Notices by David Chisnall (david_chisnall@infosec.exchange)

@aral @frechdachs It’s not a complex concept, it’s a complex thing to enshrine in legalese. And when you do, you are giving power to lawyers and people who can afford to pay lawyers, not to individuals.

If you want to peg a small tech thing to copyleft, that’s your choice. As someone who has written and released a few hundred thousand lines of code under permissive license, I won’t be joining in. I’ve seen people adopt the position that you are taking (that copyleft is the only true way) and it almost never achieves the goals that are stated.

You’re starting by saying that your licensing ideology is more pure than that of many successful projects. I don’t know how you expect that to build an inclusive environment.

@frechdachs @aral It’s also the point at which I realise that it’s not a crusade that I will be contributing to, which is a shame because I agree with all of the other points.

I’ve written a lot about why I don’t contribute to copyleft projects over the years, so I won’t repeat it all here, but at a high level, it boils down to two points:

Copyleft project licenses always include some conditions that are easy to accidentally violate. For example, if I compile a GPLv2 project and give a friend a binary so that they don’t have to build it themselves, I’ve violated the license. Will anyone take me to court? Almost certainly not, but now we’re in a land of selective enforcement and everyone needs to talk to lawyers to understand when they are compliant, not compliant but probably fine, or not complaint and at risk. I’ve spent a depressing amount of time talking to lawyers about the GPL and the number of things where the conclusion was that it was a technical violation but it would not be in the interests of anyone with standing to sue to take it to court was depressing.

I also contributed to a GPL’d FSF project where we had strong evidence of a company taking the code and distributing modified versions, but the FSF decided that it was too expensive to enforce the license. This is the worst situation because all of the legal restrictions apply to people acting in good faith but not to others because the cost of enforcement is too high.

More importantly, forcing people to cooperate via legal threat never works. People contribute changes to permissively licensed projects because they understand the value of the commons. I’ve seen far more proprietary software written as a result of the GPL than Free Software. Even small companies would rather reimplement something in house than understand the GPL in all of its intricate corner cases and so we end up with them providing no benefit to the commons. In contrast, the evolution I’ve seen many times with permissive software is as follows:

1. They take the code and maintain their own fork. Yay, the commons gives us free stuff!
2. They implement a new feature in their own fork. Yay, building on the commons lets us differentiate!
3. Upstream implements the same feature but a different way. Oh, private stuff on top of the commons is costing us,
4. They reevaluate how much of a competitive advantage they actually get. Hmm, maybe out 2% addition is not actually as valuable as we thought it was.
5. They developed their next new feature upstream and strive to have as small a diff as possible in house.

After step five, they are eager and willing contributors to the open ecosystem. With GPL’d projects, this doesn’t happen. They either do an in-house rewrite or they take GPL’d code and have compliance people deal with upstream and regard the license as a cost centre.

There are exceptions to this, but they tend to be projects that already grew to the size where a proprietary reimplementation is not feasible, such as Linux (and, even then, the level of grudging compliance from phone vendors, for example, shows you how little the GPL is actually helping).

@sarahjamielewis Congratulations on escaping the tar pit! Terminal emulation is an onions whose innermost layer dates back to Napoleonic semaphore systems and every other layer is made of poor choices piled on top.

If you haven’t already, take a look at Arcan. I think it has a lot of overlap with what you want to build. And @letoram is active here if you have questions!

EDIT: I see Wes beat me to it in this recommendation!

When I was a PhD student, I attended a talk by the late Robin Milner where he said two things that have stuck with me.

The first, I repeat quite often. He argued that credit for an invention did not belong to the first person to invent something but to the first person to explain it well enough that no one needed to invent it again. His first historical example was Leibniz publishing calculus and then Newton claiming he invented it first: it didn’t matter if he did or not, he failed to explain it to anyone and so the fact that Leibniz needed to independently invent it was Newton’s failure.

The second thing, which is a lot more relevant now than at the time, was that AI should stand for Augmented Intelligence not Artificial Intelligence if you want to build things that are actually useful. Striving to replace human intelligence is not a useful pursuit because there is an abundant supply of humans and you can improve the supply of intelligent humans by removing food poverty, improving access to education, and eliminating other barriers that prevent vast numbers of intelligent humans from being able to devote time to using their intelligence. The valuable tools are ones that do things humans are bad at. Pocket calculators changed the world because being able to add ten-digit numbers together orders of magnitude faster allowed humans to use their intelligence for things that were not the tedious, repetitive, tasks (and get higher accuracy for those tasks). If you want to change the world, build tools that allow humans to do more by offloading things humans are bad at and allowing them to spend more time on things humans are good at.

On behalf of the United Kingdom, I would like to welcome the United States of America into the select club of countries that have voted to impose economic sanctions on themselves.

@ryanc I saw an advert on LinkedIn a while ago for some product that claimed to be better than JIRA. I assumed it was terrible because anything that sets the bar that low is not going to win any usability awards.

@ryanc I used to have (before it was stolen) a Dark Sun expansion that had a character path that let you become a dragon!

@fluffgar @limebar Mining is an incredibly misleading term.

