Note that NixOS and reproducible builds did not detect the xz backdoor, and in fact NixOS shipped the malicious builds of xz (though they didn't do anything because the malware didn't target NixOS):
> I am a NixOS developer and I was surprised when the backdoor was revealed to see that the malicious version of xz had ended up being distributed to our users.
As always theory and reality are different, and the thing that made xz possible was never a technical vulnerability with a technical solution—xz was possible because of a meatspace exploit. We as a community are very very bad at recognizing that you can't always just patch meatspace with better software.
About two years post-seizure, the bureau returned Martin's money—shortly after she filed a nationwide class-action lawsuit. But while the bureau may have hoped that would persuade her to drop it, she has continued with her suit, which was back in court last week and seeks a ruling that will prevent the FBI from proceeding with others as it did with her.
Software engineering is one of the ways of playing life in "easy mode" (I moved from academia over a decade ago, and I know the difference). This blog post tries to paint it differently - and it feels like it lacks perspective compared to virtually any other occupation.
> We’re living in a world where billion dollar tech companies expect us to live and breathe code, demanding 80 hour weeks under the guise of "passion."
Yet, it is up to us. In some software jobs (AAA game dev and a certain type of startup), you are expected to crunch beyond limits. In other places, you can have a typical 40h/week job at a salary way better than the average 9-5 job. Or you can freelance a dozen hours a week and live in a remote cottage. Or work from Thailand when it's winter. Or take a gap year to regenerate, or reinvent, yourself.
Not many career choices support this freedom. In some (e.g., medical careers), grind is not optional—you won't finish university, you won't get established, and that's the end of the story. In many other jobs, if you were freelancing a dozen hours a week, you would literally not be able to afford food. In many professions, quitting means the end of a career - or at least a serious setback; in tech, it means getting many messages on LinkedIn.
Don't get me wrong - I am all for criticism of grind and exploitation. But let's not paint ourselves, members of one of the most privileged occupations, as victims of the global system.
>looks at the top X hits and then interprets it to be the correct answer.
LLMs are truly reaching human-like behavior then
Searching the web is a great feature in theory, but every implementation I've used so far looks at the top X hits and then interprets it to be the correct answer.
When you're talking to an LLM about popular topics or common errors, the top results are often just blogspam or unresolved forum posts, so the you never get an answer to your problem.
More of an indicator that web search is more unusable than ever, but interesting that it affects the performance of generative systems, nonetheless.
Yep -- our story here: https://about.readthedocs.com/blog/2024/07/ai-crawlers-abuse... (quoted in the OP) -- everyone I know has a similar story who is running large internet infrastructure -- this post does a great job of rounding a bunch of them up in 1 place.
I called it when I wrote it, they are just burning their goodwill to the ground.
I will note that one of the main startups in the space worked with us directly, refunded our costs, and fixed the bug in their crawler. Facebook never replied to our emails, the link in their User Agent led to a 404 -- an engineer at the company saw our post and reached out, giving me the right email -- which I then emailed 3x and never got a reply.
I have recently been doing some upgrades to the build system for our FE code to swap out yarn for pnpm. I’m normally a backend engineer, but I’ve spent plenty of time in the JS mines.
The most frustrating thing about dipping in to the FE is that it seems like literally everything is deprecated. Oh, you used the apollo CLI in 2022? Bam, deprecated, go learn how to use graphql-client or whatever, which has a totally different configuration and doesn’t support all the same options. Okay, so we just keep the old one and disable the node engine check in pnpm that makes it complain. Want to do a patch upgrade to some dependency? Hope you weren’t relying on any of its type signatures! Pin that as well, with a todo in the codebase hoping someone will update the signatures.
Finally get things running, watch the stream of hundreds of deprecation warnings fly by during the install. Eventually it builds, and I get the hell out of there.
It’s just nuts to me the degree to which FE development as a whole seems to embrace the breaking change, the deprecation, etc. I’ve been working on a large rust project for nearly four years and in that time there have been a few minor breaking changes in or of third party libraries, but only one major breaking change that required significant changes to our application. Meanwhile in JS it seems like you can’t go more than six months without having to rewrite something. It’s bananas.
Okay, rant over.
Already see people saying GitLab is better: yes it is, but it also sucks in different ways.
After years of dealing with this (first Jenkins, then GitLab, then GitHub), my takeaway is:
* Write as much CI logic as possible in your own code. Does not really matter what you use (shell scripts, make, just, doit, mage, whatever) as long as it is proper, maintainable code.
* Invest time that your pipelines can run locally on a developer machine as well (as much as possible at least), otherwise testing/debugging pipelines becomes a nightmare.
* Avoid YAML as much as possible, period.
* Don't bind yourself to some fancy new VC-financed thing that will solve CI once and for all but needs to get monetized eventually (see: earthly, dagger, etc.)
* Always use your own runners, on-premise if possible
Eric, thank you. Lurking in the forum answering questions evokes people to share their opinion for satisfaction and dissatisfaction and often neglectes to evoke praise (proportionally). I am guilty of this too.
So please have some well deserved praise for your work on this. We have gotten an open source wearable OS, purpose built hardware, R&D, a community, more pressure on Apple to be less of a gatekeeper, and something we can own in a crazy short timeframe. I hope you see this despite it being buried. Thank you, you glorious nerd.
This is cap. I worked on heads up glasses, and one of our issues was the lack of integration with Apple's iMessage ecosystem. Device makers are willing to go through several security measures, like deploying the MFi chips and certification. However, at best this gives you access to the notification system, not iMessage itself. You are able to respond to messages via the notification framework, but not integrate directly with iMessage even after taking all security and certification efforts. This isn't a security play. This is a walled garden play.
I guess I’ll take the contra here on messages integration — moving a message over BLE to untrusted hardware and worse accepting them back into iMessage is a massive, massive change in the security boundary and therefore security architecture and therefore security promises that apple makes on iMessage.
I do not believe average smartwatch users understand what they’d be doing if they got this. I do not believe vendors integrating with such a thing can do it safely, or even that all vendors integrating are good actors.
One reason iMessage is less of a total cesspit than SMS is that the ecosystem is closed, and makes automation difficult. It used to be impossible nearly, and in that era we had almost no iMessage spam. Now it’s difficult, and we have moderate iMessage spam. But adding hooks to make this automation easy, and worse, leave the trust environment as a feature is just wrong.
I never heard of them until they were purchased for $32 billion.