Posts by DrXym

Snap out of it: Canonical on Flatpak friction, Core Desktop, and the future of Ubuntu

My opinion of snap

I'm 100% in favour of sandbox style packaging the application level. It's very convenient to have an app just install and work regardless of the distribution.

But at a lower level this stuff can be a source of grief because its security sandboxed and if the policies get screwed up or don't behave the way the native executable does it can fail in surprising ways. I've suffered errors that only happen in snap but not the same executable run directly so I prefer the latter. I really don't like the zeal Ubuntu is trying to do this. I'm sure they'll say they're trying to modularise their distribution, make it all componentized but it comes at a cost.

I also don't buy arguments they had to use snap because flatpak supports multiple websites - that is a feature not a bug. There would be nothing to stop Ubuntu using flatpak and pointing at their own site and their own signed flatpaks if they were so worried about that.

So application level good, below application level, not so much.

Samsung picks fights with Google and Qualcomm

No thanks

Samsung loves to fill its devices with bloatware & adware that it developed in-house or was paid to install and which the user has no way to actually remove, only "disable". Some of it is positively anticonsumer like using dark patterns during phone setup to consent to install "AppCloud" which automatically installs junk & ads on their phones. I don't think there is anybody who actually *wants* those things, let alone is hoping for that software to appear on other platforms. It's even worse in the US of course where many Samsung products are basically running spyware - TVs with automatic content recognition, voice recognition etc.

You have one week to opt out or become fodder for LinkedIn AI training

Re: Am I paranoid, or....

I only log in to see which recruiter is wasting inmail points trying to contact me. I just ignore them. Wasting points is one way to devalue the service.

Marks & Spencer swaps out TCS for fresh helpdesk deal

Re: What's the saying, "penny wise and pound foolish"?

I can only speak of when it happened in a US financial services company I worked at and it boiled down to this logic - Americans cost $120 per hour, Europeans cost $90 per hour and Indians cost $40 per hour. Ergo you got 3x the value from outsourcing to India. Except it worked terribly - stuff took 3x as long to happen, required constant handholding from US / Europe, and the work was still shoddy and broken.

They first kicked it off an Indian operation as a subsidiary but when the figures didn't stack up they sold it to an outsourcing operation.

Re: What's the saying, "penny wise and pound foolish"?

I'm convinced companies outsource because they are shown a spreedsheet with 2 columns - the cost for an in-house team vs the cost outsourced to India. The difference is probably 3x difference. What it doesn't account for, is the reputational harm from the shitty service, or the added security risk. Or of using an outsourcer that will never learn the company / country culture, or develop deep knowledge, or improve customer relations, and who hires apathetic staff who don't give a damn and will be gone somewhere else in 6 months.

You get what you pay for

Outsourcing sounds financially attractive but if it ends up being provided by a revolving door of culturally clueless staff from another country who bodge fixes and don't give a damn about the service they provide then you got what you deserved.

Get ready to squint! World's smallest pixel is just 300 nm

Re: Eye of a Needle artwork

Who says it needs to be colour to be a pixel? Pixels - picture element - applies to monochromatic displays too. Some of the video terminals I used in university even had orange / amber displays.

Pro-Russia hacktivist group dies of cringe after falling into researchers' trap

If only people knew...

... how woefully insecure most legacy SCADA / HMI / PLC infrastructure is. We're talking minimal protection - plain text communications, predictable IPs, default / simple passwords, unpatched software etc. A lot of industrial control stuff is very old.

The only reason more of it isn't being hacked is that it *usually* runs on a self-contained network with no connection to the outside world. So theoretically it's safe. That is until some genius decides to connect it to the internet without locking it down. There could be a multitude of reasons to do this - remote monitoring, alarms, analytics etc., but if you let somebody in and they get past the firewall then it's game over.

The US & EU are the industry to be more secure so called "cyber resilience", but it'll take ages for it to become the norm.

Level-10 vuln lurking in Redis source code for 13 years could allow remote code execution

Re: Garbage collection. Again.

Actually the vulnerability is in C, since Lua is implemented in C. Specifically in defrag.c where it attempts some kind of cleanup operation. The Lua script is just the delivery mechanism for the payload that triggers it.

And if your intent was to crap on higher level languages then maybe check what low level language they're implemented in.

Energy drink company punished ERP graybeard for going too fast

Re: Oh really ?

Unfortunately to many companies especially big ones, employees are just replaceable components. HR exists merely to keep the workforce in equilibrium with the number required - happy enough that they don't quit faster than they can be hired.

