emidln

We don't know that it's once per device. It's been said by Google that it'll be once per device, but we haven't seen the code and we don't know the method of tracking that. What if I wipe my OS? What if I wipe data in play services? Will a future silent play services update conveniently break my p2p messaging app during a protest?

The quality of GenAI PRs scales with the driver. Many are low-effort, ill-considered, overly verbose and otherwise bad. I've seen decades of similar patches/PRs from humans.

If it "looks like claude" in that it's overly verbose (in code or comments), missing tests, etc then it should be rejected for lack of merits. If the only indication is "this user fixed 10 bugs in an hour" and the PRs are otherwise fine on the merits, rejecting the PRs because an LLM wrote them is the same as rejecting them because you know they're from an emacs user.

If you think you can identify frontier model-generated planned and reviewed c/c++ from human-generated planned and reviewed c/c++, I've got some bad news for you.

The "no slop" policy is the same as it ever was: garbage has to make it through patch code review. If an LLM wrote it rather than a human and it passes patch review, it's fine. Rejecting features or fixes because a probabilistic algorithm said "should look like this" feels a lot like rejecting c/c++ because you read Intel's docs and have a hex editor.

Edit: s/like like/look like/

It's common to write the thrush combinator as a lisp macro. Clojure ships ->, ->>, as->, some->, some->>, cond->, and cond->> out of the box. You can find similar macros for CL[0], Racket[1], and a scheme SRFI[2]. Writing them is a fun exercise in your lisp of choice if you don't have a library available.

[0] https://github.com/dtenny/clj-arrows

[1] https://docs.racket-lang.org/threading/index.html

[2] https://srfi.schemers.org/srfi-197/srfi-197.html

If an airline pilot is so bereft of fortitude that they perceive a political wifi network name as a threat, they should be disallowed command of the aircraft. They need therapy. Mental weakness like this should not be tolerated in those responsible for the safe operation of human lives.

At least on a personal max account, I can't max every window. There is also weekly limit. If I max every window, I run out of tokens halfway through the week.

I probably enjoy ELF hacking more than most, but patching an ELF binary via LD_PRELOAD, linker hacks, or even manual or assisted relinking tricks are just tools in the bag of performant C/C++ (and probably Rust too, but I don't get paid to make that fast). If you care about perf and for whatever reason are using someone else's code, you should be intimately familiar with your linker, binary format, ABI, and OS in addition to your hardware. It's all bytes in the end, and these abstractions are pliable with standard tooling.

I'd usually rather have a nice language-level interface for customizing implementation, but ELF and Linux scripting is typically good enough. Binary patching is in a much easier to use place these days with good free tooling and plenty of (admittedly exploit-oriented) tutorials to extrapolate from as examples.

I wish env -S was more portable. It's a newer feature of the coreutils env implementation and isn't supported elsewhere afaik.

How: You've ran the test on a bunch of hosts and create a spec from ranges.

Why: you might be concerned with network connectivity (you don't get to choose which data center you launch in and it might not be exactly equal), noisy neighbors on shared hosts, etc. if you're measuring for networking, you probably are spinning ups separate accounts/using a bank of accounts and something in every az until you find what you're looking for.

I'm not a CISO just a random dog on the internet, but this open letter seems to assume that privacy is not a part of your security posture and that spear phishing isn't common these days. (Is 'spear phishing' still the term for targeted electronic scams to steal credentials/access?)

I realize not everyone is using a physically stripped burner, a graphene os install, etc and not everyone works at a high value financial, govt, or infra target but for those of us who need to deal with opsec or are commonly targeted by spear phishing this advice seems abysmal.

In the current political climate of the US, if you are living or traveling here and the current party isn't cheering for you personally, you really should be considering both state-sponsored attacks and no longer have the luxury of assuming good faith by the state. Telling people to enable cheap drive by attacks that are in active use by certain government agencies is irresponsible malpractice at best and actively evil at worst.

Source: I've worked at analytics companies that actively deanonymized users using cookies when available. We used wifi and Bluetooth details when available. We built "multi channel marketing" which was just taking any information we could scrape from the user to fingerprint them and cross reference and deanonymize them so we could sell interactions to businesses like geofenced price discrimination, value of users, and could offer cross website information on shopping habits/financial profile. The shit I did 15 years ago didn't go away and no matter how much I wish I didn't write that, it was the tip of the iceberg and relatively benign.

