Notices by Cloud Manul (cloud_manul@nrw.social)

@mirabilos and then, there are people like me who prefer to avoid the sun altogether because I never get tan, I just burn.

After cursing at ALSA/pipewire for a few hours because everything _should_ work, but nothing is audible, I looked at the interface definition of my ARM board again... tell me if you can spot anything suspicious... what... the... actual... ? #firefly #rk3588

My favourite cat that looks like a confused pillow: Pallas's cat #manul #マヌルネコ 📸 by Chris Godfrey of Nordens Ark (Sweden)

@mirabilos @cjwatson @ehashman, And it wouldn't matter in any case. Most people in the OSS community never meet face-to-face; for some, there isn't even a single picture available publicly - and that's fine. "Trust, but verify" is the only thing we have. However, there should be a discussion about "clever" code. When people regularly contribute good, innocent, but needlessly complicated code, it becomes a problem.

@psykose @feld @dalias @lanodan @thesamesam @mirabilos And this is why I never leave the house without my trusty btrfs auto-snapshot parachute :)

@thesamesam @lanodan @dalias @mirabilos Hmm, I am not familiar with too many build engines in the OSS area, but the one I frequent (openSUSE build service) disables any network connection during the build itself. If a package needs something fetched from the Internet before the build starts, it must declare it, and the downloaded artefacts become part of the build archive/documentation.

@mirabilos @dalias As I said, it does not have to be an "either this or that" approach. My requirement: Production code must compile into the exact same binaries in both presence and absence of test code and test resources. That ensures 1. Nothing hidden in test code and/or test resources can be smuggled into the production artefacts, and 2. the validity of the test suite is the same. The only downside is the load on the build farm due to running the main build twice.

It appears the maintainer of #xz had been targeted personally, and his health situation was exploited so that the likely perpetrator of the xz backdoor could take over the repository. https://www.mail-archive.com/xz-devel@tukaani.org/msg00571.html