“do it again, I wasn’t looking”

  • 0 Posts
  • 35 Comments
Joined 9 months ago
cake
Cake day: September 25th, 2023

help-circle





  • If I were to fully elaborate, I’d be typing for hours, so I’ll sum up:

    • pip - default behavior is to install to system-wide site packages. In a venv, it will try to upgrade/uninstall system packages without notice/consent unless you specify --require-virtualenv. Multiple things can fuck up your ENV to make the python binaries point to system-wide, while your terminal will still show you as in a venv. Also why TF would package metadata files need to be executable? Bad practice, -1/10
    • nix - they acknowledged years ago that they should probably have some kind of package signing and perhaps an SBOM or similar mechanism, but then did nothing to implement it and just said “oh well, guess we’re vulnerable to supply chain attacks, best not to think about it”
    • brew - installing packages parallel to your system packages manager, without containers. My chief complaint here is that brew is a secondary package manager that people might treat as a “set and forget” for some packages, rarely updating them. So what happens when a standard library used by a brew package is vuln? A naive Linux user might update their system packages but totally forget to update brew. And when updating brew, you can easily hit max_open_file_descriptors because kitchen sink

    From there, it’s all extremely nit-picky and paranoid-fueled-- basically, none of the package managers I mentioned are conducive, in my eyes at least, to a secure and intuitive compute environment.

    Unfortunately, there’s not much I can do about it except bang pots and pans and throw maintainers under buses when the issue that has been present for years rears it’s ugly head. Because they are the only ones who can change this, and pressure is the only thing that might motivate them to.











  • yeah I was about to point out that corpos certainly did not just invent the word “bedrot” for their own benefit. This has been a thing for a while. Nurses often have to walk patients who are admitted for several days to prevent “bed rot” symptoms.

    If you were staying in bed all day, every day, yeah you’re gonna get some severe health issues pretty damn quick. But if you’re getting up and moving around regularly, you shouldn’t worry… but in that case, it would make more sense to idk buy a desk, sit at a table, or on the couch. A laptop in bed is not practical and certainly not comfortable with the heat it generates. Quite frankly I don’t understand why anyone would ever choose to use a laptop in bed if they have other options available.





  • See but now is it implying he’s actually a Mr. Perfect or that he’s someone who pretends insistently to be Mr. Perfect? Because if they are building nukes, how often are they actually testing for duds? Is this implying he never makes a dud and everyone where everyone else sometimes does, or that he pretends to never make a dud when realistically nobody will never know until the warheads start flying and it becomes a drop in the pool?

    I choose to believe it’s the latter, that he “takes pride in making the best bombs, with no duds” whereas the disgruntled colleague understands that everyone is expected to never make a dud and that such a boastful claim is baseless since nobody will be able to prove it until Armageddon.