Social GL-Como | Diego Roversi @ Social GL-Como

Olimex 1 anno fa • mastodon (AP)

Microsoft just open source MS-DOS
github.com/microsoft/MS-DOS
Do not send pull requests please 🤣

GitHub - microsoft/MS-DOS: The original sources of MS-DOS 1.25, 2.0, and 4.0 for reference purposes

The original sources of MS-DOS 1.25, 2.0, and 4.0 for reference purposes - microsoft/MS-DOS

^GitHub

Marco Ciampa 1 anno fa • mastodon (AP)

and BTW freedos is wayyyy better...

Micro SF/F by O. Westin 1 anno fa • mastodon (AP)

"Listen," one guard said, "I know we have only just met-"

"No," the other guard said, "we've worked together for years!"

"-but you can trust me when I say-"

"I can't, you have the curse that's opposite from mine!"

"I don't care for you at all."

"Well, I... oh... I love you too."
#TootFic #SmallStories #Microfiction

#MicroFiction #TootFic #SmallStories

2 4

Irina 1 anno fa • mastodon (AP)

This is absolutely brilliant.

Brian MacDonald 1 anno fa • mastodon (AP)

Brilliant!

And now I'm thinking about those guards. How did they meet? What did they do to get cursed? Is there some witch going around providing conveniently specific curses to kings with dungeons and an unhealthy obsession with puzzles?

What sort of home life do they have? What are their retirement plans? Can you imagine them trying to date somebody? Or worse, double-date? Or would that make it better?

mellowfish 1 anno fa • mastodon (AP)

The sun is filled with ice and gives no warmth at all.
The sky was never blue.
The stars are raindrops searching for a place to fall.
And I never cared for you.

Teryl's Tales of Whim~ 1 anno fa • mastodon (AP)

Awwww

Vint Prox 1 anno fa • mastodon (AP)

Undertale

Why did I imagine those two knights from Undertale?

Questa voce è stata modificata (1 anno fa)

consumableJoy 1 anno fa • mastodon (AP)

@emery I love this so much

@ink and yarn

Evannakita 1 anno fa • mastodon (AP)

oh I especially love how it’s unambiguous which guard is which, since “you have the curse that’s opposite mine” can only be said by the truth-teller.

Sci-Fi Girl 1 anno fa • mastodon (AP)

Roderick! 😂💖

#JourneyQuest

#journeyquest

Questa voce è stata modificata (1 anno fa)

Alexandre Muñiz 1 anno fa • mastodon (AP)

Nice. I also loved this take by John Finnemore and company: youtube.com/watch?v=02gfh-h6mT…

John Finnemore - The guards and the Saphire City

from John Finnemore's Souveniere ProgramEveryone must love The Finnemore. EVERYONE.

^YouTube

Weyland-Coyoty 1 anno fa • mastodon (AP)

The angry Goblin King informed his guards they were cursed. "You now have to work together in my labyrinth for eternity!"
"Thanks, but what's the curse?"
"... ... ...Okay, new curses... YOU must always lie and YOU must always tell the truth! YOU can never tell HIM you love him, and YOU will never hear words of love from HIM!"
"I can live with that."
"I can't!"
"Awww..."
"... Curses foiled again!"

Kexe 1 anno fa • mastodon (AP)

ahhhh so clever. Thank you!

dohru 1 anno fa • mastodon (AP)

brilliant

Elena ``of Valhalla'' 1 anno fa • friendica

Dear lazyverse, I've just read blog.prosody.im/great-invitati… and prosody.im/doc/modules/mod_inv… and I don't understand one thing: can this be used to generate an invite for an user that already exists and has been using the account for a while, but needs to reconfigure an xmpp client on a new phone?

of course they don't know their password, but I would have to reset it from prosodyctl anyway.

#xmpp

MattJ 1 anno fa • mastodon (AP)

Adding a new device via invitation is not currently a thing. Password resets links (which work almost the same as invitations) are.

Generate a password reset link with this command:

'prosodyctl mod_invites example.com --reset username'

I haven't extensively tested it with clients or invite UIs beyond Snikket, though. Feedback welcome 🙂

Elena ``of Valhalla'' 1 anno fa • friendica

@MattJ thanks!

@MattJ

Roberto Resoli 1 anno fa • mastodon (AP)

I add to the excellent @mattj explanation that both invitation things are very familiar to @snikket_im admins ...

@Snikket @MattJ

Roberto Resoli 1 anno fa • mastodon (AP)

@mattj fosstodon.org/@snikket_im/1122…

Snikket

2024-04-19 09:57:14

@shuro Snikket is XMPP for people who don't know what #XMPP is 🙂
If you're happy with Conversations, continue using it! Snikket is more limited because it focuses on a specific use case.
If you want an easy-to-use messaging solution for a group of people (e.g. family, friends, clubs), plus companion apps and easy onboarding without forcing people to learn what a "XEP" is, then Snikket is here for you: snikket.org/start/
We just want XMPP to reach beyond the tech crowd.

Get Started
Snikket is a fully open-source personal messaging server that allows groups of people such as family, friends, clubs and small organisations to have their own private communication space.
^{Snikket Chat}

@MattJ

Martin 1 anno fa • mastodon (AP)

No, but there is also a module where the admin can generate a password reset link for that user. Don't have the name in my mind ATM and can't comfortably research as I'm AFK.

Enrico Zini 1 anno fa • mastodon (AP)

qntm.org/assist

The Assist

At work we recently started experimenting with generative AI for assistance with programming. We have a new Visual Studio Code plugin which we can ask questions in English, and it spits back code.

