@djm@cybervillains.com
@djm@cybervillains.com avatar

djm

@djm@cybervillains.com

debugging, v: the process of inserting printf statements into code until one's errors reveal themselves

This profile is from a federated server and may be incomplete. Browse more on the original instance.

gsuberland, to random
@gsuberland@chaos.social avatar

I wish more people knew that light curtain sensors are cheaply available and easy to integrate into an e-stop for automated machinery. you can protect a 3.0m by 0.5m region against ingress for under 70€.

if you're building hobbyist CNC stuff (milling, XY tables, robot arms, etc.) without a full-coverage interlocked enclosure they're a very affordable way to save you from serious injury.

djm,
@djm@cybervillains.com avatar

@gsuberland links?

kissane, to random
@kissane@mas.to avatar

A few weeks back I encountered a FOSS guy here explaining that when he sees open source devs ask for money, he blocks them and then stops using their code because they're morally wrong and he only wants to work with tools made by people who are doing the work for the right reasons. (I'm paraphrasing to avoid indexing the post.)

I've resisted writing about it because I'm slammed, but the question I can't shake is: Who benefits from the ideology of "pure" volunteerism?

djm,
@djm@cybervillains.com avatar

@kissane probably the type of person who thought that the Olympic Games was better when it excluded professionals

djm, to random
@djm@cybervillains.com avatar

Nightmare stuff - still more auth bypass functionality being found in the xz backdoor
https://nitter.poast.org/bl4sty/status/1776691497506623562

danderson, to random
@danderson@hachyderm.io avatar

dangit, my inner data structure has a structural fault because of rust ownership semantics.

Conceptually, the inner struct is a binary tree where inner nodes can carry a value, and leaves can carry a value or a child tree. If you need a leaf to hold both a child and a value, you store the child and move the value to the child's root node.

Conceptually again, lookups walk down this tree-of-trees looking for the node representing the lookup key, and nearest self-or-parent value is the result.

djm,
@djm@cybervillains.com avatar

@danderson Does RefCell help here?

djm, to random
@djm@cybervillains.com avatar

Piñata proposal for a model of trusted open-source without placing more onus/load on maintainers.

  1. Maintainers keep doing what they do with no new mandates, but with encouragement and support to adopt good practices like commit and release signing, repository hygiene, CI/CD, fuzzing, etc.

1/n

djm, to random
@djm@cybervillains.com avatar

Here's my 2c on the xz incident.

This is the nearest of near-misses. Anyone who suggests this was any kind of success is a fool. No system caught this, it was luck and individual heroics. That's not acceptable when unauthorised access to ~every server on the internet is on the table. We need to find a way to do better.

1/n

djm,
@djm@cybervillains.com avatar

One factor in this incident was deep, unexpected dependency chains. I wish distributions would start taking a more minimalist approach to the options they enable in the default packages they ship.

What fraction of the sshd userbase actually needs Kerberos or SELinux (which also depends on liblzma) enabled? Put that stuff in an alternate package and reduce the exposure for the rest of your users. Fewer dependencies means less attack surface and less supply-chain risk

2/n

djm,
@djm@cybervillains.com avatar

Few of the mooted software-supply chain defences would have prevented this, as the attacker was a (relatively) long-term maintainer, was not averse to using sockpuppet accounts and was careful to hide their exploit from automated tools.

Worse, many of the solutions being offered increase the workload on maintainers. But maintainer burnout was a key factor in this incident. We need to find a way to support maintainers while being proscriptive or parentalistic.

3/n

djm,
@djm@cybervillains.com avatar

This won't be the last sophisticated and methodical OSS supply-chain attack. The actor(s) behind xz are probably already learning their lessons ahead of their next attempt. Indeed, xz might not be the only attack they had in progress.

The next one is going to be more carefully operated and harder to spot. How are we going to stop it?

4/4

djm, to random
@djm@cybervillains.com avatar

I just woke up from a long night's sleep. Anything interesting happening?

djm, to random
@djm@cybervillains.com avatar

Bless the Maker and His water. Bless the coming and going of Him. May His passage cleanse the world

dalias, to random
@dalias@hachyderm.io avatar

Heads-up FOSS maintainers!

There is a person sending bulk patches/PRs to FOSS projects for supposed issues "Found by RASU JSC" (not sure if that's a static analysis tool itself, or some org).

The patches I've received are all very, VERY wrong formulatic changes, maybe even LLM-generated, doing things as stupid as replacing sprintf(s, fmt, ...) with snprintf(s, sizeof s, fmt, ...) where s has pointer type.

