rigid

a decent syslog daemon will stream it anywhere you like

you mean, something like a new FOSS project called "OpenEye"? :-)

I wish Python had static builds!

while unusual in the "python world", there are more or less well supported ways: https://www.askpython.com/python/examples/compiling-applicat...

i'm sure go will support dynamic linking aswell sooner or later

They suck to maintain.

I love the fact that you can just update one single openssl lib and all installed apps use the updated version after a restart.

Static builds have their legitimate use-cases so maybe change that to "mandatory static builds". (iirc go support for dynamic linking is worked on and will become stable eventually)

https://textualize.io for python isn't bad either. (In case you don't like static builds like me.)

where the maintainers of F-Droid can intervene and prevent an update to an app from reaching users if it's deemed to be malicious

That sounds like a feature you want when using FOSS.

Imagine distros wouldn't have been able to intervene quickly and malicious xz would be still deployed through their channels just because the authors want to.

That's not true tho. f-droid supports (true) https://f-droid.org/en/docs/Reproducible_Builds/ for quite some time now. Those are signed by both, f-droid and the author.

Hm f-droid provides privacy friendly https://fdroid.gitlab.io/metrics/ for some time now.

I'm not sure what sort of "control" they have over the Play Store compared to f-droid, but I'd rather have a trusted 3rd party do the building transparently and verifyable.

Signal has reproducible builds for android now? Why not f-droid then, too?

yep. android 13

mobile users should tap the canvas for the particles to move.

Hence "hack". It needs keys for administration but at a first glance, I see no reason why a git-anon user couldn't be part of gitolite's git user.

ledger-cli is rock solid but it lacks a decent TUI.

Really all I want is an 80s TUI accounting app that "just works" as ledger does but with a menu driven interface with keyboard shortcut support.

Modern stuff like multi-user capabilities, plugins, templates, API etc. wouldn't hurt.

For a single author you don't necessarily need any server at all. A cloud directory or zip files work well.

But gitolite is so easy to setup & maintain, it's not a big difference and for r/w-access management within teams, it's priceless.

I guess one could even hack anonymous access with "PermitEmptyPasswords yes" and "AuthenticationMethods none"

not sure how lightweight any of these are, but https://gitolite.com/gitolite/ just needs git and ssh deployed. And it works like a charm.

...at least you weren't looking for any references to "mifflin" functions.

I bet in the majority of cases, there's no need to pressure for merging.

In a big company it's much easier to slip it in. Code seemingly less relevant for security is often not reviewed by a lot of people. Also, often people don't really care and just sign it off without a closer look.

And when it's merged, no one will ever look at it again, other than with FOSS.

I kinda miss the curiosity show.

It was a bit more science leaning but got kids to awe just the same way.

it enabled it in the first place

it took roughly two years including social engineering.

I'd say the same approach is much easier in a big software company.

where no auditor ever looks

Well, software supply chains are a thing.

"where no auditor ever is paid to look" would be more correct.

login process

RCE doesn't really follow a login process design. As soon as you got RCE you can be considered pwned.

If not now, then at the time the next locally exploitable vulnerability comes up. There are plenty.

There's a gazillion nice python SSGs but when it comes to advanced stuff like responsive imagrs, i18n or js optimization, you always have to add it yourself.

It seems most of these never became fit for use for some bigger website.

I loved etherpad but it was a pain to host back then.

I'd love to have something similar that's lightweight and not serverside node.js

This a classic "post hoc ergo procter hoc" fallacy.

You just can't know, how much more Einsteins there would be. People that would never steal an Apple II or would never even get that opportunity.

Heck, if Einstein became a younger father, there's a good chance he never looked deeper into physics despite talent and interest without someone (like a teacher) pushing him.

I claim that it's pure coincidence. Carmack didn't make it because of public education but despite of it. We can't afford this anymore.

Not sure. In Germany there's an ongoing debate for extending conprehensive schools [1] across all ages. It's a complex topic but the general gist of supporters is, that pupils profit from each other. (e.g. Bad ones get help from the good while those practice how to cooperate and explain etc.).

I don't think it's that complex. My personal premises are

* if the kid doesn't like to get up and go to school or is too tired over longer periods, the school is doing something wrong, not the kid. * if there are A LOT of kids like this, the school authority is doing something wrong (and so on, up to government) * an older kid needs support on every topic at any time when interest arises. It's the kids' choice not the schools'. * learning at school must be fun, at least 90% of the time.

That way whizzkids are easily detected, will be less frustrated and thus perform better.

I got some good example anecdotes but better won't "textwall" here :-)

Just imagine a world, where Einstein would get optimum support from young age so he would start professional physics years earlier.

Or one where he didn't go to the patent office but one where he worked in some factory or other place, not finding the spare time he needed to do physics.

Way too much luck involved if you ask me.

[1] https://en.wikipedia.org/wiki/Comprehensive_school

You're basically saying the system is obsolete when society reaches a point, where it needs no more mediocre generalists and only excellent specialists.

I wouldn't be so pessimistic.

Whizzkids will educate themselves

Only those you see becoming one.

You never hear of all the "Einsteins" who never leave the patents office because they never got inspired for some passion or various other stupid reasons.

I always stress how our public education is broken since it can't handle extreme talent very good. Important breakthroughs that advance one or more fields extremely or shifting paradigms completely, were done or prepared by whizzkids.

In these times, we need every whizzkid we can get.

now if we just teach those tools to kids instead of turning them into spreadsheet office robots, that would be great.

also nothing in linux will ever just give some cryptic hex code error or crash report.

It's either crashdump or nice error message. If not I just increase loglevel to find the actual problem.