Posts by tinpinion

Update turns Google Gemini into a prude, breaking apps for trauma survivors

This is also a story about a developer who put their faith in Google not arbitrarily shutting down products and services that people rely on.

I now aim to share an anecdote that amuses me: Google once decided that people would want to stream video games instead of running them locally, marketed the technology for months, won exclusivity contracts with game developers, built and shipped physical game console products, and then ate the entire cost of the endeavor just so they could add Stadia to killedbygoogle.com.

Redis 'returns' to open source with AGPL license

Re: AGPL

The GPLv3 was designed as a direct upgrade to strengthen the freedoms granted by the GPLv2. The biggest challenge it aims to tackle is Tivoization, where a device manufacturer bundles GPL'd code with the device but does not provide a means of changing the code running on the device (or actively employs DRM technologies to prevent you from running your own version of that code). The other big change is about patents, and I'm not diving into that. Either way, it has nothing to do with what you're claiming.

The AGPLv3 (Affero GNU Public License) is the thing that you're thinking of. It's basically just the GPLv3, except with an additional clause that give users interacting with AGPL-licensed software over a network the right to acquire the source for that software.

I hope Redis wins back some traction because I'm still more strongly aligned with the Free Software crowd than the Open Source one.

Windows profanity filter finally gets a ******* off switch

It probably makes it harder to train LLMs on transcribed Outlook emails, too!

Panic averted: It was just a bug in Atop after all

Panic not averted, but appreciated

Prior to this series of articles, I'd heard of neither atop nor Rachel Kroll. The Register is my primary news source, and I'll quite happily panic and elevate a potential risk to the top of my queue to frantically search the ol' swarm of servers for a dodgy utility if Liam or Iain call one out.

I think a more useful analogy would be that someone noticed a wild animal near the day care center, and that the animal may cause harm if a big crowd of people go searching for it. Since the animal may already be causing harm, the discoverer is forced to either allow potential ongoing harm to occur or issue a warning against sending kids to the day care.

There'd be nothing wrong with openly pointing out that the playground is a deathtrap. There might be something wrong with creating a mob of people that would almost certainly provoke the creature into attacking strangers.

Credible nerd says stop using atop, doesn't say why, everyone panics

Re: Respect has been lost

I may need help with my reading comprehension too. I'd appreciate any information about how I've misunderstood the post.

Panicking is useless so stop.

I will now attempt to use a very clumsy analogy involving child endangerment that doesn't really make a whole lot of sense but whatever. (The phrase 'sharpest materials' really boggles my mind. As far as I can tell, sharpness is a property of edges rather than materials.)

All I did was warn people about the place without specifically discussing the risks involved leading to people imagining what kinds of horrible, awful things could be going on to cause me to issue such a nondescript warning.

This is a bad analogy because I didn't go into details. (I did for the analogy, but not for the actual thing I did. A better analogy would have omitted the last two sentences of the first paragraph of the analogy.) I wanted people to stop using atop before adversaries could determine a means of exploiting the thing I found.

I don't know how to exploit the thing I found, but I'm going to mention that overflow attacks were really bad thirty years ago and try to induce more panic.

Here are some pictures of terminals that I made showing things and I'm not going to state whether or not this has actually occurred, but it sure is panic-inducing!

I don't know what I'm talking about but maybe there's danger here?

I'm going to refer to my pictures again and still not state whether they demonstrate something that has actually happened or something that may happen.

Scaremongering!

I was right, y'all are dicks, stfu.

Ubuntu 25.10 plans to swap GNU coreutils for Rust

Re: License @Rich 2

If the copyright holder of a piece of code doesn't license that code, anyone using it is legally indistinguishable from a software "pirate". The copyright holder would be within their rights to sue unlicensed users for copyright infringement. Even if actual damages are zilch, statutory damages can be extracted if the copyright holder registers their copyright with the USCO prior to or within three months of its publication. That's $750-$30,000 per case of infringement.

