@leftpaddotpy@hachyderm.io avatar

leftpaddotpy

@leftpaddotpy@hachyderm.io

purely dysfunctional programmer, soft and snuggly version; they/she.

This profile is from a federated server and may be incomplete. Browse more on the original instance.

leftpaddotpy, to random
@leftpaddotpy@hachyderm.io avatar

Wrote a quick post about how to pin packages to versions in #Nix https://jade.fyi/blog/pinning-packages-in-nix/

leftpaddotpy, to random
@leftpaddotpy@hachyderm.io avatar

the master's tools will never dismantle the master's house

  • Audrey Lorde
leftpaddotpy, to random
@leftpaddotpy@hachyderm.io avatar

fyi, if you do hexdump -C file | xxd -r, you will silently NOT get the same thing as file afterwards.

This is incredibly broken in such a dangerous way.

leftpaddotpy, to random
@leftpaddotpy@hachyderm.io avatar

oh yeah the secret project I've been working on for two months, @lix_project, is finally in public preview. there's a fair number of rough edges in the website and infra remaining to fix but the software is rock solid.

thanks so much to the dozens of people who have been running main daily for several weeks and reporting the few remaining issues. at this point i would say it's just a stabler, faster, more user friendly #Nix 2.18.

if you want to try it out: https://lix.systems

ktemkin, to random
@ktemkin@chaos.social avatar

Thanks so much to everyone who hung in this week as we’ve all worked to fix the state of the Nix community. It’s been a ride; but I think things are going to get better.

Here’s the last major piece of the puzzle — the product of several months of work from an absolutely incredible team. It’s not ready for a full announcement, but we’ve opened our beta so people who are fleeing the core Nix community have a place to go.

https://lix.systems

leftpaddotpy,
@leftpaddotpy@hachyderm.io avatar

@smallcircles @jakehamilton @ktemkin one of the tvix developers is in the lix core team. we know it well :)

leftpaddotpy,
@leftpaddotpy@hachyderm.io avatar

@smallcircles @jakehamilton @ktemkin there are public rooms in space:lix.systems, with no invite required, but maybe matrix is being haunted?

Qyriad, to random
@Qyriad@chaos.social avatar

Very glad that we can finally publicly share something we've been working on for a while: https://lix.systems/

It's still a pre-release and we're still setting things up, so this isn't an Official Announcement or anything, but it's public now 🎉

leftpaddotpy,
@leftpaddotpy@hachyderm.io avatar

@artemist @Qyriad that's just Nix!!

leftpaddotpy, to random
@leftpaddotpy@hachyderm.io avatar

👀 I am working on making inputs.meow.url = "https://some-forgejo/some/repo/archive/main.tar.gz"; Simply Work for forgejo-hosted nix flake inputs, which will probably land in forgejo 8.0.0

for progress, see: https://codeberg.org/forgejo/forgejo/pulls/3615

mjg59, to random
@mjg59@nondeterministic.computer avatar

The idea that an inode has no idea which directory it's associated with was a mistake and I will take no questions

leftpaddotpy,
@leftpaddotpy@hachyderm.io avatar

@mjg59 hmmm this and the day that the Linux networking guy invented abstract domain Unix sockets in 1996 would be my candidates for api that makes people cry.

leftpaddotpy,
@leftpaddotpy@hachyderm.io avatar

@mjg59 well, it did cause a cve in software i work on, by allowing processes to send each other fds despite no filesystem sharing, and there's no clean ways to block it outside of shoving them in separate netns (with pasta for connectivity) or using various lsms that are very ugly (or cgroup bpf lsm).

idk. whole experience didn't inspire any confidence in Linux security design.

leftpaddotpy,
@leftpaddotpy@hachyderm.io avatar

@mjg59 yes, but allowing yeeting them between ostensibly chrooted processes running as different users merely if you're in the same netns is pretty extremely surprising behaviour

leftpaddotpy, to javascript
@leftpaddotpy@hachyderm.io avatar

btw, i found a really cool book sized paper on the history of JavaScript about a year ago.

it goes from Netscape being like "oh no we need a language that people will actually use by virtue of not being Java" to "es4 fails twice" to "es5 and 6 actually ship"

the funniest part is that the flailing of es4 gets finally stopped ... by Microsoft ... out of anticompetitive behaviour since they thought it would eat the lunch of .NET by being too good.

https://dl.acm.org/doi/pdf/10.1145/3386327
#javascript

leftpaddotpy, to NixOS
@leftpaddotpy@hachyderm.io avatar

A lot of the problems in the #Nix/#NixOS community are fundamental, built into its culture, from toxic development culture to the two repeated military-industrial sponsorship situations.

The culture of undermining community authority, of acceptability of conflict of interest, of tolerating abusive behaviour, goes up to the very top of the organization, with Eelco Dolstra.

