Posts by Czrly

Re: What about Consent?

« If you can bear to hear the truth you've spoken, Twisted by knaves to make a trap for fools… » (TL;DR: no, I didn't.)

Re: 30 percent of Microsoft's code was now written by AI

Balls to that: it doesn't explain the vanishingly rare few that *do* work.

Re: Oh, look, another systemd moment

OpenRC-based Gentoo does literally *everything* better than systemd in my own experience: that is to say it just works and doesn't get in my way, over here, unlike systemd which doesn't work at all – frequently – and breaks – frequently – in arbitrary and impossible to debug ways. (I think that the cause of something breaking on Linux should lie pretty close to the thing that's breaking and, in the systemd world, everything is uselessly and hopelessly interconnected for no damn reason and so breakage is often in an entire different universe from the symptoms, making it simply impossible for me to think through!)

Sound, camera, desktop, logging in, screen-sharing, streaming all of it – even Flatpak apps (I use Steam via Flatpak) – all work JUST FINE without systemd.

I'm not a "refusenik", I just see absolutely no value that systemd adds and, conversely, I *do* see all the trouble it causes – it's just a negative value proposition with needless complexity and attack footprint, to say nothing of the real problem of consolidation of the Linux operating system and ecosystem towards a single point of control, dependency and risk!

Re: "... hibernation support is a somewhat neglected area of Linux support"

Indeed. Hibernation, today, is pretty much completely useless because the issues it causes are invariably going to take a LOT longer to resolve, over time, compared to just waiting all of six seconds for a cold-boot on modern hardware.

What *I* truly miss is *proper* suspend-to-RAM: S3. That's basically dead, too: what we have, now, is a sort of polished version of S2: suspend-to-idle. It is a lot better than S2 was, historically, but it is still nowhere near as nice as true S3 was when one got that actually working – which, admittedly, was basically never.

Define "imitate"

The only reason your example holds at all is because "imitating" art badly doesn't result in material damage and kill bystanders like imitating driving – badly – is wont to do.

As a South African – having learned to drive on those roads – I can tell you that I see human drivers here in Bavaria, in Germany (in one of the places with some of the *best* road conditions in existence, certainly the best lane discipline and objectively good driving on average) who have absolutely the wrong reaction when anything even slightly untoward or unexpected occurs on the Autobahn simply because they've never seen the like before, they aren't expecting it and they aren't practiced in driving-improv as is sometimes demanded by emergent situations that don't fit the rules-of-the-road model. Different instincts are instilled in those who learn to drive in a country where you might be met by an unlit vehicle with some number fewer than four quasi-round wheels going the wrong way across an intersection that isn't marked, is potholed, and conceptually cannot actually exist (in the sense Douglas Adams might write) (There are also some number greater than four people on the back of the vehicle, standing, and a chicken or a goat – sometimes both, or alternatively a step-ladder (either wooden or extended if usually collapsible).)

Algorithms do not have a hope in hell of handling situations that do not fit the model they're trained on and history tells us that Silicon Valley trains for cost efficiency – that's why every AI-boosting article ever written cites making restaurant reservations as a use-case: easy model, zero risk of consequence.

As a musician, I think, perhaps, that AI can "imitate" music but so can the 555 in a 90's doorbell: I don't want to listen to that!

As a software architect with multiple decades of experience, I think that AI can (on a good day, barring insoluble hallucinations) "imitate" me implementing some kind of basic CRUD-capture form but so could your average teenager, equipped with Delphi or Visual Basic back when the century turned: there is no path from that kind of thing to wrangling with real-world, live, complex applications that carry legacy baggage, are used by people who never fit the "domain models", run over shoddy networks sustaining intermittent outages, and evolve over years based on moving and emerging demands intrinsic to the real world.

Hells, as a human born into living flesh, much of my behaviour could frankly be "imitated" by your average bonobo but there's no path from that to an appreciation of poetry, a lust for walking in high places and a wont to wax lyrical about my adventures thereupon, a taste for good wine, an innate understanding of calculus and complex numbers despite an absolute inability to grasp elementary arithmetic, a baffling hubris that leads me to think I "get" Quaternions, too, a fascination with how top-spin (or any spin!) causes a fluffy-yellow tennis ball to curve as it describes its flight through the air or – indeed – the corporeal wisdom instilled by the three decades since adolescence that bespell how that living flesh engages in other behaviours we humans share with apes!