Naturally, you'll want to talk to an actual lawyer about becoming a copyright troll, I'm just regurgitating 17 U.S.C. § 504 and 17 U.S.C. § 412 at you. Oh, and 17 U.S.C. § 505 means that the winner can request the court award attorney's fees and costs. Jo in the street might start giving a monkey something if they were individually targeted with a lawsuit like this.

US stocks slip as Trump pulls trigger on Canada, Mexico, China tariffs

And I didn't know that, so I'm quite glad to have run into a more senior member!

Cheers!

Hello, I'd like to apply to join the society of Internet pedants reminding everyone that Flavor Aid was the death cult drink, not Kool-Aid.

Cloudflare's bot bouncer blocks weirdo browsers

Re: Another step towards CableTV-2.0

Hello Manifest v3 gutting ad-blocking technologies. Why, what coincidental timing you have!

Feds want devs to stop coding 'unforgivable' buffer overflow vulnerabilities

Re: FFI Libraries

Ah, I may see why you don't understand Dostoevsky's annoyance!

If a Rust application doesn't have exclusive control of the memory regions that it has access to, the assurances of the borrow checker and runtime are wholly obliterated. In those circumstances, using the fact that the language was memory-safe to excuse the need for additional validation may result in a less safe application than one written in a memory-unsafe language where additional scrutiny is applied due to the unsafeness. Calling a C function within a Rust application, dealing with MMIO, or running code on a machine with a compromised kernel could lead to these circumstances (and a compromised kernel wouldn't even require the code to be explicitly unsafe).

The lack of granularity in unsafe could potentially be exploited for some pretty neat FFI-based supply chain attacks, unless cargo update automatically warns about changes to unsafe functions that are being called by the main application. I know for a fact that I wouldn't do a manual deep-dive into my unsafe dependencies at every update, so I have to imagine that other folks in positions of power are out there with the same shortcoming.

My personal issues with Rust are its aggressively homogeneous community of "rustaceans" who think that their language is objectively superior to all other languages in every way and its contributions towards the continued normalization of the language-as-a-package-manager trend. Despite those attributes, it's a beautifully-designed language, the documentation doesn't require Internet access, and Cargo has flags to suppress its desire to infect my machine with automatically-sourced third-party dependencies.

Opening up the WinAmp source to all goes badly as owners delete entire repo

As a git user, it seems like you're getting pissed off at git behaving like a modern text editor and adapting to differences in line ending schemes in a way you don't like. mercurial's lack of faffing about with line endings sounds like a miserable hellhole where I'd have to constantly be auditing my codebase to ensure that nobody's accidentally committed a change that updates every line in a file to use a different EOL scheme. I'd much rather annotate my repository to point out binary files than have to live with that stress.

During the dark ages, typewriter carriages and platens hadn't been invented yet. Text editors in those days were probably more like an image editor, where the text wasn't actually a binary code meant to be interpreted and displayed as letters on a screen, but a visual representation of those letters instead, already displayed on a medium like parchment or a piece of rock.

Torvalds weighs in on 'nasty' Rust vs C for Linux debate

Re: Arch vs Code

You can't have your cake and eat it too. Making a C compiler produce memory safe code would require changing the language because C encompasses both bad C and good C. If the compiler refuses to compile bad-but-valid C, you've not made a C compiler.

Virtualization wouldn't prevent use-after-free errors or invalid casts. It would also cripple C with a massive bloated runtime when Rust doesn't need virtualized memory management in order to have more memory safety than C would have in this scenario.

I'm convinced that there's no such thing as a Rust programmer who isn't focused on memory management to the same degree as a good C programmer. Rust isn't memory-safe because it provides some magical sauce that could be yanked out and applied to C, it's safe because the language was designed to allow the compiler to smack you on the head and tell you that you've done something stupid and that you need to do a less-shitty job if you actually want it to output a working program. When passing a value into a function without passing it as a reference, that value is consumed by the function and can no longer be used in the caller. Only a single mutable reference to a value can exist at any one time. When working with functions that output Options, you can't get the successful result unless you provide error code for handling an unsuccessful result. You have to annotate lifetimes if the compiler isn't able to implicitly calculate them. Bad Rust programmers have to deal with these constraints just as much as any other Rust programmers, and you can't get rid of them by declaring the code unsafe.

