Skip to main content



Top #CWE reasons used in #curl #CVE reports. In the 161 CVEs we have published over 25+ years so far, we have used 59 different CWEs.

The graph shows all CWEs that have been used more than once.

#curl #cve #cwe
in reply to daniel:// stenberg://

I am curious about programming "discipline" to avoid things like stack overflows, invalid or null pointer dereferences, etc. Does curl use fixed array sizes, especially for arrays allocated on the stack? Is there bounds checking, and do lint-tools check bounds at compile time? Are freed pointers assigned to NULL to prevent referencing deallocated memory? There are tradeoffs between the Rust-style borrow checker requirements, and the flexibility of manual data structure management.
in reply to Daniel Marks

@profdc9 we do try to make it hard to do wrong, daniel.haxx.se/blog/2023/12/13… - but recall that 60% of the curl security problems were *not* C problems.

in reply to Charlie Stross

I've spent the last week down this rabbit hole and it's not been pleasant:

russ.garrett.co.uk/2024/12/17/…

I don't think it's impossible for small sites to comply, but the guidance is terrible and it seems like it's always going to leave you with some risk.



With #Prusa turning from #openness with its new Core One model and other cases, there is a need to discuss alternative models to cultivate and sustain #opensource hardware. Although promising approaches exist already, it might be vital to identify the necessary patterns of #Commoning. Read my thoughts here: blog.opensourceecology.de/en/2…

#OpenHardware #CommunitySupportedIndustry @OSEGermany cc @GOSH @stargirl



Extreme, extreme longshot, but does anyone happen to know of a copy of Everybody can Read by Lew Robins? This is a program from the 90s that's designed to teach children to read, and I'm interested in the Eloquence builds contained in it. I've tried searching on the web, but can find nothing on the program aside from a couple articles in The New York Times. Here's one of them. archive.nytimes.com/www.nytime…

reshared this



Jasně určitě vstup Ukrajiny do Nato závisí od Slovenska, hranol jede nějaký nový matroš?
in reply to KubixM

😃😃 Hranol 😃😃 tak to mě dostalo 👍👍


Když vydržíš nepapat, uvidíš zlatý prasátko 🐷

a co vy? 🤔 😂

#poll #polls plz #boost

  • PAPAT 🍔 (83%, 5 votes)
  • NEPAPAT 🐖 (16%, 1 vote)
6 voters. Poll end: in 2 days



Good news everyone! Both eloquence 4.7 and 3.3 NVDA drivers now have a "shorten pauses" selection choice, so you can adjust pause mode to how you wish with all its flaws, I suppose.


The Doctor's deadliest enemies, The Daleks, made their debut on this day 61 years ago in the classic 1963 story The Daleks - Episode 1 - The Dead Planet, and they’re still going strong! Happy Dalek Day! #DoctorWho #daleks


We're looking for a designer who has experience working on software to help with Equalize Digital Accessibility Checker in the new year. Familiarity with #a11y preferred and strong understanding of UI/UX in a web application context needed.

Who should I talk to?

#a11y

reshared this



“The Ugly Truth About Spotify Is Finally Revealed”

honest-broker.com/p/the-ugly-t…

> In other words, Spotify has gone to war against musicians and record labels.



Scotch Neat, please...
Ummm this is Starbucks?.?.?

Sigh ok... a scotch grande




VMware Workstation Pro 17.6.2 Now Free for All Users lxer.com/module/newswire/ext_l…


This is important: another mortgage crisis is emerging, this time mostly in commercial/office estates. Wondered where all the back-to-office nonsense is coming from? It's the landlords—companies that are up to their armpits in subprime offices are trying to fill them. Same with "AI is coming for your jobs", it's to force the serfs back to the office (ideally for less money).
atomicpoet.org/objects/9a15e9b…


Although the big day for us as a family of 3 is of course Wednesday, the mother-in-law had her Christmas morning with us.

She got a new Kindle from us and a ridiculous amount of sweets and other nice things.

I have a nice new jumper and some lovely local cider to get into.

And the dog, well, she got her own sofa.

#DogsOfMastodon



Google finally did it. Is it time to switch to Firefox? I believe users should be in control of what they can install and use on their desktop or laptop. There's uBlock Origin Lite, which replaces the original uBlock Origin for Chrome and similar browsers. Give it a try.
in reply to nixCraft 🐧

There's an old proverb that goes: "The best time to switch to Firefox is twenty years ago. The second best time is now."

reshared this



I'm still extremely amused that someone who hated the thought of even being within 100 feet of a mic can sound so damn good on one. It puts some people I work with to shame. My wife could give actual vocalists a run for their money in-terms of mic placement, not moving her head etc, etc. Textbook.





Going for a Christmas Afternoon Tea in my friend's house a little upstate and this is what it looks like this morning.


