Posts by that one in the corner

After clash over Rust in Linux, now Asahi lead quits distro, slams Linus' kernel leadership

Well, use of "£inux" isn't helping. What is that supposed to be? Some weird reference to the old use of Micro$oft, indicating how expensive it is to buy a Linux licence?

Plus the weird idea that the GNU project would need or want to take over another kernel, let alone changing the licence from MIT to do so. As with Linux, if you want to use the GNU tools to flesh out a complete system around your kernel, just do it. GNU itself need not take over your kernel.

And the final nail, the weird idea that Linux was ever intended, by anyone, to be a stopgap until HURD was production ready, presumably with the idea that, at that point, Linux would just - stop.

> £inux as a kernel was of course only intended in the 1990s as a stopgap with the HURD being the ultimate aim.

Citation?

Linux and HURD are from entirely different people.

I don't recall Linus ever saying he intended to create a stopgap until the HURD was ready - in fact, his announcement was that Linux "is just a hobby" and "won't be big and professional like Gnu". It was just a response to the licensing around Minix.

Feds want devs to stop coding 'unforgivable' buffer overflow vulnerabilities

Re: Offence

Negligence in all of those areas is covered by regulations, guidelines and contracts that are applicable to the field and end use. That already includes the software components: if you are writing critical systems then you follow, eg, SIL and are held to it.

> So, why not start drafting that offence list?

It makes as much sense to create an offence of allowing a buffer overflow as it does to create an offence of a dry solder joint or an under-torqued bolt: the bolt was in my Meccano Eiffel Tower, the solder was for my light-up-beanie and the software was for my Moog emulator.

If you want to incarcerate the coder who let that overflow slip by then you have to use the same mechanism that would allow you to incarcerate the spanner jockey who failed to tighten the bolt - and so far I've failed to come up with a search result for a law that created the offence of under-torquing.

Re: If C had a string type managed by the compiler...

> a lot of other languages ... there is a more full-featured option as default

Absolutely. And more power to them.

However, the question was about C (and C++), which - we all admit - has only the absolute bare minimum work done by the compiler to deal with the necessary evil of allowing (static) constant strings to be defined in your source code.

> Only some types of programs can use the model you describe

True.

Then again, that is trivially true for every single model you could ever describe. The interesting bit is whether the "some type" is a large number of programs (or even a large subset of programs).

> All the strings going back and forth to that will either be C strings...

When you look at it, all those inter-library strings tend to be passed as a buffer+length pair (preferably also null-terminated, if not hope for a better library) or even buffer+bufsize+strlen. In really well-behaved cases you can get a lock token included as well. Yes, often using a struct to keep that info together, but that doesn't imply that struct actually is "their own internal format", just a simple way to pass the data between libraries. The "pointer to a null terminated buffer" also happens to be a C string, useful for a quick printout.

All of which sounds terribly nasty to deal with, but: you get exactly the same effect with other forms of data, once you get beyond simple numerics; anything that can be a non-trivial size. Strings are not unique in that respect[1]. So image handling libraries all have their own formats (some choose to be compatible with a.n.other popular library, which is fine - until that library changes it's format or just gets overshadowed by the next big thing). Again, when you need to pass images from one library to another, you tend to end up being handed a buffer plus some metadata and you do the impedance matching as necessary.

[1] although you can argue that more people use strings than any other type, but I'd suggest looking at how many actually manipulate strings[2] versus just spitting out fixed text: hello_world.c doesn't do any string processing, the M4 macro processor does.

[2] I'd also look at how many (try to) write code to manipulate strings when they really don't need to. A lot of code will (sensibly) pass image handling over to a subprocess using, say, ImageMagick via it's executable, rather than linking it in as a library. Ditto ffmpeg or cURL. If you are really doing a lot of work to manipulate strings and your main program is in C, you can do a lot worse than invoking a specialised string footling program rather than a library.