I dunno, maybe you could argue that Rust programmers have a weakness in trusting their compiler to prevent bugs in one error class, blinding them to the existence to the sorts that crop up in business logic.

Re: Arch vs Code

Oh, for sure! C, when done carefully, can be just as safe as Rust. I use a resource management and string handling library that I've developed and tested for ten years. My biggest concern with memory has been resource leaks coming from circular dependency graphs. I refuse to turn it into a mark-and-sweep garbage collector because that'd basically be admitting that I'm too dumb to design relationship structures that are both suited for purpose and acyclical.

I was largely just trying to point out that there isn't a way to guarantee memory safety in unmodified C when arbitrary pointer dereferences are possible. It might be possible to strip C down and rebuild it as a memory safe language by design, but that wouldn't be the legendarily backwards-compatible C that we all know and love. Plus, it probably wouldn't have any of the other neat features that Rust has that have nothing to do with its safety (closures, traits (far better than class-based inheritance IMO), variably-named namespaces, the whole match syntax thing, variable shadowing).

Eh, maybe if it could do shared libraries I'd be down for it. That's the only thing keeping me from using Rust in my day-to-day work. Well, that and I'm not particularly keen on programming languages that try to be package managers. (Let Gentoo do its thing, Rust.)

Re: Arch vs Code

Rust doesn't require a framework or runtime in order to guarantee memory safety. In the context of the Linux kernel, I don't think the Rust runtime is even in use.

I'd really love it if you could explain how to guarantee memory safety in a perfectly valid C program which dereferences a pointer received from stdin. I'd love it even more if you could provide a program written in Rust that possesses the same functionality and actually compiles. It's quite a challenge, and maybe you'd learn something in the process!

I live in C and have issues with the Rust/Cargo ecosystem (and I don't want to join their cult), but the language design and safety guarantees won by allowing the compiler to reject badly-written code are not among them.

Of course the Internet Archive’s digital lending broke the law, appeals court says

In the Controlled Digital Lending scheme, a digital copy is produced from a physical one without authorization of the rightsholder, and then that digital copy is treated as a stand-in for the original for lending purposes. Hachette et al. aim to quash the theory that digitization is a right held by owners of physical copies of books.

I suspect that Hachette et al. would also aim to quash the theory that owners of physical copies of books have the right to read them if they somehow manage to arbitrarily encode a copy of the information into the meat of their brains.

You wouldn't steal a car.

You wouldn't steal a handbag.

You wouldn't steal a comfy chair.

You wouldn't steal a book.

Remembering copyrighted works is stealing.

Stealing is against the law.

Reading. It's a crime.

Core Python developer suspended for three months

Re: Bad journalism

Aw, shoot. Beat me to it!

El Reg's only addition to that particular point is the link to the 'genuinely funny' quote (hopefully the same one being referred to by the allegation).

I'm hopeful that it was merely an instance of incompetence rather than malice, but don't suspect that it would have changed anything if the allegation had been removed entirely. The remainder of the list would still have more elements in it than one.

If you're using Polyfill.io code on your site – like 100,000+ are – remove it immediately

Re: Integrity

I self-host everything, but I don't get visitors to my sites who aren't in my immediate geographical area.

CDNs are usually used to reduce load times by efficiently distributing resources from servers hosted more locally to visitors, and provide the benefit of allowing cached copies of those resources to be stored on the client device if multiple websites use the same URLs to access them.

While I agree with your philosophy, I disagree with your assessment of the tangible benefits of CDNs.

Re: Integrity

Oh, that's cool!

