So if I violate #HuggingFace's copyright, that's fine as long as I post a form online somewhere where they can 'opt out' of me violating their copyright - did I get that right?
Remote
raboof
@raboof@merveilles.town
hometown 4.2.17+hometown-1.1.2
Arnout Engelen
Independent #OpenSource developer from 🇳🇱
@nixos_org@chaos.social | @reproducible_builds@fosstodon.org | @notion@fosstodon.org
Organizing @why2025camp@chaos.social
Hackerspace @hack42@chaos.social
Volunteer at Museum @EICAS@mastodon.art
Ex-#akka team at #lightbend
Available for #OpenSource contracts next to my part-time engagement as Security Response Program Manager for #Apache
1362 Followers
2850 Following
37 Posts
Joined December 23, 2020
Matrix:
@raboof:matrix.org
codeberg:
I hunted down another nondeterminism in the Scala compiler.
It's kinda satisfying when a considerable amount of analysis, digging and testing finally leads to a 2-character fix 😆
In this case I could justify spending this time as part of a @NGIZero@mastodon.xyz @nlnet@social.nlnet.nl grant. These folks unlock a lot of foundational work for the public benefit. Proud to do part of it.
https://github.com/scala/scala3/pull/26510/changes
#ReproducibleBuilds #Scala
#EMFcamp here I come!
Having fun with NixOS on the PineTab2: u-boot video and USB keyboard now work, so I can select the NixOS generation to boot into without needing the serial console.
Teufel's MYND bluetooth speaker is marketed as repair- and tinker-friendly. I hacked in an external connector so I can turn the device on when it's in a hard-to-reach place.
Some Teufel employees took it way further: they created an expansion board so you can replace the BT board with an RPi Zero.
I wanted to flip pages using a footswitch. Now Bluetooth foot switches are cheap, but I already *had* a footswitch, so that seemed silly.
After some brainstorming at @hack42@chaos.social, some rummaging through parts boxes, and some light coding, the prototype works! Just needs a nicer form factor.
"I made this longer because I did not have time to make it shorter" - that quote was really ahead of its time, wasn't it?
Replying to
@smallcircles it is impossible to do a complex topic justice in a toot, but I think it boils down to: the baddies are huge and well-funded. FOSS makes things cheaper for everyone. Yes, that makes it cheaper for the baddies as well - but it gives team-good a fighting chance at all. So it helps the good more than it helps the bad.
Replying to
@EUCommission I bet @ionica has a thing or two to say about that visualization - so you have to ignore the cap and the empty space at the top of the testtube, but what's that scale doing there? Why is there a marker 'at' 97.5%?
Good thing they didn't 'just' take the 'height' of the liquid, but now I'm left wondering if they actually calculated the volume of the lens-shaped component at the bottom or just eyeballed it 😃.
Replying to
@BryanBennett@tilde.zone @gonzo_askold@mastodon.social Maven has made good progress in its default behaviour over time, https://maven.apache.org/guides/mini/guide-reproducible-builds.html
I'm sad you get the impression Nix doesn't upstream as much, we really do try.
Debian has been a trailblazer in reproducibility historically and this most recent feat shows they still are - but part of the fun of the reproducible builds project is that it's not a competition but a cross-ecosystem collaboration.
Replying to
@adingbatponder@fosstodon.org @zekjur@mas.to no, on NixOS we're still working towards that goal, see https://reproducible.nixos.org/ (and AMA 😊)
Replying to
@xameer yeah the NixOS route was pretty difficult until recently ;)
https://github.com/pine64/website/pull/153/changes
Replying to
@BryanBennett@tilde.zone jup - I remember the days of https://github.com/Zlika/reproducible-build-maven-plugin - I was into JVM reproducibility before I even got into NixOS :)
Replying to
@gunstick do you have a reference for that?
I wouldn't suggest using WA, for example because Meta could easily push some targeted code to expose your chats, but my understanding was that your private key never goes to Meta during typical operation. It might be part of your system backups that go to Google/Apple/wherever, though.
Replying to
@smallcircles the net outcome is positive, because it helps the good more than it helps the bad.
Replying to
@sj good question!
The start image is a binary, so in theory, someone could have 'poisoned' it to mess with the reproduction and hide their backdoor.
By taking an old image as starting point, that attacker would have to have had the foresight to 'poison' the image back in 2020, made sure this remained undetected until now, and done it in a way that is still effective today. That is much harder / less likely than the same attack in a recent image.
Of course even better would be to have some kind of 'bootstrap' from (almost) only source to having nix available in the vm to perform the build. I have not followed https://bootstrappable.org/ enough to know how close we are to that, though. There is https://github.com/oriansj/stage0-posix which I understand is used in https://guix.gnu.org/en/blog/2023/the-full-source-bootstrap-building-from-source-all-the-way-down/ but I have not yet wrapped my head around how this fits together in practice /cc @civodul @janneke
Replying to
@danct12 lol yeah 😆.
