kstrauser

That's a reasonably take. Embargos only work until the information's leaked, and once that's happened, however it happened, the bad guys have the exploit information and the clock starts ticking.

> C is not to blame for programmers using its features unwisely and, as a result, writing buggy code. Writing secure C code requires discipline, and, most likely, keeping yourself limited to a subset of the language.

It sure is to blame. Evidence shows you need wisdom, discipline, and an impossibly high bar of encyclopedic knowledge of every feature of C and all common libc's combined with an inhuman perfection of never once making a single typo, and a vast amount of tooling to analyze the code and find some of the bugs that made it through anyway.

The best, most trusted, most accomplished C programmers I could name still have a track record of writing vulnerabilities triggered by C footguns, not just garden variety logic bugs that could affect code written in any language. Can I write more diligent C code than the OpenBSD team? Than the Linux devs? Than Fabrice "I made everything" Bellard? Not a chance, but C has bitten each of them. Us mortals don't stand a chance.

But all the people deploying that binary to their webservers would have access to do that.

Know how recompilers are porting video games from one platform to another these days? That exact trick works just as well for finding vulnerabilities. Broadly.

1. Hey LLM, turn this binary into source code.

2. Hey LLM, see any glaring security issues with this source code?

It also acts as a test case. "Hey seed-generator, give me a random number between 0 and a gazillion." "Does 4 sound good?" "No, it sounds like you're obviously broken."

In theory, all values would be equally random. In practice, some results are exceedingly more likely to occur when something's wrong with the algorithm.

While any given outcome of flipping a coin randomly N times is equally likely, if that series looks like [heads, heads, heads, heads, ...], then there's probably something other than pure random affecting the output.

If you’re actually the person who created the xscreensaver/xscreensaver repo, it fascinates me as you describe it as

> Novell Netware SMP console screensaver for X11, Gnome, KDE Plasma, and Wayland Desktops

> The netwaresmp screensaver written by Jeffrey Merkey <jeffmerkey@gmail.com> and Cosimo Streppone <cosimo@cpan.org>, based on PopSquares, Deco hacks, loadsnake, and Novell's Netware SMP.

…and then accuse jwz of being shifty about contributions.

Also:

> timebombs and aother malicious code which is presently in xscreensaver.

Links or GTFO. That’s quite a libelous accusation if you can’t prove it.

> Indeed. Who could have predicted this?

Notably, the two countries involved literally fought a war about one's wish to enforce laws in the other, with the latter declaring that no, it'd prefer to operate independently of those laws.

Look, that was 250 years ago, and we've buried the hatchet. We've had our spats, but it's more like siblings arguing. Let someone else attack one of them and they get reminded that only these 2 are allowed to pick on each other. That said, our entire country was literally built on a legal system that says Americans aren't subject to British law. It's kinda part of our national character.

I definitely don’t forget that. I’m so glad we use other tools daily, and keep these around for the convenience of collaborating with some external parties who use it. I don’t mind so much when it’s just an occasional thing.

I'm not sure if you know who jwz is, because I wouldn't put any of those in the realm of impossibility.

But I think it's plausible that he might not've migrated his ancient codebase (not meant as a pejorative, but just factually) to broadly multiuser tooling. If he's maintaining the project locally, I can imagine him having spun up a svn repo way back when and not moving past it. While I love git, it might not have a lot of advantages for his specific use case.

I haven’t. Has that worked for you?

Why do you presume he uses git, though? He might, but he may as well use cvs or sccs or just a set of dated folders named “…-final2(7)”.

Anyone managed to get this running on a 2018 (Intel) Mac Mini? I tried 7.8 or 7.9, I forget which, not long ago and was flummoxed.

They come out approximately every May and October, and have for quite a while: https://en.wikipedia.org/wiki/OpenBSD#Releases

Literally no one is proposing anything similar to that.

It weighed 23 pounds. It was approximately as portable as a tower PC. You could schlep one around, but it'd get heavy after a while.

> The also organize trash collection (without which we'd have to buy individually and have a constant stream of trash trucks rolling through).

