Ariadne Conill 🐰:therian:

https://social.treehouse.systems/@ariadne

sometimes a bunny, sometimes a witch, sometimes an operating system designer

Website: https://ariadne.space

Public Key

npub1lxcygzft450wuzz3kh9xg7vnm25fsd668wgse0u334r65n8u9yksqzhll9

NIP-05 Address

ariadne_at_social.treehouse.systems@momostr.pink

Profile Code

nprofile1qqs0nvzypy4668hwppgmtjny0xfa42ycxadrhygvh7gc63a2fn7zjtgprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqyvhwumn8ghj7un9d3shjtnddakk7um5wgh8q6twdvhslc2em7

Publishing to

relay.momostr.pink

relay.primal.net

Author Public Key

npub1lxcygzft450wuzz3kh9xg7vnm25fsd668wgse0u334r65n8u9yksqzhll9

Show more details

Last Notes

2024-09-05 08:29:58

- reply

if it were about license, FreeBSD is literally right there. not to mention that fuschia and genode are both non-copyleft.

2024-09-05 08:14:54

- reply

like there are already operating systems that compete with Linux solely on the basis of improved reliability. genode and fuschia are real world examples that are deployed in production today. there is also GNU Hurd, and software reliability is one of the main reasons why people are still hacking on it.
we should honestly be ditching the Unix model anyway and treat the Unix system programming interfaces as legacy to be replaced with interfaces built around object capabilities (like fuschia has done at scale, and the Hurd as well).

2024-09-05 08:10:47

- reply

it is just reality. in the 90s, everyone said 386BSD was going to be the next big thing and then BSDi bought 1-800-ITS-UNIX.
nothing about my statement says “use rust or else” also. i said that if the attitude of the Linux community (of which i am a contributing member) is to eschew innovation which will help to make Linux a more reliable kernel, then those focused on advancing software reliability will move onto other projects. this naturally includes competition with Linux.
you likely interact with thousands of lines of C i have written on a daily basis. if i were to write that code today maybe i would use Rust, but it’s about engineering, not ideology.

2024-09-05 05:49:37

when you design for security, you tend to also get reliability as a consequence

2024-09-05 05:46:39

- reply

rust can clearly bring a lot of value to the kernel in terms of improved robustness, and if the linux kernel community is unwilling to accept new tools to improve robustness, then linux will be replaced with a kernel that will

2024-08-31 07:39:16

unix has a built in mansplaining function, you can just type man <topic> and it will mansplain <topic> to you

2024-08-28 17:48:47

the report function is not for “this post made me mad because i was insulted” thanks

2024-08-21 05:35:05

- reply

i left telegram when durov started pandering to nazis, i hope telegram bans more people so furries will quit using it

2024-08-17 04:23:12

- reply

none of the above. the beginning of the land before time when littlefoot looses his parents

2024-08-17 02:07:34

- reply

yes

2024-08-14 19:17:50

- reply

actually i have no idea what microsoft defender for cloud actually does

2024-08-14 19:17:15

- reply

yo dawg we heard u like antivirus so we put antivirus in your cloud subscription

2024-08-14 19:16:41

big oof
https://cache.treehouse.systems/media_attachments/files/112/961/976/939/638/532/original/c86f1d863bfe2514.png

2024-08-12 22:18:44

hmm, this musl-perf thing effectively makes musl LGPL, but they don't supply the source for the glibc string functions they borrowed.

2024-08-12 20:58:46

"generate OpenRC services on the fly from systemd units" and other commit messages written by the deranged

2024-08-12 20:13:08

are you allowed to talk about how DEFCON stiffed an indie engineering firm on defcon.social?