Re: As much as one would wish to disagree

> Arrays not being a first class type in C was always a flaw and not being able to determine a vector's capacity at runtime probably a cause for more forgivable overflows.

As much as I enjoy(ed) using C, I have to agree - you can (should - MUST) use libraries to manage such structures safely. Because the language (for perfectly sensible reasons, at the time it was created) uses array-notation[1] as a shortcut.

It is a "flaw" when you get into the modern situation where we *do* have the CPU/memory resources (compile- and run- time) to make using a pro-actively safer language feasible - and once feasible, preferable.

It is just a damn shame that we are all caught in the trap that creating (and getting into wide use) new languages is such a costly exercise. Which leads directly into bad side-effects such as making the jump from one language to the next too large to allow for simple changeover - and the emotional outbursts that inevitably come from that, which then creates polarisations etc etc.

Personally, I would be quite happy to have a new language[3] that is almost-C (or almost-C++) but which simply disallowed the array-notation syntactic sugar, then provided a meta-syntax to define safe usage for that syntax (i.e. called into appropriate routines for the type it was applied to). With a supplied set of basic implementations for char, int etc. If I pull out my old text books (I see Dragons!) I'm confident I could mangle, say, TCC to make the change, but that isn't likely to gain any traction outside of my LAN (for good reasons!)!

[1] perhaps it would help if everyone understood, deep in their bones, that C was never *created* with arrays, just syntactic sugar[2] to pretty up code that derefs - something that used to be demonstrable by using foo[bar] as a synonym for bar[foo] - but then the whole problem of buffer overflows everywhere comes from the fact that we want code to be written by people who don't have the right sort of bones.

[2] ditto for-loops, of course, another area - which also "helps" with causing buffer issues - where errors occur and people get into a huff about what you can, or can not, put into the sugar wrapping.

[3] no, it would NOT "still be C", it would be a different language, different filename extension etc etc

Re: Offence

> using singed where unsinged should be used

Always use a poaching pan, that way you can cook your numbers without any risk of singing.

Re: If C had a string type managed by the compiler...

C libraries, lots of libraries, which are integral to *using* the language (not part of the language proper, although you can *generally*, not always, get an initial set of "get you started with 'Hello World'" standardised libraries with the compiler).

One subset of those My First C Libraries are a few routines that let you do basic manipulation on strings represented in the way that the compiler presents constant strings that you put into the source code. After all, the compiler needs *some* way of presenting those to you and there is no point in doing anything complicated. Because...

Anyone who wants to do anything more exciting with strings in a C program can simply use a library that provides a representation that best fits their needs.

I am quite fond of using structs for the (buffer, buffer len, how full now) representation. But also like a one-codepoint-per-cons-cell approach when digging in and doing macro expansions: less space efficient but constant-time insertions and deletions.

The same goes for C++ by the way: the compiler uses the simplest possible form for constants, you get to choose which library to use for your code (many people use the STL).

Any language that promotes use of libraries can do the same, although more recent languages do promote a more complicated compiler/interpreter representation for constants - even though there is nor, and can never be, One True Representation Of Strings that is Optimal In All Circumstances. The same goes for numbers as well, of course.

Undergrad and colleagues accidentally shred 40-year hash table gospel

Re: Reminds me of how best to fill a cabin

My supplier is promising that "Desiccated Dragon Doses" will *finally* be available in the Spring[1] - he has found a new hiding place that the Sunshine Sanctuary don't know about.

[1] the problem has been making springs that are strong enough to hold the dragon when it gets thirsty.

SpaceX Crew Dragons swapped so ISS crew can go home early

Re: Bloody typical.

You should be asking that over on Threads.

DARPA skips the lab, will head to orbit to test space manufacturing tech

How large it could go without space becoming an issue

Ignite one end? Which makes it sound as though they are using oxygen from the atmosphere inside the airlock (although the illustration seems to show it sitting exposed to vacuum, so - probably not).