^qntm.org

myrmepropagandist 1 anno fa • mastodon (AP)

(via: tumblr.com/dont-fuckle-with-th…)

bringcal on tumbler says:

"i miss vhs tapes and cds i miss feeding my computers and tvs yummy treats. now theyre eating nothing. theyre being born without mouths"

edgar-allan-possum responds with a screenshot of the hashtag:

#I have no mouth and I must stream

Aug. 22, 2023

Welcome to Quindecim

^Tumblr

Jamez Barrett 🜃 ॐ Ⓐ 1 anno fa • mastodon (AP)

“Last year, I had a life-changing experience at 90 years old. I went to space, after decades of playing an iconic science-fiction character who was exploring the universe. I thought I would experience a deep connection with the immensity around us, a deep call for endless exploration.
"I was absolutely wrong. The strongest feeling, that dominated everything else by far, was the deepest grief that I had ever experienced.
"I understood, in the clearest possible way, that we were living on a tiny oasis of life, surrounded by an immensity of death. I didn’t see infinite possibilities of worlds to explore, adventures to have, or living creatures to connect with. I saw the deepest darkness I could have ever imagined, contrasting so starkly with the welcoming warmth of our nurturing home planet.
"This was an immensely powerful awakening for me. It filled me with sadness. I realized that we had spent decades, if not centuries, being obsessed with looking away, with looking outside. I did my share in popularizing the idea that space was the final frontier. But I had to get to space to understand that Earth is and will stay our only home. And that we have been ravaging it, relentlessly, making it uninhabitable."
-- William Shatner, actor

A sepia-toned portrait of William Shatner.

Questa voce è stata modificata (1 anno fa)

Brian Campbell 1 anno fa • mastodon (AP)

@Natanox @mral @trechnex youtube.com/watch?v=9GQoHIBDog…

He was clearly trying to express something profound about the experience, and Jeff Bezos is just like "Imma let you finish, but here's a fountain of champagne" and a bunch of other people in the background are cheering and spraying champagne.

William Shatner Tries To Describe The Awe of Space, Jeff Bezos Shoots Champagne Like An Asshole

Oldest living person to ever go to space, William Shatner, tries to explain the majesty of space while Jeff Bezos shakes up a bottle of champagne. Shatner cl...

^YouTube

@Natasha Nox 🇺🇦🇵🇸 @AL

Questa voce è stata modificata (1 anno fa)

AL 1 anno fa • mastodon (AP)

@trechnex
I saw that too and that said so much about the problem.
They treated him as a prop.

Cory Doctorow 1 anno fa • mastodon (AP)

Here's a fun AI story: a security researcher noticed that large companies' AI-authored source-code repeatedly referenced a nonexistent library (an AI "hallucination"), so he created a (defanged) malicious library with that name and uploaded it, and thousands of developers automatically downloaded and incorporated it as they compiled the code:

theregister.com/2024/03/28/ai_…

Children playing on a climber. The colors of the climber and the foliage behind them has been oversaturated and shifted, making it surreal. The kids' heads have been replaced with the red eye of HAL 9000 from Kubrick's '2001: A Space Odyssey.' Standing in the foreground at rigid attention is a man in short-sleeved military garb, wearing aviator shades.

Image:
Cryteria (modified)
https://commons.wikimedia.org/wiki/File:HAL9000.svg

CC BY 3.0
https://creativecommons.org/licenses/by/3.0/deed.en

--

Jorge Royan (modified)
https://commons.wikimedia.org/wiki/File:Munich_-_Two_boys_playing_in_a_park_-_7328.jpg

CC BY-SA 3.0
https://creativecommons.org/licenses/by-sa/3.0/deed.en

--

Noah Wulf (modified)
https://commons.m.wikimedia.org/wiki/File:Thunderbirds_at_Attention_Next_to_Thunderbird_1_-_Aviation_Nation_2019.jpg

CC BY-SA 4.0
https://creativecommons.org/licenses/by-sa/4.0/deed.en

AI hallucinates software packages and devs download them – even if potentially poisoned with malware

Simply look out for libraries imagined by ML and make them real, with actual malicious code. No wait, don't do that

^{Thomas Claburn (The Register)}

Questa voce è stata modificata (1 anno fa)

AndresFreundTec 1 anno fa • mastodon (AP)

I accidentally found a security issue while benchmarking postgres changes.

If you run debian testing, unstable or some other more "bleeding edge" distribution, I strongly recommend upgrading ASAP.

openwall.com/lists/oss-securit…

oss-security - backdoor in upstream xz/liblzma leading to ssh server compromise

^{www.openwall.com}

1 14

dgilman 1 anno fa • mastodon (AP)

congrats and thank you for the investigation- IMO this is going to go down as the vuln of the decade. What a find.

AndresFreundTec 1 anno fa • mastodon (AP)

@dgilman Unfortunately I suspect we'll see a lot more such attacks going forward, in all likelihood with more success in some cases.

@dgilman

Rihards Olups 1 anno fa • mastodon (AP)

@dgilman
This is insane. I expect full-fledged articles out soon, but another interesting bit in news.ycombinator.com/item?id=3… :

"the apparent author of the backdoor was in communication with me over several weeks trying to get xz 5.6.x added to Fedora 40 & 41 because of it's "great new features""

This is CVE-2024-3094 for easier tracking.

#JiaT75 #CVE20243094

Very annoying - the apparent author of the backdoor was in communication with me... | Hacker News

^{news.ycombinator.com}

#jiat75 #cve20243094 @dgilman

Questa voce è stata modificata (1 anno fa)

AndresFreundTec 1 anno fa • mastodon (AP)

I was doing some micro-benchmarking at the time, needed to quiesce the system to reduce noise. Saw sshd processes were using a surprising amount of CPU, despite immediately failing because of wrong usernames etc. Profiled sshd, showing lots of cpu time in liblzma, with perf unable to attribute it to a symbol. Got suspicious. Recalled that I had seen an odd valgrind complaint in automated testing of postgres, a few weeks earlier, after package updates.

Really required a lot of coincidences.

1 4

SiZiOUS 1 anno fa • mastodon (AP)

Kudos!

f0wL 1 anno fa • mastodon (AP)

Thanks for investigating this! 👏

Chris. R. 🎧🎼☕🍍 1 anno fa • mastodon (AP)

amazing find, thank you

Garvin Hicking 1 anno fa • mastodon (AP)

Gotta add to the noise, many thanks for digging into this. If it wasn't for you, who knows what could've been done here. You're a hero, and I mean it.

Jim Winstead 1 anno fa • hometown (AP)

Am I understanding correctly that these were sshd processes fending off the deluge of bogus logins that any publicly accessible sshd has to contend with? If so, good thing you weren’t testing on a more isolated machine.

AndresFreundTec 1 anno fa • mastodon (AP)

@jimw Correct, and indeed.

@Jim Winstead

satai 1 anno fa • mastodon (AP)

many thanks... The "coincidences" would not help unless you had abilities and cared.

mmap 1 anno fa • mastodon (AP)

The open source community really owes you a huge debt of gratitude. Thank you for exposing this security issue and bringing it to the light of day.

