My heart goes out to xz. A single maintainer, who was clearly in a rough place with mental health, screaming out to the world for some help and additional contributions, and somebody shows up wanti...
my only contribution to the xz discourse:
absolutely none of the supply chain stuff we're currently doing, including the things i like, would have stopped this. the only things that can stop this are (1) compulsively treating all code as untrusted, and (2) way, way stronger capability checks and restrictions in running systems. (1) is economically infeasible (the world runs on free labor from OSS), and (2) has had only very limited practical success.
Random, unordered, probably useless thoughts on today's apocalypxze... Part of the success in getting this into Debian may be the result of there being no xz maintainer there. It is "maintained" ...
@glyph @eb@social.coop I'm frustrated that big tech's efforts to increase core library security are "your project is too popular, you must use 2FA" and "the best reverse engineers in the world will find your bugs and put you on a 90 day disclosure deadline" and not "here is $100K/year and benefits to keep doing what you're doing at your own pace."
@eb@social.coop I really hope that this causes an industry-wide reckoning with the common practice of letting your entire goddamn product rest on the shoulders of one overworked person having a slow mental health crisis without financially or operationally supporting them whatsoever. I want everyone who has an open source dependency to read this message https://www.mail-archive.com/xz-devel@tukaani.org/msg00567.html
Itās not surprising that a major security vulnerability is once again caused by maintainer burnout and someone stepping in to take over. Weāve all been talking about that risk for years.
Sadly itās also unsurprising that OSS teams still are going to need to plead with management to stay funded, and paid OSS maintainers will still do unpaid overtime to work with volunteers. š.
Love to see forks emerge when a company gets greedy and transitions to source-available after years of accepting third party contributions and establishing market share under an open source license.
Hey, with people in the news getting sentenced to prison, facing the possibility of prison time, etc., just a reminder: it is not desirable, nor funny, that violence in prison (including sexual violence), be a part of someone's punishment. Even people you really, really do not like who have done really super bad things. It is to the United State's shame that violence in prison is part of our carceral system, and we should not celebrate it, ever. We should seek to eliminate it.
Hey everyone! #vultr just enshittified!
They re claiming ownership of all intellectual property you host on their VMs.
https://grimgreenfo.rest/notes/9rdle0uyo4d30029
Clear violation of copyright law.
So, where are people moving to? What options are out there? that suck less?
I feel like subscriptions have generally made software quality worse. There was an argument that having to make paid upgrades to generate revenue to pay salaries put pressure on companies to change things that didnāt need changing, just to get that upgrade money, and subs reflected the holistic task of careful maintenance better. But in practice whatās often happened is the subscription props up bad decisions on product direction, because subs have to keep paying either way.
@noracodes@tenforward.social IMHO you should pay for open source if you are making a profit on it. Lots of companies are reselling proprietary software and are paying for licenses without having specific feature wishes for the software, they just pay for the maintenance.
Can web designers PLEASE STOP with the thing where the bulk of the website loads first and then things on the top load last so you invariable end up clicking on something you didn't mean to
@aral@mastodon.ar.al
My little lad had a bad leukaemia when he was 20 months - in 2002. He had care at Great Ormond St - I calculated at the time (Iām an accountant) at somewhere between Ā£250k and Ā£500k, entirely free to us. And he lived.
The US families sometimes didnāt fare so well. After theyād drained all insurance & resources their kids often died of something entirely treatable.
Folks need to think very hard before voting for either #Tories or #Labour.
@nhsactivistrn
Source Available != Open Source
That's not an opinion. If it's SSPL, BUSL, etc., it's categorically not "open source" according to the Open Source Definition.
Iāll let you in on a secret: I love sporadically updated weblogs. I subscribe to over 1200 feeds and most of them are sporadic or even technically āinactiveā. Months often pass between updates
It means that every post published was important to the writer
Back in the days of snail mail, letters that began with āItās been a while since I last wrote to youā were the ones people cherished the most
You donāt need to post every day or even every week to have a blog that matters
$1 million budget: 90% test coverage, comprehensive DevOps pipeline, all work rooted in user research, delivery every two weeks, all code in an open repo.
$300 million budget: No tests, no CI/CD, no user research, delivery on an annual cadence, code is a secret because it's a trash fire.
Remember folks.
When VC is funding Corporation that releases a Open Source project its only a matter of time until they take it back.
Their goal is to get their product embedded into your organization and abuse you for free work in the hopes they can eventually sell their corporation and cash out.
Its always good for them, and rarely good for you.