Amazon grounds drone deliveries in Arizona after two crashed into a crane

Well that's not surprising

These things will be crashing into birds, trees, aircraft (including other drones), pylons, signs, buildings, towers, flying debris, hailstones & snow. They're going to be hit by bullets, nets or anything else humans can grief them with. It is an inevitable consequence of having autonomous drones flying around. Eventually some drones are going to land on somebody and kill them. But hey, Amazon saved a few cents and that's all that matters.

The sensible mitigation is ban them entirely from operating over populated areas entirely or severely limit the reason they are permitted to fly.

Apple's AirPods Pro 3 are still chuck-and-buy-again specials

Re: Not surprising...

No it isn't acceptable. It's dickish and it normalizes dickishness across the entire industry.

Re: Not surprising...

Apple got stung by the popularity of the Apple II and all the clones that popped up so they went out of their way to be proprietary from that point on. And to that they've added walled gardens, DRM, built-in obsolescence and lots and lots of e-waste.

You might expect this in £20 earbuds

But not ones costing 10x as much. Oh wait, it's Apple and they know they can do anything they like because their customers clearly have more money than sense.

Microsoft moves to the uncanny valley with creepy Copilot avatars that stare at you and say your name

I don't know what you're trying to say here. LLMs *are* deterministic - parameters are baked into the model such that for any given input you will get the same outputs. Every single time. The model is set in stone, it's deterministic.

Temperature is a runtime parameter to use randomness in selecting the output based upon a ranking. If its 0 it always picks the top ranked output, if it's more than zero it chooses less likely outputs to vary the response. The model is still deterministic, how it is applied is not. Just read any AI tutorial if this isn't clear.

If temperature is 0, then it picks the highest most likely token as its output. There are other parameters like context size but for the same context you're going to get the same output.

The one that says "I will drink your soul".

Explain digital ID or watch it fizzle out, UK PM Starmer told

No wonder

Ireland called its ID a Public Services Card (PSC) which makes clear what it is for - to present when you apply for benefits and other interactions with the government. It has a narrow purpose not to be carried around with you, not for showing a supermarket or pub that you're over 18, not for police to demand when you are stopped for some reason. It's also a physical card, not an "app", and so there is not a propensity for carrying it.

And that seems to be the purpose for ID in UK mostly - government services. But they called it Digital ID and they framed it as a way to stop illegal workers which is utterly absurd. It's disastrous branding with a paper thin justification by a government who can't do PR if their lives depended on it. I will not be surprised either if the rollout will be catastrophically over budget and botched because they'll choose some bluechip like Oracle to bleed them dry.

LockBit's new variant is 'most dangerous yet,' hitting Windows, Linux and VMware ESXi

It could be worse

Getting hit by ransomware is bad, but installing Trend Micro's antivirus is even worse. Maybe it protects against the ransomware but the cost is your machines will suffer continuously from Trend Micro's software. I've seen that crap peg CPU at 100% and destroy laptop battery life doing god knows what.

UK to roll out mandatory digital ID for right to work by 2029

This is a nonsense

I can see legitimate uses of ID but it has to be legally super narrow and well defined. e.g. to avail of government services - welfare, revenue, driving license etc. That's how Ireland does ID - it's a public services card and nothing else.

I do not see how it would possibly be tolerable to go beyond that. It's political suicide in fact and I do not understand why Starmer or Labour would even go this route or allow the narrative to go nuts. Who are they trying to please? The sort of far right loons protesting immigrants are also the same far right loons protesting mask mandates so they're not going to be happy. And who on the left wants this crap either? It's sheer lunacy. If the intent was to crack down on fraud then do it the Irish way - it's a public services card, nobody outside of government has any legal entitlement to see the card - not the cops, not individuals, not businesses.

The sweetest slice of Pi: Raspberry Pi 500+ sports mechanical keys, 16GB, and built-in SSD

$200 though

Somebody should whip out a dremel and see if they can mod some cheap mechanical keyboard & stick a Pi in it. Probably more in keeping with the ethos of hobbyists than this thing.

Google to merge Android and ChromeOS in 2026, because AI

ChromeOS should never have been a thing

Google would have been better off just making Android "desktop" ready, i.e. providing a desktop style launcher & allowing resizable windows, proper mouse & keyboard support etc.

Brit scientists over the Moon after growing tea in lunar soil

Remember when he challenged Zuckerberg to a boxing match and chickened out when his challenge was accepted? The guy likes to talk like he's a brave tough guy but he's just craven.

Musk has long bigged up how he'll go on a rocket to Mars but I just know he'll find a way to chicken out and let others die in his place.