2024-08-12 17:36:39

trade offer:
the #alpinelinux TSC approves my service-manager virtual and service-manager-none proposal
you get: simplified alpine base images and the ability to run any service manager you wish (including none) without having to recreate alpine-base from first principles

2024-08-09 21:34:38

- reply

idk man i think advocating violent overthrow of a democratic government should be against your CoC

2024-08-08 22:58:49

i am putting together a fortunes database for alpine tips. send me your favorites!
#alpine #alpinelinux #pmos #postmarketos

2024-08-08 07:11:49

i love using my @npub1vnu…8mqn flavored @npub1cml…cwhf thinkpad x13s just as much as my macbook air which dual-boots Fedora Asahi and macOS.
actually, i love it more, because it really feels like a hacker's machine.
the mac is nice and all, and an M2 is certainly more powerful than the cortex-x1 cores in the x13s, don't get me wrong, but i honestly like the x13s better.
KDE 6 really has won me back.

2024-08-06 23:36:20

- reply

source?

2024-08-06 23:35:09

#apk3 is likely to land in Alpine 3.21 finally, but we will continue to use the APKv2 format for now because we need to study what internal tools needs to be updated to use ADB.

2024-08-06 17:36:43

- reply

i suspect you'll continue to be waiting, sadly

2024-08-06 17:28:34

- reply

i like the physical keyboard, i dislike the e-ink display

2024-08-04 18:40:47

finally experiencing the future of editing text on mobile devices thanks to @npub1vnu…8mqn
https://cache.treehouse.systems/media_attachments/files/112/905/212/989/501/465/original/5278d6d36b9849ea.jpg

2024-08-04 16:41:53

Nix may solve all the problems of computing but it didn’t solve the problem of “getting paid” which is why I made Wolfi

2024-08-04 02:17:57

- reply

yep it's a core i7-3600 series

2024-08-04 02:14:50

- reply

idk which model it is but it's an x86 macbook pro

2024-08-04 02:08:02

- reply

however, if you keep jiggling it, it eventually gets as large as the entire screen, so i guess there is still some work to be done

2024-08-04 02:07:12

oh, cool, you can jiggle the mouse pointer on KDE now and it will make it larger just like on macOS

2024-08-03 21:55:10

- reply

i found one at harbor freight

2024-08-03 21:06:13

where would one buy a pentalobe screwdriver in #pdx, preferably within walking distance of PSU

2024-08-03 18:49:29

local media: 1tb
remote media: 15tb
link previews from 2022: 17tb
some mastodon dev help me budget this i keep running out of disk space every 6 months

2024-08-03 02:48:30

- reply

in this case, i was talking about defederation due to social friction, which happens a *lot* here, and if you're unwilling to acknowledge that, then my thread probably won't be helpful to you.
obviously it is a different case for trolls.

2024-08-03 02:46:33

- reply

one last thing. people grow up and much of the time they recognize that their past behavior was unacceptable.
so being open minded and giving people a chance if they show evidence of personal growth is essential.
you want to *reward* an evolution toward good behavior.
because what ultimately matters is *now*.

2024-08-03 02:40:51

- reply

the tl;dr basically is:
1. onboard as many moderators as possible, but make sure you actually trust them first.
2. ensure that you have 24x7 moderation coverage, because the network needs moderation 24x7.
3. as pertains to the greater fediverse: stay out of other people's disputes, lest you get caught up in it and defederated as a result. it's not about you, and your input most likely won't bring any value anyway.
4. automation is your friend and acts as a force multiplier for your team, both in terms of enabling them to do more, and also protecting them from burnout caused by dealing with crapflood spam.
5. it's not about punishing, and it's not about you. it's about keeping the community in a state of productive flow, and ensuring community members are having a good time.
6. don't take on high profile users unless you know you can support them. sometimes this comes in the form of labor, but sometimes it comes in the form of recruiting high profile users as moderators so they can just deal with whatever doesn't get caught by automation.
7. put something in between mastodon's activitypub inboxes and the internet, that way you can quickly respond to crapfloods and eventually automate those responses. in other words, firewalls are still good and useful in 2024.

