I've spent the last week down this rabbit hole and it's not been pleasant:
russ.garrett.co.uk/2024/12/17/…
I don't think it's impossible for small sites to comply, but the guidance is terrible and it seems like it's always going to leave you with some risk.
With #Prusa turning from #openness with its new Core One model and other cases, there is a need to discuss alternative models to cultivate and sustain #opensource hardware. Although promising approaches exist already, it might be vital to identify the necessary patterns of #Commoning. Read my thoughts here: blog.opensourceecology.de/en/2…
#OpenHardware #CommunitySupportedIndustry @OSEGermany cc @GOSH @stargirl
Why Tech-Commons die | Open Source Ecology Germany
The introduction of a new, closed Prusa CORE One should come as little surprise, but there could be a remedy A guest article by Paul Jerchel Commons die without…Timm (Open Source Ecology Germany)
reshared this
We're looking for a designer who has experience working on software to help with Equalize Digital Accessibility Checker in the new year. Familiarity with #a11y preferred and strong understanding of UI/UX in a web application context needed.
Who should I talk to?
reshared this
“The Ugly Truth About Spotify Is Finally Revealed”
honest-broker.com/p/the-ugly-t…
> In other words, Spotify has gone to war against musicians and record labels.
The Ugly Truth About Spotify is Finally Revealed
A year-long investigation by an indie journalist is a call to actionTed Gioia (The Honest Broker)
VMware Workstation Pro 17.6.2 Now Free for All Users
VMware Workstation 17.6.2 Pro is now free for commercial, educational, and personal use! Check out the latest features, bug fixes, and resolved issues.Bobby Borisov (Linuxiac)
atomicpoet.org/objects/9a15e9b…
Chris Trottier (@atomicpoet@atomicpoet.org)
Another real estate crisis is emerging. Here’s just a cold hard fact: 10% of loans on office buildings are in arrears. Delinquencies on commercial properties spiked last month. And because interest...atomicpoet.org
Although the big day for us as a family of 3 is of course Wednesday, the mother-in-law had her Christmas morning with us.
She got a new Kindle from us and a ridiculous amount of sweets and other nice things.
I have a nice new jumper and some lovely local cider to get into.
And the dog, well, she got her own sofa.
reshared this
intheloopknitting.com/doctor-w…
#knitting #DoctorWho #Dalek
Doctor Who Knitting Patterns - In the Loop Knitting
Fellow Whovians will find knitting patterns here for any age or level of interest. There are meticulously researched knitting patterns for Doctor Who cosplay and fun patterns to show your love of Doctor Who in your daily life.intheloopknitting.com
POLITIQ upouští "X". Přidat si nás můžeš na sítích:
Facebook: facebook.com/MagazinPolitiq?ut…
Instagram: instagram.com/MagazinPolitiq?u…
Threads: threads.net/@MagazinPolitiq?ut…
Bluesky: bsky.app/profile/magazinpoliti…
Mastodon: bsky.app/profile/magazinpoliti…
linkedIn: linkedin.com/company/politiq?u…
#eXit #X #ByeByeElon #Twitter #Politika #SocialMedia #Politiq #Zpravy #Media
Politiq
Politiq. 6 231 To se mi líbí · Mluví o tom (21). Magazín POLITIQ hájí od r. 2015 myšlenky liberalismu, demokracie a svobody.www.facebook.com
reshared this
#JonPertwee #ThirdDoctor #DoctorWho
Chrome is now mass-rolling out automatic disabling of uBlock Origin with the deprecation of MV2, forcing you to use the much worse Lite version instead That Lite version is so much less effective that you can fully expect YouTube ads to slip through it basically every time.
Use Firefox. Your other options are Brave (which is bad for so many reasons) or Opera (which is also horrible).
Peter Vágner likes this.
reshared this
I finally turned off GitHub Copilot yesterday. I’ve been using it for about a year on the ‘free for open-source maintainers’ tier. I was skeptical but didn’t want to dismiss it without a fair trial.
It has cost me more time than it has saved. It lets me type faster, which has been useful when writing tests where I’m testing a variety of permutations of an API to check error handling for all of the conditions.
I can recall three places where it has introduced bugs that took me more time to to debug than the total time saving:
The first was something that initially impressed me. I pasted the prose description of how to communicate with an Ethernet MAC into a comment and then wrote some method prototypes. It autocompleted the bodies. All very plausible looking. Only it managed to flip a bit in the MDIO read and write register commands. MDIO is basically a multiplexing system. You have two device registers exposed, one sets the command (read or write a specific internal register) and the other is the value. It got the read and write the wrong way around, so when I thought I was writing a value, I was actually reading. When I thought I was reading, I was actually seeing the value in the last register I thought I had written. It took two of us over a day to debug this. The fix was simple, but the bug was in the middle of correct-looking code. If I’d manually transcribed the command from the data sheet, I would not have got this wrong because I’d have triple checked it.
