amusingimpala75

Yes but if the concern is being forced to remove code in the case of copyright violation it is trivial to remove code that is a test case as opposed to a feature of the compiler

M-x cua-mode enables a variety of “traditional” keybinds such as C-x / C-c / C-v for cut / copy / paste

Well if it’s a full disk encryption exploit that still requires hardware access I imagine it would have been made for a 3-letter govt org or something

At least in the case of sqlite, rusqlite pulled in 5 or so in total whereas Go had a single library that was a thin wrapper around sqlite, and integrated into the stdlib interface. Many fewer deps

Edit: counts are fair, that’s still hundreds unaccounted

I’m not arguing on quality of the library, I’m arguing on not getting pwned by the sheer number of transitive dependencies

This is probably going to sound generic / repetitive, but my biggest complaint about Rust is the package management situation, which is entirely the result of the developer mindset. I love the ergonomics on the rust side (the functional approach to data types is beautiful), but I’m working on two projects side by side, one in rust and one in go at the moment. The dependency trees are entirely different beasts, with most of the stuff on the go project covered by the stdlib whereas I think the rust project is over 400 despite asking for just rusqlite (sqlite), clap (cli), ratatui (tui), and tauri (gui), the last of which is by far the worst offender but even without it, it’s still close on 100 which is crazy. If there were (and maybe there are, I just haven’t found them) decently maintained alternatives to the rust crates that actually have a sane dependency approach, I’d feel much better. I’m just trying to not shai hulud my system, and the rust-web people seem to want to turn cargo into npm in that regard.

[edit: TFA addresses this, though I still find crazy 90% accuracy overall vs 20% accuracy for curl]

Is this suspected vulns or actual vulns? If I recall correctly, it produced 5 for curl but only 1 was legit

Aren't most piracy services free though nowadays? This quote is at least referencing pirates that sell the pirated content.

How does a company even consider this while the CFO is privately saying the books / revenue accounting are not ready for public scrutiny?

Edit: Or has so much somehow changed in two weeks that it’s no longer necessary to wait until next year?

Are we not going to talk about the literal CFO saying their books aren’t up to rigorous reporting standards and need to wait until 2027?

Built on meaning the technology is using Git under the hood, not that it is developed using git.

Edit:

Breaking down the “word salad”:

> Radicle is a peer-to-peer code collaboration platform (“forge”) built on Git.

Peer-to-peer: it functions with individual nodes on the network spreading state for tracking it without relying on a single entity or centralised service.

Code collaboration platform (forge): you use it not just to store code but provides a way to keep track of “patches” (their term for PRs) and issues, amongst other things, to enable multiple people to collaborate on a code base

Built on git: the technology runs on top of git insofar as not only is the VCS just git, but the issues, patches, etc are stored in git. So the project isn’t merely developed using git, but when running the tool yourself it’s still backing everything under git.

Radicle CI does exist but it is admittedly fairly early on in development

Arguably if anything killed by EU

Since the exploit can be mitigated by simply blacklisting the AF_ALG module, why didn’t they release an advisory to disable the problematic module (which AFAIU is hardly used), and then only later, say after a week, release the patch for it? At least then you would have the immediate ability for a mitigation without giving away exactly how to exploit the bug.

Thank you for describing the tragedy of the commons

Their PoC does as you say, but is built upon arbitrary modification of the page cache, which could be abused for the other things

Not by default but tools like agent-sandbox.nix (bwrap, seccomp) or other nixpak (just bwrap but more popular) can provide those capabilities if you want in a fairly simple interface

That’s fair, NixOS avoids the direct stuff from Docker itself but if you’re basing on an Alpine image or something that would probably be more minimal / smaller

Yes but NixOS does all of these things already, without the process overhead

Missed opportunity for “arewehormuzyet.com”

Since this works on the raw data streams from the official distributor, this is legal, correct?

How much of the native app push is to bypass ad blockers? If you’re just using a browser plugin like AdGuard or uBO it can’t block in a dedicated app unless you replace it with AGH or PiHole, can’t help but wonder if that plays a role as well

Correct me if I’m wrong but my understanding was that ethanol in gasoline was a result laws enacted due to corn farmers (or their state reps) lobbying for subsidies, not any intrinsic part of gasoline production

emacs already has structural editing packages like combobulate

I can’t seem to find anything about this model reference anywhere besides some random LinkedIn posts and Medium articles. No official announcement or model statistics

Hence the “dense as Musk” comment

From the example:

  # XDG "compliant" programs
  .config/ etc/
  .local/state/ var/lib/
  .cache/ var/cache/

This is the first I’ve heard of using ~/etc instead of ~/.config as $XDG_CONFIG_DIR. Is there any precedent for that?

As far as I can tell, this doesn't change when the actual orbital transfer from earth to mars occurs, it just allows launching outside the normal transfer window and then loitering until the window arrives. In this case, what benefit do they have from launching it now and loitering for a year rather than just launching it a year from now?

I think what they meant is: there’s already so many other ways to fingerprint (say, canvas) that a common user agent doesn’t significantly help you

(To be clear I quite happen to like EVs)

And those people who would lose money are the EV manufacturers. AFAIK in the US EV manufacturers are barely making money even with gov’t subsidies (baring Tesla). They can’t charge what would be necessary without subsidies because most people simply wouldn’t want or couldn’t afford such a product at that price point.