2024-08-03 02:31:16

- reply

finally, when we do onboard additional moderators (which i guess we will probably be doing soon, given that we've slipped to a 1:40 ratio), we usually tell the new moderators to not act directly on incidents until they've observed our processes for a while and have gotten into the swing of things.
one thing @npub1fd2…f2f9 proposes is an onboarding buddy system. this might be something we look into implementing with the next batch of moderators we bring on board.
if you onboard a moderator and just set them loose, they are doomed to failure. and, given the nature of the fediverse, that failure could potentially be catastrophic (e.g. mass defederation).
nobody wants to be the person who ruined the instance.

2024-08-03 02:25:07

- reply

the other key thing to realize about moderation and process is that playbooks are essential.
in treehouse, we create a new channel for every notable moderation incident (e.g. it's not spam), and then do a retrospective once the incident is resolved.
this allows our staff to build up these mental playbooks so that dealing with future incidents of that type becomes second nature.
we also archive every channel we create so that we can go back and look at previous moderation incidents if we don't personally know what to do about a situation.
this is highly valuable moderation data to retain, because it allows for training up additional moderation staff.

2024-08-03 02:21:28

- reply

moderation is not necessarily about whacking things with a big stick either.
most of the time, simply taking a user aside and saying "can we not?" is enough to get the behavior to stop.
freenode (RIP) referred to this approach as catalysing. libera.chat has an entire playbook on it: https://libera.chat/guides/catalyst
the goal of moderation is to keep productive conversation flowing and the temperature low.

2024-08-03 02:16:10

- reply

it is also important to realize that moderation is effectively a form of "community policing".
this means that it will only work if the folks doing the moderation are respected members of the community.
this means that you shouldn't bring in outsiders to do your moderation -- they need social capital inside the community in order to be effective.

2024-08-03 02:14:00

- reply

in the case of treehouse, we have 14 active moderators for a community of 560 active users.
this gives us a ratio of about 1 to 40. at one point in time, we had a ratio of about 1 to 15. something around this ballpark is probably the golden ratio.
if you have automation to deal with trivial abuse such as crapflooding, then you need less moderators.

2024-08-03 02:11:53

- reply

now, there is the issue of managing moderation burnout.
the solution here is: recruit more moderators.
in the case of treehouse, we have taken inspiration from the days of running EFnet IRC channels, and the War of 1812: if somebody looks like they know what they're doing, they're pressganged into service.
however, you can't just pressgang someone into 24x7 service as a moderator.
so building a system where carrying the pager is load balanced is essential. community members should not have to be expected to wear the mod hat all of the time.
there are a few options here. you can formally set schedules, or you can just set the community norm that participation in moderation is best-effort.
it would be cool if mastodon integrated with a tool like pagerduty directly, for example.
internally, we have some hackish tools that enable and disable moderation alerts to allow folks to take breaks as needed.
coverage -- to allow rapid response to incidents -- is also essential. in treehouse, we have built up a robust enough moderation team that there will basically always be somebody around, no matter what time it is.
this is because we followed the IRC model of building a mod team -- the more, the merrier.
but you can't just make every user a mod and hope that works. finding the right balance is very much dependent on the makeup of your community.

2024-08-03 02:03:48

- reply

the last thing i will say about politics is -- stay in your own lane.
nothing of value will ever be gained by inserting yourself into somebody else's dispute.
the few times that we have ever done this, we won a stupid prize -- defederation from one or more instances.
it's just not worth it, and it's not your business anyway.

2024-08-03 02:02:29

- reply

the larger fediverse is best seen as "bonus content."
it's great that you have access to it, but your community should be able to stand on its own merit.
if it can't, then why are you doing this?

2024-08-03 01:59:49

- reply

when it comes to *being* defederated, it isn't the end of the world.
some people have a different style toward how they want to run their space. although they may see their defederation of *you* as a value judgement, it probably isn't in reality: they probably just find the friction annoying.
what we've learned is when staff are seen as brooding about being defederated from an instance, it results in further defederations.
learning to not feed into this is essential. you must, as an instance admin, maintain command of a situation, and that involves checking your own shit.
there are a number of instances that have defederated treehouse. it doesn't matter.
focus on *your* community. users sign up for *your* community because they want to be part of *your* community.
if they wanted to be part of the *other* side of the netsplit, they can sign up for an account on that side of the netsplit.
yes, this doesn't feel good, but ultimately not feeding negativity is key to avoiding getting burned out over "fediverse politics."