Otherwise, if the all the reactants needed are contained within the materials of the unignited tube, one could imagine unrolling/extruding the flat tube outside the ISS (by robot, of course), in which case space would not be an issue. Although there may be issues where Space is a problem (e.g. outgassing from the reaction - aka a rocket engine).

Maybe this will lead to a proper SF space manufactory, where the tubes are extruded from a reactor, cut to length, pointed in the right direction and the blue touch paper lit. By the time it has powered itself to the required point in the building site (to be snagged by the Caltech Arm's descendant), it will be fully cooked and ready for use.

Trump’s cyber chief pick has little experience in The Cyber

Specializes in political and regulatory litigation

So he will be able to say how far things can be taken whilst still *just* remaining winnable in court against accusations of opening the barn doors wide.

Oxford researchers pull off quantum first with distributed gate teleportation

Grover's Algorithm

Come for the entanglement, stay for the Sesame Street jokes.

(Sorry, that was the closest I came to understanding the details in this story)

Ignorance really is bliss when you’re drowning in information

Re: How to beat FOMO

Now, I know this causes other issues - we have to get the young 'uns running around the playing fields to keep them fit.

So I'd like to introduce my new line of Rugger clothes: tartan slippers with cleats and a nice comfy cardigan with a reinforced seam to survive a *proper* scrum.

How to beat FOMO

Become an old git.

Looking at the TV ads that are trying to engender FOMO, all the people running through streets or piling up in front of a display window: "gawd, that just looks so exhausting".

I must buy a new shiny "device"? But I barely managed to convince this one to accept the certificates for my NextCloud. Not going through all that again!

And so on. Pah.

Re: Big problem requiring serveral partial solutions

> I think one piece of the solution is to teach lying, deception and fraud in schools.

I've been taking the (wildly optimistic?) view that the OP meant to say teaching how to SPOT and unravel lies, deception and fraud. And call out the perpetrators.

Rather than how to better commit those acts themselves.[1]

[1] Ok, there is the argument that teaching how to spot the holes in frauds etc makes it easier for them to spot the holes they leave and fix them. OTOH if they see just how much real, hard, work it is to make a fraud compete against reality then fingers crossed they'll take the lazy route and stick to honesty ("oh what a tangled web we weave...")

Thumbs Up for the printed word.

Although my tastes no longer match my physical abilities and holding the hardback can be a strain (damn you, Peter F. Hamilton!). Which is frustrating, as a book is so much more pleasurable to use than an e-reader, let alone using a big glowing tablet when the colour images are important.

Hang on, got to change my specs to just check - yeah, I see you now, off my lawn!

Microsoft wants to quit building Army VR goggles, hand contract to Anduril

Luckey Payer One

Luckey's NerveThingie wearer-killing-headset just needs to be used the right way to make it battlefield ready: give it lots of RGB LEDs and a transparent casing to show off its liquid cooling loop with the fluorescent ink in the water and UV lighting. Then leave it lying around no-man's land in ROG packaging, like it just slipped off the back of a lorry.

The only war-fighters able to cope with the all the AR gear they'll be using by then will be hard-core Gamers, who won't be able to resist picking up the flashy and use it instead of their everyone-looks-the-same Army-issue goggles at the next LAN Party (aka Brigade briefing). Finally, tweak the trigger from too much red to too many PowerPoint slides and Johnny Foreigner is AFK forever.

Still more humane than being told to spend all day getting nauseous from using Microsoft products - you can't treat the military as if they are IT boys, that has to against the Geneva Convention.

Google confirms Gulf of Mexico renamed to appease Trump – but only in the US

Re: Gulf of Cuba

'the The' and 'swinning pool'? In a single sentence?!

At least if I'd had it as 'swining' pool I could claim to be remembering the Bay of Pigs incident.

Gulf of Cuba

or the The Hotel Nacional's swinning pool.

Meta's plan to erase 5% of workforce starts today

Re: "Meta confirmed it was expunging fact checking in the USA"

Definite upvote for including El Reg forums as social media.

