• 1 Post
  • 275 Comments
Joined 10 months ago
cake
Cake day: September 2nd, 2023

help-circle


  • Couldn’t be more wrong.

    It is not only in Madrid. When they say “Madrid unveils” it’s because Madrid is Spain’s capital so the government is there, it’s the same as “Spain’s government unveils”.

    It also isn’t a far right thing, but a push by the left (the current government of Spain is lead by PSOE, Spain’s socialist party). Their reasoning is that porn is unhealthy for the kids and it teaches them that women are submissive or whatever.

    I guess that gay porn won’t consume credits then because there is no women involved.

    It’s just straight up bullshit.


  • Many of those are fixed costs. That means that if you use the car more, it becomes more worth it.

    Instead of making cars more expensive, we should make public transport cheaper. And it should also reach outside of cities.

    If you want to go outside of a city for whatever reason (maybe you even live outside a city!) the options for public transport are very few, very expensive, and very time consuming.












  • I use KDE on my Linux machine, which means that I cannot develop anything involving the GPU.

    The moment I experiment a little with the API or give it wrong parameters, not only my program crashes, but the whole system freezes and I have to manually press the “power off” button.

    It does happen in windows too, however it’s 100x less unlikely.

    I also had a problem not long ago that crashing my program would not free the RAM, so every time I ran the program (and it crashed), I had 2-3GiB less of RAM. So I had to restart the computer every 10 runs or so.

    Operating systems are supposed to isolate programs and manage their resources. A program crashing under no circumstances should affect any other program. I don’t understand how it can happen.



  • Java I don’t know enough of to say. I never use dependencies in java because I can’t be bothered to learn Gradle/maven/eclipse/whatever.

    Python I completely disagree. First, I believe all (non-python) libraries are distributed as binaries, no local compilation at all. Which makes the issue of the content not matching GitHub even worse.

    Secondly, python is used as a glue language. Most of the time, it’s just a way to interact with bindings to a C library. There’s no big project that uses only the standard library.

    Lastly, in python, whatever you want to import doesn’t always match the pip install command. In your code you might say “import MyAwesome69”, but the command to install it is “pip install awesome lib”. Any malicious actor would just need to publish a python library called “myawesome69” and it would get many people trying to install “awesomelib”. You have to know the magic words to install each library. And projects rarely tell you how to install dependencies. Requirements.txt is a joke (if you want to automatically create it, it puts every single installed library on your machine/venv, not just the ones used in your project), but you’ll be grateful if the project you want to run provides one. Also, nobody distributes python programs as executables, which means everyone who wants to run it must know the magic words, not just the developers. Moreover, not all dependencies are available through pip. The install instructions might say “install awesomelib”, but when you “pip install awesomelib” you pull a malicious library instead of installing the actual awesomelib available via “sudo apt install awesomelib”

    I don’t usually use libraries in my python scripts, but that’s because I use it as a scripting language, they rarely reach 300 loc. If you want to use tl make an actual program. You’re gonna pull a lot of dependencies.

    C++, like java, I can’t speak of, because installing a library was such a pain in windows without Visual Studio that I was never able to. Might explain why they don’t use many libraries.



  • It is true that having many dependencies is supply chain attack. However, this is the result of combining the following:

    • The UNIX mantra of “do one thing, and do it well”
    • The more things a program does, the more intuitive and useful it is.

    If you want to keep the 2, you’re gonna need a lot of dependencies. To significantly decrease the amount of dependencies you’re gonna need to drop one of those, there’s no other way around it.

    If you wanna know what happens when you drop the UNIX mantra look at any discussion about systemd.

    If you drop the second one, everybody would have to bring their own glue. Making computers only accessible to Linux gurus that master the “|” operator and study CLI program arguments in their spare time.

    I don’t know why this article focuses on rust specifically. Every language has this problem. And cargo itself has many ways to mitigate this.

    • Lockfiles & caches: prevents unwanted version updates.
    • Custom registries: You don’t have to use crates.io, that’s just the default. Set up your own registry with only whitelisted crates.
    • Use GitHub instead of a registry: cargo has great support for this. If you want your dependencies to always match their GitHub repos, just download from GitHub and compile your own.

  • If you work (actual work, not having dinner with other companies’ CEO) you are working class.

    Even if you earn money through your salary, you are working class, even if that salary is 200k. There are people out there with literal billions of $. You already know the difference between a million and a billion, now watch the difference between a billion and 200k.

    The problem is not your surgeon or boss or whatever, they all work 9-5 like you do, the problem is the yatch owners.