It's not so obvious what to put there, though - 'compile date' is kinda useless, you'd want a 'meaningful' date. We could put Jul 7 2025 (the date of the v2025.07 tag) - but what if we'd move to a newer version of https://lists.denx.de/pipermail/u-boot/2025-January/thread.html#577641 ? Would we update to the date on that patchset then? I think maybe I'd rather see uboot remove that date entirely tbh...
#ReproducibleBuilds
Replying to
@mw@fosstodon.org wat leuk, ik wist niet dat dit een ding was! als het even uitkomt kom ik morgen even kennismaken.
Replying to
@sj that's mostly it. Starting from a newer image would be simpler as it'd avoid the 'first build the version of nix that is new enough to build the version of nix that is new enough to build the iso' steps.
Oh, one other reason the old image is useful is to reduce the chance that anything is still using a store path that already exists on the image.
Another approach I've been meaning to try is to build nix on a VM of a completely different distro, to remove the existing store from the equation. Haven't found the time yet, though - so much still to do in this area 😊
Replying to
@kpcyrd@chaos.social @luj@chaos.social it's at the individual build level, so i.e. if you click https://reproducibility.nixos.social/outputs/1c4g0f5kkwgwkmm849fm226n4p3lr551-ksshaskpass-6.3.5 you'll see it was built by 'cache' (the central nix cache) and by me, with 2 signatures.
Replying to
@bentsai@social.lol oh yeah... wasn't there this one site showing off all kinds of DHTML tricks with a rather out-of-this-world spacey esoteric theme? I can't remember the name sadly.
Replying to
@tretron @why2025camp cool! I'll try to remember pinging you once we're getting the first aid team going, but by all means keep an eye on things yourself, too 😀
Replying to
@fortyseven #ALT4you
A flightradar24 screenshot captioned "Pilots Start Meowing On ATC Radio... Controller Snaps Back". The conversation is subtitled colourfully.
Replying to
@noneuclideandreamer@mathstodon.xyz this one is especially cool indeed!
@bitartbot@freeradical.zone has some nice simple/complex patterns as well occasionally
Replying to
@jeremy@mastodon.autostatic.net hey, I didn't realize you were there, nice! let's catch up tomorrow ;)
"It's not obvious how to solve this problem, so I'll shut down the place where possible approaches can be discussed" 😕😠
https://github.com/raspberrypi/rpi-imager/issues/1354#issuecomment-4125736244
Replying to
@bagder@mastodon.social I wish this was my experience 😆. But it's certainly getting better.
Replying to
@xameer LOL. You should be able to fairly easily reset the device to factory settings using the SD card image from https://pine64.org/documentation/PineTab2/Software/Releases/ .
Or join the fun and go for the NixOS approach with https://codeberg.org/raboof/pinetab2-nixos :D
Replying to
@seawall@mastodon.nz for a second I wondered who became so attached to their childhood printer brand - though they _have_ been getting worse over time as well 😆
Replying to
@Natasha_Jay except when using a cable like this one, because there are competing standards for the TRRS connector order so you might end up with incorrect color codings 🤦😆
Replying to
@arclight@oldbytes.space @bert_hubert@eupolicy.social
Thijs Boontjes got you covered. Not quite as relaxed but still lighthearted.
https://www.youtube.com/watch?v=I63KDkMOhqA
Replying to
@0xor0ne nice write-up. Curious about the "wonderful motd" now :D.
And generally sad manufacturers seem to put so much energy into making the device user-hostile instead of safe against actually-external attackers.
Someone assuming @notion@fosstodon.org is dead just because no-one answered their question on IRC within 2 hours on a holiday.
I think one of the great things about open source is that you can pick up and revive a dormant project if it interests you.
Also, even if no large feature development is currently happening for @notion@fosstodon.org we had a nice release just 10 days ago - I wouldn't even call it dormant, certainly not dead.
Replying to
@provincieoverijssel wat ik handig vind aan de https://www.explorethousand.com/en-nl/products/bike-helmet?color=carbon-black is het gat waar je slot doorheen kan, zodat ik de helm bij mijn fiets kan achterlaten.
On the heels of the NixOS 25.11 release, I reproduced the minimal
installation ISO again.
My approach is to take a NixOS VM from 2020, and then build the ISO (almost) without relying on the binary cache. This means it builds essentially all of the build-time dependencies and all of the items that make it into the ISO
from source, without directly relying on Nix-specific prebuilt packages. On the other hand, NixOS is somewhat less strict than for example Debian in
requiring package 'sources' are actually sources, so a few builds (notably go) are actually 'built' from upstream binary releases.
It's very satisfying to see such a long (albeit well-controlled) Rube Goldberg machine of builds results in a single hash that is identical to the one from the ISO you can download from the website.
Full write-up with all details at https://arnout.engelen.eu/blog/reproducing-nixos-25.11-minimal-iso/