Happy International Asexuality Day, from VGAPride!

It's International Asexuality Day! :heart_ace:

Grey-asexual/demisexual here. (The short version of what that means: "Probably not, and probably not with you." 🙂)

my new burger restaurant concept is inspired by modern software. the options for mayo are "yes" and "maybe later", and if you pick maybe later, the chef stands at your table with a squeezy bottle, threatening to add mayo to your burger when you least expect it

stop doing frontend navigation

• right click was never meant to be disabled
• years spent reimplementing browser features yet still not equivalent to browser links
• wanted to link to another page anyways for a laugh? we had a tool for that it was called a HYPERLINK

“Navigating to your website makes me unable to go forward in navigation” statements dreamed up by the utterly deranged

"What it means is that there is no supply chain here. Because there is no supplier. I am not providing you something that you bought from me. There is no relationship. I put something online because I wanted to. The fact you made your product depend on it is your responsibility. Not mine. Not the one of the providers. We provide libraries. We do not supply them. You cannot apply rules to me. […] So all your Software Supply Chain ideas? You are not buying from a supplier, you are a raccoon digging through dumpsters for free code. So I would advise you to put these rules in the same dumpster."

🔥🔥🔥

https://www.softwaremaxims.com/blog/not-a-supplier

#xz

I think the #XZ incident has taught us that we all need to decompress

i see the compostable bluesky moderation works as designed

So, uh, if you live in Arizona and enjoy having privacy about what you jerk it to, you should *really* get in touch with your local representative. A Porn ID law is about to pass which will directly hit e621 which operates out of Arizona.

I guess the takeaway from the xz backdoor situation is:

If you’re an open-source project maintainer, and somebody starts getting on your case for not doing enough free work for them, you reply “big Jia Tan energy there” and then block them forever.

Any experienced C developers among my followers? #BoostsWelcome.

Expat, arguably the world's most popular #XML parser, is understaffed and without funding. As #xz has shown, situations like this are dangerous.

Last month, maintainer Sebastian Pipping put up a plea for help at https://github.com/libexpat/libexpat/blob/R_2_6_2/expat/Changes

(I would help myself, but my C skills barely surpass "Hello, World".)

Found via @timbray - https://cosocial.ca/@timbray/112203547801373427

#libexpat
#SoftwareSupplyChainSecurity #OpenSource #OpenSourceMaintainer
#C

That's right. It's sort of the core issue in educating people about LLMs. They don't "sometimes hallucinate". They always hallucinate. By design.

But I also think we should graduate from saying they "just" make things up. They have a sophisticated inner model that means they're more likely to hallucinate towards things that seem correct when read by humans. And studying how they are able to do that is actually interesting.
https://mastodon.social/@GeePawHill/112203183163246574

I've seen lots of XZ hot takes lots of places, I'm sure more excrement will hit the impeller on Monday.

My thoughts:
- this was well planned, as many have said - it appears that the sole previous xz maintainer was having a rough time, and that was capitalized on, to introduce a new maintainer
- it looks like the reason the timeline was rushed or hurried was because systemd was going to be dropping the liblzma dependency, but the merge window for Fedora 40 and even more critically Ubuntu 24.04 were closing - can you imagine a backdoored xz making it into Ubuntu 24.04? The long tail would be a nightmare
- this wasn't caught because of OSS, but it did make RE on the bug possible or at least much more likely, and it happened out in the open
- the reason this was caught was because one engineer was curious about half a second of latency in SSH.
- everyone is going to be losing their minds about any version of xz made after Jia Tan became a contributor, anywhere, even on something like OpenBSD, for the next long while

my takeaways:
- OSS maintainers need more support, both financially and emotionally/professionally. Burnout is real.
- the xkcd meme probably has holes worn in it by now
- this was planned and orchestrated, though it is not clear if the maintainer's account was hacked or this was the long play

- slow software hides backdoors - can you imagine if someone backdoored Electron? no one would notice a difference.

Happy Easter! This is a good visualization of stuff that I spent too many hours reading through during the two days after the Big Reveal.

#xz #xzbackdoor @fr0gger

https://infosec.exchange/@fr0gger/112189232773640259

I can't wrap my head around how almost all of the #xz reporting focuses on the failures of #opensource.
Yeah, sure, but ...

Good luck finding such an attack in proprietary code.
Via the cliché paid off/blackmailed employee, hacked dev servers/repos, or via capitalism's favorite cost-cutting measure: a remote "offshored" contracted temporary developer (or nowadays, embedded into some LLM output).

If anything, Open Source Security has *worked*.

#cypersecurity #OSS

travelynx broke so I can't see which trains are departing from the station I'm on

call that trains day of invisibility

Happy Trans Day of Visibility!

Art by Drakawa on FA!

#charr #trans #furry #art #commissioned

Alright, here it is, our entry in the Wild compo for #revision2024 : "A Statement on the Platform Wars" by Moonbase Allstars, a fun little binary that's rather portable

https://demozoo.org/productions/342318/ / https://www.pouet.net/prod.php?which=96567

(video is on YouTube now: https://www.youtube.com/watch?v=7j818mS77qQ&t=1684 )