d@nny disc@

@kirakira@furry.engineer javascript is stored in the browsers

@jackeric@beige.party @torproject@mastodon.social grapheneos is right now the most secure general purpose computing device, and entirely maintains its own hardware and software. you speak with an assumed authority in the replies of the tor project, where you know scared and vulnerable people might see what you write. if you're serious, you need to understand that this an extremely irresponsible thing to do. i honestly can't find it within me to give you the benefit of the doubt. nihilism won't save anyone, especially if you go so far as to ? associate android and the play store ? your terminology "veto" is the crux of your entire concern, and i have absolutely no clue what you could mean by that. there is so much more work to do in the middle of wartime than try to neg tor for fucking hiring someone so they can keep people safe. "truly useful" is no true scotsman i think. the people stuck on widely surveilled platforms are not an acceptable casualty! i have seen people i used to trust plant vulnerabilities in everyone's code, multiple times, this year. there still remain people i trust, like the grapheneos project, to protect users. you are fundamentally mistaken about the critical nature of the situation. when the us goes to war, it does not spare its own citizens. on the off chance you made a severe error in judgement, the grapheneos project depicts a vision for the future without depending on google. if you waste their time with replies like these—don't.

@GrapheneOS@grapheneos.social do not know almost anyone else who is making this exact point that "security" is a euphemism for "national security" and is actively opposed to privacy or auditability. certainly not user security. @dwaynemonroe@mastodon.online has identified the extreme closeness of monopolistic and fascistic hierarchical unaccountable and potentially even illegal control

@joe@f.duriansoftware.com (to your point) "consistency" seems like a deeply limited and narrow mechanism to achieve rich and meaningful communication. my experience leads me to believe that representing disparate styles and assumptions should be the goal of an operating system (or a build process). you can't simply mandate that programs or users follow your preferred constraints—if you can't represent their complexity, then they'll work around your interface, and now you have two problems

@alex@dair-community.social @DAIR@dair-community.social labor dot dair-institute dot org is such a powerful URL lmao

@idzie@kolektiva.social are you sure this isn't the beginning of an epic poem

@maxine@brain.worm.pink great environmental storytelling

@ionchy@types.pl thank you i love you

@zzt@mas.to build and packaging are actually kind of the most important thing ever, no clue why people have decided it's boring. the security state certainly doesn't think so

@zzt@mas.to poettering was responsible for weaponizing the xz hack and then created a solution that was intentionally broken. as of now and the foreseeable future dlopen() dependencies remain hidden https://circumstances.run/@hipsterelectron/116429668063527923

@GrapheneOS@grapheneos.social @dwaynemonroe@mastodon.online pypi disabled pgp signing (certified donald stufft and william woodruff tag team production. woodruff whined about how he couldn't surveil some keypairs and claimed this made them "useless") anyway if you want the cryptographic checkmark from pypi they need you to give microsoft or google a few minutes alone with your code before any user can see it. not "reproducible" but reprobuilds only bullies open source code not corps. would love the evangelism strike force to fight corporate DRM and not module signing in the kernel it is very possible to reproducibly diff a build process with module signing, diffoscope just completely sucks [yes i'm likely gonna fork it] thanks for listening!

@june those are a lot of settings

@rose @lanodan@queer.hacktivis.me @phnt@fluffytail.org crowdsourcing salt from disgruntled systemd users who have been salty for years and have had enough

@joe@f.duriansoftware.com black lives matter and no human is illegal still have some bite to them. the RE2 maintainer had the first one on the docs page. they finally took it down after he died

@fiore@brain.worm.pink that makes the acronym NAP which i like

@davidgerard@circumstances.run @iain@kolektiva.social "copyright is unconstitutional" techdirtbag

@alex@dair-community.social @DAIR@dair-community.social HELL YES

@joe@f.duriansoftware.com i did quite like that part about it

@joe@f.duriansoftware.com crying out at the moon like a coyote

@fiore@brain.worm.pink sorry for saying the wrong thing

@joe@f.duriansoftware.com the veneer of science has been used to harm throughout history, most notably through eugenics and phrenology but equivalently through modern applications of computational statistics, which misuse the same veneer of science and indicate the fundamental weakness of academia as a construct. i would question its inclusion without editing

