Rich Felker

C librarian, purveyor of the language's eldritch horrors. Poppin' shells 🦪

GitHub: https://github.com/richfelker/
GitHub Sponsors: https://github.com/sponsors/richfelker/
Patreon: https://www.patreon.com/musl

Public Key

npub1pyun3m2kkzl53edh58kmq7hm5w66r4qr62w8jl628n6nrpj8kvysges9mm

NIP-05 Address

dalias_at_hachyderm.io@momostr.pink

Profile Code

nprofile1qqsqjwfca4ttp06gukm6rmds0ta68ddp6spa98re0a9reaf3sermxzgraypgm

Author Public Key

npub1pyun3m2kkzl53edh58kmq7hm5w66r4qr62w8jl628n6nrpj8kvysges9mm

Show more details

Last Notes

2024-09-10 21:11:10

- reply

It's not fundamental to the language but to the highly async programming model that's idiomatic for it.
There is no reason for local operations (vs fundamentally async federated stuff) to go through work queues rather than being fully synchronous local filesystem ops that complete immediately.

2024-09-10 20:37:55

- reply

I despise Ruby, gratuitously async systems, and bloat. But a good part of what Mastodon/fedi does is also fundamental not just gratuitous. Separating that out with a good mostly synchronous implementation in a better language would make a lot of difference.

2024-09-03 15:31:23

- reply

But "AI" is behaving like a non-intelligent organism. The question is: what type?
It's learning patterns that aid in its survival. And what it needs to survive is VC money.
It's a parasite in a symbiotic relationship with another parasite: billionaires.

2024-08-12 17:01:30

- reply

So utterly stupid that they ever entered App Store. It's completely unrelated to their purpose and was bound to screw over them, creators, and patrons.

2024-08-05 16:57:33

- reply

If you frame that as "AI", we will reject it, even if you think it could be useful. We will assume it phones home to some C&C cloud server, that it leaks private data, that it violates principle of least surprise and has unpredictable and non reproducible output, etc. etc. etc.
Yes the "gut reaction" is relevant. Fuck "AI" and keep it far, far away from anything FOSS, in the dumpster fire of techbro VC land.

2024-08-03 20:09:02

- reply

The number of elders this happened to who never knew how to use a computer or smart phone is astronomical. It absolutely was cable news.

2024-08-03 20:01:41

- reply

Cable news spam is far more harmful than any email spam or phishing has ever been. Even losing one's life savings to a scammer (extreme worst case, not usual outcome) is far less bad a fate than being turned into a hateful zombie whose children can't recognize you (very very common outcome).

2024-08-02 16:35:28

- reply

FFS folks (audience, not the ppl I'm replying to) let's get some pressure on the flagship clowns to fix this. 👆
It's unacceptable that moderation action is being taken against ppl calling out a nazi instance admin demanding beheadings of ppl who get abortions, and not against the nazi instance.

2024-08-01 18:41:17

- reply

Some context from what got them defederated (might have been thanks to me drawing attention 😁) https://hachyderm.io/@dalias/110961631492181947

2024-08-01 18:38:58

- reply

linuxrocks.online is a known nazi instance. It's defederated from hachyderm, which is hard unless you're really bad. People on that instance are there for a reason. Indeed, a liar.

2024-07-30 22:10:11

- reply

I think even this example is a lot more deeply broken than you dig.
The actual constraints include things like:
- price the shop will charge is affordable to me (only irrelevant to the high-pay techbro elite who design this shit for themselves)
- shop is reputable and not going to scam me (not "reputable" in the sense of "good at paying SEO scammers, fake reviewers, etc.")
- do they even carry the tires I need? in-stock?
etc.

2024-07-25 02:26:55

As we see the broligarchs stepping back trying to distance themselves from the nazis they thought were about to take power, remember:
They have been the enemy all along, and they will seek to realign with and coopt whoever they see as their best chance at self-preservation.
Whatever happens, they need to be hounded and purged from power. Or they'll just keep doing the same thing. We need to leverage their flirting with nazis to make it politically viable for a Harris admin to defang them.

2024-07-24 15:31:16

- reply

With recycled bottles it's what lets you make viable amounts to print full parts with out of $0 scrap instead of $35+/kg. You can do the welding by hand but recycling is already way too labor intensive. To make it practical you need some upfront tooling cost to reduce that.