If you're using Glassdoor, stop right now and delete your account. This company just made it completely clear it can't be trusted. Read this from @arstechnica https://arstechnica.com/tech-policy/2024/03/glassdoor-adding-users-real-names-job-info-to-profiles-without-consent/
Itās Long COVID Awareness Day. An estimated 65 million people suffer from it globally. Remember that the risk of long-term health issues in multiple organs increases after each infection, even if your ā¦
Attached: 1 image
Ok Iām doin the thread I said I wanted to do last week. (feel free to mute unless you enjoy a little second-hand drama as a Monday morning treat)
Attn #devrel people! Are you job hunting? Does this pic of search results look familiar? Have you ever seen a bunch of job postings like this from Canonical and thought āgee I should apply to one of theseā?
Iām here to tell you:
ITāS A TRAP! š§µ
@JamieTanna talks about his decision to share his salary publicly on the "Changelog & Friends" podcast. Full audio š https://changelog.com/friends/31Subscri...
Who called it āintellectual property problems around the acquisition of training data for Large Language Modelsā and not Grand Theft Ģ¶AĢ¶uĢ¶tĢ¶oĢ¶cĢ¶oĢ¶rĢ¶rĢ¶eĢ¶cĢ¶tĢ¶ Autocomplete?
Yāall realize everyone in Helpdesk at your job can just import your browser cookies into their machine remotely and browse your Facebook at their leisure, right?
Like, you understand what Administrator means? It means unquestioned god from anywhere. Itās not your machine ITāS THEIRS. All you do, all your access, itās stored to be stolen. Anything hackers can do to ruin your life, IT can do better.
Theyāre children. And their government is keeping them from doctors who practice a type of medicine that cures suicidal ideation at near miracle rates. If those kids do find relief, it'll be via their parents paying exorbitant out of pocket costs or by covertly ordering those drugs online with cryptocurrencies from sketchy overseas labs.
Please don't play the Harry Potter video games and it defend it by saying they brought *you* childhood joy.
https://www.thepinknews.com/2024/03/12/trans-puberty-blockers-nhs-england-prescribe-gender-affirming-healthcare/
āBut AI is cheap!ā
Itās not, it has horrendous hardware, server housing and water and power requirements; itās just that VCs are financing it now so you get in on the hype and later they will charge you rent and it will cost you way moreāwith inferior resultsāthan, you know, hiring the writers and artists itās stealing from, but those will be gone by then.
Descriptions of autistic folks as having "trouble in social situations" but all my autistic friends get along great with each other in their social situations.
This reads like all the "introverted people just need to learn small talk" instead of having articles where "extroverted people just need to learn to be quiet".
Most of my friend AND professional colleague groups are filled with neurospicy folks. And we seem to get along just fine thank you very much.
Anyhow. I imagine this isn't new to many folks here in the fediverse...
Don't mind me. Just falling into a new research dive. - This research dive feels very meta, by the way.
If you see the AGPL licenses on my free and open source work and you think ādamn you, I canāt use this to enrich myself or my corporation without sharing back what Iāve built on top of what youāve freely shared and thus contribute to cultivating a healthy commons where others might enjoy the same benefits from my work that I want to obtain from yoursā (a) you really have long-winded thoughts and (b) well, you already see the flaw in your reasoning.
#foss #licenses #freedom #copyleft #gpl
"De-anonymising data is surprisingly easy: if you know Tony Blairās date of birth (a matter of public record) and the two dates during his term in office in which he was treated for a heart condition (ditto), you can pick him out of any āanonymisedā pool of NHS data in seconds, and then discover all those facts about his health that arenāt a matter of public record... Dr Ben Goldacre and his team at Oxford created OpenSAFELY, a āTrusted Research Environmentā that allows researchers to write programs that analyse NHS data in situ. These programs would be dispatched to run against the data held by NHS trusts, and then the system would return the results to the researchers without ever letting them handle the data ā which never left the trustsā own servers."
https://goodlawproject.org/cory-doctorow-health-data-it-isnt-just-palantir-or-bust/
#dataProtection #research #NHS #privacy
PS #Palantir, ... is literally named after an evil, all-seeing magic talisman employed by the principal villain of Lord of the Rings (āSauron, are we the baddies?ā)
the problem with celebrating girl bosses is at the end of the day you are celebrating bosses. society oriented around hierarchy is not feminist because it requires inequality.
let's think about this! the problem with patriarchy is not that some humans are born with dicks. the problem is structuring society around the unequal distribution of power. placing women within that architecture doesn't level it. but re-orienting around lateral movement building & collective organizing can! imo!
Jamie Tanna
.
