Christopher Lemmer Webber @cwebber@octodon.social
GNU (MediaGoblin, 8sync, Guile, Guix) hacker, ActivityPub co-editor, occasional artist. https://dustycloud.org/
Some lessons:
- never trust anything that says it's "localhost-only". It probably isn't. Use unix domain sockets instead.
- Someone can always blame someone else for confused deputy attacks because in a sense, the program is behaving "correctly"
- Object capability people will continue being cassandras crying about why perimiter security is a failure and will be *right*. Perimiter security is eggshell security. But nobody listens anyway because "why not, ACLs seem to work"
Some lessons:
- never trust anything that says it's "localhost-only". It probably isn't. Use unix domain sockets instead.
- Someone can always blame someone else for confused deputy attacks because in a sense, the program is behaving "correctly"
- Object capability people will continue being cassandras crying about why perimiter security is a failure and will be *right*. Perimiter security is eggshell security. But nobody listens anyway because "why not, ACLs seem to work"
if anyone wants a fun story about just how dangerous confused deputies can be, see https://lists.gnu.org/archive/html/guile-user/2016-10/msg00007.html which is a security vulnerability I bumped into which allowed for arbitrary code execution against guile processes that were being used for local development
if anyone wants a fun story about just how dangerous confused deputies can be, see https://lists.gnu.org/archive/html/guile-user/2016-10/msg00007.html which is a security vulnerability I bumped into which allowed for arbitrary code execution against guile processes that were being used for local development
ugh, I also need to prevent against confused deputy attacks against localhost because we're not running ocap operating systems and perimiter security is a failure
Glad my Racket-based ActivityPub tooling didn't go live *after* I discovered that Racket's http tooling will, by default, retrieve file:// urls from disk when using the http get tools
As an aside to other things I've been talking about lately, I do have thoughts on what good governance may mean and it's been on my mind lately regardless of other conversations happening on the fediverse. I thought about starting a thread but I didn't really want to get pulled into debates about a project that isn't mine... I don't think that's necessarily helpful.
But maybe I'll write up something soon. Governance in free software is a tough subject, but one with much history to learn from..
Actual footage of @squirrel helping to make pasta sauce by peeling the garlic
@cwebber @lertsenem @lanodan @codl Does it absolutely have to be the server that validates moves? Because if the client did, you would only need a special client for special activities like chess and use any AP account.
Criticism is welcome, but remember to give constructive criticism, which includes consideration of how your criticism will affect the other person emotionally. The golden rule applies: how would you feel if you read the message was directed at you? It's hard for someone to constructively make use of criticism if receiving it is an emotional drain.
@cwebber Option C: endlessly dithering over whether to break 80 chars or put the first arg below the function name, both of which feel slightly wrong
Something I also miss: threaded conversations were the norm. Yes, in microblogging! Some of the most intense and interesting conversations about free software philosophy and licensing happened in threads that shot way off to the edge of the page
Oldschool fediverse phrases, from about 10y ago:
- TZAG: Time Zone Appropriate Greeting (preferred over "good morning")
- TZAF: Time Zone Appropriate Farewell
- #contextpatrol : when someone posted a response which wasn't linked to the original conversation, someone might link the conversation with #contextpatrol (the old StatusNet (ie, GNU Social) interface made not doing this accidentally easily)
- #vaguejokes : an obscure joke that was not really worth or more fun unexplained
@cwebber 80 chars is best when you want to have 2 or 3 files open at once.
I am, admittedly, the former even when I shouldn't be. But hey, it'll pay off if I ever get paid by the line of code.
Yesterday I saw someone's code though that passed 200 characters wide O_O
Tag urself on lisp indentation style:
;; I'm afraid of passing 80 characters
(proc1
arg1 arg2
(proc2
arg1 arg2
(cond
[(foo)
(bar 'baz 'quux)]
[else
(beep boop 'bop)])))
;; Everyone has wide monitors these days anyway right?????
(proc1 arg1 arg2
(proc2 arg1 arg2 (cond [(foo) (bar 'baz 'quux)]
[else (beep boop 'bop)])))
One of my other favorite hacking music-artists was Pogo... but I stopped listening to their music because I was really weirded out by them making a music video celebrating Trump (and seeing them doing so outside of their music too). I dunno, I can't get behind an artist uncritically embracing the driving force behind the undermining of democracy.
@teslas_moustache @technomancy It's on youtube still https://www.youtube.com/watch?v=tLWHj9MUG90
You can rip it from there yourself, but it looks like it got taken down or something. Probably because it's 100% sampled from Dexter's Lab
sadly I can't find its download page any more, looks like mrsimon took down their bandcamp (or someone issued a takedown)
