Kragen Javier Sitaker @xentrac@social.cleverlibre.org

@akkartik Yup, #go, the board game.

Unexpected salsa/bachata dance party in the plaza on the way home from go club (which was canceled)

@tomjennings Sounds totally reasonable, and you could run it off a coin cell or solar panel and capacitor if you emulate the CPU on a low-power ARM or RISC-V microcontroller. SPI Flash is quite a bit snappier than a floppy

On Mathstodon, I see that my comment here is presented without the context of Eleanor's original comment: https://infosec.exchange/@dymaxion/117588732908802911

@evan I look forward to reading the Fediverse handles of the people who voted on each of these categories ☺

The VPRI STEPS project tried to do this in 20,000 lines of code, and to me it seemed like they got close, but no cigar. But things similar to this have been done several times before by small teams and even individuals: Oberon by Wirth and his students, Smalltalk by the Learning Research Group at Xerox PARC, Plan9 at Bell Labs, and, most notoriously, TempleOS by one schizophrenic guy who thought everyone who made him uncomfortable was Satan, so he ended up homeless and then killed himself.

And we have access to much better technology than they do: teraflops supercomputers on our desks, 32-bit RISC chips that run at 50 MIPS and cost 14¢, decades of advances in formal methods and other aspects of computer science.

Although Eleanor is certainly a very knowledgeable person whose opinions merit deep consideration, I don't think it's nearly as technically hard as she does. I wrote Ur-Scheme in three weeks, and that was before AI.

@dymaxion @dalias @rob I thought the Shuttle onboard software group had found 18 bugs in QA, not one? Also, I don't think qmail has ever had a security bug exploited in production, although Georgi Guninski did find one that could have been.

seL4, thanks to their formal proofs of correctness, claim they have also never had a bug in production — except that they were vulnerable to Spectre and Meltdown. They are also close to one line of code per developer day, but I am optimistic that this is a thing AI can actually help with instead of making things worse: it's decent at ACL2, TLA⁺, Lean, Rocq, Agda, etc.

@dalias @dymaxion @rob With respect to MMS apps irresponsibly auto-decoding media content, if you have an operating system, you can run your media content decoding in a bubblewrapped container that doesn't have any authority except to output a stream of decoded pixels. I've been messing around with bwrap trying to get it to do this for GraphViz.

@dymaxion @dalias @rob Hopefully those six or eight billion people can choose who they trust to help them keep their computers secure. They may not choose well, but the alternatives on the table (Crowdstrike, hyperscalers, and states choosing for them) will make systematically worse choices.

@mhoye We keep trying to reinvent Lotus Notes. I remember I gave a presentation at my local Linux User's Group about Coda last millennium, which worked this way. Nowadays mostly I use Git, but Git doesn't sync opportunistically, which is what you want. Fossil does, but I haven't tried Fossil.

@tomjennings That sounds ominous.

@pozorvlak Yeah, it's fantastic.

@dalias Maybe the attackers who exploit the vulnerabilities will patch them to avoid being dislodged from their beachhead.

Ultimately, though, people need to be responsible for the software they run on their own computers. The alternative is that those computers aren't really theirs, and that's nightmare fuel.

I like this term "vibesick". I think I identify with it.