Yeah. I have no idea what the answer is, just describing the nature of the issue. I come from the days when you would maybe import like one library to do something special like .png reading or something, and you basically did all the rest yourself. The way programming gets done today is wild to me.
I sort of have a suspicion that there is some mathematical proof that, as soon as it becomes quick and easy to import an arbitrary number of dependencies into your project along with their dependencies, the size of the average project’s dependencies starts to follow an exponential growth curve increasing every year, without limit.
I notice that this stuff didn’t happen with package managers + autoconf/automake. It was only once it became super-trivial to do from the programmer side, that the growth curve started. I’ve literally had trivial projects pull in thousands of dependencies recursively, because it’s easier to do that than to take literally one hour implementing a little modified-file watcher function or something.
Yeah, exactly. If you read the Snowden leaks to learn the details of what some of their actual capabilities are (smuggling flawed keys into the DH exchange for most major web browsers for example), it makes this stuff look like kids in their basements fucking around.
Reddit: Trust us we’re GENIUSES bro, most popular web site in the world, we’re so smart I swear
Also Reddit: Hey can we have more money, we lost it all again. This new plan’s gonna work tho
I cannot overstate how wonderful this is. Thank you.
I feel like this is kind of the amateur-hour stuff. It’s certainly dangerous, but in comparison to a lot of state-actor activities (or even committed-amateur activities), this kind of supply-chain attack is pretty blatant and easy to spot. Which doesn’t mean it’s easy to spot – I just mean would be trivial to volunteer and contribute some minimal fixes and enhancements to some open source project, and then at one point smuggle in a zero-day that will basically never be detected unless someone detects the intrusion itself and then works backwards from there with a ton of time to spend on it.
If you’ve ever looked at the obfuscated C contest it should be obvious that this kind of thing can be made completely invisible if you know what you’re doing. Some of the interactions and language features that lead to problems are basically impossible for a casual viewer to see, even if they’re paying attention, and the attack surface is massive and the amount of attention that goes into checking it for weird subtle vulnerabilities is minuscule.
Same as anything really
They actually observed the natives setting those controlled burns, and decided to themselves, “Yeah they’re wild savages, they clearly don’t give a fuck about anything or know what they’re doing, here’s me with syphilis and muskets and I think it’s time to share civilization with them, they’ll thank me later.” All that magic prairie ecosystem (which is basically gone now) was a carefully constructed environment maintained over generations to make hunting big game cheap and easy. But no, let’s have railroads and lead paint instead.
What I used to do when I lived in an area with a decent number of homeless people, was offer to get them some food, if I had the time for it. I’d walk somewhere with them, say what do you want I’ll grab it for you, and come out and hand it to them. It was honestly a little bit awkward to do it without feeling like a ponce, making conversation with the person or whatnot feeling condescending, but whatever.
I would say the majority would discount the suggestion. I didn’t feel the slightest bit bad saying no you can’t have any money then. A minority would be really into the idea and clearly fucking light up at the idea of having their hands on a sandwich. Those dudes I felt like it was important that they get their sandwich.
I also knew a guy who used to be homeless, volunteered with homeless services and substance abuse programs and etc, spent a ton of time on it. He never gave money on the street. He got very bitter about the subject, he just said that it doesn’t help them. Make of that what you will, I don’t really know the ins and outs, but that’s what he said.
What kind of endorsement is that lmao
Yeah. I feel like in a few years when literally nothing works or is maintainable, people are going to have a resurgent realization of the importance of reliability in software design, that just throwing bodies and lines of code at the problem builds up a shaky structure that just isn’t workable anymore once it grows beyond a certain size.
We used to know that, and somehow we forgot.