Alba 🌸

@varbin@infosec.exchange fun story: i wanted Node.js to have SSLKEYLOGFILE support as well. found there was discussion where the Node.js devs were overwhelmingly against the feature because they thought of it as a security risk. I disagreed but I wasn't involved in the project, so I figured I'd just expose the API. but then, another core dev used the API to implement a CLI option --tls-keylog and no one objected... even though CLI options can be passed through the NODE_OPTIONS environment variable. sooooo we ended up having the same functionality we were supposedly afraid of (an env var that causes keys to be dumped) just without the standard SSLKEYLOGFILE name

@varbin@infosec.exchange it'd probably be a 1 line patch at this point to make --tls-keylog default to the value of SSLKEYLOGFILE rather than empty. I'm no longer a core dev, but I might do it someday

@0xabad1dea@infosec.exchange in particular when they said (paraphrasing) "if we base this policy on ethics we would necessarily be putting the values of some members over others" reminds me of "no politics here" -- thinking that ethics/politics is something you can simply leave out, when in reality by doing so you're favoring specific ethics/politics over others. (i know jyn means well, but i don't agree with that line of reasoning)

not all AIs but somehow always an AI

@sodiboo@gaysex.cloud as a fellow nixos user, please please do not introduce this person to nixos until they are Extremely Computer even if you were not able to help much due to not being familiar with docker (which knowing you i'd doubt) they would be able to get much more help from others that way

@0xabad1dea@infosec.exchange i dunno, it would be more understandable if they were communicating some attempt to keep these concerns in mind for the policy, but they've said clearly that they believe those ethical concerns should not shape the policy, at all. it isn't a "we've tried our best to address the ethical concerns of most people, but there are lots of differences and this issue has been litigated to death so discussing it here is not productive" it's a "we can't reach any consensus at all on the ethical issues, therefore they should simply not inform the policy"

(if it succeeds without output, you are probably vulnerable if your kernel isn't patched)

quick boost this before french fedi lynches me

@tranquillity@mastodon.minionflo.net @sodiboo@gaysex.cloud right? sometimes i wonder if nixos being the one distro i am involved in at the core level makes me view it more negatively, idk

so my best guess at the 4x4x4 rubik's cube group right now is (Z3 ≀ S8)(1) × S24 × S24... haven't figured out how to filter out whole-cube rotations edit: no, the sign of the corners permutation is bound to the sign of the centers permutation

@0xabad1dea@infosec.exchange oh these are things that jyn said later in a diff comment thread, iirc they're not said in the PR description (edit: to be more precise jyn was quoting some other project member, indicating they agree with them on that)

@tranquillity@mastodon.minionflo.net @sodiboo@gaysex.cloud the more internal layers, like the bootstrapping, compiler support, crosscompilation logic, stdenv, default builder and so on

I think at least they should be called something cute, like Sparkey

anyways this is a joke in reference to https://jasone.github.io/2025/06/12/jemalloc-postmortem/

@thermia@sk.girlthi.ng i like

@tranquillity@mastodon.minionflo.net i can try that i am involved doesn't mean i'm know a lot about it, but i've certainly touched LLVM bootstrapping... what's happening?

@tarix29@tech.lgbt ideally this would have to be implemented as an output backend on your particular compositor, but to reduce effort you could launch it with its 'wayland surface' output backend (where it would connect to a second compositor, which would be yours, and open a surface there). a bit hacky but i guess you would just need to implement the core Wayland protocol

@navi okay you had me for a second

@vi right, right :neofox_sip_nervous:

@tranquillity@mastodon.minionflo.net are you trying to build the sanitizer runtimes or something? IIRC the overall plan would be something like use env toolchain to build compiler-rt: just the builtins, libgcc, libatomic, CRTthese should not reference env at allagain using env toolchain, build a libc-less llvm/clang that uses those artifacts for its output binariesthis llvm/clang along with env binutils forms a temporary toolchain, which is allowed to depend on env to run but not for its output binariesuse that toolchain to build libunwind and glibc. again these binaries cannot reference envagain using env toolchain, (re)build temporary clang to use the unwinder and glibc you just produced in its output binariesuse that toolchain to build libstdc++again using env toolchain, (re)build temporary clang to use that libstdc++ in its output binaries (hit the character limit...)