2024-07-24 14:09:05

- reply

Here's the existing product that does it right: https://www.slunaz.com/

2024-07-24 13:59:03

- reply

This product is garbage for the reason you cite, and related reasons - PTFE limits the temperature way too low to use it with the main material it would be useful for: recycled PET from bottles. It might be possible to fix both using silicone tube as the consumable though. But ideally it'd use a two part metal form and no consumables. The Slunaz machine already exists and I think it does this all right.

2024-07-23 15:21:46

- reply

This is a theory explaining why personal data collection even anonymized or in aggregate violates privacy. The result will still be used to harm you.

2024-07-23 15:13:28

Privacy as the right not to have intimate knowledge used against you.

2024-07-22 04:16:46

- reply

Yep. I waited 2 hours in a car in a parking lot at urgent care only for Dr to tell me basically he didn't believe in Rx'ing it except for certain risk categories. That was after I called ahead and asked if they could Rx it. I was super mad, went home and found a robo doc and decided not to risk it being able to call me low risk, so came up with "I'm unvaxxed" as optimal lie.

2024-07-22 01:10:56

- reply

Pax is a miracle. I felt like shit for 7+ days after still, but the fever NSAIDs couldn't touch went away immediately after the first dose and never came back, and I don't think I have any long COVID issues.

2024-07-21 22:41:43

- reply

Can/did you get Pax? You can lie to a Rx robo doc like Dr B that you're unvaxxed and do have recent kidney & liver labs to get an Rx if your Dr won't.

2024-07-19 22:20:14

- reply

I haven't followed closely but what I heard early on was that the bug was an existing parser crash bug on bad input from data files (virus definition files or whatever) and an update to the data, not a change in the code, triggered it.

2024-07-19 13:05:05

- reply

The problem is EZpass is a huge tracking system. For travel that's bad enough (but already duplicated by license plate readers). For what we read? Hard nope. Micropayments are DOA unless they can make tracking mathematically impossible.

2024-07-18 04:00:26

Normalize referring to hard coded domains in software used for pushing updates, pushing configuration changes or dynamic code, etc. "C&C domains" (in the malware sense).
And block them all as such.

2024-07-14 02:29:06

😈 idea: control system for side mirrors to track highbeams of vehicle behind and reflect them directly back in the offender's eyes til they turn them off.

2024-07-13 12:07:49

Sacrifice: let my own conditions become materially worse so that others or my future self may benefit.
Accelerationism: make others' conditions become materially worse so they'll choose to sacrifice and benefit me.

2024-07-13 02:46:21

- reply

Google Chrome, or even degoogled Chromium, is NOT "a more privacy-conscious browser". It's 1000x worse. Yes this is (yet another) betrayal by Mozilla management clowns, but in browsers like in politics, "X betrayed us" doesn't justify "so we should turn to Y who was 1000x worse to begin with".

2024-07-12 13:29:44

- reply

🤡 🤡 🤡

2024-06-20 15:12:53

- reply

There's a stronger and darker version of Poe's law: any parodic or sarcastic expression of extreme views transforms into actual adherence to those views.

2024-06-19 04:36:52

- reply

There absolutely should not be functionality to rm -rf /home in systemd or anything that would ever be installed on non-landlord systems. There is no plausible reason for someone ever to want that done as some sort of automatic management process to their own personal system.

2024-06-15 02:30:37

- reply

This, but there are still ways it's violating, particularly deletion that can make something disappear while you're reading it or gaslight you into wondering if you ever saw it to begin with.
I'd really like better deletion ux, marking anything currently visible as "deleted, please be aware you no longer have author's permission to share" rather than reflowing it out. Also, showing "deleted post by x" in bookmarks etc. instead of just nothing there.

2024-06-13 14:04:31

- reply

They're not even "cool features". They're dumb shit that socially inept manchildren with their fingers in their ears *think look cool*.

2024-06-02 14:26:20

- reply

Seems gratuitously more fragile. I'd rather have a single mcu and dumb analog wires to everything.

2024-05-31 14:11:31

- reply

I think you've clarified this before, but "leave the EU market" means "treat the EU as a hostile regime whose people we need to provide circumvention tools from outside the jurisdiction" rather than "leave EU users behind", right?

