Open Source Software Community - it's about ethics in Code of Conducts

[byuu]

You do realize every X11 application can read keystrokes from every other X11 application? Even the first versions of Windows was more secure than that. It's not "strange" that ridiculously insecure apps need some rearchitecting, it's exactly what is needed.

Wayland doesn't handle keyboard input at all. So it doesn't do it better - it doesn't do anything at all.
Any compositor has to handle it themselves and is usually based on libinput. Which you can also use with Xorg.
Also, every system I've seen gives the desktop user read access to the raw input device nodes, so you can completely bypass X or Wayland to capture all input.

The article is also wrong, made by someone to push their Qube shit.
Xorg actually does have security features to restrict that - but no distro as far as I know activates it by default since capturing global keyboard inputs is actually a useful feature, how do you think global hotkeys work?
And SELinux sandbox does indeed work. It's right in the first comment but the author refuses to correct her post and cries about how it's not Qubes.
You can also do things like nested X servers to protect against this.

And no the first versions of Windows aren't more secure. Vista with UAC has a little bit of protection but it doesn't do anything to stop capturing from a window with the same privileges. It doesn't stop a keylogger from capturing your credit card number you enter in your browser.
Neither does OS X.

 

[Dr. Sexbot]

You do realize every X11 application can read keystrokes from every other X11 application? Even the first versions of Windows was more secure than that. It's not "strange" that ridiculously insecure apps need some rearchitecting, it's exactly what is needed.

Maybe a nine year old article on security might not be the best source for current information.

Qubes is neat, but it only protects from certain kinds of attacks. I would imagine it is still quite susceptible to things clawing out of the VM or Rowhammer/speculative execution type attacks. Nothing beats a proper airgap.

 

[emuemuemu]

This isn't really the place for these kind of slapfights so I'll try to be brief.

Any compositor has to handle it themselves and is usually based on libinput. Which you can also use with Xorg.

The difference is Xorg doesn't filter input events whereas wayland compositors do.
"They use a common library therefor they do the same thing" doesn't make sense.

Xorg actually does have security features to restrict that - but no distro as far as I know activates

It's not a matter of "activating" it, XACE is a low level API you have to actually write your own policies against.

it by default since capturing global keyboard inputs is actually a useful feature, how do you think global hotkeys work?

Only your window manager needs global input to make global hotkeys work. That's not a good reason to make input events a free for all.

And SELinux sandbox does indeed work.

SELinux has no way of restricting X11. If you're talking about Fedora's SELinux "sandbox", it's just spawning a whole new X server with xephyr.

You can also do things like nested X servers to protect against this.

Yes you can run a separate X server for every single application to stop them all spying on each other.
There are also better ways I might have told you about if you weren't downvoting my posts like a little bitch.

The point is X11 is completely insecure by default and Wayland is taking radical steps to fix that at the protocol layer instead of forcing the responsibility onto unwitting users.
For what it's worth I don't give a shit about Wayland, I already know how to secure Xorg.
I just wanted to address this "everything I don't understand is pointless complexity" bullshit with some actual information.

 

[Vecr]

This blog post mirrors my thoughts on Rust quite well.

Dark Side Of Ergonomics

The dark side of ergonomics

vorner.github.io

If the "ergonomics" people get their way, the language could get even worse.

 

[CIA Nigger]

So this is a unfolding drama with Github (and another downfall to the corporate FOSS takeover): Someone got banned for I shit you not, calling someone a prick jokingly. He only got unbanned and got told his ban reason once his ban went viral on hackernews. Needless to say Github bans work exactly like every other big social media corporation ban instead of like a forum ban. You're unpersoned, all your comments and repos vanish with a 404, and people start asking what's going on when their code that relies on these libraries breaks overnight.

On March 9th, 2020, GitHub banned my account without any notice for an unknown reason. I found out about that only when people started sending me emails telling me that my hosted libraries have stopped working and asking me why did I delete my GitHub account (I didn’t). Apparently, for any person other than me, when navigating to any of my libraries’ page, GitHub simply displayed a “404 Not found” page. Not even a “user account suspended” page, just as if the person didn’t exist, and all their libraries too.

The ban resulted in tens of thousands of people using the libraries I maintained not being able to access the source codes, not being able to report bugs or seek assistance when they’re stuck. Some of the libraries also relied on “GitHub Pages” for hosting “static” assets (for example, country flag icons), and those have stopped working properly as a result.