Extermiknit! Celebrate International Dalek Remembrance Day, the anniversary of the first appearance of the Daleks on Doctor Who on December 21, 1963, with free Dalek inspired knitting patterns on my Doctor Who pattern post
intheloopknitting.com/doctor-w…
#knitting #DoctorWho #Dalek
This entry was edited (9 hours ago)



So, it's time again for my traditional synth Xmas. Where all voices have been produced by various text-to-speech engines. I am working on a new one, but it's not quite ready. So here's the old one for now. Happy holidays everyone: OneDrive: 1drv.ms/u/s!AsrDn-5JMCwmgYFS47… Google drive: drive.google.com/file/d/14xMhj…
This entry was edited (10 hours ago)

reshared this



I think I can start to articulate my process for reading two different halves of a Braille line simultaneously in a way that feels natural. My right hand is placed on the second half of the top line and my left hand is at the beginning of the bottom line. My hands "meet" in the middle, though not on the same line. My hands then move down one line. Rinse, repeat. The words process through my head in a similar way they do when I crank up my auto-scroll speed to inhale up to 6 or so words per line. Obviously this observation is still a work in progress.


Charm and charisma! Always flawless gentleman!! Absolutely perfect!!! 😍😍😍🥰🥰🥰🔥🔥🔥🤤🤤🤤💝💝💝💘💘💘🌹🌹🌹
#JonPertwee #ThirdDoctor #DoctorWho


Introducing VScan II: A visual perception layer for the blind

Sensitive content



Chrome is now mass-rolling out automatic disabling of uBlock Origin with the deprecation of MV2, forcing you to use the much worse Lite version instead ​:spinny_cat:​That Lite version is so much less effective that you can fully expect YouTube ads to slip through it basically every time.

Use Firefox. Your other options are Brave (which is bad for so many reasons) or Opera (which is also horrible).

in reply to Мя

Его не зарежут. Он не работает как дополнение в браузере. Он во всю систему интегрируется.
in reply to Zvonimir Stanecic

следовательно он изначально может _меньше_, например не может вырезать рекламу которая приехала уже встроенной в HTML


Teniendo que mantener la cabeza bien fija porque si la muevo demasiado como tengo el cable jodido el auricular izquierdo deja de sonar.

Esto debe ser genial para la salud musculoesquelética cervical, ¿no?




Inside you are two wolves.

You can use update-alternatives --config wolf to set your default wolf.



Today's music/audio production nerdery: In the Hozier song "Too Sweet", in the interlude after the first chorus, the main guitar riff becomes distorted. But if you downmix it to mono, either because you have that OS setting enabled or you're listening on a mono speaker, that distortion mostly goes away. I wonder what kind of effect they used there. It doesn't sound to me like the super-obvious phase shift. I wonder if the producer or engineer tested that song in mono.


Aaah great. I locked myself out of my own Wordpress account by guessing the password wrong 3 times and getting my IP banned for 20 minutes, this is what I get. Ha. Guess I know I have good security against people who try and snoop to guess the wrong pw and solve the math CAPTCHA. Planning to fix my contact form and maintain some additional plug-ins, but eventually my goal would be to migrate to a lighter blogging platform. With the WordPress attitude changes, I'm not happy and the dashboard has gotten so cluttered now it's a lot harder to find settings for your site when they're like 2 or 3 menus deep in some obscure part of your dashboard. In short, no. I don't recommend WP now. Try Jekyll and MkDocs for good markdown support, Eleventy, just avoid Wordpress like the plague please.
This entry was edited (10 hours ago)
in reply to Tamas G

Yay for VPNs! The WP dashboard isn't the best, but it's usable.
in reply to Tamas G

You might look into that Djangobased cms that is making the rounds as of recently due to its staunch commmitment to accessibility. That one's called Wagtail.


I'm posting a unique audio adaptation of Charles Dickens's _A Christmas Carol_ produced by @mcourcel in 2009 or 2010 (I don't remember which year). Every part is voiced by a speech synthesizer. There are a variety of synthesizers with different accents and voice styles, using both formant and concatenative synthesis. There are substantial passages of narration from the original text. I have his permission to repost this. mwcampbell.us/audio/a_synth_Xm…

reshared this

in reply to Matt Campbell

You probably got this question a hundred times when you first posted the production, but did you make that synth rendition of "We Wish You a Merry Christmas" yourself? If so, which synth is that?



I finally turned off GitHub Copilot yesterday. I’ve been using it for about a year on the ‘free for open-source maintainers’ tier. I was skeptical but didn’t want to dismiss it without a fair trial.

It has cost me more time than it has saved. It lets me type faster, which has been useful when writing tests where I’m testing a variety of permutations of an API to check error handling for all of the conditions.