If you've accepted any such patches, review carefully & possibly revert!

djm,
@djm@cybervillains.com avatar

@dalias we've received a few that haven't been terrible

mcc, to random
@mcc@mastodon.social avatar

Also by the way, I'm just going to say this, when your stated reason is disliking Bluesky is "because it's run by Jack Dorsey" it makes me think you're not really trying to be convincing because that's only going to work until the first time you encounter someone who replies "it is not run by Jack Dorsey". They will have an easier time proving their statement than you will yours. Maybe find some other way of framing your objection

djm,
@djm@cybervillains.com avatar

@jplebreton @mcc that analogy makes no sense. FB is and has been run by the same person the entire time, there's no tiny pearl there - it's the whole oyster

gsuberland, to random
@gsuberland@chaos.social avatar

I wonder how long it's going to be until fast GaN-on-Si processes are cheap enough to be able to stick 400MHz+ DC-DC converters inside addressable LEDs for super high efficiency conversion from higher supply voltages. the embedded inductance can be just a few nH at that switching frequency so it's not even that hard from a packaging perspective.

djm,
@djm@cybervillains.com avatar

@gsuberland @azonenberg that looks like an amazing light source, but I wonder how hey avoid speckle?

danderson, to random
@danderson@hachyderm.io avatar

A weird facet of this new hobby I accidentally purchased, is that I'm picking up some books for learning and for reference material, and many of the "definitive" ones are written by people who died before I was born.

More modern books also exist, but they're all about the CNC and the 5-axis and the computers that make things spin at 30,000rpm, not so much the "industrial revolution perfected" machines that hobbyists use.

djm,
@djm@cybervillains.com avatar

@danderson which book is this?

robpike, to random
@robpike@hachyderm.io avatar

My day of woe continues.

I am trying to install graphviz on my mac, for probably the fifth time in history. I caved and tried to install MacPorts to enable this, as recommended at graphviz.org, but the installer for MacPorts itself is just hanging at the "Running package scripts" stage, for like 30 minutes, showing it to be perhaps as troublesome as homebrew, which corrupted my disk some years ago.

Is MacPorts doing some protracted thing, or is it just broken? Thanks.

djm,
@djm@cybervillains.com avatar

@robpike rsync always seems to spend a long time walking the filesystem before it gets to doing much

djm,
@djm@cybervillains.com avatar

@robpike the year is 34157 (reformed epoch calendar). The final living human reaches out, with their last remaining energy, to add another debugging printf

djm, to random
@djm@cybervillains.com avatar

OpenSSH has just announced the plan and timeline to remove DSA support (already disabled since 2015) https://lists.mindrot.org/pipermail/openssh-unix-announce/2024-January/000156.html

djm, to random
@djm@cybervillains.com avatar

Spouse: what are you reading?

Me: a biography of Oliver Heaviside

Spouse: sounds like a light read

djm,
@djm@cybervillains.com avatar

@gsuberland https://www.goodreads.com/en/book/show/1199255

djm,
@djm@cybervillains.com avatar

@gsuberland only just started it

djm, to random
@djm@cybervillains.com avatar

The "robustness principle" is the most destructive concept in protocol design and implementation of all time. We should be embracing its inverse: strict, explicit state-machines with model-checked proofs

djm, to random
@djm@cybervillains.com avatar

Nice to see ... basically everyone adopt OpenSSH's mitigation to the Terrapin attack https://www.openwall.com/lists/oss-security/2023/12/19/5

djm, to random
@djm@cybervillains.com avatar

OpenSSH 9.6 has just been released: https://openssh.com/releasenotes.html#9.6

Among other things, this release contains a fix for the so-called Terrapin Attack (https://terrapin-attack.com/)

robpike, to random
@robpike@hachyderm.io avatar

Just finished Jusant. Lovely little game, no boss battles, no jeopardy, just gorgeous visuals, good soundscape, and a quiet little story. Well worth a few hours of your time if you like a change from the usual mayhem.

djm,
@djm@cybervillains.com avatar

@robpike not to be confused with The Outer Worlds, which is a vastly different game (and IMO not as good)

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • Leos
  • mdbf
  • magazineikmin
  • thenastyranch
  • Youngstown
  • osvaldo12
  • rosin
  • slotface
  • ngwrru68w68
  • InstantRegret
  • PowerRangers
  • kavyap
  • tsrsr
  • DreamBathrooms
  • tester
  • everett
  • hgfsjryuu7
  • khanakhh
  • GTA5RPClips
  • vwfavf
  • Durango
  • cubers
  • tacticalgear
  • ethstaker
  • cisconetworking
  • normalnudes
  • modclub
  • anitta
  • All magazines
    •