To address this concern, CISA recommends that developers transition to memory-safe programming languages such as Rust, Java, C#, Go, Python, and Swift.

If only it were that easy to snap your fingers and magically transform your code base from C to Rust.

guy_butterfly_meme.jpg is this unbiased journalism?

Why the heck would 2 projects share the same library?

Coming from the olden days, with good package management, infrequent updates and the idea that you wanted to indeed save that x number of bytes on the disk and in memory, only installing one was the way to go.

Python also wasn’t exactly a high brow academic effort to brain storm the next big thing, it was built to be a simple tool and that included just fetching some library from your system was good enough. It only ended up being popular because it is very easy to get your feet wet and do something quick.

The difficulty with python tooling is that you have to learn which tools you can and should completely ignore.

Unless you are a 100x engineer managing 500 projects with conflicting versions, build systems, docker, websites, and AAAH…

• you don’t really need venvs
• you should not use more than on package manager (I recommend pip) and you should cling to it with all your might and never switch. Mixing e.g. conda, on linux system installers like apt, is the problem. Just using one is fine.
• You don’t “need” need any other tools. They are bonuses that you should use and learn how to use, exactly when you need them and not before. (type hinting checker, linting, testing, etc…)

Why is it like this?

Isolation for reliability, because it costs the businesses real $$$ when stuff goes down.

venvs exists to prevent the case that “project 1” and “project 2” use the same library “foobar”. Except, “project 1” is old, the maintainer is held up and can’t update as fast and “project 2” is a cutting edge start up that always uses the newest tech.

When python imports a library it would use “the libary” that is installed. If project 2 uses foobar version 15.9 which changed functionality, and project 1 uses foobar uses version 1.0, you get a bug, always, in either project 1 or project 2. Venvs solve this by providing project specific sets of libraries and interpreters.

In practice for many if not most users, this is meaningless, because if you’re making e.g. a plot with matplotlib, that won’t change. But people have “best practices” so they just do stuff even if they don’t need it.

It is a tradeoff between being fine with breakage and fixing it when it occurs and not being fine with breakage. The two approaches won’t mix.

very specific (often outdated) version of python,

They are giving you the version that they know worked. Often you can just remove the specific version pinning and it will work fine, because again, it doesn’t actually change that much. But still, the project that’s online was the working state.

It also means “we don’t know (yet)” so there is a chance it’s not that toxic.

At the cost of sounding naive and stupid

It may be a naive question, but it’s a very important naive question. Naive doesn’t mean bad.

The answer is that that is not possible, because the compiler is supposed to translate the very specific language of C into mostly very specific machine instructions. The programmers who wrote the code, did so because they usually expect a very specific behavior. So, that would be broken.

But also, the “unsafety” is in the behavior of the system and built into the language and the compiler.

It’s a bit of a flawed comparison, but you can’t build a house on a foundation of wooden poles, because of the advantages that wood offers, and then complain that they are flammable. You can build it in steel, but you have to replace all of the poles. Just the poles on the left side won’t do.

And you can’t automatically detect the unsafe parts and just patch those either. If we could, we could just fix them directly or we could automatically transpile them. Darpa is trying that at the moment.

I think the timing isn’t quite right, because the other social media places aren’t figuratively totally on fire.

There isn’t “the great social media collapse of 20XX” happening, because of some security issue or servers being super expensive or ads being actually 99% of the content. The forces that be are managing things well enough that things aren’t collapsing right now.

There is no single actually big celebrity that has picked a fediverse platform as the place to be, follow and discuss news.

And there is no killer feature that you can only get here.

The bonfire is stacked nicely, but there is no spark. For now. That could change at any moment, but it could also take a while.

I don’t think the timing is quite right.

I don’t really have anything meaningful to contribute to the feeds and most of the discussions are a bit pointless. They’re not really changing anything. So, in part those other platforms are fueled by outrage culture. Which I know is bad, so not having it is good, but then we also don’t have the growth from it.

The technology is there and that should help. Apparently people aren’t going to mass migrate from reddit quite yet, even though the push last year probably helped a lot.

It is a network problem. I think the slow growth will / should happen eventually, because the fediverse is an objectively good place to start a community. It’s just not going to be fast and other platforms adding push factors would help obviously. We’ll see where reddit goes with their paid subs.

I don’t think the low effort posts are a problem, there is hardly motivation to interact with an empty page and there is slightly more if there are “boring topics”. At least it’s a place.

You’re a hero for making this happen in… 24 hours? 48?

The issue won’t go away, we’ll see how well everyone else deals with it, but this is a super strong argument for your system / server.

(Advertise it. Advertise it HARD. “piefed, we have private votes”.)

I would like a (c) where my instances collects all the votes on the post, and then transmits an anonymized aggregate.

“We didn’t consider the idea because it sounded silly”

Isn’t something I want scientists to say. So good on them for taking a look at the feasibility.

No.

https://www.sovereigntechfund.de/programs/applications#requirements

Take a look.

Though, if you have not heard of the program before, you’re probably not involved with a project that qualifies.

How is it vague?

It’s vague in all the legal ways:

• First of all which kinds of games it applies to. It obviously can’t work for games that have a technical server requirement, … world of warcraft, but actually EVE online. The guys who run that game, get experimental hardware that’s usually military only (or at least they did in the past). The server is not something, you could run even if you wanted to. Drawing the legal boundary between what “could be” single player offline (e.g. the crew, far cry, hitman), wasn’t done.

• It’s not clear how it should apply to in terms of company scale. The new messenger legislation that was passed, made space for the EU parliament / system to declare and name, individually, who counts as a company that is is big enough, so that they have to open their messenger system to others for interoperability. It’s not clear if the law has to apply to everyone, and every game, or just e.g. companies above 20 million revenue or something.

• It’s not clear what happens if a company goes bankrupt, and the system isn’t immediately ready to keep working.

And a few more.

That being said, I think Thor’s stance on this is silly. All of that is part of the discussion that is now starting. He could raise good points and get them included, but I guess that’s not happening.

It is broken in the sense that it’s absolutely insane that they can take 30% and nobody can build a competing product that only takes 20%.

It is not broken in the sense that they keep doing what they are doing and developers and customers consistently choose their offer.

It’s not a monopoly because they exploit their position.

It’s a monopoly because nobody else is trying hard enough.

I would do this if I could order it and have it arrive in a reasonable time.

Not really motivated to build it myself.