EV charging biz zaps customers with data leak scare

The EU legislation is basically that new chargers should take a common form of payment like a credit card.

In the ideal world that should mean - plug in, tap a card to start, the card is preauthorized and you get billed for the amount of charge. But unfortunately many of the older chargers and even some new ones have some bullshit reason you need to use an app. e.g. maybe they technically allow payment by credit card, but there is no kiosk and you have to scan some QR code to get to an online payment system to type the card by hand blah blah.

Really the legislation should be kicking providers in the teeth to install a card reader and a touchscreen. It's not rocket science and the alternatives are anti-consumer and anti-adoption.

Pigs will fly: Uber Eats to trial drone delivery

I've said this in the past but I don't think it will take birds like seagulls long to learn if they attack these things, that they crash to the ground and delicious food spills out. And that and other screwups resulting in crashes will inevitably mean property damage and injuries / loss of life.

Drone delivery should be strictly regulated & licensed and should only be permitted for exceptional things with strict regulations about where drones can operate and fly over.

Rust-style safety model for C++ 'rejected' as profiles take priority

Re: Rust is the future

Smart pointers are thread safe in one way but not another. You can copy / increment / release a shared_ptr between threads, but the object it manages doesn't become thread safe by virtue of being managed. So if thread 1 & 2 call a function at the same time it could race and C++ doesn't care if you lock access or not. C++ really needs something equivalent to Rust's Mutex<Arc<Thing>> pattern where you *must* unlock the mutex to obtain access to the shared object.

As for Firefox there were some interesting blogs about the CSS rules engine but basically the argument was the existing engine needed to be rewritten entirely and it was easier and safer to do it in Rust. Most of Mozilla is still C and C++, because there is no reason to reimplement something for the sake of it, but the CSS rules engine was another matter. They were porting the layout engine too when Mozilla underwent changes but it's still being worked on for the Servo browser.

Re: No wonder

C++ has all the issues of C with its own on top. That is the reality.

And what "compiler guarantees" are you even talking about here? Does C++ stop you using a pointer after you've freed it? Does it stop you trying to delete something which you never allocated? Does it stop you walking off the end of the buffer? Does it help if you screw up RAII wrappers by not writing a mess of code to properly implement the rule of 3 or 5?

The answer is it does none of those things. The C++ language is no help at all. Instead, the language ships with template libraries to mitigate against issues but it does not eliminate them entirely and never will. It is very easy to write code which will crash even with the help of a template.

And you say "no one sane" but reality can be seen just by looking at the CVE database. It can be seen by the massive list of restrictions standards like MISRA C++ impose to mitigate against error. It's frankly laughable that people get so defensive that they try and deny reality.

Re: Rust is the future

Exactly. The CVE database is filled with issues directly caused by shortcomings of C and C++. Are we to believe that these are all due to lack of competence, or simply inherent to broken unsafe languages?

Re: Rust is the future

Macros are inherently terrible. It would be better as a inline function template that took a reference to the pointer, but even that is not great. If you wanted to safely free in C++ you're better off to use a smart pointer - either shared or unique. You're not out of the woods if multiple threads are involved because you should guard access to the smart pointer to prevent race conditions, but C++ doesn't care if you do or don't.

Also I programmed it OLE2, COM, and DCOM for 7 years and it was quite common to have some dangling reference to IUnknown. If something released it too soon or didn't release it wasn't always easy to figure out where the problem was. Microsoft made things like CComPtr, _com_ptr_t (like a smart pointer) which helped, but not always.

And all these things require people do the job the compiler is there for. But C++ (and C) does not give a damn if you write code properly. Which is why the CVE database is filled with issues directly attributable to the languages - memory leaks, use after free, double free, races etc. If it wasn't an issue languages like Rust wouldn't exist to prevent it happening.

Re: Rust is the future

32 people and counting in denial about a simple statement of fact.

No wonder

Making C++ (or C) safe by design basically means writing an entire new dialect which doesn't suffer the faults of C++ (and C), namely unchecked references, pointers, free/alloc and all the rest of that stuff. And throwing in something equivalent to Rust's borrow checker so mutable / immutable operations can be tracked. And doing something about move / copy semantics. And doing something with exceptions. And with all the disgusting issues with class constructors / destructors, assignment operators and so on.

I guess C++ committees know even if they managed to nail this problem down the language would be even more baroque and complex than it already is.

Microsoft inches toward Rusty Windows drivers, production use still a no-no

Re: Unsafe

It doesn't "bypass everything". Unsafe Rust is still more safe than C++ where EVERYTHING is unsafe, where the compiler doesn't give a damn if you have dangling references, null pointers or anything else. Rust still enforces those checks. And by requiring the programmer to explicitly go into unsafe blocks it isolates and identifies issues if they do arise. This is abundantly obvious by looking at the Rust drivers in the Linux kernel where the majority of it is still safe and where the unsafe blocks explicitly document why they're unsafe.

