! There's probably VM images around with a working installation

flying_sheep ,
@flying_sheep@lemmy.ml avatar

Chimeras are not that rare. They happen e.g. whenever some mutation happens early in development: one half of one quarter or one eighth, … of the cells will be of the mutated kind. There's also other ways

flying_sheep ,
@flying_sheep@lemmy.ml avatar

… has gotten some help and is now a pretty well-adjusted human being, who still tells right wing trolls to go suck it, and still tells paid professionals that they should have known better when they should have known better, but in language that isn’t abusive.

So I don’t know why you bring him up.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

I don’t understand why anyone ever expects a different outcome. They fork something that has quite some investment into the original version. How do they expect to keep up?

flying_sheep ,
@flying_sheep@lemmy.ml avatar

Duh. But you do understand what purpose the metaphor serves?

flying_sheep ,
@flying_sheep@lemmy.ml avatar

I think you're a decade behind on this. It's true, just read up on it. Linus took time off after criticism for his language got too much. And he improved by a lot. You'll find no more name calling directed at contributors after a certain date.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

Within the last 10 years and the next 5 years, software using old hacks instead of GUI toolkits are expected to switch, yes.

People can choose to continue to use X11 until KDE Plasma 6 hits Debian stable.

I don’t see a problem. Nobody forces Wayland onto anyone yet, except for bleeding edge distributions like Fedora. And unless you’ve been severely misled, you should know what you signed up for when you installed Fedora.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

And that'll shake out in the time it takes for X11 to go away. I get what you're saying, although I don't share your opinion about portals from a user perspective: I'm just happy that Firefox finally uses the Plasma file picker.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

If you bring the two parts of your comment together and dial back the assumptions of bad faith, you’ll get a consistent picture:

Wayland is a blank slate replacement for how to do window management on Linux. At some point it’ll become the standard for software that’s new or maintained. Unmaintained software that doesn’t talk to the internet and is therefore safe to run even with security holes will continue to be supported via XWayland. The giant scope and API surface is part of the reason why it’s deprecated. Maintainers are expected to target the new way to do things going forward, because there are people able and willing to maintain that support (many of those people former X11 maintainers who are looking forward to stop having to deal with that legacy behemoth)

That’s the state of things I wanted to express. Not my opinion, no agenda, just how I understand the situation.

flying_sheep ,
@flying_sheep@lemmy.ml avatar

I think having separate standard APIs for screenshots, screen capture, and video capture that aren't married to one implementation makes sense.

I partially agree about the focus on containers/sandboxes. Yes, it makes sense to criticize that something designed for a different use case results in different trade-offs. But on the other hand, are the use cases really that different? We're talking about standalone desktop apps, they need some common building blocks no matter if they're containerized or not, right?

Otherwise I don't know enough about the standards to comment there, you're probably right!

  • All
  • Subscribed
  • Moderated
  • Favorites
  • random
  • All magazines