Still want to support your FOSS Supply Chain with money but do not know how?
You can still be the first company to do so with my help! This consultation has not yielded any interest from anyone!
Prove me wrong and support your Supply Chain!
And yes. I am doing this because i really do need the money. I got some unexpected bills piling up this month and I really would appreciate the money.
So let's help each other!
If you have ever wanted me to answer some of your questions at work or help you figure something out... You can!
I still have a small consultancy on the side, and I will happily bill you for just a consultation. No need to make it big. Anything from a look at the quality of your codebase with a nice report, helping you analyse your incident management or just help run a postmortem.
Anything.
You can find all my contacts at the bottom of my page
https://www.softwaremaxims.com/consulting
Open question, maybe for @joshbressers .
We know vulnerable Log4j version to log4shell are still downloaded to this day.
How many actual breach have used it?
I ask because it is a useful way to analyse the whole "apocalypse of vulnerability". If even multiple years non patched one that attackers knows about are not used....
So, it is not only the UK that keep peddling charlatan's information about ADHD, the french TV do it regularly.
I have adult diagnosed #adhd If I had been medicated as a kid, I probably would fare far better as an adult. And I got lucky, being in a relatively well off family, that supported me, doing well at school and having a lot of help. And all the rest of the privileges I have.
But that is not the case for most people. ADHD diagnosis and medication save life and save a ton of money for society.
I am lucky that I know how to read research paper and also to search them. I have spent quite the time on it.
So if you have any questions or doubts about ADHD as a medical condition, feel free to ask me any question, even in private. I will try to answer and help you understand what is truth from fabricated misinformation.
Come at me :)
Why am I not scared of "AI hacking"?
Well because of this. You see, it is such an easy target rich environment that getting more capabilities would not change anything to the game.
And that is if it even works at all.
for reference on what "We Kill People" means here, see https://hachyderm.io/@Di4na/116888367439703361
Today in "We Kill People" n988390
So i just read the anthropic post on their own inadvertent "hack" ....
I am screaming. Everything in this post screams both incompetence and deep wrong models of the world. Even the solutions they offer.
This is... This is not even wrong. I don't even know where to start, every single paragraph is fundamentally wrong.
Like. Please for the love of everything listen to the experts.
https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals
When people wonder why I wrote https://www.softwaremaxims.com/blog/open-source-hobbyists-turf and why I am angry...
I just received the OpenSource Summit schedule from a LF newsletter.
And it is fascinating how much it can be all stuff from Alpha Centauri that have nothing to do with the realities of FOSS.
Like, I know for who it is. I get it. But also, why do you happily pay to be misinformed if you are in a decision making position?
I mean, I know why. I get it. But still, this is such a waste of money and time that is precious for everyone.
Before I spend time writing it, is anyone interested in my take about the HuggingFace/OpenAI situation ?
Three themes.
1. How to obfuscate and scare with languages
2. Oh No! The door was open and there was light, so I entered
3. It is uneconomical. And the only fix is better FOSS quality
Why I do not see a future in coding with genAI/LLM. And why I am an AI skeptic.
This post has been waiting for me to polish it for a year now, but I never found the energy. So you are going to get it raw. No pass through any of the beta readers I usually do.
I may do a pass later to clean it up, but I am just too tired these days to spend a lot of time on my hobby. So it may stay that way.
If you want references, feel free to ask, but they should not be hard to find.
On my way to #GUADEC , as they nicely invited me to give a keynote. Looking forward to seeing you all there!
And I am around tonight if you want to organise something.
Damn do I hate travelling by plane though. It is not the plane. It is the airports.
RE: https://tldr.nettime.org/@kdawson/116885702874242574
We Kill People, Case study n 52477
If you don't know, a regular answer I get when I talk about Quality in Software is "it is not like we are doing Safety Critical stuff here, we do Sprockets".
At which I usually respond "well, we DO Kill People regularly, because Sprockets end up everywhere". So I keep a regular look out for this kind of cases.
Hence the We Kill People serie.
"find ways to decrease the burden on maintainers in the long run."
How can you do that when you have no idea what the problems actually are and do not even talk about what is the burden.
I don't care about this kind of report, like nearly all hobbyists maintainers. Do you know why?
Because it doesn't even register. These reports are far low on the hierarchy of urgency. The urgency for a hobbyist maintainer is
1. Keep the build system running
2. Keep the tests running/CI running (that matters less than the build system)
3. Keep the code working despite all the change in our environment. Like if you are a JS library, you need to adapt to change in Node, Deno, Chrome, Firefox, Safari and their mobile versions.
4. Update dependencies and all the breakage it creates.
5. Fix old fucked up mitigations made for the previous points
6. Keep the documentation updated
7. Ok, I can look at the security stuff report maybe, and possibly fix some
8. Keep documentation working
9. New features
Some of this hierarchy is a bit murkier, but the top is *really there*.
As you can see, the security report will never get met, because the top 4 already take more time than available to hobbyists. If you want to ease their burden, you need to act on these top 4. The rest can be as easy as possible, it will *still never reach the level of importance*.
So I have so many problems but my main one is this one
"Its goal is to front-run a serious problem facing open-source maintainers"
*Why is this a problem for FOSS Maintainers?*
People will file reports? That is what we consider a *problem for FOSS Maintainers?*
I keep breaking my build which takes hours to fix due to our build systems being built with chewing gum and wire since the 90s, our C compilers can barely output multi line errors, we have nearly no way to know if our code update will break our downstream...
But a serious problem is a dozen useless report being filed on us?
*what the fuck are we doing here?*
https://blog.trailofbits.com/2026/07/02/field-reports-from-patch-the-planet/
If you ever wonder what I mean when I keep going back to "if you want better FOSS infrastructure, fix the tools", consider the time spent on this build problem. Then compare it to the average budget of "2 to 4h per quarter" of a hobbyist maintainer.
The problem is not that we have little ressources. The problem is that we spend it in useless build system and dependencies side quests.
RE: https://mastodon.social/@andrewnez/116771370491582851
This. So much this. Listen. Read. Don't tell him he is wrong.
Consider how your idea fits once you accept these as facts that are immutable.
Of note, I don't think this i *bad*. I think this solves the problem the EUC has, which is decoupling from the US. So it focuses, really heavily, on end-user shrinkwrapped software and things that focus on Digital Rights for the end-user.
This is not a bad thing. They are doing exactly what they need for their goal and for Digital Rights.
But as I will keep arguing, most of the problem that the FOSS infrastructure of the world encounters right now are not Digital Rights problems. They are Roads and Bridges problems.
Different problems, different models, different solutions.
So uh. I had a look at the EU Open Source Strategy.
It is deeply rooted in a mindset from the 90s and totally misses the mark for open source infrastructure. I am not surprised, nor am I disappointed. This is in line with the kind of hobbying and models of FOSS that has been developed and pushed by all the Foundations.
At least we have something. There are a few nods to the real solutions and problems in there, hidden, but they do not fit in the overarching plan and it shows.
Time for us to keep trying to offer more realistic models!
https://digital-strategy.ec.europa.eu/en/policies/open-source-strategy