• 0 Posts
  • 68 Comments
Joined 2 months ago
cake
Cake day: March 23rd, 2025

help-circle

  • OSS on the other side has the downside of being free.

    That means it’s:

    • massively underfunded because nobody donates
    • no SLA-style contracts to hold anyone accountable
    • most of the time no 3rd party security audits because free software (especially libraries or system tools) don’t go through procurement and thus don’t require them
    • everyone expects that “someone” will have already reviewed it becouse the code is open and used by millions of projects, while in reality they are maintained by some solitary hero hacking away in his basement

    If stuff like OpenSSL was CSS, it would be at least a mid-sized company making lots of revenue (because it’s used everywhere, even small license fees would rack up lots of revenue), with dozens of specialists working there, and since it would go through procurement there would be SLAs and 3rd party security audits.

    But since it’s FOSS, nobody cares, nobody donates and it was a singular developer working at it until heartbleed. Then some of the large corporations which based their whole internet security on this singular dude’s work realized that more funding was necessary and now it is a company with multiple people working there.

    But there are hundreds of other similarly important FOSS projects that are still maintained by a solitary hero not even making minimum wage from it. Like as shown with the .xz near miss.

    Just imagine that: nobody in their right mind would run a random company’s web app with just one developer working in their spare time. That would be stupid to do, even though really nothing depends on that app.

    But most of our core infrastructure for FOSS OSes and internet security depends on hundreds of projects maintained by just a single person in their free time.



  • Could be the AMD CPU (had a few kernel issues with that CPU, for example on anything newer than 6.10 the laptop doesn’t wake from sleep, that’s a well-documented issue either with the CPU or the chipset), could be the mobile 4070, could be because I’m using Fedora (some of the issues I have like the one with performance randomly dropping to single-digit FPS and that not clearing up with a reboot are reported quite often on Fedora), could be something entirely different.

    I’m on a budget gaming laptop (Lenovo LOQ), could be that they messed up something there, don’t know.

    I haven’t even touched HDR so far, because the base function isn’t there.

    Games on Steam don’t tend to give me trouble, for some reason it works better there, but I don’t have 300 or so free games on Steam.







  • If the teacher was so wrong, explain to me how a majority of the students would have understood that question and been able to figure out the correct answer and provided the correct format?

    But did they? How do you know? Have you seen the other students’ assignments?

    Most likely, this specific task wasn’t actually a homework task at all but created just for this meme.

    But teachers like this exist, and I stand by that that these teachers are wrong. Understanding and actually thinking about a problem are much more important skills than to obey blindly and follow pre-set directions without even reading what the question actually says.

    I’d say, a student that answers the question as expected is failing in regards to reading comprehension.

    And from my experience, if a question is worded as wrongly as the one in the meme, then half the class will have it wrong and there will be a group of parents at the next parent-teacher conference complaining about it.


  • Sad that you don’t read replies, because what you are saying makes a ton of sense, and I have questions.

    I don’t really have the time to try out 20 distros. I used Kubuntu quite a lot before, but I had issues with it, so I wanted to switch away. I tried out Mint, PopOS and Fedora, due to common recommendations and Fedora is the only one that really caught my fancy.

    But “tried out” means “installed it, ran one game on steam, done”. Don’t really have time for more. Since then I have regretted choosing Fedora.

    What would be a good distro if I want to game, but I also need it as a general purpose distro? I don’t want to have to dual-boot between a gaming distro and my regular distro where I code and run all my regular stuff on.

    I’d also like to have something that doesn’t update the kernel all that fast, since my laptop doesn’t wake from sleep on a kernel newer than 6.10 (at least on Fedora 41). It’s a documented bug that doesn’t have a fix yet, apparently.



  • In my country, the written final exams include a Q&A section in the beginning of the test, where the teacher and the headmaster are present, and where they present the tasks and students are allowed to ask questions. After that section, the headmaster leaves and students and teachers aren’t allowed to talk for the rest of the test.

    I noticed a missing specification in one of the tasks. It was a 3D geometry task, and it was missing one angle, thus allowing for infinite correct results. During the Q&A section I asked about that, and my teacher looked sternly past me to the end of the room and said “I am sure the specifications are correct”. If there was an actual error in the specifications, the whole test would have been voided and would have to be repeated at a later date, for all the students attending.

    As soon as the headmaster was out of the room, he came to me and asked where he made the mistake. He then wrote a fitting spec on the whiteboard.

    I liked that guy. He was a good teacher.


  • That’s not what it is, no.

    Teachers make mistakes, like any human being, and a good teacher can deal with the fact that they made a mistake and that a student found said mistake.

    A teacher who insists on being right over being correct is a bad teacher, because a teacher is supposed to teach a child understanding and knowledge, not blind obedience above anything else.

    That’s how you end up with a population who agree with the leader even if he tells them the sky is green.



  • Let me be clear: I wasn’t arguing for the law, only explaining how it will be likely used.

    Depending on the exact content of the law and the first few precedences in court, what you are doing might or might not qualify.

    Since you seem to only make attachments/utilities for commercial guns, it would be likely that that kind of activity is not covered by the law. Your guns are no “ghost guns”, they are commercial guns, legally purchased from a seller, with a registration number and everything. (I guess you purchased them legally.)

    The gun is specifically targeting “ghost guns” that are created “at home” without registration numbers and stuff, so I don’t think that applies to you.

    But who knows how exactly this is going to be applied.

    Banning 3D printers for the purposes of stopping ghost guns is stupid, for the exact reason you named (lathe, mill, welders, …), especially because all of these tools are used for all sorts of stuff and creating guns isn’t their main purpose. The same cannot be said for the design files, no matter whether they are for a 3D printer, CNC machines or just a manual on how to build a gun the conventional way. The purpose of such design files is to create a gun, and that can be made illegal.

    Whether it should or whether it would even help to stop ghost guns is another story.



  • That’s definitely a problem with every bit of code, that everyone relies on stuff they don’t or can’t review.

    My point is that FOSS provides a false sense of security (“Millions of people use this library. Someone will already have reviewed it.”).

    But the bigger issue is that FOSS is massively underfunded. If OpenSSL was for-profit, it would be a corporate project with dozens if not hundreds of developers. Nobody would buy a piece of core security infrastructure from a self-employed dude working away in his basement. That would be ridiculous to even think about that. And if this standard component was for-profit, even very low license fees would generate huge amounts of revenue (because it’s used in so many places) and this would allow for more developers to be employed.

    And since it would be an actual thing that companies would actually buy, they’d demand that third-party security audits of the software would be done, like on any paid-for software that companies use. They’d also demand some SLA contracts that would hold this fictional for-profit OpenSSL accountable for vulnerabilities.

    But since it’s FOSS, nobody cares. Companies just use it, nobody donates. It’s for free, so the decision to use it usually doesn’t even go through procurement and anything related to it. I tried to get my old company to donate to OpenSSL in the wake of Heartbleed, and the company said they don’t have a process to donate to something, so can’t be done.

    So everyone just uses this little project created by one solitary hero and nobody pays for it. And so that dude works alone in his basement, with literally the online security of the whole world resting on his shoulders.

    Luckily after Heartbleed a lot of large corporations started to donate to OpenSSL, but there are hundreds of other equally important projects that still nobody cares about. As seen e.g. with the .xz near miss.