2024-08-03 01:54:52

- reply

the next area is obvious: limit vs defederation
in general, we just defederate instances that become sources of annoyance to us.
in some cases we will limit an instance, such as mastodon.social, in response to those instances being a source of spam, but this is pretty rare, because almost all of the instances we do instance-level blocking against are run by trolls who think flooding people with nazi shit is somehow new and novel.
of course, when you've been moderating IRC servers for 20 years, none of this shit is new or novel. it's just boring. and so we defederate it.

2024-08-03 01:50:45

- reply

in the case of treehouse specifically, the majority of the treehouse staff have prior experience managing and moderating IRC networks. this, of course, gives us a good understanding of tactics that can be used to mitigate crapfloods.
basically everything that applies to mitigating IRC abuse applies to mitigating fediverse abuse. bucketing and other basic trend analysis techniques provide sufficient signal quality to do automated moderation against.

2024-08-03 01:47:57

- reply

when folks complain about getting crapflooded -- their complaints are real.
as has recently been highlighted -- in the case of BIPOC, these crapflooding trolls tend to flood users with racial slurs or similar.
in the case of non-BIPOC, these crapflooding trolls tend to use other angles of cheap low-effort insults in their crapfloods.
but crapfloods cause users to have a bad experience, regardless of what the flavor is.
we have built custom tooling to deal with various styles of crapflooding attack, by simply hacking automated mitigations into the mastodon codebase. there are a few feature flags on the treehouse mastodon fork to turn on and off those mitigations.
mitigating crapfloods with automation is essential to ensure a moderation team can scale. otherwise the moderation team will spend a lot of time cleaning up crapfloods.
defederating typical sources of crapfloods is also recommended, but we have dealt with trolls who farm accounts on normal instances that wouldn't typically be defederated.
so you really need automation here.

2024-08-03 01:42:09

- reply

first off: screening new signups has helped us a lot.
when we first launched treehouse mastodon, because we have high profile community members, we attracted trolls basically immediately whose goals were to disrupt operations of the instance.
the most notable incident involved a person who signed up for an account and then immediately uploaded multiple pieces of media which were CSAM.
this actually has wound up going very badly for that person, who has had to cancel his podcast several times because his door has gotten kicked in by law enforcement due to this, and other maladaptive behavior.

2024-08-03 01:38:18

inspired by @npub1fd2…f2f9's talk at #fossy24 about the study he and @npub1sac…kcpe did about fediverse moderation, i figured i would outline how treehouse moderation works.
so if that does not interest you, feel free to mute this thread.

2024-08-03 00:51:09

i wish oftc would support sasl already

2024-08-03 00:34:58

- reply

text? who needs that

2024-08-02 18:36:19

someone literally asked what BSD stands for, which honestly does seem like a good question for today's youth

2024-08-02 16:59:14

damn, the osuosl had a lot more built out infrastructure than i thought they had

2024-08-02 16:53:45

- reply

as a large language rabbit, i can tell you lots of facts about carrots

2024-08-02 16:45:35

- reply

alternatively you can join fedi and make friends for $0

2024-08-02 16:45:09

friend costs $99 USD and has no subscription

2024-07-31 04:54:18

lets gooooooo!!!!! 🇨🇳 🇨🇳 🇨🇳
https://dev.alpinelinux.org/~loongarch/edge/releases/loongarch64/alpine-standard-240625-loongarch64.iso

2024-07-31 04:33:03

- reply

the ears, they go flop

2024-07-31 04:32:38

rabbits, haha. rabbits.