2024-05-30 13:05:10

- reply

"escaping from the source" is irrelevant now. None of the sources are wearing them. The only mask data relevant anymore is what it can prevent the repeat infection enthusiasts from putting into your body.

2024-05-23 13:32:25

- reply

The core problem with curlbash is the *philosophy* - presume the user doesn't know how to admin their own system, install deps they need, etc. and ask them to let a script you wrote play admin on their box. (Along with that, it acts as license *not to document* what the user would need to do things themselves.)

2024-05-23 11:32:33

- reply

The flip side is it detracts from your credibility when you do it. Folks know "curlbash bad, projects recommending it are security clowncars" as a rule but don't understand the subtleties to evaluate "well in this instance it's not as bad".

2024-05-23 11:27:31

- reply

> not just "someone may sub in a malicious script...
Not only is that still relevant, just not usually the biggest problem; validating the curlbash antipattern by copying it, even in a context where it's less dangerous, seems bad too.

2024-05-23 11:01:57

- reply

No, an OS installer is creating a known system not modifying an existing one. (Well short of multiboot which I have Opinions™ about anyway)

2024-05-23 10:51:42

- reply

That alternative is not much better but also unacceptable. No users should be instructed to run privileged scripts from random sources that don't and can't understand the nuances of their system and make unstructured, undocumented, non automatically reversible changes to it. The security aspect is not just "someone may sub in a malicious script when UA is curl". It's "random changes to system break security invariants".

2024-04-08 15:49:02

- reply

No, that just gets you logged out of everywhere you wanted to be logged in, and trained to get phished by login fatigue.
The right solutions are UBO and firstparty isolate.

2024-04-02 00:03:27

- reply

You don't do stuff that requires privacy on school-provided devices. Since when do you have permission to install root CAs on locked-down, school-provided devices anyway?

2024-04-01 23:59:16

- reply

The way to do that is running UBO, not MITM.

2024-04-01 23:29:55

- reply

One HUGE side benefit for the public would be making it *impossible* for employers to impose draconian BYOD policies on employees, since consumer phones would lack the functionality they want (MITM roots). They'd have to provide work devices.

2024-04-01 23:17:13

- reply

Seriously, the number of people who have a legitimate need for custom root certs is utterly tiny (security researchers & reverse engineers mainly) and we don't really need to do that on our daily driver devices. Same as compiling out dangerous functionality in Linux kernel so it doesn't inadvertently get invoked or used by root kits. You can always do a custom build with it when you need it.

2024-04-01 23:13:48

- reply

That's why it's open source. 🤷

2024-04-01 22:59:10

- reply

But I still believe it would be a lot more secure if the functionality were not there at all unless you either compiled your own OS from source (anyone who actually needs to MITM their own apps is capable of doing that) or paid $1000 a seat for enterprise edition.

2024-04-01 22:56:10

- reply

"Without explicit permission of the user" is meaningless if the application is able to ask for permission. The only acceptable compromise position is user having to manually dig deep into settings menu to find where to add CA certs, then getting a detailed warning that if anyone has told them to do this, that person is trying to backdoor their device, and that they should only add CA certs for a CA they personally operate or trust.

2024-04-01 13:59:46

- reply

Is this really how it worked? 🤦
I have said 100 times and been ignored: device & browser vendors need to remove custom root CA support from their mainline products for consumers and only offer the antifeature in a $1000+ enterprise product.

2024-04-01 13:38:04

- reply

🤏 🎻

2023-12-19 01:00:37

- reply

The theory is that it both cuts off the ability to do racist/sexist/nepotist selection claiming there was some hidden characteristic that made one candidate "better", and it frees up everyone from wasting disproportionate amounts of energy trying to be or appear "best" because once you establish sufficiency, you're done.

2023-12-18 23:35:52

Thought on hiring/role filling/admissions/etc. justice, inspired by something I just read and commented on:
Would we be better off taking N randomly selected candidates from a set of applicants who meet basic qualifications & can show competence, rather than trying to select the best? I suspect so...

2023-08-27 12:42:08

Heads up: linuxrocks.online has no rule against transphobia, retaliates with warnings against users who try to report it, and has actively transphobic users defending these aspects. #fediblock