@joe@f.duriansoftware.com i did laugh at love is love

@fiore@brain.worm.pink boring names chosen for stuff scientists don't like, fun names for stuff they do like. indicates how coolness dictates what people work on. idk if that's what watterson meant though

@heidilifeldman@mastodon.social the virginia districting scared me a lot today and i was momentarily frozen and you reminded me that now is the time to be brave is all

@kirakira@furry.engineer have many thoughts on this

@NullTheFool@mastodon.gamedev.place coffeescript!!!!

@Em0nM4stodon@infosec.exchange big fan of your work!

@vtrlx@mastodon.social i continue to find every one of your design decisions surprising and compelling

@vtrlx@mastodon.social @VATVSLPR@c.im i also find the argument that monospace is ascii-centric to be compelling

@joe@f.duriansoftware.com veteran of the DOS wars

@dsalo@digipres.club GOT EM

@jzb https://fsfe.org/news/2026/news-20260504-01.en.html The reported internal guidance, referred to as “SDLC-8”, would require public repositories to be made private unless an explicit exception is approved. not sure why the @fsfe decided not to provide the contents of the internal guidance, or link to the place where it was first reported? the EFF usually does this and it allows people to evaluate their claims much more directly which i appreciate. for example: Taking already public repositories offline does not prevent attackers from analysing deployed systems, dependencies, interfaces, or binaries. is there room to offer release source tarballs in this framework? does a developer need to publish access to their entire git history? git history btw is often the most difficult to secure against scrapers—see how every gnu savannah cgit web interface has experienced 100% downtime for months (although there are other issues there too). i know @ska has done it but it was not at all trivial. i can see at the end it notes: to publish the reported guidance so that seems like there's some sort of gag order on publishing the leaked guidance? it's just difficult to evaluate how serious of a problem this is if there are no specifics. the fsfe being a legal organization rather than a news one was where i would be hoping to see more discussion of the relevant legal specifics, or to explain what the possible legal workarounds might be

@leo bookmarked your recs i don't have anything special. i do like having a VOC mask for when I Make A Mistake but that one is also the hardest on my nose

@fiore@brain.worm.pink the molly project is absolutely on the level afaict

@joe@f.duriansoftware.com fleets were an experimental art form originating from the ephemeral nature of bytes written to /tmp. while early attempts would often seek a raw kairotic expression by juxtaposition of familiar themes at stable paths, the introduction of overlays would quickly progress to the modern form, wherein /tmpistas construct and expand upon a palette of inputs through intermediates as they iterate upon what will become the final contents of the output framebuffer

@fiore@brain.worm.pink i think calvin and hobbes had the right take on dark matter vs quarks

@fiore@brain.worm.pink i don't like physicists physics is cool

@heidilifeldman@mastodon.social thank you for bravely going out in the face of all this and for walking us all through it with you. i admire your work greatly and i'm reminded that positive change is the work of a movement of supporters not individual heroes

@jeremy_list big cutie

@ska@social.treehouse.systems @dalias@hachyderm.io @alwayscurious@infosec.exchange we can do better

@zzt@mas.to nobody understanding the significance of systemd not declaring dlopen() dependencies is what allowed poettering to actively lie and not get called on it. if you want to disempower these people it's important to be able to describe a solution without the flaws they inserted

@fiore@brain.worm.pink yeah astrophysics is cool

@joe@f.duriansoftware.com throws tomato

@joe@f.duriansoftware.com @steve@discuss.systems @ferrix@mastodon.online 99 blocks allocatable, 99 blocks in a free list, take one down, unlink prev and next, 98 blocks are now allocatable

@joe@f.duriansoftware.com read this as "social justice app" and was impressed at the biting cyberpunk satire

@jordan@sometimes.social @inherentlee@flipping.rocks xpath is soooo underrated

@fiore@brain.worm.pink i think regular physics is garbage