Marek Baczyński 1 anno fa • mastodon (AP)

🫡

railmeat 1 anno fa • mastodon (AP)

Thanks for your work on this. Everyone should follow your example.

AndresFreundTec 1 anno fa • mastodon (AP)

One more aspect that I think emphasizes the number of coincidences that had to come together to find this:

I run a number "buildfarm" instances for automatic testing of postgres. Among them with valgrind. For some other test instance I had used -fno-omit-frame-pointer for some reason I do not remember. A year or so ago I moved all the test instances to a common base configuration, instead of duplicate configurations. I chose to make all of them use -fno-omit-frame-pointer.

AndresFreundTec 1 anno fa • mastodon (AP)

Afaict valgrind would not have complained about the payload without -fno-omit-frame-pointer. It was because _get_cpuid() expected the stack frame to look a certain way.

Additionally, I chose to use debian unstable to find possible portability problems earlier. Without that valgrind would have had nothing to complain.

Without having seen the odd complaints in valgrind, I don't think I would have looked deeply enough when seeing the high cpu in sshd below _get_cpuid().

AndresFreundTec 1 anno fa • mastodon (AP)

There are more coincidences that are even less interesting. But even the above should make it clear how unlikely it was that I found this thing.

Pedro Fonseca 1 anno fa • mastodon (AP)

but still, you did. 🙇👏

Alex M. Dunne (he/him) :ally: 1 anno fa • mastodon (AP)

Nonetheless, amazing work. Hope you get a Gold Star at the office...

Questa voce è stata modificata (1 anno fa)

Bernd Helmle 1 anno fa • mastodon (AP)

outstanding...luck , knowledge and experience have met the right person at the right point in time.

AndresFreundTec 1 anno fa • mastodon (AP)

Just to be clear: I didn't mean that I didn't do good - I did. I mean that we got unreasonably lucky here, and that we can't just bank on that going forward.

1 1

Michael 1 anno fa • mastodon (AP)

dont for a minute think that you are ever having a holiday again! We need you monitoring those timings! The world needs you! 🏅

Le Néandertal se sent las, las 1 anno fa • mastodon (AP)

but there are thousands of devs running all sorts of tests. The question is not "what were the odds that you missed it", but "what were the odds that everybody missed it"...

Jay Reding 🇺🇦 1 anno fa • mastodon (AP)

That was more than just good - you probably stopped a devastating attack on the whole industry. The open source community owes you a huge debt of gratitude. Had that exploit gotten into the wild it would have been awful. Catching it early was an immense win.

I hope Microsoft recognizes how much of a contribution you made to the entire industry.

RiemaruK 1 anno fa • mastodon (AP)

Hey dude, you really save Millions, thanks a lot.

(Luck or not you did a fantastic job).

haliphax 🦃 1 anno fa • mastodon (AP)

Yep! Important to remember that one of the coincidences in the chain was that it landed in your lap, and you had built a set of skills over your career that were necessary to dig deeper. 🍻

henriklewander 1 anno fa • mastodon (AP)

Unlikely they attacked only one out of every possible package that could provide access to a system. How do we find all the other dormant hacks?

Andrew Helwer 1 anno fa • mastodon (AP)

lmfaooooooo the fact that this was found because of -fno-omit-frame-pointer confirms this is the final FOSS Discourse Event, literally every single thing that people have ever talked about in FOSS for the past year makes an appearance here

Mark (praseodym) 1 anno fa • mastodon (AP)

wondering whether Debian also finally decided to also add frame pointers led me to bugs.debian.org/cgi-bin/bugrep… which was created by you! (10 years ago, and still open…)

#767756 - glibc: Consider providing a libc build compiled with -fno-omit-frame-pointer to help with profiling - Debian Bug report logs

^{bugs.debian.org}

AndresFreundTec 1 anno fa • mastodon (AP)

@praseodym Hah. I've apparently been doing this stuff for a while.

@Mark (praseodym)

Mark (praseodym) 1 anno fa • mastodon (AP)

I see you’ll be at Oxide and Friends, super cool! Unfortunate a bit too late for me (2am) so I’ll listen to it as a podcast.

I’m trying to understand the context a bit better: how did you get Debian with -fno-omit-frame-pointer, did you compile it yourself? Or did the valgrind errors came from PostgreSQL builds with liblzma linked to it?

AndresFreundTec 1 anno fa • mastodon (AP)

@praseodym I do not have all of Debian built with -fno-omit-frame-pointer (although I do have a ~10 year old bug report about wanting a glibc package with frame pointers), just postgres. The errors came from postgres being built with libsystemd support, which in turn linked to liblzma.

@Mark (praseodym)

Michel Lind :fedora: :debian: 1 anno fa • mastodon (AP)

now that @fedora, @ubuntu and @archlinux have frame pointers, maybe this #xzorcist issue will encourage #Debian to follow suit

#Debian #xzorcist @Canonical Ubuntu @Fedora Project @Arch Linux :archlinux:

Questa voce è stata modificata (1 anno fa)

Mark to Markov Chain 1 anno fa • mastodon (AP)

I recognize -fno-omit-frame-pointer as being important for ASAN github.com/google/sanitizers/w… which has some overlap in functionality with valgrind (but obviously a fundamentally different approach).

AddressSanitizerFlags

AddressSanitizer, ThreadSanitizer, MemorySanitizer - google/sanitizers

^GitHub

gokuldas 1 anno fa • mastodon (AP)

"... and kids, that's how i saved the world"

makazeu 1 anno fa • mastodon (AP)

Thank you for making free world safer.

Glyph 1 anno fa • mastodon (AP)

I feel both confident and also kind of queasy when saying this: it seems extremely likely that this is not the first time something like this has happened, it's just the first time we have been lucky enough to notice.

LisPi 1 anno fa • pleroma (AP)

That is true.

Binary artifacts have no business existing in Free Software (or near-binary considering how auditable pre-generated config scripts end-up being). The way it was compromised in this case is almost certain to have happened before and reminds me of the SourceForge malware debacle (so arguably that's another famous example of it happening before).

I"m not sure if many other projects do like Guix and record the checksum of the whole repository so as to ensure reproducibility purely from source.

🍒🌳 Hartmut Goebel 1 anno fa • mastodon (AP)

> I"m not sure if many other projects do like Guix and record the checksum of the whole repository so as to ensure reproducibility purely from source.