You can read an extensive summary of the issues and sign an open letter to the Foundation here:

https://save-nix-together.org/

leftpaddotpy, to random
@leftpaddotpy@hachyderm.io avatar

💭 hydras have so many heads to pat, they're very good and lovable creatures, even if they are full of perl and tech debt

leftpaddotpy, to random
@leftpaddotpy@hachyderm.io avatar

OH: plural people write rust in large numbers because it is a systems language

leftpaddotpy, to NixOS
@leftpaddotpy@hachyderm.io avatar

i appreciate that the #NixOS foundation has shipped a strictly improved sponsorship policy, apologized, and indeed has given the community a veto on sponsors in spite of its wording. congratulations to everyone who has put an unbelievable amount of work into making this happen!

there's a lot of work still to do on getting fascists out of the community and everyone is quite exhausted from the fight to get this passed. however. the fascists will get kicked out.

https://discourse.nixos.org/t/nixos-foundation-event-sponsorship-policy/43110

leftpaddotpy, to NixOS
@leftpaddotpy@hachyderm.io avatar

over the course of the last few months, my views on have changed from "please don't give them any support" to "we need to eject them from the community as soon as possible".

their employees (multiple right wing trolls) have collectively wasted hundreds of hours of contributor time arguing about sponsorship rules to stop them driving people away, and have begun to be actively cited by people as reasons to leave the community in higher numbers than they ever brought.

leftpaddotpy, to random
@leftpaddotpy@hachyderm.io avatar

nix-repl> let __sub = a: b: "🥺"; in 1 - 2
"🥺"

#nix

b0rk, to random
@b0rk@jvns.ca avatar

what's your favourite third-party command line git tool? Mostly interested in tools that just do 1 thing (like git-absorb or delta or git-vee), not so much full git UIs like lazygit or magit. Also not looking for prompt tools like starship right now.

leftpaddotpy,
@leftpaddotpy@hachyderm.io avatar

@glyph fyi that one has been effectively replaced with the cli called "gh". but for some reason they didn't deprecate hub? wat.

dfeldman, to random
@dfeldman@hachyderm.io avatar

If there were another binary backdoor similar to the xz attack that was found today... how would you find it?

(The xz attack was found by chance and some trivial issues that caused performance degradation)

leftpaddotpy,
@leftpaddotpy@hachyderm.io avatar

@raito @alanc @dalias i would absolutely believe autoconf files to be a vector for malicious code, they're incomprehensible macro noise by nature, and this is just speaking as a nixos maintainer for whom these files are simply constantly broken and should not be used regardless of malice

tbh my view is that release tarballs that aren't simply the git state are a practice that should be abolished. or at least we should diff the heck out of them and figure out how to catch malicious autoconf.

leftpaddotpy,
@leftpaddotpy@hachyderm.io avatar

@raito @alanc @dalias wonder if the solution here is to construct things to evaluate whether an autoconf script is one that could have been generated by any released version of autoconf and check the maintainers' work, so we could find out if there's malicious stuff going on (even if distros just ignore the release tarball anyway)

leftpaddotpy,
@leftpaddotpy@hachyderm.io avatar

@alanc @rst @raito @dalias yeah. which means really we have a responsibility to either make it possible to get those exact versions via docker or nix or so, or we need to abolish putting autoconf files in tarballs

joeyh, to random
@joeyh@hachyderm.io avatar

I rag on github a whole lot, but this is one feature it has that I really like.

Since JiaT75 backdoored xz-utils, I have blocked him and now get to see a warning in every project he touched.

I hope wasmtime et all are doing some careful review..

leftpaddotpy,
@leftpaddotpy@hachyderm.io avatar

@joeyh i blocked all the pro stallman open letter signers with a script years ago, and i can find which projects are most likely to be toxic by the number of blocked contributors on them. for some reason i have never found the blocked contributors to have done anything substantive though. it's funny how right wingers claim they do everything and actually ... do not.

leftpaddotpy, to random
@leftpaddotpy@hachyderm.io avatar

pushes ur compiler off a shelf like a cat breaking a vase
CLANG!!!

leftpaddotpy, to random
@leftpaddotpy@hachyderm.io avatar

software engineering strategy: make the program crash and dump core cleanly and early.

fun fact: signed overflow can be made to crash 100% of the time in a substantive code base with nearly zero (gcc) to immeasurably low overhead (clang). and then you don't have to think about it doing unpredictable UB ever again.

simply pass: -fsanitize=signed-integer-overflow -fsanitize-undefined-trap-on-error to the compiler

in rust
[profile.release]
overflow-checks = true

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • JUstTest
  • tacticalgear
  • rosin
  • Youngstown
  • mdbf
  • ngwrru68w68
  • slotface
  • khanakhh
  • ethstaker
  • everett
  • kavyap
  • thenastyranch
  • DreamBathrooms
  • magazineikmin
  • anitta
  • osvaldo12
  • InstantRegret
  • Durango
  • cisconetworking
  • modclub
  • cubers
  • GTA5RPClips
  • tester
  • normalnudes
  • Leos
  • provamag3
  • megavids
  • lostlight
  • All magazines
    •