NASA’s radiation tolerant computer lives up to its name after surviving Van Allen belts

Re: Lighter than air computer?

You just have to look at the reflection of the bloke's head in the shiny film behind the box and ask yourself: is that someone looking down or craning their neck to look up?

Answers on a postcard to the usual address.

Only 4 percent of jobs rely heavily on AI, with peak use in mid-wage roles

Speech recognition is most definitely something that was classified as an AI topic and worked on by AI researchers.

But, now that it is a (sort of) working system, it is no longer "AI". 'Twas ever thus.

Re: What a surprise

> if they bothered to open the company website and locating the "Questions" sub-page

Or if the companies would put useful information front and centre on their home pages, instead of glossy photos and mindless videos.

LLMs: making it easier to justify aggravating web design.

(I may, possibly, be frustrated after yet another week spent trying to dig for actual specs to get my random assortment of boxes to talk to each other but being continually told Acme Inc has The Solution For You - fine for you, but what about me? Mutter, swear)

The biggest microcode attack in our history is underway

Every x86 ADD opcode - every x86 opcode, fullstop - is implemented as microcode.

That is the the whole point of microcode.

Aside from anything else, the microcode is what allows all the different addressing modes to be wrapped around ADD - and to allow those modes to be parallelised, loading both operands into the ALU asap[1].

Sending every ADD to microcode really improves efficiency.

[1] Not to mention all the weird-ass register scheduling that allows opcodevre-ordering or even hyperthreading to occur (these two sequential ADDs don't have any common sources or destination and we have two ALUs available right now, let 'em both run in parallel - or nope, that first ADD has to wait on BL to be available, but the one after it can start now).

Judge says US Treasury ‘more vulnerable to hacking’ since Trump let the DOGE out

Re: What constitution

> if for example the actual president stepped down.

Mind yer step, luv, we just polished those stairs, that nice Mr Musk gave us a big bucket of wax.

Re: Comment fields must always be used

All of which is trivial compared to the other things he is doing, but shows that even the smallest demands are ill-considered.

Comment fields must always be used

Hmm.

Financial transactions - those will be the ones with identifiers that link back to the relevant department, contract number, recipient ame/title/shoe size etc. To let you dig up all the *standard* information when you want to audit it. The sort of database stuffed full of boring repetitive transactions that just went through without any drama.

But every now and again, Something Happened that isn't completely covered by the usual tick boxes ("The dog chewed up his paycheck, issued duplicate"). So you can add a comment to explain what is going on.

And one of your department's self-assessment runs is "count how many times we had to use the comment field" - because too much use of that indicates that the other fields are not adequate at capturing Real Life, so you ought to look into tweaking something.

So, Musky has just spotted something he can claim is some kind of inefficiency/corruption ("See, they are deliberately leaving this blank! What are they not recording? What are they hiding?") and then initiate "an improvement" that'll just mean wasted time typing "Same as last month" on every janitorial paycheck, makes self-assessments less useful/efficient...

But it means he can squeeze out another self-congratulatory Xit, which is the important thing.

Does this thing run on a 220 V power supply? Oh. That puff of smoke suggests not

Re: "built to survive minor accidents"

> Who let the magic smoke out

Oh, I thought it was the Sisterhood of Karn who did that.

Tesla sales crash in Europe, UK. We can only wonder why

Re: Its a mystery

Oh grief, those Range Rovers, not a drop of mud in sight (although that does work to keep them out of our village, that'd be far too close to, you know, actual farms and countryside).

And talking of "close", don't they realise that if they don't back off from our rear window, we can't see and marvel at their vanity number plates?

The greatest set of YouTube comments - in the wuuurld.

Eggheads crack the code for the perfect soft boil

> put in a hole in the ground for several month covered by earth... and then served once unearthed

Thank you for the image of a pescatarian squirrel.