If the packager chooses to use the official tarball as "the source", validating the checksum would not have helped. Also whether it's always possible to run running autoreconf depends on the content of the tarball.

Which brings me to the (preliminary) conclusion that we'd better use repos as source of trust
@lispi314 @AndresFreundTec @glyph

@Glyph @LisPi @AndresFreundTec

Martin Ueding 1 anno fa • mastodon (AP)

@kirschwipfel @lispi314 @glyph
Sounds good. But some projects have a build stage which generates lots of things. Packagers for distributions need to set up the needed environment and perform these steps. It seems much easier to use a provided artifact in these cases.

I think this attack is hard to defend against: An evil insider in the project with control over the code and artifacts. One could also hide malicious stuff in the code itself directly, in plain sight.

@🍒🌳 Hartmut Goebel @Glyph @LisPi

正經說話搞笑做法 1 anno fa • mastodon (AP)

I read news that about this attack, thank for your alertness. 👍

silverwizard 1 anno fa • friendica (via ActivityPub)

@AndresFreundTec Good job! You deserve a lot of kudos!

@AndresFreundTec

Winni Neessen 1 anno fa • mastodon (AP)

You accidentally hit the find of the year (so far at least). Might even have fucked up a state-sponsored campaign with your find. Kudos for that and also great write-up of the whole issue.

Kenneth Hoste 1 anno fa • mastodon (AP)

Thank you for your efforts, and the excellent writeup you did when reporting what you uncovered.
It’s already clear that this whole situation will shake things up quite a bit, and rightfully so.

For those interested, see also boehs.org/node/everything-i-kn… on the history behind this…

Everything I know about the XZ backdoor

Please note: This is being updated in real time. The intent is to make sense of lots of simultaneous discoveries

^boehs.org

Luke Miller 1 anno fa • mastodon (AP)

You literally saved the internet and probably billions of dollars, well done

GermanoMassullo 1 anno fa • mastodon (AP)

you're a hero!

Lukáš Zapletal 1 anno fa • mastodon (AP)

fascinating read. Thanks.

Mo :ferris: :tux: 1 anno fa • mastodon (AP)

Thank you 🤗

wfk 1 anno fa • mastodon (AP)

So, is the exploding complexity of software in itself perhaps a security risk? The fact that the existing code is so complex that it is relatively easy to hide a backdoor with nobody noticing is somehow worrying.

Calisti 🏳️‍🌈🦇 1 anno fa • mastodon (AP)

How many of your 2407 followers did you gain in the last 48 hours? (One of them being me 😇)

BrilliantIdiot 1 anno fa • mastodon (AP)

Read about this on Lemmy. Just want to say I appreciate it. Very nice work! I'm not that smart, so the fact a half-second delay set off red flags for you is incredible.

JohnnyThan 1 anno fa • mastodon (AP)

Thank you.

Bullwong 1 anno fa • mastodon (AP)

This is wild, your hyper-specific benchmarking accidentally saved the majority of computers worldwide 😭

_Wr_ 1 anno fa • mastodon (AP)

You saved millions of Internet users

Daniel Chateau :donor: (シャトー・ダニエル) 1 anno fa • mastodon (AP)

Mildly curious about something in the report; why were you using Debian Unstable in a production environment? Isn't that generally intended for testing or am I misunderstanding your report here?

AndresFreundTec 1 anno fa • mastodon (AP)

@djchateau This was on a system for testing and benchmarking, not a production system in that sense.

@djchateau

Matthias 1 anno fa • mastodon (AP)

if we ever meet IRL, I owe you a beer!

Zac Bowling 🥑 1 anno fa • mastodon (AP)

incredible work!

Moppi 1 anno fa • mastodon (AP)

Thanks !

Àngel Aguilera :debian: 1 anno fa • mastodon (AP)

Ja ho deveu saber, que li devem una birra (i més) a @AndresFreundTec, veritat?

@AndresFreundTec

uyamuyatuya43 1 anno fa • mastodon (AP)

Thank you for being lucky and not letting it go

🙏

Andrew Hao 1 anno fa • mastodon (AP)

Thank you for your analysis and time!

Graham Perrin 1 anno fa • mastodon (AP)

thank you, I see the paragraph that begins:

"To reproduce outside of systemd, …"

I have someone claiming:

"The exploit requires systemd. …"

Can both be true?

Postscript: thanks to @vi for helping me to realise my misunderstanding.

Apologies for the noise.

@Vi • :flan_ranger:

Questa voce è stata modificata (1 anno fa)

Rượu Ngoại QKAWine 1 anno fa • mastodon (AP)

Luckily I read the information early to prepare.

Erik Uden 🍑 2 mesi fa • mastodon (AP)

You're a hero ❤️

Elena ``of Valhalla'' 1 anno fa • friendica

Ricevo, e credo che sia utile per un po' di vittime di #trenord qui sul fediverso

prealpina.it/pages/lombardia-t…

“La norma nel prevedere la necessità di richiesta dell’abbonato reindirizza la misura compensativa del disagio a chi effettivamente lo ha subito, diversamente da quanto accadeva con il vecchio bonus.”

che credo voglia dire, più o meno “speriamo che la maggior parte dei pendolari si dimentichino di chiederlo e/o non vengano a sapere di doverlo chiedere”

se ho ben capito le istruzioni su come fare la richiesta sono già su regione.lombardia.it/wps/porta…

@LaVi 🕊️📚🐈 @Fabio #trenò

#trenord #trenò @Fabio @LaVi

4 3

Elena ``of Valhalla'' 1 anno fa • friendica

@LaVi 🕊️📚🐈 @Fabio mi pareva tempo fa di aver trovato su uno dei siti istituzionali (trenord o regione) che i treni soppressi contino uguali ai treni con più di 30 minuti di ritardo, ma adesso non ho il link sottomano (e non so se le nuove regole siano cambiate).

Comunque c'è il fatto che quei dati non dicono che i treni in ritardo sono ovviamente soprattutto in ora di punta (anche per ragioni ragionevoli, tutto sommato), e che quindi impattano molte più persone rispetto ai treni in orario alle 10 di mattina o alle 8 di sera.

