Notices by Demi Marie Obenour (alwayscurious@infosec.exchange)

@dalias Is that because of used car vs new car pricing differences? Or because you don’t drive very much?

@dalias @ska That makes sense if you don’t care about performance. I suspect that companies that pay developers of new kernel or graphics APIs generally do care.

Right now, I care a lot about software rendering, but as soon as the security problems with GPUs are solved I won’t care anymore.

@ska @dalias I suspect that in the future, high-performance code will use io_uring via a library that abstracts it away. I don’t think making it easy to use kernel APIs directly needs to be a goal.

It’s like OpenGL vs Vulkan: Vulkan makes it very hard to write a trivial application, but for large, complex applications it turns out to be a better fit.

@dalias Is splice even useful nowadays?

@dalias The main problem with both of these is that companies would move abroad.

@dalias I’d rather not bet against @filippo either.

@dalias When it comes to quantum computing, I don’t recommend betting against Scott Aaronson. When it comes to cryptographic algorithm selection, I don’t recommend betting against Filippo Valsorda.

@dalias Is there a method (indistinguishability obfuscation?) to generate the key without knowing the factors?

@dalias Is there anyone who is not a C stdlib or compiler implementer who would understand this? What fraction of those who are stdlib/compiler implementers would understand it?

(For anyone confused, the most common meaning of FTM is “transgender man”, with First Time Mom as a very distant second.)

@sertonix @dalias @Foxboron @alpinelinux @archlinux Bingo. LLVM and Linux both have LLM-assisted contributions and neither are practical to fork.

@dalias Not sure where you live, but Hurricane Electric provides a free tunnel broker.

@tnorinder @dalias Then how are the developers going to get paid?

Serious question. CPython is critical infrastructure. Leaving its development to volunteers is obviously not a good idea.

Ideally, critical open source software would be paid for by various governments through non-profit organizations. Sadly, that is currently nowhere near enough.

@dalias what is the alternative?

@dalias @lunareclipse Who is going to change all of the programs that run in that CI? Things like NPM, Cargo, git, curl, and the like.

I like the idea, but implementing it is a massive amount of work, and most of it falls not on the CI provider but on its users.

@dalias @lunareclipse One of the reasons CI does that is that it is so inconvienent to cache things nowadays. CI boxes are stateless by design, and using a network cache requires either an MITM certificate or changing the URLs one uses. Better tooling for this would really help.

@dalias Wouldn’t that mean WWIII? I’m pretty sure that intentionally killing the head of state of a foreign nation is an act of war, and my understanding of the EU’s mutual defense treaties is that this would mean an US vs EU war. France and the US both have nuclear weapons so this would be armageddon.

@dalias Doesn’t that cause Linux to have to page out stuff like executable code instead?

@dalias How does one run that?

@dalias What’s the bullshit?

@whitequark Using a compiler compiled to WebAssembly? WebAssembly runtimes do have vulnerabilities some of the time. Microsoft wrote a research paper about running WebAssembly modules in VMs.