> Forward collision warning has misfired on 2 occasions on me in the last 3 years

My Lexus is afraid of a bush behind my garage in the alley. It's on a neighbors property and not really overgrown, but my car refuses to get within about 5 ft of it. Makes backing out a nightmare. I haven't figured out a way to disable it, and have considered just selling this 2025 NX.

If you can be prosecuted for guessing urls you can be prosecuted for sending garbage data in a way you know will be uploaded to a remote system.

I suspect this data is made "anonymous" and sold to insurance companies and misc data brokers. If it's linked to my insurance company, I don't want to jack my rates. Further, I've thus far avoided a CFAA conviction and I'd like to keep it that way.

My 2025 Mazda Miata has a CAN connected Telematics Control Unit that sends a bunch of data to Mazda on ignition off. Among this data is acceleration and velocity data along with coordinates sampled for where you were. It is also used as a gateway for the Mazda app to start your car, query your vehicle's tire pressure, etc. It is claimed that you can opt out of this by calling Mazda and being persistent.

The CAN traffic is unencrypted. It was pretty easy to MITM this module with a cheap arm Linux board and a can transceiver to enable writing a two way filter capable of blocking the traffic that didn't raise any DTCs (that I observed) and could be turned on/off by the user. I preferred this approach to complete disconnection of the module (which is noticeable via errors at the diagnostic port) or trying to faraday cage or disable the antennae on the TCU so it can't remotely send/receive. I can also turn off my module or completely remove it before I sell it.

I fear the next version of Miata will be an encrypted CAN like most other cars have moved to and even with my expertise I won't be able to access the latest safety features from new cars without surrendering what little privacy I've been able to claw back.

.interp to a glibc/libc you ship or static linking. These days it’s probably faster (in dev time) to just run a container than setting up a bespoke interp and a parallel set of libraries (and the associated toolchain changes or binary patching needed to support it).

Static linking doesn't produce smaller binaries. You are literally adding the symbols from a library into your executable rather than simply mentioning them and letting the dynamic linker figure out how to map those symbols at runtime.

The sum size of a dynamic binary plus the dynamic libraries may be larger than one static linked binary, but whether that holds for more static binaries (2, 3, or 100s) depends on the surface area your application uses of those libraries. It's relatively common to see certain large libraries only dynamically linked, with the build going to great lengths to build certain libraries as shared objects with the executables linking them using a location-relative RPATH (using the $ORIGIN feature) to avoid the extra binary size bloat over large sets of binaries.

If the integrity protection is like any of the TPM implementations I've seen, it often doesn't apply once the thing is already in memory, just that when it first loads that it (and everything before it) was attested. This matters a lot once you get into the userland, esp with an older system, since any random off the shelf exploit can be chained into modifying kernel memory with the intention of modifying the binfmt loader for loadercode (or anything else). Of course, if the loadercode is just a thin shim to prod the secure firmware and that's what has the tamper mode rather than being two separate firmwares for controlling the display, you probably can't progress very far.

I'm essentially skeptical that if you have the ability to control the linux root filesystem for a very old linux distro that any other security measures for the linux binaries themselves matter.

If you take a look at the binary that decides whether to boot the secure firmware or the tamper screen, it's probably trivial to patch to get the secure firmware running for more inspection. If the point of the linux system is networking and updates, that implies a method for updating the firmware of the secure portion which isn't ideal. If their check for whether it's tampered or not is in the linux userland, I'd be awfully suspect of their firmware update.

This looks neat. I remember the various fvwm95 and icewm themes doing a similar number in the late 90s and early 2000s.

It would be fun to pair this with Gambas[0], a free VB6 clone that works with GTK.