@tranquillity@mastodon.minionflo.net the temporary toolchain should now be complete enough to be used to build the final toolchain that you will distribute (binutils, full compiler-rt if wanted, llvm, clang) along with the libgcc, libatomic, libc, dynamic loader, libstdc++, libatomic, libunwind that it depends on to run (which are the ones you built yourself, not from env)

@raito @filmroellchen @aks fucking hell

@kitten@social.elizabeth.cat then name it Pikachu or something

@zvavybir@social.zvavybir.eu I'm afraid the above code only works in 3.6+ :neocat_pat:

@zvavybir@social.zvavybir.eu thanks, updated :)

@wallabra@bark.lgbt (unless there were some updates I'm unaware of, this actually happened in june iirc)

@wallabra@bark.lgbt it is being discontinued see the link in the thread

@iro_miya yes, android switched to file-based encryption so that apps could choose what to encrypt (or rather, what to encrypt behind pin and what to encrypt without pin). and iirc examples specifically included the background and alarms

@samhenrigold huh, i don't remember seeing this in the device tree...

@chrisvest@mastodon.social yes, i was wondering if their own updater has it enabled. would be hilarious if not

@ChrSt@lethallava.land yes! https://channel.0w0.best/posts/7042 saw it through https://x.com/IntCyberDigest/status/2033547961976639890

@tranquillity@mastodon.minionflo.net how do they reference the environment? if it's in things like build IDs or the interpreter, that's expected, but i guess you get them in i.e. DT_NEEDED? (if so, which are the offending binaries and what libraries are referenced?)

@samhenrigold@hachyderm.io it's apparently behind the AOP

@tranquillity@mastodon.minionflo.net last thing I tried was compiler-rt, then libunwind, then libcxx, and iirc I got stuck on the libcxx yea that makes sense to me, you want to build your libc and dynamic loader before your C++ stdlib, since the C++ stdlib will surely use libc

@indigoviolet if you don't need that exact behavior, you may get pretty close with the typing booster or table IMs, which AFAIK get triggered by special keys being pressed (not held down)

@tranquillity@mastodon.minionflo.net I can only get one component building, but that component always links to the system builds of things huh, really? so if you build compiler-rt, its output binaries reference things from the environment?

@tranquillity@mastodon.minionflo.net I wanna use compiler-rt as the runtime, not libgcc compiler-rt implements a libgcc (a subset of it, anyways) and above I was saying to use that one (rather than the original from gcc, I'm not sure that's even an option) (but you probably want a libgcc DSO for things to link against, regardless where it comes from) and musl as the libc if I can, and libc++ as the c++ sti, not libstdc++ changing these in the plan above should not have many consequences, so go ahead :) Is there a toggle I can set to have these two build without libc? I'm not sure if there's a toggle you have to enable, so much as simply not feeding a libc when setting the system lib/include dirs, but in any case it's possible yes. we do it in nixpkgs unless they can be somehow made to use the LLVM libc...? afaik LLVM doesn't have a libc? I'm confused

@memdmp@catgirl.center ah that may well be, i'm not very knowledgeable about china

@tranquillity@mastodon.minionflo.net later when I'm less eepy I look at this again, but I think you do NOT want to set COMPILER_RT_EXCLUDE_ATOMIC_BUILTIN=no unless you're linking everything statically. instead you want compiler-rt to give you a libatomic DSO (don't remember the option) and for this initial stage you do not want the atomic builtins to depend on pthreads as you do not yet have a libc (again don't remember the option)