I'm also waiting for examples of C++ which are more safe than Rust.

Re: Unsafe

I said almost a superset. I am aware there are slight differences such as reserved keywords and a few other things, but they are generally so esoteric or marginal for all intents and purposes it doesn't matter. C++ has all the problems of C (since it can compile C) with its own on top. And there is nothing you can do more safely in C++ of any version than in Rust. Nothing. If you think there is, provide examples. Chances are your examples will be "somewhat safe", i.e. they will attempt to use C++ templates to avoid traps and pitfalls set by the language itself but no guarantee that your code is actually safe.

And you're clueless about unsafe rust. Why don't you go read up what it means instead of what you think it means. I shall summarise *again* - an unsafe does not disable any compile time checks of Rust so it still does lifetime & borrowing checks but unsafe grants access to memory operations like pointers.

Re: Unsafe

Can be used, usually isn't used, and has all kinds of fun scenarios where it can break because C++ is so complex. Enjoy trying to get your rule of 3 / 5 working properly because the language has no clue how to copy / move data from your RAII wrapper safely otherwise.

Re: Unsafe

C and C++ are not "very different languages". C++ is almost a superset of C. If you are desperate that I make the distinction, then C++ is all the unsafeness of C with its own unsafeness throw on top and a bunch of classes and templates to partially mitigate for problems inherent to the language.

And both are equally as unsafe for the purpose I was highlighting.

I also find it kind of odd you wish to split hairs rather than acknowledge the point I was making which is demonstrably true - that unsafe in Rust is still safer than either C or C++.

Re: Unsafe

"Unsafe" in Rust is somewhat misunderstood. People probably think it's equivalent to C or C++, but an unsafe block still checks lifetime and borrow checking. The unsafe refers to the fact that it grants access to functions that manipulate memory & pointers - things you might use to call C code, or interact with hardware. So it's less safe than default Rust but still much safer than either C or C++ where the compile time checks are minimal.

Also, if you look at Linux kernel drivers written in Rust most of the code doesn't even use unsafe. For example if you look at this Nova driver (a GPU driver) there is a smattering of unsafe blocks but not as many as you might think - https://github.com/torvalds/linux/tree/master/drivers/gpu/nova-core. Indeed, the kernel coding guidelines require any unsafe is explicitly prefixed with a comment "SAFETY:" explaining why it's in an unsafe block which in itself encourages code to only use it out of necessity.

So to summarise. Unsafe is still better than C/C++ and it's only used where it needs to be used which means a lot less scope for bugs to happen.

VMware's in court again. Customer relationships rarely go this wrong

And if Tesco wins

Let's hope they use any money they get to move off VMWare. I don't know what their infrastructure looks like but I bet their usage of VMs is a pyramid of importance with some critical instances at the top and down at the bottom a bunch of throwaway things.

At the very least their IT department should be looking to mitigate the threat of using VMWare and coming up with alternatives starting with the stuff that's easiest to migrate and moving upwards. Even if the case is lost or settled, it doesn't seem smart to be using software from a hostile company any longer or any more than strictly necessary and having a clear exit strategy. Perhaps they could even publish their results for other customers to follow suit just to stick it to Broadcom.

Red Hat back-office team to be Big and Blue whether they like it or not

Re: I remember a time...

At the time I was using OS/2 as my desktop for development and the virtual terminal ran in a window onto what I guess you mention was 3270 above. I didn't care to find out. All I knew was it was awful. 5 years before I had been using pine on VT100 terminals attached to Unix and it was superior to what IBM made their own engineers use. That's even before considering even back in the day Windows users and even X11 users would have pretty decent graphical email software they could use. But not IBM.

Like I said it was just this weird otherworld of proprietary technologies and stacks which were pretty much dead outside of IBM but forced on the people inside. The only IBM software I actually liked using at the time (other than OS/2) was a version control system called CMVC which was really pretty neat and ahead of its time (sort of like a proto JIRA + VCS). But like everything else in IBM it was virtually unused anywhere else. I had the misfortune to use Clearcase outside of IBM later in my career and I wouldn't be surprised if some poor bastards in IBM are still forced to use it. Likewise with Lotus Notes which made my life a misery in a few places.

Re: I remember a time...

