smokey_circles

> Amazon is blatantly misleading people here

I'm not so sure I agree about that, presuming you're talking about the open source comments. If not, you can ignore the rest of the comment (except the last paragraph, pertinent question for you)

The SSPL is not an open source license [0], and that's all there is to it.

There must be a better version of it out there somewhere. Something to the tune of "use our software as you wish, however you may not offer it as a hosted solution without a license from us. This license entitles you to direct support and other goodies to justify such a stance".

I can't think of those "other" goodies but that's why I'm not a business type :D

I don't think I'm making a crazy statement here, am I? Maybe I'm just being young and naive. Can you shed some light on your experience with trying to work with Amazon to address the problems? I imagine they didn't listen (they're just too big to care it seems), but I'd like some first-hand experience to gauge with.

[0]: https://opensource.org/node/1099

I don't think their intention is to Embrace, Extend, Extinguish, but I also think it's a side affect of being such a behemoth with a much better offering.

I can't think of a way to offer an OSS product and make money in the "traditional" means of support when Amazon is around. You just can't compete with them because you're right: They are a MUCH better product.

Not because they understand the software better than you (although I'm not saying they don't either), they just have more resources.

Why can't we work together instead of being in direct competition, you know? There must be a way to do that

I understand the question mark about what it is that Amazon did wrong here, and for the most part I agree that they've done nothing wrong.

But I am not Amazon's side here. This is my very subjective take on the matter and by no means am I claiming to be correct.

Amazon represents and existential threat to the open source business model. To those who say otherwise: How do you compete with a company with the incredible amount of resources available to Amazon? They could outprice you (running at a loss) and use that as leverage to bring your customers into their ecosystem.

I'm not saying Amazon is actively hostile towards opensource. I recognise that they even submit contributions to the stacks they use (at least the ones I've seen). But there's no argument that I could host a better instance than Amazon. That would be one hell of a grandiose delusion.

I don't know what the answer is here for open source. Maybe a license that allows free use, but prohibits you directly competing (offering a paid solution for support of the product) without a license.

I don't think that's unfair stance to take, it doesn't punish Amazon for being such an incredibly successful and powerful hosting provider (I like AWS, I really hope I'm not sounding hostile towards them) but it creates a symbiotic relationship instead of a directly competitive one.

Maybe I'm being naive and overlooking something, but I don't see what choices Elastic had here.

I don't agree with the arguments that Elastic made a killing last year and therefore they should shut up and be grateful. Be grateful for what, exactly? That a behemoth of a platform is taking business share from them? You can't expect them to be OK with that, surely. I don't agree with their response either, but I think it's time the open source community acknowledges that we're in a different era now and we need a license to reflect that.

1. Don't punish Amazon, they haven't done anything wrong (and you can very easily nuke small businesses that offered support too, nobody is whining about them). Open source should belong to all of us. Making money off of that should really belong the original authors. I don't think that's a wildly ridiculous opinion.

2. Protect your business model, or maybe even come up with a new one that works hand-in-hand with a hosting provider like Amazon, rather than waiting for them to drain your market (which is not their intention but you can't ignore that it's happening).

An example I can think of for 2) is building a version of the product that's more suitable for Amazon, which might help relieve overhead for them setting that product up. Then charge them for supporting that codebase. I'm imagining a twist of the "enterprise-grade" tier with extra features for enterprise-grade users. Have a "cloud-provider" tier on top of that (that supports replication, multi-instance, easy-up-down state or whatever you can think of).

Again: I'm just a dude who thinks there's a growing elephant in the room that can be addressed in a manner that's beneficial to all parties. I don't mean to attack Amazon or Elastic, but I think this incident is a harbinger for what's to come

-----

EDIT: Maybe the right move is to approach the cloud providers as an OSS provider and ask them to work with you on your business model. Don't wait for Amazon to build your product into an offering, build it with them. Take a cut of the revenue. Maybe?

I disagree, going so far as to call this intentionally obtuse or misinformed.

1. CO2 is not the sole measure of environmental impact. The land usage problem is also pretty serious. Deforestation chief among it.

2. I can't find any literature to back up the claim that CO2 has an atmospheric residency of thousands of years, seems to be 100 at best estimates [0]

3. Over that 100 year period, Methane has 25x greater effect than CO2 [1]

4. Methane oxidises into CO2 and H20, so transport is still not the greatest contributor

[0] https://scholars.unh.edu/cgi/viewcontent.cgi?httpsredir=1&ar...