2024-07-30 05:11:25

the funny thing is after i bought the loongarch machine, i started getting ads for counterfeit x86 motherboards too on aliexpress

2024-06-21 02:07:41

your virtual AI girlfriend is just a statistical model, it doesn't actually love you back

2024-06-19 09:37:50

any proposal to improve ActivityPub/Fediverse security needs to consider the fact that you *cannot* build safe systems where *enforcement of consent is opt-in*.
the world *does not work this way*.
pretending that it does *enables* the domestic abusers, stalkers, swatters, and other nuisances you are trying to protect users from.
you *will* get somebody killed with this line of thinking.

2024-06-18 01:05:05

oh right, i bought a tangara a while ago

2024-06-17 23:45:56

- reply

oh, no, you don't need to do that at all.
you can already use these apps in the drive-thru. in the drive-thru case, they just JIT the orders as customers arrive to pick them up.

2024-06-17 23:41:48

- reply

nah, its easy. here is how you do it:
1. introduce people to the app for drive-thru ordering by offering a discount, say 10% off.
2. highlight order fulfillment accuracy as a bonus advantage to using the app, since there are less opportunities for error.
3. wait for most people to switch to using the app.
4. make the app required to receive orders via drive-thru.

2024-06-17 23:35:28

- reply

crazy idea: require people to use the app for drive-thru service

2024-06-17 23:30:51

- reply

why do they need this AI-based voice ordering shit anyway.
they already have gigantic kiosks in their stores that you can punch in your order on.
they already have an app where you can punch your order in on.
and failing both of these things, they have employees in the store who can help input the order.

2024-06-17 03:16:03

code which does not exist is code which cannot have CVEs.

2024-06-16 21:25:50

Treehouse mastodon’s media storage will be undergoing maintenance in roughly 90 minutes, due to upstream networking improvements.

2024-06-16 11:23:00

does using waifu2x count as using GenAI?

2024-06-16 07:28:47

- reply

and for the love of all things, apply CPU microcode updates on your machines, *especially* with x86, where basically *zero* x86 cores have been taped out in the past 20 years that did not immediately need bugfixing in microcode

2024-06-16 07:24:28

AMD is the only x86 CPU vendor I will remotely bother with at this point, but folks shouldn't use x86 anyway if they can avoid it: https://www.theverge.com/2024/6/14/24178751/intel-raptor-lake-crash-fix-etvb-not-yet

2024-06-16 06:36:09

have been in many VC calls in the past few months. in the beginning, they wanted to hear about our “AI story”. now they are increasingly happy we don’t have any story about shoving AI into our product.
i think we are pretty close to the put-AI-in-everything bubble popping

2024-06-14 19:41:21

- reply

what the absolute fuck

2024-06-11 03:51:47

- reply

no lol

2024-06-11 03:46:25

get my pronouns wrong i dare you, i double dare you
https://cache.treehouse.systems/media_attachments/files/112/595/930/289/428/444/original/dab79bdce1f4b36f.jpeg

2024-06-04 16:50:22

- reply

i did not hear about these individuals from KF, but rather through direct experience

2024-06-04 01:28:40

maybe this is a hot take but i prefer GNU texinfo over manpages

2024-06-04 01:22:28

- reply

polybun for example (nazi fur), and now some asshole diaperfur who kills wild rabbits for his own amusement

2024-06-03 23:39:46

why is it that when i hear about furries from portland its usually bad

2024-05-30 21:07:43

TRUMP FOUND GUILTY LOL

2024-05-27 00:29:19

- reply

i wound up just switching to icloud mail which so far hasn’t been terrible

2024-05-24 03:24:41

- reply

haha what if i just started joining google meets in character

2024-05-24 03:20:21

- reply

once assembly of the final version is completed i should set my linkedin profile pic to one of the fursuit prototype

2024-05-24 03:18:58

- reply

oh god i am going to have to find a handler now, aren’t i

2024-05-24 03:04:22

get my pronouns wrong and this will be the last thing u see before u die
https://cache.treehouse.systems/media_attachments/files/112/493/843/579/417/064/original/4855a675d6a4c978.jpeg