I thought the same until I worked there early in my career albeit as a contractor. Worked in IBM Hursley which is an amazing place and programming OS/2 was fun. But dear god the corporate culture was stifling - everything was by committee and mystery requirements with layers of management stretching to infinity. It was like entering a parallel universe where the entire software stack was unnecessarily different from everywhere else because IBM ate its own dog food even if the dog food was mouldy and 10 years out of date. I remember having read email on some dumb terminal where you had to refresh the screen to see if email had arrived because the terminal couldn't refresh on its own.

It's AI all the way down as Google's AI cites web pages written by AI

Re: Always a problem

If it's a legal requirement then all the major AIs *will* comply - Copilot, ChatGPT, Grok, Gemini etc. It can be done in a way where it is not personally identifiable (random ids) but as long as its there then it covers the majority of abuses whether some rogue AIs comply or not. It's in their interests to comply in a way since it allows them to avoid ingesting garbage but it also allows people to block AI by marking their content as if it was AI and it allows people to detect fake images.

Always a problem

AI generated content should really be watermarked. A watermark consisting of ids for the content and ids for the generator and maybe a few other flags and fields.

Even text can be watermarked given an sufficient amount of it. These mechanisms should be mandatory and made public so that anybody given an image, audio, video or text (of sufficient size) can scan for watermarks. It might stop AI from ingesting garbage and it could also be used by people who don't want their own content ingested by AI.

VMware before Broadcom was 'a unicorn in fluffy cloudland'

So basically...

... he's in so deep with VMWare he'll say anything to justify the actions of its new masters

AI web crawlers are destroying websites in their never-ending hunger for any and all content

Poison the content

If your website is being attacked by bots which are ignoring the rules in robots.txt then start feeding them garbage. Feed content which is itself AI generated, possibly containing malicious, actively wrong information. Generate images which are not what they say, generate text which is gobbledegook, fake news, libellous content, fake sports / places / people & facts, medical misinfo. Try and make it something likely to stand out from the homogeneous slop and generates new paths in their models. Just delberate garbage. Either they don't detect the garbage and end up poisoning themselves, or they do and will probably leave you alone. Either way, it's their fault for being dicks.

Older developers are down with the vibe coding vibe

Re: But...isn't it all just bollocks?

It's definitely a double edged sword. I think it's fine for knocking up throwaway code. But if its production code then you really need to examine what it's saying, or only use it to inform the actual code you write. I also find that it completely mangles things on libraries which have lots of breaking changes between releases. e.g. I've used it with Jetty where 8,9,10,11,12 are radically different and the output is often just mashed up garbage levels with some hallucinated dependencies thrown in for good measure.

Older or more experienced?

AI frequently generates code which is superficially correct but often isn't in ways that take experience to spot. It might be inefficient, it might miss edge cases, it might be insecure, it might use deprecated or dangerous methods.

I wouldn't trust ANY programmer who blindly trusts the output at face value. And "vibe" programming is basically sheer incompetence hiding behind a buzzword.

Microsoft can't guarantee data sovereignty – OVHcloud says 'We told you so'

Re: Sounds like

A company might have very good reasons for data never leaving a particular geographic zone - privacy, secrecy, & other legal guarantees. If a cloud provider cannot guarantee that data is siloed and NEVER leaving that silo then that needs to be a very serious cause for concern. It potentially means any guarantees a company makes about GDPR compliance, or anything else, aren't worth the bytes they're encoded with.

So it's a major cause for concern. And the easiest way to ensure data is siloed is indigenous cloud providers who operate and run from Europe and not outside interests.

Sounds like

The EU needs to start handing out fines until these companies CAN guarantee data sovereignty. And in the mean time start getting indigenous cloud providers up and running so the choice isn't between 3 US providers and a smattering of half baked Euro alternatives.

Getting touchy-feely with a Raspberry Pi Touch Display 2

The bezel is too big

Whether "deliberate" or not, the bezel is very bad. Maybe it does help hobbiests but only because its so enormous it might let them hide cables poking out of the RPi its attached to. But if that's the reason, then the bezel could have been a separate plastic piece that the screen clips into. Or the screen dimensions could be larger and the bezel smaller but still providing space for the same.

Everything is 'different on Windows': Zed port delays highlight dev friction

Re: OB Linus

Case insensitive is annoying but tolerable for ASCII. It gets super annoying with languages where upper / lower are totally different or where transliteration is involved. e.g. if you were German you might write schloss, or schloß, or SCHLOẞ, or any other variation and the case insensitive filesystem might cope but it doesn't mean apps on top will. So I agree with Linus that file names should be unambiguous which means case sensitive and unicode. No code pages, no to upper / lower, no file name shortening / mangling.