Notices by Ludovic Courtès (civodul@toot.aquilenet.fr), page 7

@jas @daviwil @shtwzrd Good points. The separation as channels is both a technical and a social challenge (Conway’s law).

As for the minimal computing base, I find it sad that apart maybe from the BSDs, nobody is focusing on building a “system”. We end up with glibc depending on Python, GCC requiring a recent C++ compiler, etc.

Guix *is* focusing on building a system to a large extent, and perhaps the answer is to “own” its basic components.

Recently (past week?), #Guix proper passed the 30K package limit, all free software!
https://repology.org/repository/gnuguix

“Authenticate your #Git checkouts!”
https://guix.gnu.org/en/blog/2024/authenticate-your-git-checkouts/

Yup! Time to consider doing it!

Update: When getting public money $1,000 at a time is inefficient, there’s always the option of getting the money at its source, right from the academic institutions.

Example: French research institutions give ACM an undisclosed amount of money in exchange for “unlimited* open access publication” 👇
https://www.couperin.org/non-classe/acm-association-for-computing-machinery/

* unlimited for two years

@PierreSenellart @p4bl0 Et combien de fois le budget de HAL ? Quelle honte. Alors qu’on pourrait soit nationaliser soit contourner (remplacer par un service public) Elsevier et les autres…

It’s 2024. The ACM and its friends are still ripping public money, asking authors for $1,000 to make their paper “open access”.

One word: parasites.

Les vidéos du forum ORAP sur #HPC & #reproductibilité de mars sont en ligne 👇
http://orap.irisa.fr/52ieme-forum-reproductibilite/

Incidentally, that’s another illustration that retrofitting namespaces in an ambient-authority monolithic kernel is tricky.

This is in contrast with the Hurd, where per-process views are an inherent part of the design.

Recommendation is now to disable network namespaces to mitigate vulnerabilities due to their interaction with unprivileged user namespaces:
https://www.openwall.com/lists/oss-security/2024/04/14/1

That’s a sad outcome.

@wingo OpenSSF and Linux Foundation want to grab supply chain security money from the US federal government; the xz backdoor is an opportunity for them to demonstrate that “something needs to be done” and that they’re well positioned to “do something”.

“Scientific publishing has a language problem” (July 2023)
https://www.nature.com/articles/s41562-023-01679-6

I don’t subscribe to the conclusion that LLMs will save us, but the description of the problem is spot on.

On this topic, the UNESCO Recommendation on Open Science encourages linguistic diversity:
https://www.unesco.org/en/open-science/about?hub=686

It sounds like wishful thinking at this point, though.

It’s now possible to create a #Guix System instance where the default ‘guix’ command sees the channels of your choosing:
https://guix.gnu.org/manual/devel/en/html_node/Customizing-the-System_002dWide-Guix.html

This is particularly useful if you want to create a ready-to-use system image.

@lechner ‘guix pull --disable-authentication’?

(Please stop with “please”: I’m pleased you say “please” when asking for something, but it makes me feel like you think you’re talking to the user support department.)

“Towards reproducible minimal source code tarballs?” by @jas4711:
https://blog.josefsson.org/2024/04/01/towards-reproducible-minimal-source-code-tarballs-please-welcome-src-tar-gz/

I think “make dist”-generated tarballs are just one part of the xz debacle (and not the most frightening part), but at least we can do something about them: when they’re the byproduct of a build process, we can build them from source (like Debian does); when they add something that’s not in the VCS (such as .po files), we can at least ensure a reproducible build process as Simon advocates here.

@lanodan On dirait. Dans le même espace (bruyant), il y avait trop personnes en visio en même temps (trois visios distinctes bien sûr).

C’est officiel : dans le TGV, les espaces entre les wagons sont désormais des salles de visioconférence.

Embarrassing: only today did I learn that “archival” is an adjective, not a noun.

I’ve been using it wrong for so long that I’m considering patching dictionaries.

My friends, I made a terrific (terrible?) discovery that goes by the name ‘sdlpop’:
https://packages.guix.gnu.org/packages/sdlpop/1.22/

I spent hours on this as a kid and it was great, even though I’m not sure I ever went past level 2 (I didn’t today).

When I’m on the verge of completing a programming task, I find myself taking my time, slowly polishing things.

It’s a bit like when you’re getting close to the end of a book and start slowing down just to enjoy.

(Am I the only one to have this pathology?)