Notices by Howard Chu @ Symas (hyc@mastodon.social), page 2

@nxadm @dalias Go has this weird design mentality of fetching every dependency you're using, straight from github. And no dynamic linking. It's too opinionated, IMO.

Not to mention it was intentionally designed to be less flexible than C.

@dalias yep, same. https://mastodon.social/@hyc/114841502231953489

Frankly the interminably slow compile times were the first red flag for me. But resorting to AI just yells out "we don't know what we're doing".

Hudson has relocated from the couch to the bed for phase 2 of today's napping. #caturday

@cmconseils the Victorian era really killed men's fashion huh.

Heathrow airport dim sum is actually edible

@dalias if you're really self-hosting your email you should have an actual domain name of your own though, and it should resolve both forward and backward.

@dalias my favorite was always hosts whose IP address is encoded in their DNS name. I used to just flat reject them but now I only greylist them because more subscription mailers are using dynamic hosts for sending.

@thomasfuchs @zrail Fortran. I was a maverick and used C, and eventually helped write JPL's C Coding Standard.

@zrail @thomasfuchs definitely. But most people in computing have almost zero exposure to actual computer science.

Meanwhile, yes, my degree was in Computer Engineering, in the Electrical Engineering and Computer Science department at UMich's College of Engineering. I practiced real software engineering, at UMich, at JPL writing software for the Space Shuttle, and elsewhere. But I'm also just a hacker at heart.

@dalias it's a DoS but not the same as an actual crash, which is unanticipated. There is zero security exposure from an assert failure: no data leak, no unauthorized access, no possibility of code injection. The trigger conditions are clearly spelled out in the assert itself, so it's trivially remedied. Calling it a security issue dilutes the word "security" to meaninglessness.

@bagder OpenLDAP is seeing more AI-assisted bug reports that claim to be security issues, but aren't.

E.g., calling a crash in a commandline tool a DoS (no, it's not a service).

@bagder the other one we see is calling assert failures crashes. It's not a SEGV, there's no possibility of data exfiltration or RCE. There's no security exposure, it's just a bug. One that was anticipated hypothetically by the original developer, but whose final disposition wasn't decided upon way back when.

E.g. /* can this even happen? */

They toss in an assert, and it lives quietly in the code for decades before someone definitively shows yes, it can happen...

Destruction of knowledge - this was always the inevitable end of the AI road https://scholar.social/@Iris/115020211902735145

@skinnylatte jealous... just had dim sum in Dublin last week. Such limited selection, no sesame rice balls. Sad.

Reminder: AI "generated" code is 100% plagiarized. You must not accept code of unknown provenance into your code base. Doing so opens you up to potential copyright infringement lawsuits. Nobody needs a repeat of the SCO vs IBM lawsuit over ownership of Unix.

Accepting AI-assisted code is just legally untenable. That's black and white, there's nothing to debate. Projects that accept it are idiots and should be shunned.

https://mastodon.social/@hyc/114777864519941643

@libreleah agreed. I wrote LMDB this way as well, return from functions is an error code or 0 for success; any values to be returned go thru the parameter list.

The C standard string functions suck. https://mastodon.social/@hyc/111596133680619519

Family of B-Trees | Database Internals #6

Today we explores several B-Tree variants designed to overcome the limitations of traditional database indexing, specifically targeting issues like write amplification and concurrency overhead. The author categorises these systems into distinct strategies: Copy-on-Write models like #LMDB ensure data integrity through immutability,...

https://m.youtube.com/watch?v=k-N2eT7wWeg

@dalias my Huawei phones have an "Optimizer" app that tells me it is periodically deleting "junk" but never tells me what got deleted. Only barely better than useless.

The other feature I hate is Android now silently removing permissions from apps I "haven't used recently" even though they're always running in the background. Like microG services, which breaks periodically because its permissions get removed, even though Settings shows them still enabled.

@dansup @matrix @xmpp signal still just crashes on startup on my Huawei phone. It apparently uses google APIs so it certainly isn't escaping from BigTech.

@skinnylatte huh. I was taught "ma ling shu" for "potato".