Post B6OKGUSaEPVpBaV8JU by hyc@mastodon.social
(DIR) More posts by hyc@mastodon.social
(DIR) Post #B6MJu6XI6xtmIe6oVc by xan@xantronix.social
0 likes, 0 repeats
@dalias It's incredibly baffling to me how frequently it has been demonstrated in the course of uutils development how little people have referenced even coreutils CVE data or taken care to understand really basic things, like, /dev/tty or the file descriptor-oriented calls that make shit saferit seems less like an exercise in safety and more a clean room effort to relicense a thing in an ecosystem popular with the kids
(DIR) Post #B6MJu775xqXS5grPJg by xan@xantronix.social
1 likes, 1 repeats
@dalias anyhow i'd be a lot less negative about that whole endeavour if Canonical kept the dogfooding to themselves
(DIR) Post #B6MKKNRFtFzgFeoUlM by lanodan@queer.hacktivis.me
0 likes, 2 repeats
@xan @dalias I think it's not even clean room, because for this you'd actually hunt for all third-party documentation and specifications/standards, which they didn't (like how some of uutils CVEs are blatant "didn't read POSIX") and instead grabbed the coreutils testsuite.It's just pure "Rewrite it in Rust" where the only goal is for it to be in Rust.
(DIR) Post #B6MKuB51JhIELZU5Jo by mangeurdenuage@shitposter.world
0 likes, 0 repeats
@xan >more a clean room effort to relicense a thing It clearly is.
(DIR) Post #B6MXPoykDsVeWAP76O by datenwolf@chaos.social
0 likes, 1 repeats
@dalias Welcome to the club.
(DIR) Post #B6OIxwxPxGpU72WF28 by hyc@mastodon.social
0 likes, 0 repeats
@dalias yep, same. https://mastodon.social/@hyc/114841502231953489Frankly the interminably slow compile times were the first red flag for me. But resorting to AI just yells out "we don't know what we're doing".RT: https://mastodon.social/users/hyc/statuses/114841502231953489
(DIR) Post #B6OIxxDiydsCvc9GS0 by nxadm@infosec.exchange
0 likes, 0 repeats
@hyc @dalias What about other contenders like Go (fast compile, less smug about C)?
(DIR) Post #B6OIxxO0MQ63RUxTTU by hyc@mastodon.social
0 likes, 1 repeats
@nxadm @dalias Go has this weird design mentality of fetching every dependency you're using, straight from github. And no dynamic linking. It's too opinionated, IMO.Not to mention it was intentionally designed to be less flexible than C.
(DIR) Post #B6OJ2XrEhcE7iOopSy by mirabilos@toot.mirbsd.org
0 likes, 0 repeats
@dalias @nxadm @hyc yeah, its Microslop Github dependency is insane.And yes, it was intentionally designed as 80% language, one is supposed to use the right tool for the remaining jobs; ofc few do.
(DIR) Post #B6OJFp5tvdyAwD0f5M by mirabilos@toot.mirbsd.org
0 likes, 0 repeats
@dalias @nxadm @hyc you probably mean Issue9 (aka "golang" or "Google-Go"), not Go!
(DIR) Post #B6OKGUArIJKmIcCyga by nxadm@infosec.exchange
0 likes, 0 repeats
@hyc @dalias (It's not tied to github, it can be anything. It's in practice mostly github because most people publish their libraries there.)
(DIR) Post #B6OKGUSaEPVpBaV8JU by hyc@mastodon.social
0 likes, 0 repeats
@nxadm @dalias yes, but still that's an open door for malware, wherever you point it. https://mastodon.social/@hyc/113999242008616734RT: https://mastodon.social/users/hyc/statuses/113999242008616734
(DIR) Post #B6OKGUglNgr3tZ8SPo by nxadm@infosec.exchange
1 likes, 0 repeats
@hyc @dalias I don't see the difference with e.g. Java before maven where you had download libraries from weird random sites, or npm today where you know your dependencies will break in a few month. Probably good old Perl had it right with their CPAN model.
(DIR) Post #B6OLDnrBl30GQhICf2 by hyc@mastodon.social
0 likes, 0 repeats
@nxadm @dalias also, it's intentionally limiting in its expressiveness. Which makes sense as one of its design goals - it was designed to make projects and programmers at Google interchangeable. There's only one way to do things, so there can only be one "style". In short, it's designed for mediocrity. https://channel9.msdn.com/Events/Lang-NEXT/Lang-NEXT-2014/From-Parallel-to-Concurrent
(DIR) Post #B6OLDo2X4s4qzsbGLI by hyc@mastodon.social
0 likes, 1 repeats
@nxadm @dalias if you look at it as an attempt to make human programmers into interchangeable code spewing machines, then Google's new emphasis on AI code spewing machines probably means golang was a failure.
(DIR) Post #B6OPQaZsq9UupIYC0W by hyc@mastodon.social
0 likes, 0 repeats
@mirabilos @dalias @nxadm wow, "status changed to Unfortunate" https://github.com/golang/go/issues/9#issuecomment-66047478
(DIR) Post #B6OPQawZTne5xfAJN2 by lhp@mastodon.social
0 likes, 0 repeats
@hyc @mirabilos @dalias @nxadm "status changed to unfortunate" would be a tremendously funny group chat sticker / response-thingy
(DIR) Post #B6OPQb6UstaMSRoEqG by nxadm@infosec.exchange
0 likes, 0 repeats
@lhp @hyc @mirabilos @dalias It reads as very passive-aggressive, but it could be me :)
(DIR) Post #B6OPQbHqCiex1d7IWW by mirabilos@toot.mirbsd.org
0 likes, 0 repeats
@lhp @hyc @dalias @nxadm it totally is
(DIR) Post #B6OPRKTmBBwdBg2xsG by hyc@mastodon.social
0 likes, 0 repeats
@mirabilos @dalias @nxadm tbf, I sympathize. After all, naming is one of the two hardest problems in computer science (along with cache invalidation, and off-by-one errors). And I had to rename LMDB shortly after its release, to avoid confusion with other projects... it's tough to come up with good names.
(DIR) Post #B6OPUJcLq7jBNqTvQO by mirabilos@toot.mirbsd.org
0 likes, 0 repeats
@hyc @dalias @nxadm but if you can, a multi-billion-euro company can
(DIR) Post #B6OPeznvqSL97SzWNs by mirabilos@toot.mirbsd.org
0 likes, 0 repeats
@hyc @dalias @nxadm imagine Google released something called LMDB today, perhaps some cloud DB thingy all the big companies will use