eXpl0it3r

Are CVE really a good thing for open source projects?

No doubt is it a good thing to have issues reported and fixed, but CVE feels a bit like blackmailing maintainers - either you fix the issue or we get your project flagged with "security scanners".

I guess, my distaste mostly originates from randomly assigned high CVE numbers that don't reflect the actual threat. And the fact that it gives the companies which use the code "AS IS" an imaginary stick to hit open source maintainers, until they fix the issues for the company (for free of course).

Despite the "Gold-suite" comparison, when looking at the KaTeX and RaTeX output [1], the KaTeX output is consistently better. RaTeX has either a lot of aliasing going on or appears blurry.

But the native and library nature of RaTeX is very interesting, especially with the provided C ABI.

[1] https://ratex.lites.dev/demo/support-table

If it's an open source project that has been used by others, please consider giving out maintainer access to others (now or later).

It's sad, when projects are abandoned and a whole bunch of users would be willing to (partially) maintain it, but the key holder implicitly or explicitly decided that nobody else should have access.

Forks are not he same: It's very hard to get enough traction with existing users and the discoverability is terrible.

As maintainer I won't be able to give you an unbiased response. The biggest difference is, that SFML is a C++ library.

What motivates me to work on SFML is, that we're building something separate from SDL. I don't think, we - as in the general developer world - do anyone a favor in consolidating everything into one library (why use X, when Y does the same?). Additionally, I think it's a very interesting "field" of trying to provide a common API across different OS; and sadly it seems to be an area where few resources exist and fewer developer actually understand it, as "everyone" just uses SDL. Finally, I really like the open and welcoming community we've built over the years and at the same time, I'm happy we're not getting as much attention/pressure as SDL.

The Nature paper from last year: https://www.nature.com/articles/s41598-025-91115-8

Yeah, then again most people haven't experienced this and are happy to just enable "track changes" in Word and send the document back and forth, maybe if you're lucky, it's hosted on SharePoint or OneDrive.

OnlyOffice, Nextcloud OPffice, Collabora might all have free offerings to a degree, but you'll end up at the mercy of the companies behind those tools and OnlyOffice comes with Enterprise offering that does also cost money.

Costing money isn't necessarily bad, but it's also hard to beat free & libre.

Since this uses Direct2D, is this Windows-only?

How much of the code was vibe-coded?

I'm in the opposite camp. Give me some local tool that does disappear when the maintainer moves to the next thing.

Well and I can eat the cake as well, make it some native app that has proper performance.

I still have two active accounts and neither of those were in the breach of the 20% of accounts.

The discussion requirement is often to prevent disappointment, waste of time, and anger, when maintainers simple close PRs, because it's not the direction they want the project to go. A lot of people will take this very personally, so it's much better to have a conversation about it beforehand.

Except for investors who couldn't figure out the right "Zoom" to buy shares from [1].

[1] https://www.ft.com/content/98635c63-b4ab-49a3-9c18-1de6819d6...

A lot of users still like the mix of a good UI for most tasks, while being able to do a lot of power user stuff without an added layer. Plus many will choose macOS also for the hardware, which support for new chipsets is still rather WIP under Linux.

I hate this as well, especially since I have greylisting enabled on some email addresses, so by the time the email login is delivered, the login session has already timed out and of course the sender uses different mail servers everytime. So in some cases, it's nearly impossible to login and takes minutes...

Inventing and replicating face different challenges though.

What's DEP?

In my opinion this is mostly self-inflicted by Microsoft.

Sure some push for web-based solution has moved a lot of people away from desktop applications, but even before that Microsoft muddied the waters of native UI development.

Moving from User32.dll and GDI to GPU based rendering with WPF, might not have been the worst idea - and WPF is still going strong - but it's a clear cut, leaving old apps un-upgradable. So if companies need to eventually rewrite it, will they stick with desktop apps or move to "web apps"?

Unfortunately, Microsoft didn't stop there, but we've since seen a bunch of different attempts at new Windows UI libs to the point, where nobody trusts Microsoft anymore (remember Silverlight?) and everyone else is left confused by the chaos of an ecosystem.

Or "Management Studio". Never heard "SQL Studio" either.

What are the reasons to use a throw away account and neither mention the product nor the niche area?

What's your source and/or quality of the financial data? How much do you cover? What data fields do you provide?

That's already what is happening...

When you do a check on https://haveibeenpwned.com/Passwords nothing is sent to the server. Instead the password is hashed locally and a list of the hash range is downloaded, which contains all the hashes and the number of occurrences.

The server doesn't receive the password, neither in plain-text nor hash form.

Why are you as surprised?

People don't just share their stargazing plots "for fun", but because it has meaning for them.

I encourage you to still share your ideas and thoughts. It doesn't need to be as a blog, but in general. :)

Don't censor yourself out of fear of what others might think or misunderstand.

Many may get confused and some might not like it, but there may also be a small group of people who understand, which if you fall silent couldn't be reached.

And/or submit it to: https://powrss.com/

Same idea, maybe with a bit more focus on RSS

And then you risk people making stupid decisions, which you have to fix later on, because you didn't attend the meeting.

Sometimes it's not just about whether others think you should be there.

I fully agree! Can also recommend to everyone to take a similar course or use self-study material on the topic. Understanding the lowest layers makes you a better software engineer, as your mental model of a CPU/PC gets sharper.

Someone has built a RSS feed aggregator specifically for personal websites: https://powrss.com/

Is this for your personal workflow, or for applications that you ship?

How do you handle deployment / packaging of multiple, different ecosystems?

PdfPig [1] is a (partial?) port of PdfBox, I haven't really tried it so far, due to the weak support for PDF creation.

[1] https://github.com/UglyToad/PdfPig

The past week, I've implemented a Markdig renderer that outputs / renders into a Migradoc document, which can be converted to PDF. For the limited used case it works quite well and I'm currently looking into open sourcing it with some other MigraDoc related stuff under MIT.

Justified text isn't exactly a standard Markdown feature though. I guess Markdown converters are in general not easy, since there are so many dialects and at best people just mix in pure HTML, requiring a HTML renderer as well.

Anyways, if you're interested in the Markdig to MigraDoc renderer, let me know.