The only hint from GitHub was when I navigated to their website and (only for me) it showed a notification at the top saying: “Your account has been flagged. Because of that, your profile is hidden from the public. If you believe this is a mistake, contact support to have your account status reviewed”. I’ve sent a support request to GitHub, Inc. as soon as I found out about the issue (Ticket ID: 594578). It has been almost a week and they haven’t responded yet. (spoiler: they did respond after this article was posted on Hacker News)

What could possibly be the reason of the ban? Maybe one of my repos contained a mysterious “blacklisted” word? Or was it a hyperlink to some “blacklisted” website somewhere deep in the source codes? Or maybe I’ve called someone a moron on the internet recently? (spoiler: that finally turned out to be the case) Whatever it could be, it doesn’t justify immediately blocking off public access to a bunch of useful open-source projects tens of thousands of people rely on in production.

Also, apparently, all my comments in all issues in all other repos have instantly disappeared for anyone other than me, and some of those comments contained some valuable information/knowledge/solutions. While git version control itself makes sure that you don’t lose your code when GitHub, Inc. decides to block you, the same isn’t true for all your other intellectual assets in the form of the comments you’ve posted in issues/pull-requests/commits/etc (including your employer’s private repos). It’s funny how GitHub’s marketing is all about “sharing” and “co-creating”, and at the same time look how easily they strip the community of the source codes and knowledge base the people (not them) have collectively created with their time and effort (several people have contributed to my repos both in the form of code commits and issue comments) just to maniacally hunt down one guy who just happened to fall out of favor for an unknown reason. Is it what’s called a “loose cannon”, trusted with all our sources?

The fascinating part is to possibly get unbanned you need to fill out a form that basically doxes yourself and forces you to state all your business and travel connections to specific countries. It's even worse than Twitter asking for IDs and phone numbers to maybe get unbanned.

While we're at it, Microsoft just bought npm and plans to integrate it with Github.

 

[AmpleApricots]

X11 has seen some changes recently that weren't exactly great and I'm pretty sure this trend will continue to eventually snuff it out in favor for wayland. Also some functions like indirect rendering that made it even more network-capable just conveniently "broke" some versions ago and are fixed by exactly nobody. Also re: trusted and untrusted apps - X11 as has been said has this and you can actually kinda compartmentalize apps so they can't do things like reading input into other windows. Now guess which often used program crashes when you try to run it as an untrusted app. I give you a hint: It's a program that's for browsing the internet and is a product of Google.

You see similar shit happening to evdev (E: that's actually the kernel interface, I meant eudev), the systemd-free udev replacement which is something lots of programs depend on. It sounds like paranoia but there's so much politics in FOSS now and such a vested interest by big corps to commercialize it and make everything dependent on a select-few projects run by RedHat et al. that I don't really believe in coincidences anymore.

 

[Shaka Brah]

X11 has seen some changes recently that weren't exactly great and I'm pretty sure this trend will continue to eventually snuff it out in favor for wayland. Also some functions like indirect rendering that made it even more network-capable just conveniently "broke" some versions ago and are fixed by exactly nobody. Also re: trusted and untrusted apps - X11 as has been said has this and you can actually kinda compartmentalize apps so they can't do things like reading input into other windows. Now guess which often used program crashes when you try to run it as an untrusted app. I give you a hint: It's a program that's for browsing the internet and is a product of Google.

You see similar shit happening to evdev, the systemd-free udev replacement which is something lots of programs depend on. It sounds like paranoia but there's so much politics in FOSS now and such a vested interest by big corps to commercialize it and make everything dependent on a select-few projects run by RedHat et al. that I don't really believe in coincidences anymore.

It's not hard to tell that a lot of these social justice people are bad faith actors, since even some of the ones who are legitimately troons and sodomites (and not just pretending to care) work for corporations that would gladly prey on FOSS projects. Microsoft and Google have become totally overrun with them, and they have free rein to push out anyone they dislike.

 

[Stock Image Photographer]

In currently ongoing news, the Void Linux team is going through some drama. A while back, xtraeme (the creator of the Void Linux project, hereafter known as "Juan") completely disappeared, forcing the rest of the developers to find a new domain and to create an entirely new github organization. According to Juan, this was not a voluntary absence; he simply lost access to his main system (Link/Archive). I'm pretty sure this has been covered in this thread before, so I won't linger on it. The only real context you need for the following is that Juan has been perceived as being flaky in the past, and he seems to be dealing with some mental distress as a result of his divorce and subsequent loss of contact with his daughters (Link/Archive).