I think it's a rubbish design from an auditability perspective, but it's definitely a neat idea.

I'd point out that a CDN could also legitimately patch the script with a version which isn't API-compatible and my site would also instantly break without notification. (Or it would become buggy for no discernible reason.)

The literature around SRI, such as Frederik Braun's (a co-editor of the draft) "A CDN that can not XSS you: Using Subresource Integrity" strongly suggests that untrustworthy CDNs are the target of the technology rather than untrustworthy web hosting companies. I don't disagree that it could be useful in ensuring that one's own code hasn't been altered. I find it strange to think that a hosting company wouldn't have access to both the document and its first-party resources, but I'm practically a lay-person when it comes to paying others to host content.

I'd personally rather face a broken website than allow one to be taken over by a supply chain attack, and that applies doubly when I'm the user of a site rather than someone involved in running it. I would consider it unconscionable for a bank's website to be using a third-party CDN for script dependencies without using this technology, for instance.

Integrity

Firefox 43 and Chrome 45 started supporting this thing called Subresource Integrity back in 2015 (Edge and Safari joined the party in 2018). Basically, use a specially-formatted hash in the 'integrity' attribute of the 'script' HTML tag. It allows scripts coming from third-party CDNs to be ignored if they're modified.

While I've just learned about it today myself, I can only hope that folks who do this for a living have a bit more of an ear to the ground for such revolutionary advances in security technologies as these.

Endless OS 6: How desktop Linux may look, one day

Re: Wayland?

You were lucky to have Linux From Scratch! We 'ad to wake up at two in the morning, find all the dependencies ourselves, assemble and link everything by 'and, power the computer all day by running in a tiny 'amster wheel, and our tea was superheated steam being sprayed at us if the machine crashed.

Gentoo and NetBSD ban 'AI' code, but Debian doesn't – yet

In Gentoo's case, the policy only applies to content contributed to projects of the Gentoo Foundation. Contributions made to non-Gentoo projects (even projects that can be installed on a Gentoo system through Portage) aren't beholden to this requirement.

Gentoo Linux tells AI-generated code contributions to fork off

While I don't believe it's been done for anything more than convenience, Gentoo recently began offering prebuilt binaries for quite a few amd64 and arm64 packages!

https://www.theregister.com/2024/01/03/gentoo_starts_offering_binaries/

https://www.gentoo.org/news/2023/12/29/Gentoo-binary.html

Open sourcerers say suspected xz-style attacks continue to target maintainers

Re: Dependency

It would be trivial for larger open-source organizations to create stable downstream versions of these codebases. I'm pretty sure quite a few large open-source-using companies (Google, Facebook, Microsoft) maintain internal forks of open-source software that they rely on. Upstream can continue putting out new and exciting changes, and a stable version which only receives reviewed updates can be maintained by someone with a bit more heft.

You could even package those stable versions together and make it easy for users to install through some kind of software installing application. Since they're stable versions, you could even precompile the code and skip both the impact of downloading the source and compiling it! Like, hear me out here: you could run a command like... app-get xz-utils, and it would just install a reviewed copy of xz. You could manage your entire environment with a tool like that!

In order for this all to work, however, the open-source organizations would need to actually review changes rather than simply precompiling and distributing them as they come in. Maybe we should grant the management of all open-source software to Microsoft instead. They're super-interested in open-source and even own GitHub!

Microsoft hits $3 trillion as investors drink AI Kool-Aid

Re: Possibility

"Less regulation," cries the person who wants to hamper open source development by heaping regulations onto it. "Punitive taxes," cries the person who wants small businesses to pay a licensing fee to open source projects that are primarily written by big corporations.

What a troll.

Firefox 122 gets even more competitive with Chrome on translation

Re: Since the translation DB can't be held locally ...

