takeda

Just because you love walled garden, doesn't mean others think the same. In fact you are the minority. This is especially visible on Android, where Google introduced side loading since the beginning and is struggling how to disable it. For example by blocking it in new android based products like Android TV.

Or EU ruling that Apple needs to provide side loading, so Apple still only enables it on EU SIMs, making it hard to still build products with it.

You mentioning Windows that it's "a privacy and security a clown show". Yet you are dismissing that Linux is for servers. That still doesn't change the fact that Linux is even desktop is much more secure though. Also mobile problems was not solved by mobile phones, in fact it was much worse, and more recent windows versions "backported" those ideas.

> It wasn't conceived, for example, to stop car manufacturers from engineering the cars to accept parts that are only made for their cars.

That's not what antitrust law supposed to protect. It's clear that different products will have different parts, what antitrust laws would do (if they weren't rendered toothless) would punish any blocking of competitors springing up.

Everyone who you ask will tell you that ads never work on them, yet we all buy branded shit.

Same thing with propaganda used by social media.

This video illustrates the effects of it: https://youtu.be/pB7WzqUq4Nk?t=324

aren't they already split and use different app in China vs US. Interestingly Chinese app's algorithm chooses more STEM videos, while Western version just pushes addictive crap.

Exactly, if they pull out it only means that the fear that it was meant only for propaganda was well justified.

There's a great book that I think everyone should read:

"On Tyranny: Twenty Lessons from the Twentieth Century" by Tim Snyder, it's also is short and to the point (audiobook is 2 hours long) and teaches people what to look for to see when their country slides into authoritarianism and what to do to fight it.

The author also reads it on YouTube if you can't get a hold of it.

That's exactly it.

Freedom of speech is my right to be able to bitch about Biden or Trump without having to worry that I'll die in prison.

Freedom of speech is not a right of foreign entities sending me memes about them to manipulate who I will vote for in the election.

There's a law where foreign entities can't own TV or Radio in US. This might be controversial, but IMO it should be updated to also include social media as this is source where people get news from.

> "Ban" is completely appropriate shorthand for "ban (unless something highly improbable occurs)."

It's only improbable if the suspicion is true, and in that case: good riddance.

Also TikTok apparently isn't even allowed in China they have their own version.

Thanks for the Close() example, that's a nice solution, although would it work if you wanted to handle an error (not just log it?)

> Standard go error handling maximises for locality. You don't see many "long range" effects where you have to go and read the rest of the code to understand what's going to happen. Ideally everything you need is in the diff in front of you.

I'm assuming you're comparing to exceptions.

I don't know about that. I think this relies on discipline of the software engineer. I can see for example someone who is strict and only uses exceptions on failures and returns normal responses during usual operation.

With Go you can use errors.Is and errors.As which take away that locality. Or what's worse, you could have someone actually react based on the string of the error message (although with some packages, this might be the only way).

I still see your point though, but I also think Rust implemented what Go was trying to do.

You get a Result type, which you can either match to get the data and check the error, you can also pass it downward (yes, this will take away that locality, but then compiler will warn you if you have a new unhanded error downstream), or you can chose to unwrap without checking error, which will trigger panic on error.

Tomorrow's title:

"Linux Foundation joins IBM to accelerate the mission of multi-cloud automation and bring the products to a broader audience of users and customers." ;)

> I understand were you are coming from but I actually like the explicit error handling in Golang. Things being explicit reduces complexity for me a lot and I find it easier to spot and resolve potential issues. It's definitely something that I can understand not working for everyone.

This sound a lot of like Apple user arguments about iPhone 1 missing copy & paste over a decade ago.

I am very pedantic about checking responses for errors, but from my experience when working with a team and existing project I see that people notoriously forget to check the result. TBH it is a pain to essentially repeating the boilerplate `if err !=nil ...`.

What's worse is that even documentation skips checks. For example `Close()` method. It's almost always returning error, but I almost never seen anyone check it.

The reason for it, is if you want to use `defer` (which most people do) you would end up with very ugly code.

The other alternative would be to then making sure you place (and properly handle error) close in multiple places (but then you risk of missing a place).

And other solution would be using `goto` in similar way as it is used in Linux Kernel, but there are people who have big problem with it. I had a boss who religiously was against goto (who did not seem to understand Dijkstra's argument), and asked me to remove it even though it made the code more readable.

They still preferred to revert it as it looks very suspicious.

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1068047

https://github.com/libarchive/libarchive/pull/2101

Sorry for that ugly comparison, but that explanation reminds me of the theories when covid started, that it was created by secret organization that is actually ruling the world.

People love when there's some explanation that doesn't involve randomness, because with randomness looks like we don't have grasp on things.

Google actually had tooling that was detecting it, but he disabled check that would show it.