Since about two months ago, Juan has been pestering the owners of the Void Linux github organization to give him direct commit rights so he can work on features for the package builder and clean up the repositories (Link/Archive). Although he was quite aggressive on twitter regarding this issue, he was much more diplomatic when his behavior was questioned on the Void Linux subreddit (Link/Archive). Just yesterday, things escalated when Juan attempted to commit breaking changes to the musl-libc package (Link/Archive). Several comments, most likely from Juan, have been deleted, but you can infer that this is not the first time Juan has done something like this and that harsh words were exchanged. Then, Juan filed an issue where he puts forth suggestions for lowering the amount of oversight needed to push packages. There are two captures of this conversation: An earlier one where Juan is being extremely aggressive to another Void Linux contributor (Archive), and a later one where these comments have been cleaned up (Archive). As a result of compounding frustrations, and most likely finally set off by the previously-linked exchange, Juan decided to completely resign from Void Linux today (Archive). It's worth noting that during the time when that issue was open, a commit containing quotes that were either directly mocking Juan or could be interpreted as making fun of his divorce was approved for the Void Linux version of fortune, which increased tensions (Link/Archive). The final comment in the resignation link shows that a head Void Linux maintainer took issue with Juan's behavior, reporting him to github and implementing an project-level block against him. It seems github took the report seriously, since Juan's github page no longer exists. That same maintainer has put out an official statement on the Void Linux website explaining what has happened and how they will move on (Link/Archive). Juan, on the other hand, is making threats on twitter about revoking the license to Void Linux's package manager, name, and branding (Link 1/Archive 1, Link 2/Archive 2, Link 3/Archive 3, Link 4/Archive 4, Link 5/Archive 5)

As a Void Linux user, I'm not particularly concerned by all of this. The project survived just fine for over a year without Juan; most people weren't even aware he was gone. He has no legal standing to revoke his code, and in the extremely unlikely event that the branding and name are revoked, the project will survive just fine under a new identity. I just thought I'd share this because Juan is melting down in real time and it's both funny and sad to watch.

 

[Dreamland]

Sad to see a man being so broken by his wife, that he's not only willing to fuck over PPC chads, but also assume the gender-liquid "they/that" moniker on twitter. His fast and loose interpretation of organizational rules and his aggressive rants most likely are how he lost custody of his own kids, (except github repos aren't your wife, stop beating it you dummy).

a commit containing quotes that were either directly mocking Juan or could be interpreted as making fun of his divorce was approved for the Void Linux version of fortune, which increased tensions (Link/Archive).

Fucking kek.

 

[Feline Supremacist]

That sucks. Void is the only distro that runs decently on an old G5 iMac someone gave me. Gentoo would probably run well too i just don't want to invest any time installing it on a 15 year old computer that was iffy the minute it came off the production line.

 

[Stock Image Photographer]

Sad to see a man being so broken by his wife, that he's not only willing to fuck over PPC chads, but also assume the gender-liquid "they/that" moniker on twitter. His fast and loose interpretation of organizational rules and his aggressive rants most likely are how he lost custody of his own kids, (except github repos aren't your wife, stop beating it you dummy).

I didn't want to do too much speculating in my post, but I think something like that is definitely going on here. My take is that Juan is spiraling because he feels he is losing control of his life. First he loses his literal children to his ex-wife, then he loses his figurative child to the people who had to step up and take charge of the Void Linux project while he was gone. I'm sure you're aware of this, but for people who aren't, Void would not exist without Juan. It was created by him as a testing bed for the package manager he was developing: xbps. It says a lot about the quality of software this one guy built that an entire community formed around it and that said community was large and dedicated enough to continue his work in his absence. This ends up sucking for Juan because it means that Void has outgrown him; he can't treat it like his personal project anymore and push reckless commits to master because there are a lot of people who would be screwed over by him doing that. Despite being the creator, he just doesn't give the other Void people a reason to trust him, so he feels his baby has been taken away from him. That's why I said this whole thing is partly sad to watch, because you can tell this guy is using this situation to work through some personal issues.

 

[RetroCrab]

For want of an emulation community watch thread, I'll post this here since it's open source drama.

DOSbox is an MS-DOS emulator that has for years stagnated under a bunch of dramafags, countless patches for years they'd refuse to merge for no reason that accumulated into many offshoot forks. The authors act like raging cunts to anyone who tries to improve their baby.

Eventually dreamer and kcgen came along and made DOSbox-staging: https://dosbox-staging.github.io/
It's a modernized fork that fixes many serious bugs and supports a lot of newer stuff.
Modern things like Git, CI and improvements to make contributions easier.

