My timeline is full of #NetBSD recently and I love it.

One of the things that I have noticed while using the #GeminiProtocol more: I don’t like inline links. I think they’re bad for readability, are distracting and people trying to find clever parts to turn into links is just annoying. In the end, you need to hover everything that is a link to see what it is going to, instead of a clearly labeled link after the paragraph. E.g. random words being a link to Wikipedia. Just put a link below the paragraph that says “Wikipedia article on foo”, then I know what it is without hovering and don’t get distracted from reading.

So, yeah, #Gemtext not supporting inline links? That’s not a missing feature. It missing is the feature.

Even if you’re not writing for Gemini: Please stop with all the inline links. It’s just bad.

So, we have a public nginx RCE with demo exploit + a new public Linux LPE with demo exploit, for both of which the patch is less than a day old. So there is a public 0day chain to get root on 50% or so of the internet via a simple HTTP request. Oooooof.

Recently I’ve lost pretty much all joy and motivation to work on my hobby projects. All this AI slop sucks the joy out of computers for me. I‘m extremely NOT excited about the future.

It feels completely boring to me to do anything manually that other people are doing by just talking to a computer.
Why invest decades of your life into something when someone else just talks to a computer for 10 minutes and completely replaces it?
E.g. see the proliferation of ObjC runtimes recently, when I spent a lot of time back then figuring out how everything works because the GCC code didn’t even have comments. Only for it all to be consumed by AI and someone creating within a weekend a new runtime using AI that just stole all my work.

I feel like I’m just done with it all. No point in writing any code anymore. It will only be consumed by AI and then someone just recreates it all in 10 minutes. No matter what you do. All you do at this point with public code is a donation to AI companies so their AI can do more things and replace yours.

So yeah, I’ve contemplated to just hit the archive button on all my projects and stop writing code entirely.

Haha, it seems they used real browsers to circumvent Anubis. So the same tricks as on a real browser work to completely exhause them of memory. I can now see them dying one after another.

OK, it seems to be thousands of connections with each of them trying to do multiple queries per second. The experiment “internet” has failed.

OK, so #AI #bots have managed to bypass #Anubis - again. How much is the AI DDoS by now? So much that the Linux kernel can’t handle it anymore:

nf_conntrack: nf_conntrack: table full, dropping packet

And yes, this is seconds after rebooting the VM even.

This is insane.

OK, that’s it. Let’s shut down the internet, there is no point anymore. AI bots have destroyed it completely, there is no point in keeping iy anymore.

RCE in popular Rust library to extract Tar files: https://www.phoronix.com/news/Rust-TARmageddon

The class of bugs that have been called impossible in Rust by the fanboys. The class of bugs that have been called so bad that they can only be fixed by rewriting everything in Rust. The class of bugs that have been called so important to fix that this justifies dropping 90% of all platforms.

So that all turned out to be a pile of BS. What a surprise.

Oh, and Python, where large parts of the ecosystems have been rewritten in Rust, which turned it from one of the most portable languages to basically not portable at all? Also affected. Of course.

At least Rust has dynamic linking so that we can just update a single file, right? Oh…

Can we stop with the BS and the hype now, please? Software security is not a matter of the language alone, but of engineering practices and proper design. So please stop bullying projects now for not using Rust.

@thomholwerda Your captcha on OSNews is also active for the RSS feed, breaking it.

AI scrapers now seem to employ botnets to scrape websites, effectively DDoSing them with multiple thousand requests per second from residential IPs all over the world. As they know they’ll get banned, they randomize the user agent, using stuff like Firefox on Windows 98. Yeah, sure, the last version of Firefox on Windows 98 wouldn’t even be able to do the TLS handshake.

They can still be identified by doing things no human would ever do. Like for a repository, requests every single commit as an archive. Or requesting blame on a file that nobody would ever be interested in.

In any case, has anyone found an effective way to ban this AI bullshit? I fear I need to employ some JavaScript to return the actual site contents, but that would reduce accessibility.

In today’s “ @objfw keeps finding broken OSes and compilers” episode:

Clang likes to forget a variable: https://github.com/llvm/llvm-project/issues/88706
Clang hang in an infinite loop: https://bugzilla.redhat.com/show_bug.cgi?id=2275090

I think I should change the goal for ObjFW and just turn it into a compiler and OS test suite and encourage everybody to include it…

One of the sad side-effects of the #xz #backdoor is that many projects feel like they need to move away from #autoconf, when the problem wasn’t autoconf itself, but shipping a bunch of .m4 files – and that nobody diffed repo vs tarball (if nobody does that, it doesn’t matter what you do in the repo, e.g. switching build systems).

This is sad because it means cross-compiling stuff will soon no longer be possible, as autoconf is so far the only thing that gets cross-compiling right. CMake is a complete mess, Meson is far from great for cross-compiling and everything else just outright doesn’t support it.

People, clean up your configure.ac, get rid of .m4 and audit repo vs. tarball! That’s less work, much more effective and doesn’t kill cross-compiling!

Also, if you absolutely must blame a piece of software that was used by xz for this: That’ll be #gettext, which was the reason for the insane amount of .m4 files in the first place. gettext is a mess and that is really something we should get rid of.

I started a writeup of what I found so far about the #xz backdoor since so many people kept asking in the XZ backdoor reversing chat: https://github.com/Midar/xz-backdoor-documentation/wiki

Feel free to add to it! I have analyzed more already but ran out of energy to write it down for now.

Wait what? One of the most used #Rust libraries ships a BINARY that has been proven to NOT EVEN MATCH THE SOURCE? How can Rust people think this is acceptable?

And here I was thinking that you need to trust their binaries to bootstrap Rust at all was bad, but now it’s also you need to trust the binaries of random developers. Or that I thought it was bad that they tried (unfortunately successfully due to the hype they managed to create) to infect all modern software using their “Rewrite it in Rust” movement so that you can no longer run it on less common OSes / CPUs (because if you would mention that, they’d just tell you to go fuck yourself, essentially. librsvg, anyone? python-cryptography, anyone?).

I think we have reached the point: Rust needs to die. Not because the language is bad, but because of its community. It needs to be ripped out of everything and Rust code needs to be rewritten in something else with a less toxic community.

Does someone with an #Amiga have networking set up? I think I found a bug in FS-UAE’s bsdsocket.library, but need someone to confirm.

Please boost.