Re: Cheer up.

Almost. The infrastructure isn't built, yet, and infrastructure projects are notorious for taking longer than they should so over-production of power in the medium to long term is hardly likely. But the bubble will burst though so I doubt tax payers will end up funding GPU power draw – not commonly or for very long, anyway.

The *real* question will be whether the tax payer ends up bailing out the speculators who find themselves holding the bag when the scam reaches its conclusion.

This could go either way. In any kind of just reality, this would be absurd. But it's almost certain that this will become yet another "too big to fail" scenario and we all know how those end: the rich get richer.

Is this scam perhaps the first that's "too big to bail"? You know: I fucking hope so!

Re: Android is dead to me.

I can't. I can't unlock the bootloader because I'd need a key from Huawei and they won't give me one. Why use a Huawei device? Because that's the thing I have and there's no way in hell I'll throw good money after bad buying another phone until this brick no longer functions at all so that's it.

There's absolutely nothing wrong with it. In fact, even the battery still works and the OLED screen is glorious compared to just about any "cheap phone" I could replace it with. But that's the thing, isn't it? The hardware is GREAT but it is not mine. If it were mine, I would be able to run whatever, without needing a key from customer support to unlock the bootloader – the bootloader would never be locked in the first place.

Which brings us back to the article: how are Google going to implement this verification because the only way to do so would involve either a PKS approach where Google must sign *every* APK ever shipped or some kind of verification approach where devs sign their own APKs and Android won't run them until it has first asked Google whether the public key associated with the signature is valid for some verified developer and hasn't been revoked.

This – sure as eggs are eggs – makes Google the gatekeeper for *everything* you might ever want to run on Android hardware and that, in my mind, constitutes EVIL just like a locked bootloader or DRM.

Microsoft would like this power on the desktop if they could have it: that's what TPM 2 really is about. First, they get TPM 2 into every desktop by E.O.L. Windows 10 and get everyone to enable it; next: expect Windows >= 11 to have just this kind of "verification" feature as a hard requirement to run any software: either Microsoft has to sign it or the O.S. must ask for some kind of permission and the TPM 2 uniquely identifies the workstation so that authorisation cannot be transferred or shared. The TPM 2 also encrypts the request to run the software such that it cannot be modified and any response – allowing or denying – from Microsoft is useless on any other box.

Only One Bigger Problem

We *do* have one bigger problem: the amount of money any given company needs is defined as "as much as possible". That's it. That's the whole problem. And that's why the world's largest software company shoves toolbar ads: they represent earnings of *more* money and the existence of more implies that more is possible and so they need that. Hence: toolbar ads.

The corollary is the same: those ads do not have to work nor even represent exposure worth their cost to the channel partners – Microsoft only need to be able to *sell* those adds to the channel partners and they know how to land that sale. There does not have to be any value, just revenue, sales and movement of money. Hence: the A.I. bubble – only speculation and investing and bullish FOMO is needed and all the right rich people get richer and who cares about the future when the bubble bursts or the atmosphere ignites because the Earth can't sustain the heat-generation and carbon emissions?

Certainly not the speculators!

Re: I'm gonna get mega-downvoted

Or OpenRC which I run on my development workstations and all my servers, without a single problem. Literally: I have *never* had a real problem that stemmed from the init system because that's literally all it is: an init system.

Sure: it sometimes inits something that is broken because sometimes other things don't work but that's not inits fault.

The reason systemd is a problem is purely because it is purportedly there to be one thing but, in reality, does a whole lot of other things that no significant audience is wanting. You can't mobilise an army of init experts to "solve systemd" because, at best, that army will produce the best possible init system which will entirely fail to gain traction because being the best init system isn't even the same game or competition. Similarly, there is no army of experts aiming to build the best kitchen sink to compete with systemd on its own terms because no experienced experts believe that a kitchen sink is good or even viable.

So, when industry comes along, they funnel funding, convention, norms, backing and popular vote into their own pet kitchen sink and systemd is what comes out the drain.