Google/Microsoft/NSA could just say they detected it with internal tooling and not disclose how exactly. Google and Microsoft would love to have credit.

If you think of it as a state sponsored attack it makes a lot of sense to have a "secure" vulnerability in system that your own citizens might use.

It looks like the whole contribution to xz was an effort to just inject that backdoor. For example the author created the whole test framework where he could hide the malicious payload.

Before he started work on xz, he made contribution to libarchive in BSD which created a vulnerability.

It depends a lot which server you join, https://beehaw.org it's very welcoming, https://lemmygrad.ml is full of tankies that hate the West (supposedly it's about communism, because original creator is a communist, but it's more pro Russia pro China, anti US and in support anything the West doesn't support and vice versa). If you go to https://lemmy.world (the biggest server) you'll see mostly memes.

Though you can subscribe to different communities and customize your experience, often what you can experience from specific community depends on which server it is located.

https://programming.dev/ and https://lemmy.dbzer0.com/ might be good for technology related communities.

Tildes is not part of fediverse.

As for fediverse a lot of depends on the server you chose, for example https://beehaw.org is much friendlier.

Really? My impression is that everyone is welcome. The only way I could imagine someone ending having a bad time there is to be hostile to other users.

I don't, it feels like another Google Glass or Tesla Cyber Truck where you spent a lot of money to be ridiculed for being a sucker.

I would also add https://tildes.net

> They'd effectively have a skeleton key that only they could use (or sell) that

this looks more like state sponsored attack and it doesn't look like someone joining and at one point realizing they want to implement this backdoor.

The guy joined the project 2 years ago, developed a test framework (which he then used to hide binary of the backdoor in which appears that is complex and others are still figuring out how it works) then he gradually disabled various security checks before activating it.

And he was in the project for just 2 years.

Looks like he only introduced that "bug" in CMake. Was there migration in progress from autoconf to cmake?

This was an issue in Python 2, where for some dumb reason it allowed mixing tabs and spaces and equated tab to 8 spaces (I think). Python 3 doesn't have that issue.

This doesn't look like a research.

This looks like state sponsored attack. Imagine having a backdoor that you can just go to any Linux server and with your key you can make it execute any code you wish without any audit trail. And no one without the key can do it, so even if your citizens use such vulnerable system other states won't be able to use your backdoor.

I could be wrong, buy my understanding is that it isn't even a door. It simply allows anyone that has a certain private key, to send a payload that the server will execute. This won't produce any audit of someone logging in, you won't see any session etc.

Any Linux with this installed would basically become a bot that can be taken over. Perhaps they could send a payload to make it DDoS another host, or payload to open a shell or payload that would install another backdoor with more functionality, and to draw attention away from this one.

This is lame, it should say No, as you need DNS to load that page :P

I really hate that meme. DNS is the most robust system that actually can achieve 100% uptime (even though pains me to say it as it originates from USC, and I'm a Bruin ;). Every time you type an URL on the internet you're using it.

DNS can fail when someone who is managing it have no idea what the hell they are doing and abuse it to do things it wasn't meant to do.

Companies don't do s*t if they don't see it being beneficial. Perhaps they started it because they anticipated Redis license change.

Or maybe they saw redis had some shortcomings when trying to use in their cloud offering. The thing is that once it will get popular enough that other cloud providers might add it to their offering, the license likely might also change.

I think whateveracct was referring to is this link:

https://github.com/NixOS/nixpkgs/blob/master/pkgs/developmen...

What that file is doing, is building a package, and it essentially is a combination of what Makefile and what RPM spec file does.

I don't know if you're familiar with those tools, but if you aren't it takes some time to know them enough to understand what is happening. So why would be different here?

This does far more than Dockerfile though.

- it contains information how to actually build the application

- how to set up a dev environment

- how to build application with musl

- how to build application with glibc

- how to build python with only with expat, libffi, openssl, zlib packages

- how to take botocore and patch it up to only have cloudformation, dynamodb, ec2, elbv2, ssm, sso, sts clients

Try to get all of that into a single Dockerfile and see how complicated mess you end up with.

The actual docker configuration is here:

https://gist.github.com/takeda/17b6b645ad4758d5aaf472b84447b...

It might be still confusing to you at first, as you're used to list of incremental steps how to get to the final result, while this description instead is declarative (you're describing not the steps to do, but what the final image should be).

It's basically comparing bash script with bunch of "aws" CLI invocations to a terraform or cloudformation file.

You don't. Those scripts will just fail forcing you to rewrite them. This is why some people trying to create new packages often complain, because they need to patch up original build for given application to not do those things.

There are still ways that package will not be fully reproducible, for example if it uses rand() during build, Nix doesn't patch that, but stuff like that is fortunately not common.