[1] https://unece.org/challenge

I find the pattern

    for {
        select {
            val := <- someChan
            doSomething(val)
        }
    }

for single channel reads very common. I don't like this pattern because you can't close the channel, which is a useful way of signalling you want the routine to end. I guess you could add a signal channel in that select block too, but the language supports "auto exit loop" on close already, via the range function

Instead:

    for val := range someChan {
        doSomething(val)
    }

It might be subjective but

1. It reads better

2. It leaves the loop when you call close(someChan), which is neat

But that's just my take. I'd be curious if anyone has any reasons for the single-channel-read-in-a-select-block approach

Oh that's easy.

The Polish government (like most authoritarian governments) wants sole control over who has censorship authority. [0][1][2]

Also: You're conflating "speech they don't like" with "policy violating conduct" which IS legally enforceable in most countries, including Poland.

As usual: Don't like it? Go somewhere else. Just not Parler, they couldn't host a piss up at a brewery.

[0] https://apnews.com/article/poland-courts-warsaw-2dece52da1fa...

[1] https://ipi.media/as-violence-escalates-in-poland-journalist...

[2] https://ipi.media/alerts/polish-journalist-arrested-while-co...

Freedom of speech is not freedom from social consequence. It doesn't apply to private institutions. Ever. End of discussion.

What should be discussed is whether or not Twitter and Facebook have crossed into the "public utility" domain. I mean, twitter literally facilitate and handover a POTUS account that reaches hundreds of millions of you Americans.

It feels like Americans won't do that though because the idea of talking to the other side is unimaginable.

But twitter and facebook have incredible power over the public, and I don't think it's crazy to suggest a regulator

I might be, I took the article at it's title to mean "2FA does not protect you from your password being leaked"

Ah, I did overlook that one.

That said: I remain unconvinced that 2FA is a trivial thing to beat. Now we're talking about an active attempt to impersonate you, as opposed to a general catch-all-the-2fa-less-logins

Put another way: If you ran this phishing site, would you focus your time on the logins with 2FA enabled (which if I've understood correctly means you'd have to catch them in the window the token is valid for) or the logins without?

No.

2FA is designed to authenticate that this is you logging in. Wrong off the bat.

The "they just use your login token" is akin to "they just hacked the CIA's database". Just.

I also don't see how the author thinks that the same users who struggle with yubikey won't simply search for the github.com login on githud.com in their password manager. Bitwarden and co are great but the default domain creates a problem where login.signup.domain.com does not match login.domain.com and so users are used to searching.

The bit that completely lost me was the lamenting of convenience with the YubiKey.

Security and convenience are polar opposites.

Coupled with the "tech bros" comment, I am not sure this is in good faith at all

I don't think that's true, but I'll also admit that the history of the cold war is very muddled and I am no historian.

The US's version was written by the white house's journalist. It is not objective and lots has been refuted from calls leaked by the soviets after the fact, and a few of the advisors too.

TruTV/Adam Ruins Everything has a take on it [0] (not saying that's the objective history but they raise some eyebrows).

Some facts we do know though:

1. JFK rode on an anti-communist wave to beat his opponent into office

2. The US moved missiles first

3. The military was following orders from the top

[0] https://www.youtube.com/watch?v=k5wc9V7ggVg

--------

EDIT: on some reflection, I think I actually just proved your point. If that was just left to the military then cooler heads may not have prevailed

People are people and whether they are maintainer or customer, we can all be ass-hats.

How would you prefer that kind of "arbitrary planning" be addressed though?

I don't have any luck with my FOSS projects but I am SUPER grateful for that because I just don't have the time to sit and work on them after I've done the job I have to pay the bills I also have.

Any advice for someone like me?

Generics are awful. They solve no problem in the domain space, only the developer space.

Which then creates the problem of developers who insist on writing infinitely extensible generics with indecipherable bounds.

Just repeat code. You'll be fine.

If you find yourself repeating a LOT of code because Go does not support generics, maybe stop and think about your design. Putting generics in as an escape hatch will do you more than good, guaranteed

> Living costs don't necessarily correlate with talent levels.

As someone who lives in a low cost country: rubbish. There's a reason we're a lower cost.