Re: IMaybe not a piano

I disagree. I actually think the reason my code never fails in production is because the action of my key-strokes used to enter it into the computer is informed by my knowledge of the sensation of flinging piano-hammers off the escapement with some modicum of skill and aptitude.

At least: I'll sell that line as hard as necessary in a job interview or salary discussion with no remorse. Never let the truth get in the way of a good story! ;)

Re: Want to start a career in coding?

Nobody begins their career with a will to remain a junior and these stochastic-token-extruding-machines will never become the experts. Given a job of any complexity, they are USELESS. It's all very well to say that with some kind of accuracy rate and some kind of hallucination rate they can perform some simplistic, limited, exceedingly common tasks with some level of success but these models rapidly become totally incompetent in more nuanced situations or when the task needs to satisfy broader or grander requirements or objectives.

The industry has yet to realise that us grey-beards will not be replaced by these extruding-machines and, as a grey-beard, I -- for one -- would like to extend a welcome to anyone contemplating becoming a newbie and beginning their career, now.

We grey-beards largely do not care about the existence of these supposed-newbie-replacing-machines because they play no role in our more abstract and complex jobs. If you see an enraged grey-beard raging against the extruding-machines, it is nearly always because they resent wasting time fielding extruded issue reports, extruded pull requests, CVEs, code submissions and the like. Some idiot is using these things and wasting OUR time with the extrusions. Go away, you demons of stupidity!

What we *do* care about, however, is the fate of the newbies, themselves. We don't want to correct A.I. excretions. Fundamentally, we LOVE helping junior programmers because we want them to grow into better programmers who can help us, work with us and, one day, go on to become the grey-beard themselves.

We don't help juniors because we want the code they're submitting. Trust me: helping newbies usually takes longer than just doing the work, ourselves.

In the stochastic-rubbish-extruding-machines, we see junior-level near-competence (at the very, very best) along with a hopeless situation. Vetting the machine's output helps nobody. Even if, somehow, the model did learn from our correcting of its output, that would serve the corporation behind the model who owns the vast server-farms on which it can operate and our mentoring of such a thing would basically be futile and also to to our own detriment!

If you're a junior software engineer or thinking of becoming one: go find your nearest grey-beard and ask them whether they'd feel more amenable to mentoring, correcting and training you or whether they'd rather save your salary and pay that up to a mega-corpo for a hopeless model.

GitHub → whipper-team/whipper

You, sir, need to know about `whipper` (for Linux, GitHub → whipper-team/whipper).

I used to happily use DbPoweramp – bought and paid-for – for many years and only recently (in the last month) stumbled upon `whipper` and I can honestly say I'll never look back. Once it knows a few attributes of your disk drive (including the AccurateRip offset), ripping a disk is as easy as `whipper cd rip`: one command-line, drive emits spinny noises for some while and `.flac` files get written to some place in your home folder. If you're going through a stack of disks, each one after the second can be as easy as two keypresses. It is the epitome of a great "desktop"-but-command-line program.

Sure, one invariably needs to patch up the metadata on the files after they're ripped but that's nearly unavoidable and DbPoweramp was never the best interface for that in any case.

`whipper` employs `cdparanoia` properly and also checks AccurateRip. Everything about it instils confidence in the fidelity of the audio data.

On the first day I tried it, I spun up nine audio CDs pretty much back-to-back after the first and that proceeded so smoothly, it quelled all my inklings of impending-need-to-hack that new Linux desktop workflows often entail. That stack of disks had sat on my desk for 18 months before I finally got around to ripping them simply because I wasn't in the mood to fight if necessary. I used a relatively ancient LG blu-ray drive connected over USB and did this on Gentoo under a custom configured Kernel – you'll forgive that 18-month period of apprehension and appreciate *why* the easy time I had was so refreshing.

If it worked for my Gentoo desktop, I cannot imagine it being in any way obtuse under Linux Mint!

(Now: foobar2000, however, is something I have yet to replace under Linux. R.I.P.)

The Means were not Insecure

The channel was perfectly secure. The recipients at the end-points were erroneously selected. Theoretically, if the part of Signal had been played by some surely-over-priced, over-budget and long-delayed government, designed-by-committee, end-to-end chat software, there would be nothing preventing the accidental addition of a journalist as a recipient of the chat except the fact that journalists typically aren't added to such systems at all.