@Fabio @LaVi

1 1

Lars Wirzenius 1 anno fa • mastodon (AP)

1/ It’s a big day for the Radicle community :space_invader: We're excited to announce the rollout of our first release candidate for Radicle 1.0 — our most significant update to date :tada:

Start collaborating today
👉 radicle.xyz

Here’s an overview of what’s new 🧵

Radicle

Sovereign code infrastructure.

^radicle.xyz

Lars Wirzenius 1 anno fa • mastodon (AP)

2/ This release marks the stabilization of Heartwood, the peer-to-peer protocol that powers Radicle with a sovereign data network for code collaboration and publishing, built on top of Git. Heartwood addresses the usability and performance concerns faced during previous protocol iterations while doubling down on Radicle's secure and resilient primitives.

Learn more about Heartwood:
radicle.xyz/guides/protocol

Radicle

Sovereign code infrastructure.

^radicle.xyz

Lars Wirzenius 1 anno fa • mastodon (AP)

3/ Radicle 1.0 features the core primitives for code collaboration, including patches and issues, with CI coming soon :corn:

Typically, artifacts like patches and issues are only found on centralized platforms like GitHub or GitLab, or their self-hosted counterparts. In Radicle, they are stored directly inside repositories and replicated between peers. This means that social artifacts inherit the same properties as source code: they are local-first, user-owned, and cryptographically signed.

Lars Wirzenius 1 anno fa • mastodon (AP)

4/ Instead of depending on a centralized server, Radicle users run nodes connected via a peer-to-peer network. Nodes host and synchronize Git repositories across the network, using a gossip protocol, alongside Git’s transfer protocol.

With this release also comes the launch of the Radicle Network, which lets users provide bandwidth, storage, and data availability to peers of their choice.

To seed is to give back 🌱

Lars Wirzenius 1 anno fa • mastodon (AP)

5/ Already, the Radicle Network is growing:

📈 > 100 nodes online daily
📈 > 400 unique repositories
📈 ~ 50 public seed nodes replicating repositories

Lars Wirzenius 1 anno fa • mastodon (AP)

6/ If you've been waiting for the right moment to try Radicle, this is it! We’ve got some shiny new guides to help you get started:

User Guide → radicle.xyz/guides/user
Seeder Guide → radicle.xyz/guides/seeder

👾 👾 👾

Radicle

Sovereign code infrastructure.

^radicle.xyz

Lars Wirzenius 1 anno fa • mastodon (AP)

We need neutral and permissionless infrastructure to truly free the web 🏴‍☠️

Reliance on centralized forges is not sustainable for the future of free and open source software. We built Radicle to change that.

Try Radicle. Free your code.

Amolith 1 anno fa • akkoma (AP)

after figuring out how I needed to start/integrate ssh-agent, this was easier than expected!
app.radicle.xyz/nodes/seed.rad…

Radicle

Sovereign code infrastructure.

^{app.radicle.xyz}

Amolith 1 anno fa • akkoma (AP)

aha and now I've got it seeding from my own node
app.radicle.xyz/nodes/radicle.…

Is there currently anything for exposing tags and the tags' annotations as releases and release notes? What happens when someone decides they want to delete a repo from the network? Is that even possible?

Radicle is _really_ cool so far. I hope more people pick it up :)

Radicle

Sovereign code infrastructure.

^{app.radicle.xyz}

Lars Wirzenius 1 anno fa • mastodon (AP)

@amolith I'm nor sure about the tags. May I ask you to join the Zulip to ask? The people who know Radicle deeply are there.

@Amolith

Evan Prodromou 1 anno fa • mastodon (AP)

Evan Prodromou is ignored

stf 1 anno fa • mastodon (AP)

this radicle looks very interesting. is there also some web-frontend even if only read-only - for the casual drive-by oooh-that's interesting kind of stumbling over projects and poking at their intestants?

Lars Wirzenius 1 anno fa • mastodon (AP)

@stf Yeah, there is bot a "web site" where you can browse a node's repositories and a "web app" where you can browse your own and (still experimental) manage issues and comment on patches.

@stf

Andrew Gallagher 1 anno fa • mastodon (AP)

that’s really cool! One terminology concern though - there’s a glaring conflict between “git remote” and “local first storage” that will really really confuse people (and git is already confusing!).

Lars Wirzenius 1 anno fa • mastodon (AP)

@andrewg I've forwarded that to Zulip.

@Andrew Gallagher

Lars Wirzenius 1 anno fa • mastodon (AP)

@lmas We're working on it. No promises on when it'll be ready.

@lmas

Alex 1 anno fa • gotosocial (AP)

It's a really cool project but now I wish they would make a presence on the fediverse too (and not just twitter). Can't be bothered to create yet another account on their zulip instance or whatever it's called

Lars Wirzenius 1 anno fa • mastodon (AP)

@lmas Apparently for read-only access, Zulip doesn't require an account. The #annoucement stream is where releases are announced, but we intend to broaden from there.

#annoucement @Alex

Stefano Tartarotti 1 anno fa • mastodon (AP)

Il sovranismo spiegato con l'umidità.
#sovranisti #destre #lega #salvini

#lega #Salvini #destre #sovranisti

Uncle Duke 1 anno fa • mastodon (AP)

first milk goes bad then it turns evil

fluffy pure white cat rests in the bottom of a clear waste paper basket

Programming Quotes 1 anno fa • mastodon (AP)

Debugging is twice as hard as writing the code in the first place. Therefore, if you write the code as cleverly as possible, you are, by definition, not smart enough to debug it.

— Brian W. Kernighan

#debugging

1 3

Adrian Hon 1 anno fa • mastodon (AP)

RIP to a real one. Practically everything he wrote was decades ahead of its time, not to mention superbly entertaining and deeply humanist. file770.com/vernor-vinge-1944-…

Vernor Vinge (1944-2024) - File 770

Vernor Vinge, author of many influential hard science fiction works, died March 20 at the age of 79. Vinge sold his first science-fiction story in 1964, "Apartness", which appeared in the June 1965 issue of New Worlds.

^{Mike Glyer (File 770)}

Adrian Hon 1 anno fa • mastodon (AP)

Lots of people sharing their love of A Fire Upon the Deep and A Deepness in the Sky, but don't miss Rainbows End.