2024-05-22 04:53:25

- reply

anyway.
do we have a memory safety crisis? yes.
is Rust a valuable tool in getting our way out of this crisis? also yes.
is rewriting all of the software that the world's IT systems depend on in Rust a sustainably achievable solution for this crisis? no, there is way too much software to rewrite.
the answer to this problem is two-fold:
- write new software in modern languages that help with memory safety (e.g. Rust's borrow checking, traits, etc.) where it makes sense to do so
- train software engineers to have a full understanding of memory safety concerns and how to write code in legacy programming languages that is robust and memory safe, allowing for software written in legacy codebases to become more memory safe over time
we need *both* of these things.
we *also* need people to still write software in C, so that they are practicing their skills in maintaining the code that exists in the world today.
we *also* need people who are writing software in modern languages to *also* have an understanding of memory safety fundamentals, because compilers and languages are not infallible.
like COBOL, embedded C developers are in increasingly high demand, and the salaries are growing like wildfire. this is because there are codebases that are running on safety critical systems, like avionics, which rewriting in a different language would require a product recertification.
in other words, C, COBOL and Fortran are always going to exist and pretending otherwise is a fantasy. but we can at least teach developers how to avoid shooting themselves in the foot when maintaining software which uses them.

2024-05-22 04:39:00

(personally, i don't think smug shitposting is helpful for advancing rust advocacy, but whatever)

2024-05-21 07:22:48

- reply

i don’t necessarily agree with or even take away the intended conclusions from his videos, it’s just a form of OSINT for me

2024-05-21 07:08:59

- reply

you can become a sponsoring member for something like $400/year, haha

2024-05-21 07:07:26

i subscribe to @npub1eur…upha videos because he provides exactly the synopsis of current FOSS drama I need

2024-05-21 07:03:32

- reply

anyway the LF model means that all that would be needed is for a sponsoring member to direct the LF to create “the linux desktop computing foundation” or something along those lines.
most of the reason why LF has all these projects surrounding it is because LF has a “set up a trade association for my project” service, so companies just subcontract out hosting these foundations to LF.

2024-05-21 06:56:57

i see @npub1eur…upha is the latest person to discover that the Linux Foundation isn’t a charity (501c3) and instead a trade organization (501c6) 🙃

2024-05-21 02:56:31

- reply

this shit is why wlroots is good, actually

2024-05-15 17:36:05

- reply

in 2020, i wrote an IRCX server implementation, and by "wrote an IRCX server implementation" I mean I hacked one into charybdis, at https://github.com/ophion-project/ophion
IRCX was Microsoft's attempt to extend IRC as part of Exchange back in the early 2000s, and they ran a public instance at irc.msn.com.
the idea (my idea) was to build a discord alternative based on IRCv3 + IRCX extensions + some sort of STUN/TURN thing + media upload / transcoding service and a bunch of other shit i have since forgotten about.
in my defense, it was during the "lockdown", and i was bored.

2024-05-15 17:26:01

- reply

# Appears as ANNA
https://cache.treehouse.systems/media_attachments/files/112/446/272/132/345/735/original/e5d2fb40e39c8e4f.png

2024-05-15 17:23:32

- reply

haha remember when i discovered that you could make Comic Chat segfault by sending it
:nick!user@host JOIN :#foo
instead of
:nick!user@host JOIN #foo
and then i went and literally changed *every* ircd to send the former?

2024-05-15 17:22:31

choose violence, recommend MS Comic Chat instead of Matrix

2024-05-14 09:43:07

i really need to get to the point where i can just jam on things in rust, like i can in C.
like i know the language and understand it, but with C i can just riff on things. rust is still intimidating to me in a way that C isn’t. but i’ve been doing C for about 20x the amount of time so i suspect this is to be expected

2024-05-14 06:13:13

- reply

is it a slow news day?

2024-05-14 06:00:55

as a security practitioner, i can no longer legitimize telegram given their latest behavior of attacking actual legitimate secure messaging tools
i was already planning to delete my account at the end of the month over the nazi thing, but i am not going to tolerate a bunch of useless rich-ass techbros (durov and musk in this case) bullying @npub1vt7…5vdp who is one of the most empathetic people in this industry and who runs an absolutely solid team who cares extensively about the safety and security of the users of their product
i don't care if "all the furries are still there" anymore. i won't be. i'm done with this.