Despite six months of the fork authors trying their best to help upstream, the DOSbox developers saw that they were losing users to this fork, and decided to ban the fork authors from their site and delete six months worth of technical improvements to try and stop the emulator.

More discussion on it here: https://www.reddit.com/r/emulation/comments/g6pjmi/dosboxstaging_0750_release_candidate_1_published/

The deleted technical discussion thread:

https://imgur.com/a/bnJEZcx

https://imgur.com/a/HnG1Ls4

 

[Dreamland]

For want of an emulation community watch thread, I'll post this here since it's open source drama.

DOSbox is an MS-DOS emulator that has for years stagnated under a bunch of dramafags, countless patches for years they'd refuse to merge for no reason that accumulated into many offshoot forks. The authors act like raging cunts to anyone who tries to improve their baby.

Eventually dreamer and kcgen came along and made DOSbox-staging: https://dosbox-staging.github.io/
It's a modernized fork that fixes many serious bugs and supports a lot of newer stuff.
Modern things like Git, CI and improvements to make contributions easier.

Despite six months of the fork authors trying their best to help upstream, the DOSbox developers saw that they were losing users to this fork, and decided to ban the fork authors from their site and delete six months worth of technical improvements to try and stop the emulator.

Ver archivo adjunto 1253140

More discussion on it here: https://www.reddit.com/r/emulation/comments/g6pjmi/dosboxstaging_0750_release_candidate_1_published/

The deleted technical discussion thread:

https://imgur.com/a/bnJEZcx

https://imgur.com/a/HnG1Ls4

>Afraid of C11
>Afraid of git
>Afraid of SDL2
>Frisian
Why can't he just stop being a boomer and get stuck in the past with the OS he's bootlegging?

It has metastasized to /g/, however they're more preoccupied with calling Qbix a zoophile (understandable, Frisia is the Wales of NL).

/g/ - Technology » Thread #75591364

rbt.asia

 

[RetroCrab]

It has metastasized to /g/, however they're more preoccupied with calling Qbix a zoophile (understandable, Frisia is the Wales of NL).

/g/ - Technology » Thread #75591364

rbt.asia

Thanks for the link. I knew the DOSbox authors were trannies, but I didn't know they were diaperfurs into cub as well.

I mean I'm not at all surprised but fuck, that is some top-shelf exceptional degeneracy. Are there any emulators written by normal people?

 

[Mikoyan]

Thanks for the link. I knew the DOSbox authors were trannies, but I didn't know they were diaperfurs into cub as well.

I mean I'm not at all surprised but fuck, that is some top-shelf exceptional degeneracy. Are there any emulators written by normal people?

Ver archivo adjunto 1253625

So where's the usernames/Twitters/FA Accounts of these folks? I'm needing some popcorn material.

 

[OwO What's This?]

The deleted technical discussion thread:

https://imgur.com/a/bnJEZcx

https://imgur.com/a/HnG1Ls4

cmon dude

Edit: also, archived the /g/ thread https://archive.md/Yd04K

 

[awoo]

Are there any emulators written by normal people?

Normal people don't write emulators.

Actually some grad students and professors who have written toy projects seem normalish. I know a Japanese guy who has written an emulator for old Fujitsu computers and he seems pretty normal. Who knows though.

 

[CIA Nigger]

For want of an emulation community watch thread, I'll post this here since it's open source drama.

DOSbox is an MS-DOS emulator that has for years stagnated under a bunch of dramafags, countless patches for years they'd refuse to merge for no reason that accumulated into many offshoot forks. The authors act like raging cunts to anyone who tries to improve their baby.

Eventually dreamer and kcgen came along and made DOSbox-staging: https://dosbox-staging.github.io/
It's a modernized fork that fixes many serious bugs and supports a lot of newer stuff.
Modern things like Git, CI and improvements to make contributions easier.

Despite six months of the fork authors trying their best to help upstream, the DOSbox developers saw that they were losing users to this fork, and decided to ban the fork authors from their site and delete six months worth of technical improvements to try and stop the emulator.