It's perhaps a less successful story but remains, after almost two decades, the best description of what augmented reality games and ARGs might do to the world. en.wikipedia.org/wiki/Rainbows…

2006 novel by Vernor Vinge

^{Contributors to Wikimedia projects (Wikimedia Foundation, Inc.)}

Charlie Stross 1 anno fa • mastodon (AP)

That's the book that "Halting State" lost to in the 2007 Hugo awards. (Which was *also* about AR and ARGs, and also espionage and crime.)

Adrian Hon 1 anno fa • mastodon (AP)

@cstross a tough year!

@Charlie Stross

Piers Cawley 1 anno fa • mastodon (AP)

@cstross Rainbows End is the one that lives in my head more than the rest of his books (though they all have their places in there).

Every time autocorrect fucks up again, I find myself wishing for the kind of interfaces described in Rainbows End.

@Charlie Stross

Charlie Stross 1 anno fa • mastodon (AP)

@pdcawley But NOT the approach to library digitization!

@Piers Cawley

Piers Cawley 1 anno fa • mastodon (AP)

@cstross NOOO. That's fucking *horrifying*.

I do like the idea of searchable marginalia, but not at that cost.

@Charlie Stross

Scott Laird 1 anno fa • mastodon (AP)

@cstross @pdcawley the first time I read that, I kept asking myself if that was *actually* the easiest way to scan a library, given enough computing power. I still think the answer the probably yes.

@Charlie Stross @Piers Cawley

🇸🇭🇮🇳🇲🇦🇮:verify: (not here right now) 1 anno fa • mastodon (AP)

Mastodon Just Let Me Save The Original GIF And Not The h.264 encoded MP4 You Made From It Challenge 2024 - Impossible Difficulty

:( big sadge

J Wolfgang Goerlich 1 anno fa • mastodon (AP)

Shel Silverstein doesn’t get nearly enough credit for predicting ChatGPT.

Diego Roversi 1 anno fa friendica

A cat, just because....

#cat

#cat

Diego Roversi 1 anno fa friendica

the animated gif was too big for friendika. Let's try with a scaled down version:

#cat

TarValon.Net 1 anno fa • writefreely (AP)

- Book five spoiler incoming -
"Who Killed Asmodean?" was by far the most commonly asked question Robert Jordan received. He said the answer should be "intuitively obvious to the casual observer." So, who did you think it was at first?
#AesSedai #BrandonSanderson #Community #Fandom #Fansite #Fantasy #FantasyBooks #RobertJordan #TarValon #TarValonNet #TheWheelOfTime #TheWhiteTower #TootersOfTime #WheelOfTime #WheelOfTimeSeries #WoT #WoTBookSpoilers #WoTOnPrime

#community #fantasy #wot #fandom #thewheeloftime #fantasybooks #wheeloftime #aessedai #brandonsanderson #fansite #RobertJordan #tarvalon #tarvalonnet #thewhitetower #TootersOfTime #wheeloftimeseries #wotbookspoilers #wotonprime

Colin Watson 1 anno fa • mastodon (AP)

I had no clue, but I still think he meant this remark in the way that such a phrase would be understood by students of mathematics or physics hearing it from their professors: that is, if you think really hard about it for some weeks then you ought to be able to reconstruct the chain of reasoning using only information you currently have. (And in fact since m.fanfiction.net/s/4975913/1/S… got it exactly right in 2000 or so, he was right!)

Natanael Copa 1 anno fa • mastodon (AP)

#scaleway offers #riscv metal instances now. And they support @alpinelinux !

It appears to be relatively vanilla alpine edge with a custom kernel.

labs.scaleway.com/en/em-rv1/

Elastic Metal RV1

The world's first RISC-V servers available in the cloud. Taste the new open processor architecture now. Will you take the risk?

^{labs.scaleway.com}

#RISCV #scaleway @Alpine Linux :alpine:

Greg Egan 1 anno fa • mastodon (AP)

“Scale melds incredibly creative and thought-through hard science fiction with the kind of social-political angle Egan’s increasingly been foregrounding in his work, and you’d do well to pick it up.”

locusmag.com/2024/02/the-year-…

The Year in Review 2023 by Jake Casella Brookins

2023 wound up being a strange reading year for me. I started the year with a big move: from Chicago back to beautiful Buffalo, NY. While it’s wonderful to be back east and closer to the mountains, …

^{Locus Online}

Andrey Konovalov 1 anno fa • mastodon (AP)

Wrote an article about turning a ThinkPad X1 Carbon 6th Gen laptop into a programmable USB device by enabling the xDCI controller 😯

Now I can emulate USB devices from the laptop without any external hardware, including via Raw Gadget or even Facedancer 😁

The overall process included fiddling with Linux kernel drivers, xHCI, DWC3, ACPI, BIOS/UEFI, Boot Guard, TPM, NVRAM, PCH, PMC, PSF, IOSF, and P2SB, and making a custom USB cable 😱

xairy.io/articles/thinkpad-xdc…

🤫 Unlocking secret ThinkPad functionality for emulating USB devices

Enabling and using xDCI controller on ThinkPad X1 Carbon 6th Gen

^{Andrey Konovalov}

Trammell Hudson 1 anno fa • mastodon (AP)

the lock bits being reset during S3 sleep and not re-locked seems like an evergreen design failure. Thunderstrike 2 used a similar mistake (PRR lock bits not re-locked soon enough coming out of S3 sleep) and Prince Harming was a regression (PRR bits not re-locked at all on a new platform). trmm.net/Thunderstrike2_detail…

slide from thunderstrike 2 presentation showing a log of console commands reading FLOCKDN bits, going to sleep, and reading FLOCKDN again, now with no locks enabled

Thunderstrike2 details

Collection of my projects and hacks.

^{Trammell Hudson's Projects}

Marco d'Itri :debian: 1 anno fa • mastodon (AP)

Come chiunque aveva previsto, a meno di un mese dall'attivazione la piattaforma #antipezzotto di #AGCOM oggi ha illecitamente censurato l'IP 188.114.97.7 di Cloudflare che ospita centinaia di migliaia di siti che non c'entrano niente con lo streaming dello sport. Bravi tutti. #piracyshield

#agcom #antipezzotto #piracyshield

1 8

[MAIONE MIKΨ] 1 anno fa • mastodon (AP)

probabilmente nel tutorial di cyber sicurezza su YouTube non si parlava di CloudFlare 🦧

Questa voce è stata modificata (1 anno fa)

Marco d'Itri :debian: 1 anno fa • mastodon (AP)

Dopo diverse ore 188.114.97.7 è stato sbloccato, anche se non ho capito su quale base legale visto che i blocchi dovrebbero essere permanenti.