We need to be very, very clear about what happened and overly pedantic, here. I'm just waiting for the first numpty to start spouting that, look, Signal isn't all that "secure" because it just got "hacked" or man-in-the-middled or something and government secrets got "stolen", then twist that argument into one in favour of legislation enforcing backdoors in end-to-end encrypted messaging platforms like Signal, compromising the academic argument that true end-to-end encryption cannot be secure if it has any backdoor at all.

If those sound like dumb arguments, that's because they are dumb arguments. But they'll likely suffice and any hints that Signal is somehow insecure will only make that likelihood greater.

Re: Hi ! We want to steal everything...

> Yes because paying for stuff is economically unfeasible...

Arguably, at the consumer level, paying for stuff is not only economically unfeasible, not only unfeasible in general, but impossible. I have a long list of books I would love to read but cannot, simply because I'm planning a move so I don't want to buy a hard-copy to add to my existing packing problems and buying those titles as DRM-free ebooks that will work on my Tolino (kobo variant) device is impossible in every way. They're newer titles with living authors who I support and I would love to pay those authors but I just cannot.

The rest of the world has a very simple counter to the AI bros: all they have to do is say that violation of copyright by US companies will result in international abandonment of copyright treaty – and, similarly, for patents. This would also include dropping international enforcement of DMCA section 1201 and refusing to respect US copyrights and enforce them against people not in the EU – even if their IP addresses appear in torrent swarms. Tit for tat.

Of course, this would only carry weight if the AI bros were in favour of copyright at all and they are not. Their end-game is the total rubbishing of copyright across the board because they are betting that it is obsolete. There is no need for copy protection for content that can be extruded at scale, on demand, without the need to pay creators to make it in the first place. Their bot-shit doesn't benefit from copyright protections because they are selling its excretion-as-a-service, not the artefacts excreted.

Re: Lots of Astroturf in this thread

This is par for the course wherever browsers are discussed. Indeed, the ubiquity and indomitability of the Brave astro-turf gang is alarmingly high – that, alone, would be enough to raise red flags, in my mind, even if I didn't know the sordid history of the Brave browser and how it has been associated with an awful number of "web 3" debacles, continues to push crypto-currency, tried to pull the affiliate-abuse trick that Honey would later (rightly) be lambasted for, and generally behaves appallingly in numerous ways – and there are archived links (wayback machine et al.) to prove it, whatever the gang spouts.

Brave earned their place in the untouchable-software-purveyor box and there's nothing they can or could do to redeem themselves in my opinion, just like Microsoft, Alphabet, Meta, Unity, Adobe and some others. All of these corpos earned their untouchability through numerous acts of bad-faith that were *not* mistakes – not single incidents but a history of scummy behaviour.

I feel like Mozilla have joined them in that box, now, and although this is a hot news headline, today, Mozilla were teetering on the brink of the abyss for a very long time, already.

How far we've come!

Oh how we look back with fondness on the days of yore, now that a "Let me google that for you" reply is no longer a cynical, obnoxious act but triggers, instead, some deep and fond nostalgia for the World Wide Web before enshittification and the Death of Search, when "googling" could justifiably be considered not only to actually be helpful but *so* helpful, indeed, that "googling" was considered by some to constitute due diligence before one could pretend to curiosity sufficient to pose a question in a comment thread!

A curious sarcastic commenter wants to know: *when* one "googles" for Torvalds' age, today, does one actually *find* it? Or does one find a verbosely worded essay on (among other things...) the history of the concept of age, why tracking the age of someone is useful, code-snippets showing how to do an age-adjacent thing in Javascript+React, and a stirring memorandum on how knowing an "age" can benefit YOUR business or your bottom line, followed by a link to a premium, for-profit tool for age tech and a sidebar in which an online webinar taking place right now, on embracing age and age-related cloud products with integrated age-AI models, is advertised as the only way to succeed in today's economic climate?

Re: "You're driving towards a wall!" "No I'm not!" *smash*

Sometimes, I think we should just give up and stop trying to save ourselves – the effort would be better spent inventing ways to leave a legacy for the bonobos, the octopi and the dolphins and all other species that might one day evolve higher levels of intelligence so that we can warn them not to repeat our mistakes.