1. We have a lower standard of education

2. We have a higher cost of technology (relative to average income)

3. We have a lower need for the luxury market where most technology resides

You can also look at the proportion of field leaders. Are more from the developed nations or the developing ones?

The developed nations had a headstart on technology, do you think the developing ones have overcome that, despite most of us going backwards in terms of access to education and the wealth gap?

Don't take it personally, I'm not trying to tell you that you're a bad developer. What I'm saying is we have to work harder to uplift our country's fields and not fall into the trap of "well I'm the biggest fish in this tiny pond so therefore I'm an equally big fish in the ocean". It does not work that way.

This whole argument ignores the massive shifts in infrastructure that happened between dial up, adsl and fibre (and all the things in between). If you will pay for it, someone will build it.

I agree there is a practical limitation but

1. We're nowhere close to it, but it turns out a few large entities running the show is not efficient and slows it all down.

2. Information Technology is one of (if not the) the most rapidly changing fields

3. The cost of bandwidth will abide by Moore's Law, which means the price of producing it should as well. Couple that with the fact we're referring to an immensely wealthy sector and the cost argument loses merit pretty quickly

>What happens when we have 4 people per home, all streaming uncompressed 8k VR video streams, and 200 homes in a subdivision?

So you're arguing the correct approach is to give everyone pipes that are capable of doing that, but limit the amount of time they're allowed to really work them. None of that makes sense to me, am I missing something here?

I don't see this as being a solvable problem.

Having a psychographic model is dangerous to social structures, it just makes it far too easy to manipulate those who are easy to manipulate (which, given any topic, is the vast majority of people).

There are no effective defenses against this that I can see.

The trouble is the disconnect between Facebook's apparent business model and what it actually is, although I'll admit this might be conflating who is the real bad guy here.

The business of advertising is behavior manipulation, pure and simple. Nothing about that strikes me as "safe"

Masks are a pointless waste of time when it comes to containing the pandemic.

Yes yes, I know. Just let me explain.

Masks DO help prevent the range particles can travel when you breathe. I'm not arguing that. The fact is, however, they're useless in comparison to the ACTUAL champions of prevention.

And that would largely be hygiene. I'm willing to bet 99% of you reading this do not clean your fingernails properly while washing your hands. Which is fine, THAT'S how good soap is. Doing it poorly is orders of magnitude better than not doing it all.

Is the same true of masks? Absolutely not. If you don't wear a mask properly, it's useless. It gets worse with specialised gear, like the N95s. You need to be trained on how to fit, test and adjust that. Have a beard? Not gonna work. Small leak out the top? Nope, it's buggered.

You ever notice how developing nations struggle with higher infant mortality rates, caused by preventable communicative diseases like cholera? It's because they don't wash their hands with soap. Soap is literally a life saver [0]. There's a damned good chance it's saved you a nasty infection, if not your life, directly or otherwise.

It's strange to me we understand why gloves aren't effective, but somehow that logic gets lost when masks pop up. If you don't know how to stop yourself from contaminating your environment, you're really not getting anything from wearing a mask. Or gloves. Or scrubs.

China is a fantastic example of this. They just ignored the whole "human rights" problem and went straight to welding people into their own homes [1]. Highly effective. Conversely, they'd been wearing masks for a long time because of their air pollution. Clearly not very effective. (The point here is the behavior and the objective is more important than the mask).

Here's what we should be focusing our energy on:

1. Social Distancing

2. Wash your hands properly [2]

3. Coughing etiquette

4. And then, finally, PPE including masks. If you don't know how to use gloves properly, then don't waste your money (because we all seem to forget economics is also a problem to solve here).

JUST focusing on masks won't cut it. Rather focus on JUST washing your hands then. You will see a much larger return on investment there. That evidence is also irrefutable. Compare the rate of death from communicable diseases in areas where washing with soap is prevalent to areas where it is not. SARS-CoV-2 has a lipid bi-layer, so soap will destroy it.

[0]: https://www.ncbi.nlm.nih.gov/pmc/articles/PMC2587156/

[1]: https://www.cbc.ca/player/play/1703503427818

[2]: https://www.youtube.com/watch?v=xLIFT9xoWSQ the key bit here is scrape your nails against your hands when they're full of soap, so that the soap gets UNDER your nails too. Germs are tiny, and everywhere. So get em good

I'm not a huge fan of the thermal throttling comparisons.

