Notices by Glyph (glyph@mastodon.social), page 2

answer: 6 months ago (November 24, 2025)

"Allow IPv6 Interface Identifier for Zone-Based Firewall"

Not the *clearest* language to describe this feature, but since I've been waiting for over a decade, I'll take it

https://community.ui.com/releases/UniFi-Network-Application-10-0-156/67344cb3-8f12-47bc-8796-20de6857c7b2

ZOMG unifi finally has feature parity with OpenWRT

When did they finally add this???

c.f. https://blog.glyph.im/2015/09/inbound-ipv6.html

Sigh. So: bad news it seems that the "Live Translation" feature which I will need to use on an upcoming trip, is gated behind "Apple Intelligence" toggle, and thus I need to have the model goo present on at least one device. That's the bad news. The good news is that this most apps seem to have individual preferences so I *can* turn all the toxic "summary" behavior off. But this appears to be a constellation of checkboxes smeared out over a zillion different apps. Has anyone made this list?

@dalias @whitequark @jpm this is one of those cases where the long tail bites you extremely hard. logging is easy if you "just" call getnameinfo. accounting is easy if you "just" understand the implicit structure of a /64. routing is easy if you "just" use ip6tables. testing is easy if you "just" know how to set up your CI provider with custom firewall configurations. happy eyeballs is easy and all you have to do is "just" implement a dense 10-page RFC by yourself.

@pinskia @dalias @whitequark @jpm literally the first hit, I did not have to try _at all_ to get this result.

give me an hour or two to really get in the zone of a first-year programmer yelling at a slop bot and I bet I could find you tutorials using gets()

@dalias @whitequark @jpm it breaks down at many levels. maybe your socket code works just fine but your logging code assumes IPv4-only and thus crashes if it gets an IPv6 result, so you just disable IPv6 because who cares it all works on IPv4 anyway. Or maybe you have some accounting code that relies on subnets. Or your software works fine but your release version contains a *configuration* that disables IPv6 by accident, and thus you never test with it. The area for potential errors is large.

@dalias @whitequark @jpm the point is that people do not learn by consulting the POSIX spec, they learn by googling "socket tutorial" and looking at the first hit, which is https://www.cs.rpi.edu/~moorthy/Courses/os98/Pgms/socket.html

a relevant excerpt from the client program on that link:

server = gethostbyname(argv[1]);
…
serv_addr.sin_family = AF_INET;
bcopy((char *)server->h_addr,
(char *)&serv_addr.sin_addr.s_addr,
server->h_length);

@dalias @jpm @whitequark and "call connect() a bunch of times" like… could _technically_ work, but you gotta know to call getaddrinfo and not gethostbyname, and you have to not really care what you're connecting to for purposes of logging or accounting. there are a lot of places where it's easy to accidentally start being v4 only if you don't know a ton about networking

@dalias @jpm @whitequark the IPv6 retrofit in twisted (which, granted, we did probably 15+ years ago and it felt pretty late at the time) was a surprising amount of manual effort. and it's still annoyingly easy to add way too much coupling at various points in the stack, if you're doing anything even vaguely networky

@dalias @jpm @whitequark wait what? no it isn't. is there even a happy eyeballs in libc?

@tokyo_0 @dalias the only answer I've gotten to the question "and what mechanical tooling do you have in place to enforce your other voluntary attestation contribution policies, such as the obligation to not copy and paste your employer's copyrighted code into our codebase" so far is "that's different" but I really don't see how it is

@pfish.zone so much of the maintainer community right now is handwringing about "but if we ban LLM use, how will we tell?" and I am exasperated because the answer is not some sophisticated word-probability detection machine, it is "they will be blindingly obvious about it, and if they manage to not be obvious for a second, they will brag about it, they can't stop themselves"

Real talk: the real "supply chain risk" is that you treat your open source "supply chain" like shit and assume that we will all take any amount of abuse from you and just keep doing volunteer labor forever without ever complaining. And, equally real talk: most of us—myself included—actually do love the process and the community so much that you're right, and there will never be any real consequence.

But not all of us.

Remember that point in history around 2021 where suddenly there was a rush of supply-chain attacks that were all *VERY* focused on infostealer malware that could detect metamask wallets, specifically? Now imagine that instead of a few threat actors uploading a few scam typosquats, the people who are motivated enough to target you and want to ruin your life are your entire dependency supply chain, and the Metamask that marks you as a target is your Claude Max subscription.

Your chatbot being (hypothetically) momentarily commandeered to delete your local copy of the project that you were *already explicitly forbidden to use it on* is the gentlest possible introduction to this type of direct action and if it happens to you, you should be *very grateful* that this is how you got the message and not via something much more elaborate, insidious, and potentially life-changingly bad.

Like the fact that I show empathy and understanding and, increasingly, have a sort of "no ethical consumption" / "harm reduction" message about LLM use makes me a bad messenger for the message that not only are LLMs abstractly "harmful" but that there are people who you *are harming* and some of those people are not going to take it lying down.

Due to my somewhat prickly and precise definition of "software ethics" I would not, personally, do this, but I think it's good that someone has. The industry—and the "community", such as it is—needs a wake-up call. The conversation *around* this reminds me of the loud booing from commencement crowds as speakers wax rhapsodic about "AI" destroying their careers and their futures.

https://github.com/jqwik-team/jqwik/issues/708

what's cool in the world of browser extensions

I mean this is me complaining that LinkedIn, the website which models all human interaction as either performing employment or seeking it out, has a data model that fails to accurately model things that are not employment. so I don't know what I expected I guess

I originally had it as an "experience" because there doesn't appear to be a way to time-bound an "honor". if you're inducted or elected to an honorary role with actual — if minor — obligations and perquisites, it doesn't seem like there's a way to say that that has ended? Like right now I'm an active PSF fellow but I could request a transition to emeritus status and then I wouldn't be any more.