That's not a given. I live in a non-HOA area, and everyone on my street has trash collection from the same company on the same day. Thursday night, we set our carts out. Friday morning, we bring them in.

There's a wide middle between HOA bureaucracy and pure chaos.

Why do you believe game companies have special rights that book and music publishers don’t? If I buy a book or CD, I can keep that copy forever, sell it, lend it, donate it, give it away, or let my kids inherit it. I own that copy.

Why can’t I do all those things with a copy of a game I bought?

50 years is insane for software. There may be 1 or 2 versions of 1976 software that people still buy today, although I’m skeptical. 30 years is also far too long; same deal for 1996 versions of software. Who’s buying new copies of Windows 95 today? 20 years seems about right.

I own a CD. Can I sell or give away as many copies of it as I want?

Every single time I talk to an auditor or security team:

Them: Are you a Mac or Windows shop?

Me: 100% Mac, except for the Finance team...

Them: sigh Yeah, same here.

I signed our Slack Enterprise contract this week. Yes, it is insanely expensive. But if time is money, the alternatives would've been far costlier. (Do not interpret this as me having any special love for Slack. It's just the lesser evil in this context.)

I documented a recent experience joining another company's Teams instance:

---

To log into the Teams website on my Mac:

* Use Passwords to log into Okta.

* Use Okta Verify + Touch ID for MFA.

* Log into Teams with Okta.

* Install Microsoft Authenticator on my phone because Okta’s SSO isn’t enough for MS.

* Log into my work account in Microsoft Authenticator. (Bonus: typing an Okta password into some random app’s webview gives me the warm fuzzies!)

* Bounce to Okta Verify + Face ID on my phone for MFA.

* Scan the QR code on my Mac with my phone.

* Enter the 2 digit code shown on my Mac to double-plus authenticate with Microsoft Authenticator.

As punishment for doing all this correctly, finally have to use Teams.

---

This is 100% accurate. Halfway through the hoopjumping, I realized it was ridiculous and started over from scratch so I could record each step of it.

I'm certain some step in there is necessary to support Outlook Express, and they can't clean up the process without annoying some bank paying for enterprise support of their Windows Server 2003 setup. These are the downsides of eternal backward compatibility.

No. It's just slop.

I own a Stephen King novel. I'm looking at it right now. Your contention is that I can sell or give away as many copies as I want of it, and if not, why?

It's fascinating how far experiences can diverge. I've had fantastic luck with it starting about a year ago, and it's been rapidly improving since.

Who’s vibecoding the kernel? I’ve heard stories of devs using AI to help write code, but don’t recall a single story of an experienced kernel dev vibecoding anything.

I’m strongly with you on that. Current models aren’t perfect, but neither am I. In a lot of my daily use, they’re as good as or better than I am at certain tasks.

I hear people around me talking about a bad experience they had with ChatGPT last summer as though it proves all AI coding is “slop”. Honestly, it makes me sad for them. There are reasons to dislike AI, but so many detractors skip right past those to anecdata that just aren’t relevant anymore, if they ever were.

Similar here in the states. I, as a ham, can't enter someone's house. The FCC gang who gave me a license are allowed to get a warrant to do that.

I parsed that as:

> HAMs are typically empowered [in their rule-following] by actual telecommunications agencies [who have] legislative authority to enter premises and what have you to resolve issues

That is, hams (not "HAMs") feel empowered to advise others to obey the law, because they have to work with government agencies who can make life unpleasant for those who don't. It's not "hams [have] legislative authority".

Maybe I'm wrong, but that's how I read it.

When it does, it often leads to prosecution, or at least reputational damage. But I can go nuts on my own LAN without affecting yours in any way. It's not possible for me to conduct wild RF experiments in my own house and not affect my neighbors.

It would be hard for me to physically interfere with an airport without having armed guards descend upon me. It would not be hard for me to build a radio that could strongly interfere with airplanes on final approach. The FCC rules that make it illegal and also bring the wrath of the feds down upon you are the sorts of regulations I actually support, along with air and water pollution controls, weight limits on trucks using taxpayer-owned highways, banning of mining in public parks, and other things that keep our shared spaces safe and usable.