Apple completely fucked the pooch on the previous gen(s?) when it came to design.

They don't get points for fixing an utter fuck up. That should have triggered a recall, imo.

However, the performance of M1 looks hella solid, and kudos to them. I'm gonna stay with Linux because I'm comfortable in it, but innovation is never a bad thing.

INB4 walled gardens and code signing: stop drinking the koolaid and do your own research

>It also doesn't matter who initiated the bribe.

What a silly thing to say.

Whether or not you initiated a bribe does not defend your participation in it. True

But ignoring the balance of power for, what appears to be, a reason to hate on Apple is just daft. Shockingly so.

A police offer demanding a bribe is not the same as a police officer accepting one. Just ignores the entire social dynamic of humans. Power dynamics are the central theme of human relationships. This is just a weird form of victim blaming, though not for a moment am I suggesting anyone is innocent here.

The Undersheriff should be crucified as a means of deterrence. You can't have positions of power occupied by those seeking to corrupt them. Which, I think, is not far off your argument, you just want to seem to needlessly drag Apple into this.

They weren't involved, beyond their employee basically stealing their stock. Is that somehow their fault? Should we charge them with criminal negligence for trusting someone? That's not going to have long term consequences for whistleblowers at all

This is... Silly.

1) You can look at the 5 eyes alliance's assault on encryption. That's literally forcing their will on the company (and others)

2) The TikTok ban demonstrates not only capacity but an appetite to exert to control over this domain

3) That whole "summon the CEO of the company to directly answer questions from the group of people literally in charge of policies around reform and control"

Or we could sidestep these questions and conflate income with ownership

Good points all round.

But what I'm not doing is saying "you should always use stash". I'm providing use cases, for me personally, where stash is the correct approach.

"Ah", but you might be inclined to argue, "such and such a reason". Yes, but also no.

Right tool for the right job is also an argument for competency and context. Sometimes a hammer is useful for more than just hammering, but very rarely.

The point is there is usually more than just 1 approach, and niche/edge cases can be real nasty if approached with the attitude that everything is a nail

Well this blew up and lots of you missed the point

> right tool for the right job

I'll give you that this is (slightly) ambigious. But here's the gist

>you can safely ignore the opinion of anyone who says "never do X"

There are lots of alternative tools listed in this comment tree.

Stash has a purpose. You should know what that purpose is. A tool is only as good as its user

>If zoom (the company, not the software client) can get the encryption key, the call is not e2e encrypted

Ah, thank you. That was the bit I was missing.

Silly question I know but I couldn't wrap my head around the wording

I don't understand how the FTC arrived at the conclusion they're not E2E? Or have I missed something?

>Despite promising end-to-end encryption, the FTC said that "Zoom maintained the cryptographic keys that could allow Zoom to access the content of its customers' meetings, and secured its Zoom Meetings, in part, with a lower level of encryption than promised."

Not wonderful but that still, technically, is an E2E encryption scheme. Is it not? Or do they mean one end terminates in Zoom's servers and it's not E2E through the whole pipe, but rather two pipes stitched together?

Agreed it's not as secure as they marketed, but this seems to suggest if you want to offer E2E you need a specific kind of key storage to meet this new precedent. Good in practice, but maybe the FTC are not the right people to placing such a hurdle down?

I'm sure I've missed something though.

>Never stash

Er, no. Right tool for the right job.

Whilst I agree that the idea of putting differing lines of work into different branches is great, that's not what stash is for. That's what checkout is for.

Stash is used to record the current state of the working directory and index while also returning to a clean working state.

I guess for the author, stash is used to preserve changes when pulling in upstream changes you missed. It can, but it does waaaay more.

What happens if, like many people, you're working on a few branches at a time. Could be a monorepo, could be a couple long living branches, w/e. What do you do if you've done work against a branch and want to lift and shift to another branch?

You could commit and rebase and all sorts of clever mangling of the history.

OR you could use the right tool for the job

---

Follow up

[0] https://medium.com/@yankee.exe/mastering-git-stash-workflow-...

[1] https://git-scm.com/book/fa/v2/Git-Tools-Stashing-and-Cleani...

Wonderfully written, completely baseless.

Not meant as a criticism of Rust, but you will unseat COBOL from the finance sector LONG before you get the gaming houses onto rust.

Not impossible, highly improbable though