basique · HackerTrans

il y a 2 ansdiscuss

i honestly don't really get the angle of debugging via strace - i'd much rather prefer something more wireshark-like, where I can see all messages processes are sending to each other, since that would make it easier to decipher cases where sending a message to a service causes it to send other messages to its backends

basique

il y a 2 ansdiscuss

I mean, the problem here is more that companies don't really want to be pro-user and respect privacy. You have to make it so that companies can't exploit their consumers to increase profits, because if there are no repercussions they will.

Also, I wouldn't say Apple is that pro-user. They regularly fight against right-to-repair, and Cory Doctorow even had an article about how they spy on their own users https://pluralistic.net/2022/11/14/luxury-surveillance (I haven't looked into this fully, though, so this might be hogwash) The 'Apple = Privacy' thing feels more like a marketing gimmick to me than a real commitment.

basique

il y a 2 ansdiscuss

This article also says that you'll get exploited even if you are a paying costumer. (that's a part of enshittification as defined by Cory Doctorow, even! companies first exploit their customers, then their business costumers/ad providers)

basique

il y a 3 ansdiscuss

A lot of products have an immoral part in the supply chain. Do you propose that people abstain from all of them?

basique

il y a 3 ansdiscuss

Isn't iSH literally an x86 emulator?

basique

il y a 3 ansdiscuss

Protecting Google's customers from what? iMessage?

basique

il y a 3 ansdiscuss

>make software open source

>people use it under the license

>"you're literally taking my work"

>change license

>people are mad that software isn't open source anymore

I really don't get these arguments that the businesses that supported OpenTofu "blatantly stole" Hashicorp's work, as if Terraform wasn't licensed under a permissive license

basique

il y a 3 ansdiscuss

Any fake certificates the malicious CA signs will have to be written to a Certificate Transparency log, which would make noticing the fact that the CA has done something like this easy.

basique

il y a 3 ansdiscuss

Jail time and fines? I don't get what you're talking about

basique

il y a 3 ansdiscuss

> There is a clear limit to how slow simple looking code can be in C# or java

Java/C# code can become incredibly slow if you allocate way too many objects, use Streams/LINQ or touch URL#equals. Why are managed languages specifically better here?

basique

il y a 3 ansdiscuss

> however, it is simply not the case that games have rampant amount of hacking in general.

Have you played TF2 recently?

basique

il y a 3 ansdiscuss

The point of htmx is to be able to do the interactivity on the server, so using it with your existing, general API isn't really the point - the backend (or, well, frontend backend?) just serves the needed data directly in the markup. This isn't really ideal if you think of your site as a separate frontend/backend, but it makes sense if you already have a backend and don't want to make an API just to then write JS that consumes the API and shows you stuff. Granted, this doesn't really work well with offline-first apps, but it's nice if you need to actually poke the server whenever you need to do something.

basique

il y a 3 ansdiscuss

Why is it a wrong abstraction?

basique

il y a 3 ansdiscuss

Not publishing source code demotivates the white hats and "good people" more than the bad actors, IMHO. There's a reason a lot of cryptography-related libraries have open/available source code

> But have you ever found an exploit and reported it? Yes, actually. It was for a project I had already contributed to, so I was just reading source code and stumbled upon a somewhat critical bug. The main problem there was figuring out how to fix it without breaking API, really.

basique

il y a 3 ansdiscuss

IPv4+NAT still exposes your router's address, which is still problematic, no? If you want more privacy than that you can use a VPN, which should work on IPv6 too.

basique

il y a 3 ansdiscuss

Can you list some of these extensions? (and what compositors support them, of course)

basique

il y a 3 ansdiscuss

Aren't Cloudflare Workers multitenant? Although, if you want to be cynical, that could be a reason they aren't 'enterprise grade™'.

basique

il y a 3 ansdiscuss

> Is having a program superglued to an outdated library with known (and fixed already) bugs really what you want?

It is not superglued. If you want to update dependencies, just remove the lockfile and reinstall everything. The main reason people do this is because just updating a library without the program knowing by not specifying the exact version leads to behaviour silently changing, which is terrible (especially on CI!)

basique

il y a 3 ansdiscuss

> Whitelisting is the correct approach. Isn't most of the point of using the JVM thrown out if you have a limited standard library?

> And you would run C code in a completely trivial way: you have a huge array which is your memory, and you read/write bytes to it. That sounds like it would have terrible performance. Would every read of an int have to manually build it from the 4 bytes it's made of? This just seems like something the JVM won't handle that well.

Besides, this would mean that if you want to run a language like C#, which has references and value types (and you can make a reference to a value type from a pointer into a buffer), you would have to emulate them, which will hamper performance, or just use the same strategy as you used for C.

basique

il y a 3 ansdiscuss

The JVM can't really be properly sandboxed, though. Even the JDK developers have stopped trying and deprecated SecurityManager. On the other hand, WASM is specifically designed to not really be able to do anything fancy unless you give it functions that actually do something externally. Besides, how would you even properly run C code on the JVM?

comments