Re: Before boiling

Just needs a cool box, not all the way down to 4 degrees in the fridge.

When the English Summer sticks its head out, we put the eggs into the cool, windowless, store room. Yes, for both days.

We tried one of those - but quit because it smelt revolting when it got hot! Sulphurous - which is really not a good smell when anywhere near an egg.

Re: "a total duration of 32 minutes"

Visions of the Caracticus (sp?) Potts Breakfast Machine from Chitty Chitty Bang Bang.

Re: "a total duration of 32 minutes"

It was a bit of a change, tempering Bob Monkhouse on Golden Shot and then watching The Mr Hell Show.

Golden Baby....

I was told to make backups, not test them. Why does that make you look so worried?

A rod for my own backup

At New Year, I had a think about the pain of restoring our systems at home: a random collection of servers that do whatever we find useful/interesting around the house (from NextCloud to 'Pi BirdNet).

The data and archives are on a NAS, which syncs to a duplicate box for a basic backup. So reasonably happy with that. But restoring an individual one of the machines is a PITA.

Ah Ha! Move them all into VMs, with a common hypervisor (dead easy to install, not "restore", as needed) and then just use the admin tools for the VMs. Oh, and see if the R'Pi's SD card can be replaced by network boot. Don't want to worry about high-availability and live VMs moved from host to host (just a simple home setup - and the random weird peripherals don't auto-unplug themselves, so not worth the bother).

Second week of Feb: oh, if only I was running a Data Centre, or at least a "Home Lab" that I pretended was a DC! All the hypervisors (Proxmox, xcp-ng are the bestest candidates so far, 'nuff said) are geared up to single-click manage all the Big Boy Heavy Lifting, but I don't *want* to merge everything into one pool! The boxes are all "whatever I got my hands on that year", no two the same...

I *have* made progress: I have now added two new-to-me PCs to the pile, so that I can trash those learning how (please be "how") this can work!

But when it *is* working, I *will* be able to easily make backups of the VMs, can easily check they'll restore and run.

Won't I? Please.

Re: Here are the copies

But the operator had to wait until purchasing could get him enough Tipex to completely white out the disc before installing the update.

Oracle starts laying mines in JavaScript trademark battle

Re: A rose by any other name. . .

> Isn't that the point? If the only thing binding J*v*Scr*pt to *r*cl* are the first four characters, then make the change.

I'm with you there (see a.n.other comment above or below this, depending on your sort order).

But even if we convert all of El Reg to a more sensible name, we are but a few souls, brave and true, wading out onto the sands, swords held high or clattered against our yellow-hued shields, as we chase back the waters that recede before us. But they return with the moonlight, covering the beach with detritus dropped by the hordes of The Great Unwashed, who have heard The Full Name of The Beast and chant it endlessly (even if only to curse it for miring their surfing in the mud).

Ah, forgive the despairing words of a tired old warrior - I was sore wounded in the C-Hash skirmishes. Come, we shall raise again the Red Banner Of Five and drape it over our pages to hide what in truth lies there.

Re: A rose by any other name. . .

I think that this AC may have escaped the advertising blitz that a certain company (famous for their pizza boxes) could push out at the time and has mistaken shell-shock for being a fanboy.

As I was trying to indicate, it could get a little - intense - as they tried to make sure you remembered their name (Helios, was it?).

Once you get on a mailing list...

Re: Rename ja ascript

> ECMAScript—who came up with that name?

Everybody in the standardisation group that wrote the relevant draft for ECMA, when Daddy Netscape and Mummy Microsoft wouldn't stop squabbling. It was the worst choice and therefore equally repugnant to everyone, with no favouritism.

> It wouldn't take long for us as developers to get used to calling it something new

Well, everybody has been making the same complaints about the name for some three decades and haven't managed ant better yet.

But, please do give your best shot and we'll see if we can make it stick (maybe just on El Reg for a start - so something appealling to commentards - but then we can annex Stack overflow and after that, THE WORLD![1]

[1] sorry, sorry, just caught a touch of the old Oracles there

Re: A rose by any other name. . .