Another case it had inverted the condition in an if statement inside an error-handling path. The error handling was a rare case and was asymmetric. Hitting the if case when you wanted the else case was okay but the converse was not. Lots of debugging. I learned from this to read the generated code more carefully, but that increased cognitive load and eliminated most of the benefit. Typing code is not the bottleneck and if I have to think about what I want and then read carefully to check it really is what I want, I am slower.
Most recently, I was writing a simple binary search and insertion-deletion operations for a sorted array. I assumed that this was something that had hundreds of examples in the training data and so would be fine. It had all sorts of corner-case bugs. I eventually gave up fixing them and rewrote the code from scratch.
Last week I did some work on a remote machine where I hadn’t set up Copilot and I felt much more productive. Autocomplete was either correct or not present, so I was spending more time thinking about what to write. I don’t entirely trust this kind of subjective judgement, but it was a data point. Around the same time I wrote some code without clangd set up and that really hurt. It turns out I really rely on AST-aware completion to explore APIs. I had to look up more things in the documentation. Copilot was never good for this because it would just bullshit APIs, so something showing up in autocomplete didn’t mean it was real. This would be improved by using a feedback system to require autocomplete outputs to type check, but then they would take much longer to create (probably at least a 10x increase in LLM compute time) and wouldn’t complete fragments, so I don’t see a good path to being able to do this without tight coupling to the LSP server and possibly not even then.
Yesterday I was writing bits of the CHERIoT Programmers’ Guide and it kept autocompleting text in a different writing style, some of which was obviously plagiarised (when I’m describing precisely how to implement a specific, and not very common, lock type with a futex and the autocomplete is a paragraph of text with a lot of detail, I’m confident you don’t have more than one or two examples of that in the training set). It was distracting and annoying. I wrote much faster after turning it off.
So, after giving it a fair try, I have concluded that it is both a net decrease in productivity and probably an increase in legal liability.
Discussions I am not interested in having:
- You are holding it wrong. Using Copilot with this magic config setting / prompt tweak makes it better. At its absolute best, it was a small productivity increase, if it needs more effort to use, that will be offset.
- This other LLM is much better. I don’t care. The costs of the bullshitting far outweighed the benefits when it worked, to be better it would have to not bullshit, and that’s not something LLMs can do.
- It’s great for boilerplate! No. APIs that require every user to write the same code are broken. Fix them, don’t fill the world with more code using them that will need fixing when the APIs change.
- Don’t use LLMs for autocomplete, use them for dialogues about the code. Tried that. It’s worse than a rubber duck, which at least knows to stay silent when it doesn’t know what it’s talking about.
The one place Copilot was vaguely useful was hinting at missing abstractions (if it can autocomplete big chunks then my APIs required too much boilerplate and needed better abstractions). The place I thought it might be useful was spotting inconsistent API names and parameter orders but it was actually very bad at this (presumably because of the way it tokenises identifiers?). With a load of examples with consistent names, it would suggest things that didn't match the convention. After using three APIs that all passed the same parameters in the same order, it would suggest flipping the order for the fourth.
that very much matches my own experience. (I've not specifically used copilot but the jetbrains built-in local thing 🤷)
It helped with boiler plate code and then introduced subtle bugs that took multiples of the time saved to find.
Time to stop using codeql in the #curl project perhaps?
github.com/curl/curl/pull/1579…
GHA: drop codeql by bagder · Pull Request #15798 · curl/curl
We started using codeql for static code analysis in 7183f5a, June 2020. Since then, not a single commit has been merged into the source code repository citing codeql as source or reason. Yet, it ke...GitHub
Hi fellow Mastodonians.... just wanted to check something;
my feeling is that there is a lot more activity on Mastodon at the weekends than during the week (by which I mean re-posting, liking & replying) ... is that just me or a more general impression?
kurtseifried (he/him)
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to kurtseifried (he/him) • • •kurtseifried (he/him)
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to kurtseifried (he/him) • • •@kurtseifried The main problem in my view is that virtually nobody cares about the CWE. No one ever complains about it or asks for it to get change etc. We basically put a finger in the air during 20 seconds when writing the advisory, search around all the available ones and then go with the one we think is the least bad one. And we never go back to reconsider and no one propose anything else.
So they are all fairly arbitrary but "decent" because we try to pick an accurate one.
kurtseifried (he/him)
in reply to daniel:// stenberg:// • • •so I know from my perspective of using them it was essentially a measure of how bad is this? Like cross site scripting versus buffer overflow, I’m probably gonna care more about the buffer overflow. Also, in general most CWEs have a very specific CVSS score, or a pretty tight range, and making sure they sort of sync up was always helpful.
I feel like it also matters a lot less than the open source world, because obviously the majority of source security vulnerabilities linked to the vulnerable code and or patch. You don’t have to trust the security advisory. You can just go look for yourself.
I guess for anyone reading this thread what do you use CWE for?
Daniel Marks
in reply to daniel:// stenberg:// • • •daniel:// stenberg://
in reply to Daniel Marks • • •Making it harder to do wrong
daniel.haxx.se