Piero Bosio 1 anno fa • mastodon (AP)

Purtroppo a rimetterci è anche la reputazione dell'Agcom.

dday.it/redazione/48554/piracy…

PiracyShield ci ricasca: decine di siti leciti bloccati dietro un IP di Cloudflare. Danni collaterali o illecito?

Sabato 24 febbraio 2024 la piattaforma PiracyShield ha ordinato ai provider italiani di escludere un IP dalla navigazione, una delle tantissime segnalazioni. Ma si trattava di un IP di Cloudflare: in un colpo "bannati" decine di siti leciti.

^{Gianfranco Giardina (DDay.it)}

Il Gigante 1 anno fa • mastodon (AP)

ma non ci sono gli estremi per una class action per una cosa del genere?

Rozzychan 1 anno fa • mastodon (AP)

A podficcer posted this link about voice acting that is pretty hilarious.
#voices #voiceActing

tumblr.com/seananmcguire/74270…

Seanan's Tumblr

This is such a skill

^Tumblr

#voiceacting #voices

Daniel Keys Moran 1 anno fa • mastodon (AP)

Isaac Asimov:

Fabio 1 anno fa • friendica

This message does not exist

I received an intriguing notification in the Microsoft Outlook 365 web interface: "This message can't be saved because it no longer exists. It can only be discarded. Make sure you copy the contents of the message before you discard if you want to use them later. " I have some ontological questions.

^www.kmjn.org

Italy

Rasmus Bååth 1 anno fa • mastodon (AP)

On my blog: Why pandas feels clunky when coming from R

sumsar.net/blog/pandas-feels-c…

Why pandas feels clunky when coming from R

Five years ago I started a new role and I suddenly found myself, a staunch R fan, having to code in Python on a daily basis. Working with data, most of my Python work involved using pandas, the …

^{Rasmus Bååth's Blog}

Ada Palmer 1 anno fa • mastodon (AP)

"One price of free speech is eternal humility, recognizing that none of us is immune to becoming a tool of censorship if we fail to recognize its manipulative tactics."

“Tools for Thinking About Censorship”

reactormag.com/tools-for-think…

Tools for Thinking About Censorship - Reactor

^{Ada Palmer (Reactor)}

Marcos Abreu 1 anno fa • mastodon (AP)

I would like to say that your article is amaizing! And you are a great writer. Thx for sharing.

Questa voce è stata modificata (1 anno fa)

Ada Palmer 1 anno fa • mastodon (AP)

@abreums Thank you!

@Marcos Abreu

Liam @ GamingOnLinux 🐧🎮 1 anno fa • mastodon (AP)

Since Reddit has now sold out to AI, a reminder if you're into #Linux / #LinuxGaming that Lemmy exists and it's open source.

I'm a mod here too: lemmy.ml/c/linux_gaming@lemmy.…

Linux Gaming - Lemmy

^lemmy.ml

#Linux #linuxgaming

addie 1 anno fa • mastodon (AP)

Stop turning your Linux apps into Docker containers and removing the normal install methods.

nano's old account's rotting corpse 1 anno fa • akkoma (AP)

a tower of blocks captioned "all modern video infrastructure". one tiny block on the bottom is stopping all of it from falling over, and it's labelled "ffmpeg"

1 1

Zand :arch: :terminal: 1 anno fa • mastodon (AP)

Mi preoccupa molto il Piracy Shield introdotto, anche se non vedo partite piratate o sia possessore di "pezzotto", ma per le implicazioni a corto/lungo termine che porta.
È notizia di un paio di giorni fa che insieme agli ip di alcuni siti di streaming video siano stati indiscriminatamente bloccati in toto gli ip di 2 CDN (cloud4c.com e parte di zenlayer), rendendo impossibile anche a chi avesse servizi leciti li sopra di essere raggiunti dall'Italia, l'organo che si occupa della faccenda (agcom) è un organo privato che si erge a "controllore", "multatore" e "bloccatore". Con il mer(d)aviglioso governo fascista che abbiamo ci vorrà poco affinché da un utilizzo anti pirateria si passi ai blocchi per fini politici adducendo motivazioni fantasiose (tipo il decreto antisemitismo di Salvini per gli artisti e le tv).

Zand :arch: :terminal: 1 anno fa • mastodon (AP)

Poi, ovvio, con i dns giusti, vpn, tor ecc te ne sbatti, ma il problema è per l'utente medio e soprattutto per il grande disegno di censura che potrebbero applicare

Lysander il breve 1 anno fa • iceshrimp (AP)

A me stupisce (forse non dovrebbe, non più) il fatto che sta cosa è andata su e come stampa nessuno ne ha parlato. Ne ho sentito giusto di sfuggita come "il governo inventa una innovativa piattaforma anti illegalità" e bon.
Cosa che mi irrita e mi turba profondamente.

Poi, per quanto ne so (chi sa corregga quando dico cazzate!) non bastano dns puliti ma serve proprio una vpn (e questo comunque se gli ip bloccati non sono in un AS gestito da un provider italiano) perché è una sorta di blackhole-on-demand.
Gestito da privati.
Un enorme merdone su un sacco di livelli insomma.

Mi chiedo cosa possano fare i proprietari delle cdn bloccate, se possono fare causa e a chi.

Diego Roversi 1 anno fa friendica

Tutto sacrosanto, ma non mi risulta che Agcom sia privato.

Zand :arch: :terminal: 1 anno fa • mastodon (AP)

@diegor si si è stata una mia inesattezza, ho travisato il privato con indipendente

@Diego Roversi

Enoch 1 anno fa • mastodon (AP)

Happy caturday 🐈! Here’s a cat selfie I found somewhere on the www! 😂 i hope you all have a great weekend ☀️🥳🙌

Gray cat taking a selfie with 2 Rottweilers behind him standing in the snow

Talen Lee 1 anno fa • mastodon (AP)

This youtube video does something I literally had no idea was possible with the subtitle system. Watch it without subtitles to get an idea for what the base video looks like, then watch it with the subtitles on.

youtube.com/watch?v=ZYlaUrj2Zk…

Oshi no Ko Opening (4k 60FPS)┃Creditless

Oshi no Ko OP / Opening Theme "Idol (アイドル)" by YOASOBITV Anime "推しの子" Opening ThemeLyrics by @yaco77 , @ichimonji4kanime , https://www.youtube.com/@JakeUHDv...