PS I may have been spending too much time at that point talking to Sun and their sales people; by the way, have you heard of Sun? They have this great thing called Display Postscript and a little language called Java {eyes glaze over, exits mumbling "runs everywhere, tee hee, runs everywhere"}

Blue Origin spins up lunar gravity for New Shepard flight

Re: flight time

> sustaining the gees comes for free once you have spun up

Just so long as nothing runs around the spin equator for too long or too fast.

If you want to test a Lunar Rover's traction (not necessarily adult-human-sized Rover, might get crowded) then you need to make sure it reverses direction regularly (or you run two, one spinwards, one anti-spin).

Although, at 11 RPM, your Rover's are going to have to go slow to avoid affecting their effective weight too much.

Openreach tests 50 Gbps broadband – don’t expect it anytime soon

Apparently, I could get a "good deal" if I sign TODAY for a fibre download speed that exceeds the speed of my LAN.

At some point in the distant future

From Open reach?

Remind me, when is the Sun scheduled to be a Red Giant?

Why UK Online Safety Act may not be safe for bloggers

VPN to connect the family "intranet"[1]

Cursory reading followed by a run through the online checklist, really hoping I missed a paragraph...

But what constitutes an "online" service or website? Is it explicitly defined somewhere as something on an IP address that is exposed to the Internet and can be accessed (at least to a login page) by anyone with a just web browser?

What if the service is only accessible via a VPN - and that has been set up already such that the various households see no functional difference between it and, say, The Register? That is, they just put in the URL and off they go, as it ought to work. Second cousin Timmy (who I don't actually know other from his posts) is letting his school chum Doug post from Timmy's room as Doug has the photos of their garage band[2]

Note that there are exclusions if the site is only providing access to your businesses Intranet-type stuff (CRM etc) but there is nothing about if you are not a business! And that still leaves a Doug as a problem.

[1] sorry for using that word

[2] trying to come up with a reasonable scenario that includes a wider group of people

Specifically says that user-generated content is not provider content

> "posting comments or reviews relating to provider content" (eg, comments about bikes posted to a bike blog)

So if a comment section veers off-topic from its TFA, in particular starts discussing other comments, it stops being related to provider content and then *does* become the responsibility of the website?

This gets a bit silly and meta, but especially if comments are plucked from the web page and presented out of context...

Google: How to make any AMD Zen CPU always generate 4 as a random number

Re: Sid6581 LFSR

> My trusty old Sid “noise generator” works via “linear feedback shift register,”

A LFSR generates randomoid numbers - they look (and sound) random (to our senses) but they really aren't.

Re: This is possibly what you were alluding to, but to elaborate...

> User microcodeable processors would be interesting to experiment with ...

Have a look at the Xerox Alto emulator (another article). You, the end-user, were expected to be loading up programs and/or OSes that each had their own microcode and you can debug microcode in the emulator.

Re: if trust is a true issue

Well said.

We tried to come up with pragmatic responses to that article; the best we had (which you can still argue over 'til the cows come home) was you would try to ensure that you weren't trapped within that closed set of pre-built tools that were looking for their own source code to poison. Which only works if you have a multiplicity of compilers/assemblers/linkers - i.e. the entire toolchain - and use these to build each other. Which may mean going back to the original way the first compilers come about, hand-building the first one and bootstrapping up. Or being convinced that it is not feasible for all of your toolchains to be able to recognise and poison every other toolchain from its sources.

This takes up a lot of time and energy. Especially if you are going to start worrying about, say, poisoned AMD microcode; it was easier back in the 1980s: if you had modifiable microcode it wasn't all cryptographically signed and you had a chance to play the same game.

Which, of course, then drops you straight into the hoary old question of how much work you feel is necessary to adequately protect yourself.

Which is bottom-line the question that every paper about security and trust poses.