Sometimes, I think we should just sever our tubes and queue the music, start the party, go not gently into one glorious, hedonistic goodnight and let evolution run its course as soon as possible on evolutionary time-scales, for a more worthy species to rise to inherit the earth.

Certainly, our continued struggles aren't doing the bonobos and the octopi any favours!

But I accept that others have not given up the fight and I *will* continue to fight in solidarity with them. And, more and more, I'm thinking that fighting is going to be necessary because playing nicely is not working.

Re: In the opinion of this Englishman

The connotations attributed to the adjective, "hot," would imply that a hot fluid was perceptibly warmer than a "tepid", "lukewarm" or "blood-warm" fluid which one might understand to be approximately body-temperature. Conclusively: "hot snot" would be distinct to "tepid snot" in the imaginations of most readers.

(I do hope I have not offended any reader's imaginations in my synopsis of these English-language facts.)

I'm a hater.

Does it work? Who can say? What does it work *at*? If that question were simple, I – too – would honestly not care very much about it because I do not count "init systems" amongst my areas of interest, particularly. I do consider myself to be a systemd hater, however. I'll own it!

I can't answer the question of what systemd works *for* or at because it seems that systemd is trying to be everything: it is not just init. Every other news story about systemd concerns its creeping into yet another domain it has no reason to touch.

So, I ask: who can say it works? We can't even define what its scope is or what it will be, tomorrow, so who can define whether it is fit for purpose or not?

I hate it because I can't ignore it as long as I'm a Linux user. The way it creeps into every domain makes it necessary for me to know about it and care about whether it is fit for purpose or compromised. The more systems it touches, the more irreplaceable it becomes and the more I need to care about it.

I run Gentoo, on OpenRC, and don't even use systemd and yet, still, I have to care about it because of its outsized impact on the whole Linux ecosystem – that's why I hate it.

I don't know a damn thing about how sysvinit looks on the inside, or how OpenRC's upstream code-base truly is to hack on, but I do know that I can define their standard operating conditions and the job they're supposed to perform and I can answer that question: do they work? If I determine that either one is lacking, I can implement my own replacement to meet my needs because their scope is contained. It is nearly impossible to "replace systemd" in the ecosystem, today, and only becomes more difficult with every new development in this farce.

To judge that it works would require confidence that it succeeds at what it claims to do which I've argued is ineffable but it is easy to prove that it does NOT work because one only needs to find the stuff it breaks. I use Gentoo almost exclusively on desktops and servers, today, but I have used systemd-based distributions often enough to see it break, frequently, often rendering Linux mechanisms that should be 100% independent of init, like `sudo`, totally inoperable or introducing new supply-chain attacks, like the way the whole `xz` thing transpired.

Should the OpenSSH developers have cared about whether the supply-chain of `xz` should form part of their threat model because of how distro package maintainers at Debian might link things to satisfy the requirements of agent P's "init system"? That would be totally absurd but, yet, that actually happened. That actually came to pass. That is why I care. That is why I'm a raving, frothing lunatic with rage whenever I read about systemd. This situation *is* absurd.

… and it threatens our operating system: Linux. I actually like to be able to use computers that run a sane operating system.

Re: 42% less unix philosophy

Eleven seconds. My development desktop, on Gentoo and OpenRC, boots from cold, hard power-off to a fully-operational KDE Plasma 6.2 desktop in eleven seconds.

Maintaining some open source-code isn't supposed to carry a punishment. It is this sort of opinion that breaks that deal.

This is why I never publish my work as open-source and only ever push patches up to projects that I really, really love and trust to value my contributions. There are simply far too many who think that "maintainers" should just deal with the nasty side of open-source for whatever reason.

Re: We need a User Agent that isn't Googled.

Pre-emptive response: "Source Available" does *not* cut it for a web browser, supposed to be a User Agent, with which human beings do things like Internet Banking, personal or intimate messaging and – on occasion – research which conflicts with the prevailing status-quo of the land in which they're living such as searching for certain bears that like honey or for clinics deplored by a certain political lobby for culture-war reasons.

