Post B9fvIEpYEGleTM0SDg by ariadne@social.treehouse.systems
(DIR) More posts by ariadne@social.treehouse.systems
(DIR) Post #B8mVhZcaPw1Sflv0xk by ariadne@social.treehouse.systems
0 likes, 0 repeats
to be absolutely clear: pkgconf, or any of my other foundational projects, will never participate in ANY program that takes away autonomy from maintainers.so, in very simple words: the akrites project can do whatever the fuck they want, but if they approach me with some AI slop 0day and tell me I have a week to fix it, I will tell them to fuck right off, and if they do anything other than fuck right off, I will probably be suing them.
(DIR) Post #B8mW0dhlSWUKq7Qq8W by ariadne@social.treehouse.systems
0 likes, 0 repeats
to make this point further clear, I think I will be accelerating my plans to move pkgconf to codeberg
(DIR) Post #B8mWOD6lzparIlMwSG by ariadne@social.treehouse.systems
1 likes, 1 repeats
if the future of indie free software maintenance is to be bullied and pushed around by corporate linux foundation projects such as akrites, then I'm frankly not interested
(DIR) Post #B8mYk4bcUMSbD8LlWC by ariadne@social.treehouse.systems
0 likes, 0 repeats
@vathpela i *am* maintaining critical infrastructure. and i *am* very tired of these people already.
(DIR) Post #B8mlCxAWPwPpzdDFbc by argv_minus_one@mastodon.sdf.org
0 likes, 0 repeats
@ariadne A week?! Whatever happened to 90 days?
(DIR) Post #B8mlbWfi4NIr3OWAAC by argv_minus_one@mastodon.sdf.org
0 likes, 0 repeats
@ariadne Since when did you have any obligation to any of them, anyway? You never promised anybody that your code would be free of bugs. “NO WARRANTY” is in every FOSS license ever. If they want a warranty, they're gonna have to pay you for one.And if they threaten to violate responsible disclosure, well, that's on them if they do that.@vathpela
(DIR) Post #B8mom2ewIMCr1HraWe by ariadne@social.treehouse.systems
0 likes, 0 repeats
@vathpela @argv_minus_one the problem is that if you don't play along, they come and become "maintainer of last resort"
(DIR) Post #B8mq9XXZXDp61cLJTM by argv_minus_one@mastodon.sdf.org
0 likes, 0 repeats
@ariadne How? Aren't you in control of your project?@vathpela
(DIR) Post #B8mqM8FqrGhlMp3gmW by ariadne@social.treehouse.systems
0 likes, 0 repeats
@vathpela @argv_minus_one don't know, but that is their stated intention.
(DIR) Post #B8mqSA5qw0vmo7Fz7Y by ariadne@social.treehouse.systems
0 likes, 0 repeats
@vathpela @argv_minus_one @eragon don't know, go ask the akrites weirdos
(DIR) Post #B8mrJ4llSZNJdw5lpI by argv_minus_one@mastodon.sdf.org
1 likes, 0 repeats
@ariadne This is starting to sound like just a bunch of self-important bros that you can safely ignore.I mean, sure, they can fork your project and declare themselves “maintainers of last resort”, but…who cares?And if they start going around breaking responsible disclosure and blackmailing actual maintainers, they'll become pariahs in a hurry.@vathpela @eragon
(DIR) Post #B8mxVQb4jMC4XYMibA by ariadne@social.treehouse.systems
0 likes, 0 repeats
@argv_minus_one @HaTetsu I feel I am being generous with the hypothetical week timeline, yes.
(DIR) Post #B8ncXvbSW98bP6r78S by grumpybozo@toad.social
0 likes, 0 repeats
@ariadne @vathpela Some of us appreciate the extreme annoyance of the (non-coding) part of that work and are grateful for it. Thank you.
(DIR) Post #B8nemVPUNumMQ5KsLY by ariadne@social.treehouse.systems
1 likes, 1 repeats
@argv_minus_one @HaTetsu so far my experience with other "vulnerability clearinghouses" is that they have sent me patches for vulnerabilities in DEAD CODE.as in the vulnerability was in a function that was no longer used for years.and then they got angery because I deleted the DEAD CODE instead of merging their patch.