As the article that Liam linked to only mentioned that the translations are performed locally, here's a bit more context:

The translation functionality that is now being rolled into Firefox is based on Project Bergamot (https://browser.mt), the product of an EU-funded consortium of universities and (since 2019) Mozilla. Using it requires you to download a translation model onto your device, but being able to perform device-side translation means that the contents of the translation are not shared with an online service.

Bergamot has been around in the form of browser extensions for a while: the Bergamot extension itself (https://addons.mozilla.org/en-US/firefox/addon/translatelocally-for-firefox/), followed by Mozilla's 'Firefox Translations' add-on (https://addons.mozilla.org/en-US/firefox/addon/firefox-translations/).

So, in summary: it works by downloading a machine learning model onto your device and feeding the contents of the page into that model locally. If it's using the same codebase as Mozilla's add-on, it'll be using the SSE4.1 CPU instructions to do it.

Burnout epidemic proves there's too much Rust on the gears of open source

Re: "Burnout"

1.) Burnout also applies to paid development work: for me, it usually starts when I'm introduced to a Project Mangler. (How long will it take to implement this feature? Depends on how poorly-designed the data structure is when the seven other teams you're managing are done messing it up. It'll probably take about two hours to program and several weeks of trying to figure out good ways to tie loosely-related records together because you won't let the competent people sit together and discuss requirements and plans.)

2.) The open-source ecosystem benefits from corporate contributions in the exact same way that the free-software ecosystem does not. The GPL family of licenses hack copyright in a way that is often unacceptable to corporate greed. (Red Hat's core clientele are businesses, and, while I am disheartened by their strategy of penalizing customers who exercise their GPL-provided rights, I feel that their actions are (legally) justified as long as Red Hat fulfills their obligations.)

3.) What good could any government do? I'm seriously looking for answers, because the extremes of what government intervention can do are pretty bleak: prevent companies from contributing to free/open source software, prevent them from using it (won't somebody please think of the servers?!), require software developers to obtain a government license to practice their craft, levy hefty fines against free/open-source developers for contributing insecure code to organizations who don't audit what they consume...

4.) Imagine if a guy called Greg created a foundation which aimed to make retail workers' lives easier by rewarding patrons for keeping stores tidy. It's an incredibly bad analogy for the topic being discussed, but it sure would be funny if Greg actually managed to pull it off.

What's really going on with Chrome's June crackdown on extensions – and why your ad blocker may or may not work

Re: This, coupled with YouTube's recent blitz

Firefox supports profiles, but they're admittedly not as easy to access as Chrome's are.

The way I've always done it is to add -P (or -ProfileManager) to the launch options to get access to the selection interface, and you can add --no-remote to allow multiple instances of Firefox to run simultaneously (at least on the Linux build).

I have just learned that there is also the about:profiles page, which allows access to the same functionality from within the running browser. Cool!

Utah outlaws kids' social media addiction, sets digital curfew

Re: While I do not agree with 99% of...

Spectacular idea! Here's a bookmarklet that I just threw together for myself to do the job. It adds an additional button to the left of the Reply button which hides the thread, and works on Firefox at least.

javascript:(function(){var a=[i=>document.createElement(i),'parentNode','setAttribute','appendChild','getElementsByClassName','addEventListener'];var h=function(t){var x=a[0]('li');var y=a[0]('div');var z=a[0]('a');z[a[2]]('href','javascript://unhide_post');z.innerHTML='unhide';y[a[3]](z);x[a[3]](y);z[a[5]]('click',function(){x[a[1]].removeChild(x);t[a[1]].style.display='';return false;});t[a[1]][a[1]].insertBefore(x,t[a[1]]);t[a[1]].style.display='none';};for(var i of document[a[4]]('post edited')){var r=i[a[4]]('reply_link')[0];var n=a[0]('a');n.innerHTML='Hide Thread';n[a[2]]('class','reg_btn reply_link');n[a[2]]('href','javascript://hide thread');n[a[5]]('click',(function(i){return function(){h(i);};})(i));n.style.marginRight='5px';r[a[1]].insertBefore(n,r);}})()