You cannot fork a Source Available software if those who publish it change their behaviour in the future. Without the threat of being forked, the corporation behind the software faces no checks and balances from their user base and being morally upstanding holds no specific utility value. This means that morality necessarily ceases to be a dominant strategy as soon as the Dollar arrives at the door.

A Source Available software will have no long-term plans to maintain support for user-first standards like Manifest v2 because they know that user disagreement is impotent. Indeed: Vivaldi say they'll support v2 until some time next year – THAT'S NOT LONG-TERM and we can't just fork Vivaldi in 2025, either, should they neglect to extend that or even just forget that promise before June, 2025. (Vivaldi, to be fair, are in an unfortunate position because they surely don't want to maintain v2 in their own fork of Chromium. Again: the problem is in evidence.)

Re: This just seems wrong

The other big question is why does the corpo have any influence on the actions of the .org, anyway?

I've always understood the split between corpo/.org for FOSS products to define the boundary between what the community retains (.org) in return for – you know – actually building the whole product, and the money-making entity to be set up as just one service provider to profit, employ a core team of developers, and, ostensibly, to sponsor that community.

It's supposed to be a hedge so that all the FOSS developers don't just immediately jump ship, fork, and refuse to ever touch the original code again – potentially turning directly to their lawyers to ask whether a corporate take-over is legal. FOSS devs understand that they're getting ripped off (in a way) but that the split is inevitable as soon as the projects becomes successful enough to demand a stable revenue stream coinciding with corporate profiteers looming, inexorably, anyway.

It seems to me that Automattic are proudly and loudly pronouncing the quiet bit: FOSS projects are basically suckers for this abuse. I don't particularly care one jot about Automattic, WPEngine or WordPress but I do care about FOSS (in general) and it seems to me that this story is relevant as a cautionary tale for the whole ecosystem.

Re: Open Source Licenses are already sufficient.

TL;DR: this whole palaver exists purely to precipitate a nonsense-fight in which the very concept of copyright is borked by collateral damage.

Re: Is this their final 'footgun' moment?

Always remember the single-paragraph, fundamental truth of the advertising industry: advertisements shoved into faces – "exposure" – exist only for there to be a concepts of "ad exposure" to sell to gullible advertisers. Hit rates or conversions to actual transactions are intensely and extremely irrelevant.

Advertising has nothing to do with actually selling a product or service. That was once called a "hit rate" or something but everyone realised pretty quickly that advertising hit rates were always and always would be ridiculously low – well below any kind of noise floor. Advertising is all about selling ad space or potential "exposures".

That's why algorithmic feeds and content farms exist. They aren't there because they provide utility. They're there because they represent potential exposures to sell to fools. "Engagement" metrics exist to make those seem valuable – the more time wasted, the more potential "exposures" there are to sell.

Advertising is the antitheses of a "collective action" problem and that's why ad-blocking went ignored for so long. Ad-blocking represented "collective action" in opposition to advertising by the wrong group of people – the users – and those in power didn't care about that because the only action that would threaten them would be if the idiots paying for the ad space acted against it – which they did not. Google, Microsoft et al can still sell their "exposures" to fools even if the users who might actually click the fool's ads block them. Again, the hit rates and conversion stats were so low and meaningless, the effects of ad-blockers were immeasurable. (YouTube being the one exception to this, admittedly. I honestly don't even...)

Re: Haters Should Be In The Headline, Not systemd

I imagine that the up-stream OpenSSH developers do consider unadulterated `sshd` to be perfectly well ring-fenced from attacks against systemd, or `xz`/`liblzma` or – more generally – from the attack surface of essentially unfunded libraries with at-most-one trustworthy maintainer. That's why they don't link those libraries!

The UNIX Principle is what we *need* to be discussing but – frankly – what's the use? It has been long abandoned. Meanwhile, call me a "hater" because, yes, I do hate the very concept of a Linux box that runs an init that scorns the UNIX Principle so extremely that a daemon likely to run as `root` must necessarily be compromised *at build time* for compatibility.

OpenSSH should never need to know of the existence or use of whatever is chosen for init or whatever initiates it as a daemon, let alone be critically compromised via a supply-chain attack targetting that initiator or libraries that may or may not be linked to that.

If, indeed, `libsystemd` is not safe for use then it should not exist at all.