Ver archivo adjunto 1253140

More discussion on it here: https://www.reddit.com/r/emulation/comments/g6pjmi/dosboxstaging_0750_release_candidate_1_published/

The deleted technical discussion thread:

https://imgur.com/a/bnJEZcx

https://imgur.com/a/HnG1Ls4

Regarding the DOSBox news, is it any wonder why DOSBox is stuck in such a sad state? If the developers aren't going to accept patches, of course people are going to fork it. It's literally ZSNES tier of "not being updated", except at least DOSBox has forks because the demand nowadays is for better PC/DOS emulation and DOSBox fills a niche that even low level PC emulators like PCem/86box can't fill. Then there's the fact that the creator is probably a Vogons moderator/is pals with them, and Vogons has a reputation for having shit moderation and attracting lots of kids.

Normal people don't write emulators.

Actually some grad students and professors who have written toy projects seem normalish. I know a Japanese guy who has written an emulator for old Fujitsu computers and he seems pretty normal. Who knows though.

The normal people who write emulators end up getting tech industry jobs and making it big. Look at Aaron Giles. He got a job at Connectix, did a lot of work on Virtual PC and wrote a PS1 emulator called Virtual Game Station, and both were highly influential. VGS was the target of a lawsuit that basically ended up legalizing emulation, while Virtual PC led to the company being bought by Microsoft...and his job transferring over. On the side he also worked on MAME as well and was the lead dev for years. Recently he's worked on ARM64 Windows and wrote an x86 emulator for it. There's also plenty of commercial computer emulators, and both QEMU and SIMH have most likely been used in production environments as well to replace older computers. Sony also had a position open years ago for developers to work on their PS Classics PS2 emulator.

The computer side of the emulation scene attracts less exceptional people, and it's not a surprise since emulating a lisp machine or a vintage computer attracts a different demographic than emulating a Nintendo. It's also had a lot of promising emulators as of late. Look at the DOSBox-X fork of DOSBox, it has some interesting features including PC-98 emulation. It's a fork with a different goal than staging (better and more hardware support, ability to run demoscene prods) but also is vastly better than the outdated inaccurate pile of shit vanilla DOSBox is. MAME also has some interesting shit coming from that camp as well on the MESS (non arcade) side of things from obscure computer emulation to the Tiger handheld emulation featured in an AVGN video and embraced by archive.org.

 

[RetroCrab]

The computer side of the emulation scene attracts less exceptional people, and it's not a surprise since emulating a lisp machine or a vintage computer attracts a different demographic than emulating a Nintendo. It's also had a lot of promising emulators as of late. Look at the DOSBox-X fork of DOSBox, it has some interesting features including PC-98 emulation.

Aaron Giles is right old chap, as was the founder Nicola Salmoria.

That makes so much sense actually. The most exceptional emudevs always seem to be working on Nintendo systems. Byuu for SNES, MooglyGuy for N64, Beware for GBC, Endrift for GBA, StapleButter for Nintendo DS, and entire teams full of troons for Gamecube, Wii, Switch and 3DS. I am trying to come up with counterpoints for Sony and Microsoft systems and I'm drawing a blank. Sega has some personalities, especially in the Dreamcast scene, but they're mostly just the regular kind of narcissist crazy.

You've just crushed my 20 year dream of a decent N64 emulator ever coming out, but I guess DOSbox is more of an exception to the rule here, that's reassuring. For PC-98 emulation, DOSbox-staging said they were going to merge that at some point. Hard system to get into without speaking moon runes but there's so many games for it, should be fun if we can get a decent emulator and some fan translations. FM Towns also seems really cool yet under appreciated, I think under the hood it's also an x86 computer.

 

[Shaka Brah]

Aaron Giles is right old chap, as was the founder Nicola Salmoria.

That makes so much sense actually. The most exceptional emudevs always seem to be working on Nintendo systems. Byuu for SNES, MooglyGuy for N64, Beware for GBC, Endrift for GBA, StapleButter for Nintendo DS, and entire teams full of troons for Gamecube, Wii, Switch and 3DS. I am trying to come up with counterpoints for Sony and Microsoft systems and I'm drawing a blank. Sega has some personalities, especially in the Dreamcast scene, but they're mostly just the regular kind of narcissist crazy.

You've just crushed my 20 year dream of a decent N64 emulator ever coming out, but I guess DOSbox is more of an exception to the rule here, that's reassuring. For PC-98 emulation, DOSbox-staging said they were going to merge that at some point. Hard system to get into without speaking moon runes but there's so many games for it, should be fun if we can get a decent emulator and some fan translations. FM Towns also seems really cool yet under appreciated, I think under the hood it's also an x86 computer.

Is there even really an emulator scene for OG xbox and 360? The emulators I remember looking into were very low on the usability scale compared to, say, Dolphin, and it always seemed like more of a lack of interest than a genuine hardware limitation.