[0] https://gambaswiki.org/website/en/main.html

This is one of the reasons I like Clojure. There are very useful dialects with broad overlap between:

Browser / JavaScript environments -> ClojureScript

General Purpose (JVM) -> Clojure

Fast Scripting -> Babashka (although I've used ClojureScript for this in the past)

C/C++ Interop (LLVM-based) -> Jank (new, but progressing rapidly and already useful)

I can largely write the same expressive code in each environment, playing to the platform strengths as needed. I can combine these languages inside the same project, and have libraries that have unified APIs across implementation. I can generally print and read EDN across implementations, provided I register the right tag handlers for custom types (this is one area jank still has to catch up). Reader conditionals allow implementation-specific code as needed.

I'm really excited about Jank giving me a good alternative to JNI/JNA/Panama when I need my Clojure to touch OS parts the JVM hasn't wrapped.

> No they don’t. Just like everyone doesn’t know Cobol, Fortran, Scala etc.

Sure somebody might not have Python experience, but it's pretty easy to just not hire someone who says they don't know Python and isn't willing to learn for the role. I don't know that you'd filter out many candidates out of any random 100 devs.

I'd recommend nanobind over pybind11 at this point. Similar api, from the same author, but under active development and support.

Not the universal usage of a euphoria-inducing, pacifying drug covering large-scale psychological manipulation and inudstrialist domination of society? Brave New World is a dystopia because it shows a fully satiated and socially occupied doesn't care that it is being manipulated and repressed. You don't care about your caste,or the atrocities committed to others, or learning to better yourself because you take another hit of Soma and join an orgy.

Did we read the same book?

It worked well enough for my last company. It does require a team to teach it and to do the heavy lifting on custom rules and tooling. I'd rather do that than worry about whether my c++ that was exposing me to millions/billions of risk might have skipped some tests in our haste for an intraday release.

It's possible to use bazel to do this. You need to be very explicit (The Bazel Way(tm)), but in exchange, you can ask the graph for everything that is an rdep of a given file. This isn't always necessary in bazel (if you avoid weird integration targets, deploy targets, etc) where `bazel test //...` generally does this by default anyway. It's sometimes necessary to manually express due to incomplete graphs, tests that are not executed every time (for non-determinism, execution cost, etc), and a few other reasons but at least it's possible.

You can do this, albeit slightly less reliably, in the US as well. The geolocation isn't perfect, but you could easily put "With delivery to XXXXX [edit]" where XXXXX is a zip code you geolocate off an ip (or lookup in a user profile for a recurring user).

Linux on a Skylake-era i7-6820HK (quad core, ~3.2ghz) runs modern GNOME or KDE just fine. I had 64gb of ram and had cleaned the guts and installed a slightly bigger/faster NVMe to use in the last year. It runs LibreOffice or GoogleDocs just fine. It's slow to finish big compiles owing to 4 slow cores, but it's responsive even when bazel is doing its best.

The biggest issues I have with my system is that even with a brand new battery, battery life on 45W Skylake portables isn't ideal (this system is nearly 10 years old now), yielding about 2.5 hours with light browsing or terminal work. The 4k IPS screen is also dim-ish, but I remember it being pretty nice for the era in late 2015/2016. Compared to an M3 macbook pro is like the moon compared to the sun. This isn't inherently an issue with the CPU though.

If you leave the laptop plugged in, it's fine compared to a modern machine. Connected to an external display to avoid the dim screen and I'm able to do my programming/administration work just fine. I don't need a ton of cores to run GNOME powering Chrome and Kitty + tmux + ssh.

Rich Hickey calls this "hammock time".

IMO, the language is only a small part of a deeper relationship with your IDE. The IDE needs a good debugger, a good introspection system, and good hooks to modify things (ideally anything). Emacs meets this criteria, but few others do. This is why there is a living corpus of 40+ year old elisp that can be drawn upon for functionality and inspiration.

If you're using Arrow from duckdb, you're using C or C++ bindings. Hack the arrow lib, recompile (and adjust if necessary) whatever bindings/programs using your hacked arrow. If you're using multiple implementations of arrow that arent just bindings, you might have to hack it in more than one place.

You don't have to solve the entire world, you only need to hack what you actually use. If the issue with an optimized arrow impl is memory incompat in duckdb, recompile duckdb with your hacked arrow. This is where "overengineered" stuff like mono repos really shine. I've done exactly this type of thing at past jobs.

Don't let perfect be the enemy of good enough.