Proof of work schemes rely on a problem where it's easy to determine whether an answer is correct, but hard to find the right answer. Each node in the network can guess an answer and then see if they got the right one. Whoever guesses right 'wins'. With a faster processor (especially a GPU or custom hardware), you can make a lost more guesses, so you have a higher probability of winning.

Whoever wins can use their solution to add a new block to the blockchain. Roughly speaking, this means that they can process one transaction. This also lets them charge a small transaction-processing fee, so 'mining' generates new coins because you're paid for processing transactions.

I haven't looked for a while, but last time I checked the entire Bitcoin network was processing around 7 transactions per second, with a power consumption of a modest country. To put this in perspective, a single Raspberry Pi running PostgreSQL can easily handle a couple of orders of magnitude more with a power consumption of a few Watts. If you have three of them, you can set up a replicated cluster and still easily handle a thousand transactions per second (probably more). Visa handles over 20,000 transactions per second, including running a load of fraud detection things.

They aren't doing anything useful, they're just burning energy to play a gambling game where tickets are paid for in electricity and compute power.

@mcc I always thought of Oracle as the lawful evil tech company. At least prior to the Sun acquisition, their evil was directed almost exclusively at people who had signed a contract with them, whereas most other big tech companies manage to do a lot more collateral damage.

It's easy to dislike Oracle and never have to touch their products. The same is somewhat true of Apple. It's far less true of the likes of Google, Microsoft, and Facebook.

@collectifission @bughuntercat Os we didn’t have C, Pascal derivatives would have taken the same place and, I suspect, the world would be a marginally better place. Later Pascal dialects fixed a lot of things that Kernighan complained about in Why Pascal is not my Favourite Language and a lot of additional things that were not fixed in C.

The original Mac operating system was written in Pascal, not C, and Win16 was designed to support both C and Pascal as first-class languages. The Burroughs Large Systems machines used (garbage collected!) Algol to write the OS.

UNIX was influential, but it’s not always been for positive reasons. A lot of the things that made modern systems so insecure would have been impossible on MULTICS, but UNIX threw the, away and they were not reintroduced even when UNIX derivatives were running on machines orders of magnitude more powerful than those for which MULTICS was designed.

Imagine you’re in a casino. Someone walks up to the roulette table, puts $1000 on 14. They win! They now have $50,000. Now they move to another table, and put $500 on red. They lost, so they put $1,000 on red. They lose again. They put $2,000 on red. They win! Now they have $50,500! They’re such a winner!

You didn’t see that they put $1,000 on 14 every day for the past twenty days. They only won because they are able to afford to lose $20,000. They’re actually only $30,500 up, but that’s still a big win. You also didn’t see the ten other people who tried the same strategy, but never landed on a table that came up with their number.

This is the kind of person that Silicon Valley idolises.

@encthenet In the south of Wales, road signs are written in English and then Welsh. After living there for a few years, I was surprised that slightly further North, the signs were Welsh only. It took me going past a couple of the, to realise that they weren’t. They were written in Welsh then English and my brain filtered out the alternate lines.

@feld I wanted to build a DNS resolver with CCF (distributed key-value store that ran in SGX enclaves and other TEEs). The clients would be able to get a remote attestation that they were connected to a server that ran a specific version of the server code. The network would be able to send queries to authoritative servers from any node, maintain an internal cache, and do spurious lookups to make it hard to attack with traffic analysis.

I think this would meet the requirements for DNS encryption.

Why are are people wanting their time with Rust when the B5500 showed that the best language for systems programming is garbage-collected Algol?

Lots of people seem to be confused. There are three very separable problems:

• Sending billionaires to Mars.
• Making it possible for humans to survive the trip to Mars.
• Making it possible for humans to survive on Mars.

The second two are in no way a prerequisite for the first.

@revng What's your baseline allocator if jemalloc is a 30% speedup? FreeBSD has shipped jemalloc as the default malloc in libc, and I see a fairly consistent performance improvement replacing it with snmalloc.

It’s amazing how many LinkedIn posts say some variant of ‘remote work is bad because remote teams can’t do {thing remote teams have been doing successfully since IRC was the state of the art in communication for remote workers}’. And what they mean is ‘I don’t know how to manage remote teams’. It takes a special kind of arrogance to believe that just because you can’t do something that other people have been doing for decades, that thing is impossible.

Don’t settle for an alpha male, wait for at least the release candidate.

@SecurityWriter

What I do fear is that for those that do heavily invest, they’ll be required by the likes of Microsoft to begin to speak in ways that Copilot can parse and ‘understand’.

We have those things, they’re called programming languages and they have well-specified syntax (and, often, semantics). Unfortunately, the shape of what an LLM can parse depends on its architecture and training data, and fairly small changes to either can have a big impact. Copilot seems to be a roll in release thing, where the underlying models can be changed at will. Just because you have created a shape that Copilot can parse today does not mean that it will work tomorrow.

We are going to see many organisations rediscovering ontology drift. My favourite thing about ontology drift is that it’s recursive: everyone who rediscovers it comes up with incompatible terminology for it and cannot share their findings in a useful way.

@ryanc A school my mother worked at had a filter that would block porn and one of the heuristics it used was the number of Xs in a page. Anything about XFree86 or Linux tended to be blocked.