^YouTube

bert hubert 🇺🇦🇪🇺🇺🇦 1 anno fa • mastodon (AP)

Very proud that the IEEE has published my article “Why Bloat Is Still Software’s Biggest Vulnerability - A 2024 plea for lean software”:

spectrum.ieee.org/lean-softwar…

Why Bloat Is Still Software’s Biggest Vulnerability

^{Bert Hubert (IEEE Spectrum)}

Zand :arch: :terminal: 1 anno fa • mastodon (AP)

Filippone...
Ok che (come al solito dato che idee tue non ne hai mai avute), hai "copiato" l'impegno profuso da me e @kenobit sul progetto bookwyrm, ok che ti sei preso il dominio bookwyrm .it perché senza atteggiamenti predatori non ci sai stare, ok che hai mantenuto il logo ufficiale così puoi fare il paraculo e attirare gente spacciandoti per "istanza italiana" (tanto la descrizione non la legge nessuno), ma cazzo, copiare lettera per lettera (solo che non sai formattare il testo) il codice di condotta di bookwyrm.gatti.ninja... Dai su un po di fantasia, ce la puoi fare anche da solo no?
Nelle immagini in scuro gattininja in chiaro filippone.

#bookwyrm #gattininja

Policy copiata (male) dal collettivo devol

#Bookwyrm #gattininja @Kenobit

Yaku 🐗 1 anno fa • mastodon (AP)

@guardaminfaccia Daje FilippONE facci sognare, accusa gattinija di aver copiato da te!

@Fata turchina

rag. Gustavino Bevilacqua 1 anno fa • mastodon (AP)

È strano che non abbia ancora registrato puntarella it.

[EDIT]Ah, capito… è GIÀ registrato.

Questa voce è stata modificata (1 anno fa)

Diego Roversi 1 anno fa friendica

Erty 1 anno fa • hometown (AP)

Saw a meme and decided it needed a 4x4 taking it to the furthest extreme

1 3

Wynke 1 anno fa • Messaggio privato mastodon (AP)

Looks to me like Murphy understands the other ones pretty damn well...

brennen 1 anno fa • mastodon (AP)

ok, ok, but in the spirit of the original law, shouldn't murphy's razor be "anything that can be complicated, will be complicated"?

LWN.net is now @LWN@lwn.net 1 anno fa • mastodon (AP)

A locally exploitable glibc vulnerability lwn.net/Articles/960289/ #LWN

A locally exploitable glibc vulnerability

Qualys has disclosed a vulnerability in the GNU C Library that can be exploited by a local attacker for root access. It was introduced in the 2.37 release, and also backported to 2.36.

^lwn.net

#LWN

Julia Evans 1 anno fa • mastodon (AP)

combining branches

wizardzines.com/comics/combini…

combining branches

^{wizard zines}

Questa voce è stata modificata (1 anno fa)

Cat 🐈🥗 (D.Burch) :blobcatrainbow: 2 anni fa (Ricevuto 1 anno fa) • mastodon (AP)

Google announced that starting in June 2024, ad blockers such as uBlock Origin #uBO will be disabled in Chrome 127 and later with the rollout of Manifest V3 (#Mv3).

The new #Chrome manifest will prevent using custom filters and stops on demand updates of blocklist. Only #Google authorized updates to browser extension will be allowed in the future, which mean an automatic win for Google in their battle to stop YouTube #AdBlockers .

#ManifestV3 is deceitful and threatening to your privacy, and now is a good time to switch to #Firefox (@mozilla) and/or #TorBrowser (@torproject) if you haven't done so already!

EFF (@eff) on Google’s Manifest V3:

⚠️⁠eff.org/deeplinks/2021/12/chro…
⚠️⁠eff.org/deeplinks/2021/12/goog…

Chrome Manifest V3 Transition Timeline (2023-11-16)

🚩⁠developer.chrome.com/blog/resu…

EDIT for clarification: MV3 in Chrome will still allow some ad blocking extensions, but will severely limit their blocking ability and even restricts pre-set filters to 50 MAX.

Chrome Users Beware: Manifest V3 is Deceitful and Threatening

Like FLoC and Privacy Sandbox before it, Google Chrome’s Manifest V3 is another example of the inherent conflict of interest that comes from Google controlling both the dominant web browser and one of the largest internet advertising networks.

^{Electronic Frontier Foundation}

#google #firefox #Chrome #torbrowser #adblockers #manifestv3 #MV3 #ubo @Electronic Frontier Foundation @The Tor Project @Mozilla

Questa voce è stata modificata (2 anni fa)

Cat 🐈🥗 (D.Burch) :blobcatrainbow: 2 anni fa • mastodon (AP)

Mozilla Firefox

Desktop
📥⁠mozilla.org/en-US/firefox/
Android Play Store
📥⁠play.google.com/store/apps/det…
iOS App Store
📥⁠apps.apple.com/us/app/firefox-…

Tor Browser

Desktop
📥⁠torproject.org/download/
Android Play Store
📥⁠play.google.com/store/apps/det…
Fdroid Repo
📥⁠support.torproject.org/tormobi…
~~iOS App Store~~ (try OnionBrowser)
📥⁠onionbrowser.com/

#Firefox #Mozilla #TorBrowser #Tor #Browser #Privacy

Firefox - Protect your life online with privacy-first products

Firefox is more than a browser. Learn more about Firefox products that handle your data with respect and are built for privacy anywhere you go online.

^Mozilla

#privacy #firefox #tor #Mozilla #browser #torbrowser

Questa voce è stata modificata (2 anni fa)

Mikko Tuumanen 2 anni fa • mastodon (AP)

@mozilla But where is the download link to get Firefox apk? I don't want Google Play in my phone.

@Mozilla

Julian Andres Klode 🏳️‍🌈 1 anno fa • mastodon (AP)

Ah shoot I meant to write EU regulators but I keep forgetting. Like someone should investigate it and if there isn't a law to prevent it, write one.

Questo sito utilizza cookie per riconosce gli utenti loggati e quelli che tornano a visitare. Proseguendo la navigazione su questo sito, accetti l'utilizzo di questi cookie.

Note sull'uso di cookie da parte di questo sito.