runningmike

Simple is use your thunderbird mail to read RSS feeds. Check https://support.mozilla.org/en-US/kb/how-subscribe-news-feed...

There are some good SAST scanners and many bad commercial scanners.

Many people advocate for the use of AI technology for SAST testing. There are even people and companies that deliver SAST scanners based on AI technology. However: Most are just far from good enough.

In the best case scenario, you’ll only be disappointed. But the risk of a false sense of security is enormous.

Some strong arguments against AI scanners can be found on https://nocomplexity.com/ai-sast-scanners/

revised 13 May 2025 (this version, v2)]

- Backup and restore

- integrity checks from security perspective

- nlp, finding same tokens in text

Etc

“ Supply chain attacks are malicious updates that sneak into open source code used by many apps.” No!

This should be: Supply chain attacks are malicious updates that sneak into source code used by many apps.

Stop blaming FOSS. Too many people still have the perception that FOSS software is insecure

Some nice things in this RFC. But The not only the end user is unlikely to understand complex end-to-end cryptographic protections, also many developers should not burn their fingers or nextgen-vibe AI tool on programming E2E encryption things.

Section and peer reviews seems doable. But how can AI text be detected when I. One sentence a minor manual change is made? And what about false positives? How will false positives handled? A common problem, also in plagiarism detection. Which often fails in subtle ways.

Great short read. But this “ It’s why the world wasted $10B+ on self driving car companies that obviously made no sense.”

Not everything should make sense. Playing , trying and failing is crucial to make our world nicer. Not overthinking is key, see later what works and why.

The full story https://archive.fosdem.org/2024/schedule/event/fosdem-2024-1...

Great summary! replacement for email should not be email, but something better. But for many years, history learned us that there’s nothing invented that sticks…

Anonymity by default : not true, banks shouldn’t be trusted. And retrieved referral info will be stored by banks.

Good question, but on the wrong place. Question has been asked regularly. The HN was https://slashdot.org/ till ad bots took over.

https://news.ycombinator.com/item?id=25318880 https://news.ycombinator.com/item?id=32422387

All python packaging challenges are solved. Lesson learned is that there is not a single solution for all problems. getting more strings attached with VC funded companies and leaning on their infrastructure is a high risk for any FOSS community.

AI or machine learning is not a tool for every problem. Or to put it even more clear: In most cases applying AI/machine learning is overkill, too expensive, does not work, and other traditional software solutions make far more sense. So the short answer for most use case is: do not use AI/machine learning.

See e.g A Field Guide to Complex Systems , https://www.bm-support.org/problem-solving-methods/

Nice article! Simple gets complex very fast when creating systems for business problems. For anyone interested in tools check some tips in a free cc-by book at https://nocomplexity.com/simplifyit/

Strategic consulting is never about knowledge. It’s all about personal relationships and having another external company to blame for all important decisions. Nobody gets fired for hiring IBM. Or whatever sh*t company.

90% of the cost will be building the business. Product dev cost are minor! Do you want a business or great software that nobody uses?

This wheel has been reinvented again and again. The $$$ seems very attractive. But simple is a scam… https://news.ycombinator.com/item?id=44838059 Make an existing Foss wheel better. This is a hard crowded market with many many tools and solutions. But the problems are seldom solved with a tool alone.

I think there is a lot of code that relies on the repr() or str() so there can be security implications. Since this idea is far from new it strongly reminds me of the mail thread https://bikeshed.org/ from the living legend PhK.

Nice idea. In practice many sites have different methods to prevent scraping. Large risk on doing things manually imho.

Haven’t tried gpt 5, I’ll keep hoping local AI tools will eventually do the job..

Reading the first line I thought it was about https://github.com/eclipse-capella/capella, the Foss solution for Model-Based Systems Engineering. Confusing. But now there is also a Capela with a single ‘l’ -) Great writeup Kyle, thank you!

It is indeed a complex problem. But is Google now killing FOSS slowly? IMHO there is far too much emphasis on Foss security and far too little on closed sourced hardware, firmware and software. Too much blame and pressure will not solve the complex problems as stated in the blog.

Nice writeup and status update on use of Foss ml things. Saves me a lot of time!

Great interactive story! This story shows some power of publishing on the web. No malware ad networks on this page is a relieve.

“ These organizations are very exclusive clubs and anything but open.” This is so true! Many tests of the OpenSSF Scorecards do not make sense when you e.g do not use github actions and have a one persons project…..

“ a federated and independent repository of trusted plugins and themes for web hosts, commercial plugin and tool developers in the WordPress ecosystem and end users.” The goal of this project is blurred. They want to move away from WP and allow commercial plug-ins. Both are very hard to accomplish. Forking WP and build a community was more transparant and easier to do. Since WP is gpl , there has for a long time been too many violations by commercial plugin sellers. You can sell your plug-in, but you must apply with the gpl terms. So release all the code. Too many plugins are malware, since code is loaded by an api call. No trust, no security and no privacy.

Nothing wrong with simplification, however there is always is a but.

Mostly privacy rights of EU citizens are not improved by this changes. Privacy was, at least on paper, good arranged by this GDPR. Wondering if this changes will make it really better and for who!

Could Microsoft deny the request from the US government? I guess not, but i am not familiar with US laws for US companies…