letstrynvm

That sounds reasonable, but here we are with Android's endless security disaster and all their apps written in not-Java from the beginning.

The most cancerous aspects of Android are by design, that you cannot control network exfiltration from apps, you cannot update or modify the OS pieces at will, and the apps are monetizing everything you do and everything they can find against you. Librem will answer these.

No, chain-of-trust only has one trick... it can check that what you're about to run is unaltered from what was signed to some degree of probability.

If that is the - shipped and validly signed - bugridden nightmare-fuel like the propreitary Qualcomm 802.11 stack or proprietary multimedia bits that are a rich and continuous source of vulnerabilities (take a look through the last months here https://source.android.com/security/bulletin/2019-06-01 ) all the buzzwords did was ensure the vulnerable version is running so it can be exploited. The evil maid can get in that way.

Librem's security model is that of a Linux box, signed update packages... it's not a panacea against hacks but nor are the buzzwords you mentioned. At least they're trying to eliminate the really dangerous proprietary pieces that constantly provide new vulns.

I guess that's because they know that Chain-of-trust only gets you so far.

Eventually you're running something big with bug after bug found every month and and an attack surface that includes the local filesystem and the network. At that point the buzzwords make no difference.

I was pretty amazed when I bought an MR200 lte-capable router that the LTE module actually runs its own personal Android discrete from the router cpu.

https://openwrt.org/toh/tp-link/archer-mr200#the_lte_modem

Of course that has never and will never receive any security updates. So although iommu isolation is good, it may not help much if there's a whole other OS hacked that can initiate its own network connections and futz with any traffic, eg, deny main OS updates until it can attack it via an unpatched vuln. TLS is good but it'd only take one hhtp connection through unpatched webview.

Librem seems to have the correct way forward, reject the big mess of Android and catch up to it with completely Open pieces.

https://puri.sm/products/librem-5/

They're making good progress and I can't wait to be able to update my handheld device with mainline pieces for as long as anyone who still uses one cares to update it. Currently my Samsung Android device is at Dec 2018 patchlevel and nothing I can do about it.

I've worked for over 30 years only remote on one thing or another... most of this guy's points are on the money.

Unless it's enforced to share information properly, if some people are in an office and others are not, there are two classes of political animal created immediately and that will affect everything.

Unless I missed it, he didn't get into how variable work really is... this 10h thing is kind of a crock for the kind of work I do anyway... sometimes you are blocked on the one thing you have to be doing and it's difficult to focus on things that are of secondary importance just because you should be working. Other times you're being paid, but there's nothing to do for one reason or another. You can usually find useful things to do but at these times, they already know the situation. They want you to just note it, keep your head down and do something you can do yourself that should be somewhat helpful, and pick up immediately the thing is unblocked.

It's just not always possible to move things forward for 10h each day... be transparent about it. Sometimes if it's an architectural or philosphical issue, you need to study it and then do something else while your brain thinks about it. Some days nothing is going to move forward no matter what you do because of your personal state... you learn to recognize it and let it go... tomorrow or the day after you'll be back in triple force and more than make it up. The people who are paying you usually care about results not hour by hour but week by week. So long as it's all happening on that scale everyone's happy.

You actually claimed:

>> The PRC exerts indirect control over Taiwan's economy by pressuring its trading partners, so the distinction is academic.

That's not what happens. What does happen is China pressures international bodies like the UN and the Olympic committee to pretend if they want to talk to Taiwan, they must talk to only China.

But it has mainly cosmetic effect... eg, despite all that effort, Taiwanese passports (not issued by China) are recognized almost everywhere except China

https://en.wikipedia.org/wiki/Taiwan_passport#Limitations_in...

Of course the nuclear-armed mainland is bigger and scarier than a small island of 20-something million with only conventional forces. But China has not been suppressing Taiwan's trade as you wrongly said, it has been encouraging and benefitting from it to the point it's the #1 partner with double the value of the US.

The distinction is far from academic.

China itself is Taiwan's top trading partner

https://www.trade.gov.tw/english/Pages/Detail.aspx?nodeID=94...

Followed by the US. China does not need to "pressure its trading partners".

Taiwan has its own currency, does not pay tax to the mainland, has a real democracy, and is an ally to the US.

Chinese passports can devote a page to whereever they want, it means nothing.

Interesting fact... phone numbers in the Taiwanese capital begin 02. That's because when the KMT invaded, they reserved 01 for Nanjing, their base of operations when they were the mainland government, and for whatever reason they wanted to believe they would be able to retake it.

https://en.wikipedia.org/wiki/Telephone_numbers_in_Taiwan#Ar...

Does this mean Taiwan owns Nanjing? :-) Nor does the passport page act as a deed of ownership for Taiwan...

It's nice you are interested in this topic.

So why don't you look into it and make your opinion from the facts?

https://www.washingtonpost.com/opinions/2018/12/18/chinas-in...

https://www.nytimes.com/2018/11/22/world/asia/taiwan-electio...

Maybe he should do himself a favor and fix his broken :443, or disable it.

Who is making money off let's encrypt? The service is provided for free.

His https is still broken.

Maybe he'll fix it if someone points it out to him.

... I said his https is broken. His https is broken.