(DIR) Post #B8nf9HWOBlHg0NQK8W by foolishowl@social.coop
0 likes, 0 repeats
@ariadne At some point we need to do something about the vampires, because not reproducing our blood supply doesn't seem like a viable long term solution.
(DIR) Post #B8nfOGucjffISYuIO8 by gsuberland@chaos.social
0 likes, 0 repeats
@ariadne @argv_minus_one @HaTetsu I report bugs in dead code / unused functions all the time so they don't get accidentally picked back up and used in later code changes, but getting mad about them deleting that dead code is just moronic.
(DIR) Post #B8nfZ5yNkSMriWpGu8 by ariadne@social.treehouse.systems
0 likes, 0 repeats
@gsuberland @argv_minus_one @HaTetsu they did not send me a bug, they sent me a PR on github
(DIR) Post #B8nfcIP9z1R58usS8G by argv_minus_one@mastodon.sdf.org
0 likes, 0 repeats
@ariadne #Linux kernel has been doing the same lately. Deleting little-used code rather than fixing its bugs, that is.I understand why they'd do that, of course, but it does make me a little sad that you can no longer run a modern operating system on retro hardware. Being able to do that was pretty neat. Not, like, life-essential or anything, but neat.@HaTetsu
(DIR) Post #B8nfkekgmSRYlgvxbc by ariadne@social.treehouse.systems
0 likes, 0 repeats
@dalias @gsuberland @argv_minus_one @HaTetsu i mean the PR explained the issue, it is just that they did not bother to do proper analysis: if they had done so, they would have discovered that they patched nothing, since it was dead code.
(DIR) Post #B8nfqVj9FPtoW20M6K by hyc@mastodon.social
0 likes, 0 repeats
@ariadne @argv_minus_one @HaTetsu we get these in OpenLDAP too. Stupid waste of time.
(DIR) Post #B8nfvPq4ZG4NhXaB6G by ariadne@social.treehouse.systems
0 likes, 0 repeats
@hyc @argv_minus_one @HaTetsu honestly tempted to add a CLAUDE.md file with the fuck off code in it.
(DIR) Post #B8ng0XfQtCVbQd3AfI by gsuberland@chaos.social
0 likes, 0 repeats
@ariadne @argv_minus_one @HaTetsu oh it's one of those 😩even with the Patch The Planet project we did at work, which was directly funded and sponsored by OpenAI, every project we worked with opted into being involved and even then we made the patches/PRs 100% optional deliverables. if people didn't want code, we didn't deliver it - reports and advice only. if we can manage that courtesy in those circumstances, idk why these people can't do the same.
(DIR) Post #B8ngLn0v1hEZ6eEQV6 by ariadne@social.treehouse.systems
0 likes, 0 repeats
@gsuberland @argv_minus_one @HaTetsu i mean, i don't really care either way: if a clearinghouse sends me a patch and it is correct, i will merge it.my problem is when we disagree.
(DIR) Post #B8ngocLblKaUQIegLY by gsuberland@chaos.social
0 likes, 0 repeats
@ariadne @argv_minus_one @HaTetsu I guess this is what happens when you tell inexperienced randos that their job is to go find bugs in stuff using tools, LLMs or otherwise. they haven't done their time in the trenches to learn the hard way that a bug you found is just a bug and not a reflection of your work's value. what people value is being helpful and offering good advice, especially in terms of preventative measures like SAST integration (where relevant and welcome).
(DIR) Post #B8nkO791YFQhw7O2qm by wronglang@bayes.club
0 likes, 0 repeats
@ariadne @argv_minus_one @HaTetsu you took clout away from them! 🫠
(DIR) Post #B9fvIEpYEGleTM0SDg by ariadne@social.treehouse.systems
0 likes, 0 repeats
@divVerent local vulnerabilities can still impact build provenance or build reliability. network access does not make something more or less vulnerable.
(DIR) Post #B9gdSr3XMGZvuEQ9Kq by ariadne@social.treehouse.systems
0 likes, 0 repeats
@divVerent *shrug*