I can recall three places where it has introduced bugs that took me more time to to debug than the total time saving:

The first was something that initially impressed me. I pasted the prose description of how to communicate with an Ethernet MAC into a comment and then wrote some method prototypes. It autocompleted the bodies. All very plausible looking. Only it managed to flip a bit in the MDIO read and write register commands. MDIO is basically a multiplexing system. You have two device registers exposed, one sets the command (read or write a specific internal register) and the other is the value. It got the read and write the wrong way around, so when I thought I was writing a value, I was actually reading. When I thought I was reading, I was actually seeing the value in the last register I thought I had written. It took two of us over a day to debug this. The fix was simple, but the bug was in the middle of correct-looking code. If I’d manually transcribed the command from the data sheet, I would not have got this wrong because I’d have triple checked it.

Another case it had inverted the condition in an if statement inside an error-handling path. The error handling was a rare case and was asymmetric. Hitting the if case when you wanted the else case was okay but the converse was not. Lots of debugging. I learned from this to read the generated code more carefully, but that increased cognitive load and eliminated most of the benefit. Typing code is not the bottleneck and if I have to think about what I want and then read carefully to check it really is what I want, I am slower.

Most recently, I was writing a simple binary search and insertion-deletion operations for a sorted array. I assumed that this was something that had hundreds of examples in the training data and so would be fine. It had all sorts of corner-case bugs. I eventually gave up fixing them and rewrote the code from scratch.

Last week I did some work on a remote machine where I hadn’t set up Copilot and I felt much more productive. Autocomplete was either correct or not present, so I was spending more time thinking about what to write. I don’t entirely trust this kind of subjective judgement, but it was a data point. Around the same time I wrote some code without clangd set up and that really hurt. It turns out I really rely on AST-aware completion to explore APIs. I had to look up more things in the documentation. Copilot was never good for this because it would just bullshit APIs, so something showing up in autocomplete didn’t mean it was real. This would be improved by using a feedback system to require autocomplete outputs to type check, but then they would take much longer to create (probably at least a 10x increase in LLM compute time) and wouldn’t complete fragments, so I don’t see a good path to being able to do this without tight coupling to the LSP server and possibly not even then.

Yesterday I was writing bits of the CHERIoT Programmers’ Guide and it kept autocompleting text in a different writing style, some of which was obviously plagiarised (when I’m describing precisely how to implement a specific, and not very common, lock type with a futex and the autocomplete is a paragraph of text with a lot of detail, I’m confident you don’t have more than one or two examples of that in the training set). It was distracting and annoying. I wrote much faster after turning it off.

So, after giving it a fair try, I have concluded that it is both a net decrease in productivity and probably an increase in legal liability.

Discussions I am not interested in having:

  • You are holding it wrong. Using Copilot with this magic config setting / prompt tweak makes it better. At its absolute best, it was a small productivity increase, if it needs more effort to use, that will be offset.
  • This other LLM is much better. I don’t care. The costs of the bullshitting far outweighed the benefits when it worked, to be better it would have to not bullshit, and that’s not something LLMs can do.
  • It’s great for boilerplate! No. APIs that require every user to write the same code are broken. Fix them, don’t fill the world with more code using them that will need fixing when the APIs change.
  • Don’t use LLMs for autocomplete, use them for dialogues about the code. Tried that. It’s worse than a rubber duck, which at least knows to stay silent when it doesn’t know what it’s talking about.

The one place Copilot was vaguely useful was hinting at missing abstractions (if it can autocomplete big chunks then my APIs required too much boilerplate and needed better abstractions). The place I thought it might be useful was spotting inconsistent API names and parameter orders but it was actually very bad at this (presumably because of the way it tokenises identifiers?). With a load of examples with consistent names, it would suggest things that didn't match the convention. After using three APIs that all passed the same parameters in the same order, it would suggest flipping the order for the fourth.

#GitHubCopilot #CHERIoT

in reply to David Chisnall (*Now with 50% more sarcasm!*)

that very much matches my own experience. (I've not specifically used copilot but the jetbrains built-in local thing 🤷)

It helped with boiler plate code and then introduced subtle bugs that took multiples of the time saved to find.

This entry was edited (8 hours ago)


I have the opinion that Elon is a Nazi and if you're buying products from him you support him and Nazis.
This entry was edited (15 hours ago)


Time to stop using codeql in the #curl project perhaps?

github.com/curl/curl/pull/1579…

#curl


Hi fellow Mastodonians.... just wanted to check something;

my feeling is that there is a lot more activity on Mastodon at the weekends than during the week (by which I mean re-posting, liking & replying) ... is that just me or a more general impression?

#Mastodon #SocialMedia #weekend

in reply to Emeritus Prof Christopher May

I don't know to be fair. I just notice the difference in posts and interactions between timezones, but some people have a lot of free time on the weekend I suppose