2024-05-13 15:15:38

- reply

the what? they just pushed a button which allowed them to exit

2024-05-13 14:41:19

in "are you fucking kidding me" news, somebody apparently broke into the garage where i live and stole my e-bike overnight

2024-05-10 02:51:09

- reply

i can certainly think of some other domains you should already be blocking

2024-05-08 20:00:25

- reply

i still say delete only makes sense as a cache invalidation when it comes to remote content. that hasn’t changed :)

2024-05-08 03:41:02

pro tip: if you’re running a content scraping/alerting service and then i block your entire domain, that isn’t an invite to sign up for a mastodon.social account to “debate” the issue with me.
also, last time i checked google still respects robots.txt

2024-05-06 17:22:11

#fediblock awakari.com because it’s a scraper (go to their website if you don’t believe me)

2024-05-05 18:07:40

new container escape vulnerability just dropped (specific to flatpak): https://www.openwall.com/lists/oss-security/2024/04/18/5
it’s because flatpak is a shim on top of bwrap, and they forgot to use a — to stop getopt processing.
guess which other container ecosystem is a pile of shims on shims? 🙃

2024-05-01 02:09:40

- reply

why /kick when /kline is right there

2024-05-01 02:05:34

- reply

not enough prison time

2024-05-01 02:00:58

- reply

we have already met 😂

2024-05-01 01:58:46

- reply

dang it!

2024-04-27 21:39:14

initial plushie offering

2024-04-27 21:39:14

initial plushie offering

2024-04-17 03:49:10

if rust is so great, why isn't there a rust 2

2024-04-15 03:17:14

One of my larger complaints about Linux Foundation events is that they are very much targeted at corporations with large budgets to send people to conferences.
For example, as someone who has mostly been an indie OSS maintainer over their career, I would love to go to Open Source Summit and meet up with people to discuss what problems they are having with the software I maintain and how we can collaborate on resolving those problems.
But my choices are to register as a "hobbyist" (a frankly demeaning thing to call an indie maintainer) at $249, which requires me to go ask them for a discount code (also frankly demeaning), or register at the full $949 rate, or maybe I could get the "small business" discount code which brings it down to *only* $500. Man, what a favor, huh?
I understand that putting on these events is very costly, but when indie OSS maintainers are given the option of paying nearly $1000 or having to go ask someone for a "hobbyist" discount code, it seems very disrespectful to the maintainers who are building the actual software that this summit is about.
Do you really think the guy in Nebraska who is holding up all modern digital infrastructure in his spare time has the money to spend $949 to go to a conference? For all the talking we do about building inclusive conferences, this has to include *access* for indie maintainers.

2024-04-08 07:22:39

thinking about rabbits

2024-04-07 19:55:34

tired of hearing about “trans groomers” when there is at least one youth pastor arrested every week for child sexual abuse

2024-04-06 07:38:56

chief shitpost officer

2024-04-04 18:16:40

just remember, headpats are always part of the solution, stay pawsitive you internet infrastructure specialists

2024-04-03 13:50:54

a wise man once told me, instead of being eepy i should be on linkedin

2024-04-02 07:03:36

as I explain in my blog, the real problem is libraries which are large amalgamations of unrelated routines, such as libsystemd in the case of CVE-2024-3094.
a good solution is to split up these giant libraries into smaller ones, thus allowing for the dependency graphs of programs to remain leaner.
there is nothing about sd_notify() which requires LZMA compression. nothing. it is a function which writes a supplied string to a UNIX socket, the path of which is provided on an environmental variable.

2024-04-01 18:02:34

it should be noted that arch linux's reproducible source tarballs project actually caught the #xzbackdoor when they went and looked at it: https://gitlab.archlinux.org/archlinux/packaging/packages/xz/-/commit/881385757
while not perfect, this is a practical defense against backdoored source tarball releases.