Does that really need downvoting into oblivion?

I use HTTPS Everywhere plugin for firefox... it's pretty surprising in 2019 how many network-related blogs and articles are on http links and the https equivalent is broken.

You can use Let's Encrypt, it's free. It makes me not want to listen to what's supposed to be their wisdom on networking matters if they can't even get that right.

> Where did they get a shaft encoder with over a million counts per rev?

The article says they put the encoder directly on the motor, before gearing it down. So the effective resolution after gearing is magnified. But the encoder moves much faster accordingly, hence the need for higher speed / fpga decoding.

It sounds impressive, but "FPGA supercomputer"? It's a few optical shaft quadrature decoding state machines and feedback to motor controllers. Describing that as a 'supercomputer' suggests there's a lot of marketing bs flying around.

Still if its resolution really is 50 micron it should be able to, eg, mill useful pcbs with the right head.

One of the unusual and desirable things about this is your customers for the dev board will largely be very experienced... you acknowledge it in the letter you sent out.

What surprised me is until it's fixed, there's no certainty what the problem is. Eg, dsi lanes mixed up, polarity of dsi lane wired wrong, some semidocumented reset signal on the panel got forced to 0V or forced inactive but panel requires it strobed, psu to panel must come up in specific order, psu level or quality or wiring mismatch... there are many possible ways just from having no video it can be a hw rework issue to solve it. Of course dsi is also complex, it can easy be a sw-only config issue, or some combination.

It's not up to me as your paying customer to go ask on a 'support channel' why, it's up to you to explain the reasoning why you believe that's a software-only issue.

Maybe I missed it, but it doesn't seem to cover setting up a cross toolchain and rebuild everything from source.

I have one of these on the way.

The main surprise for me is they're shipping it without the lcd panel working.

They can control the backlight. But no video.

Now I'm participating in the gamble that can be made to function without rework, I'd at least like complete details, not "we are talking to the panel vendor".

It's maybe confusing because you are presupposing OOP as the default. Humans tend to observe some situation and sythesize stories to explain it, even when it comes to observing their own actions.

I don't mean to unfairly paraphrase but to transpose what you wrote so it shows these stories you are telling yourself

- usually people criticising OOP are "bad programmers"

- OOP is easy, alternatives are hard

- Even if OOP model is a bad fit, it's still a model and the extra devs needed to solve its bad fit can easily be chained to the oars

- If OOP makes trouble, it was because it was "done badly"

- Most easy things work well enough even if "done badly" (that is just not true)

- If OOP can be cobbled together to work at all, it is justified since that justifies anything

If you consider a simpler proposition like, "this can be done in a few hundred or thousand lines of C99 instead of latest C++ and boost", I think there is just no valid reason to bring OOP into it.

Right... and also, as you increase the model complexity rendering correctness and speed take a dive to the point the preview render is unusable.

Nope...

https://www.softwarefreedom.org/resources/2008/compliance-gu...

That's the basis of eg Kernel enforcement, the most-distributed project out there by far.

"professional behavior" would make sense if both sides are getting paid.

If only the user is getting paid, and he wants support or something else from the FOSS author, why should the FOSS author be held to this "professional behavior" standard?

It helps me to remember in a public forum, whether my point is acknowledged by the OP or not, is only a small fraction of the number of people who may read and accept it. If the OP unreasonably denies or refutes it, in fact they may be silently judged accordingly.

No need to make your good point a hostage in your own mind to whether the OP will publicly accept it.

There are no punitive 'teeth' in GNU licences. If you don't like the terms, don't use the thing under that license.

Stallman is his own man and can boycott what he likes and explain why to others.

"Punitive" "teeth" as found in proprietary EULAs and various unreasonable copyright laws looks like jailtime and financial ruin.

Yes that's basically what I found too.

To practice OOP, its approach is every class should be a "library". Procedural code that doesn't have a class context is felt to be a shameful throwback to an earlier era degenerate C practices. From before some people feel they starting writing "good C++" apparently.

Yeah... you mentioned

>>> maintainable, testable, extendable and configurable

but not reusable. I'm not blaming you, or disagreeing... C++ didn't produce reusable results for me either.

I dunno what you were doing 20 years ago, but I was doing this... there wasn't any problem with the classes being unclean or the boundaries cut in the wrong place. It was simply I was almost never going to use those classes a second time. If they had been C functions, I would not have needed them a second time, either, almost always.

After a year or two I realized that being the case, the entire loving OO encapsulation of then was not simply worthless but an active waste of time. And I went back to C.

If you get value from other C++ things that make it worth paying the price, that's great. But file away for a possible future horrifying 3am realization, perhaps nothing is worth the price of a gyre like boost, and just writing it in high quality C may be a better answer.

> and still write maintainable, testable, extendable and configurable code.

"reusable"... reusable code? That was the original point of OOP.

After a few years being a believer n the late 90's as a C++ Ubermensch, I had the horrible realization neither I nor anyone else would reuse any of the classes I had given beautiful interfaces to, and carefully documented. Any time I spent planning for reuse I might as well have spent staring out the window.

Of course who needs to reuse your own classes when you have the huge canker Boost you can drag around with you from task to task.