can you provide a relevant example for this context?

That was an entire body of research at the University of Minnesota and the “hypocrite commits” weren’t found until the authors pointed people to them.

https://www.theverge.com/2021/4/30/22410164/linux-kernel-uni...

How long did the log4j exist?

https://www.csoonline.com/article/571797/the-apache-log4j-vu...

What was the other package that had the mysterious .?

And yet they were found. How many such exploits lurk unexamined in proprietary codebases?

yet you say this like Apple or Google or Microsoft has never released an update to address a security vuln

Apple[1], Google[2], and Microsoft[3] you say?

You say this as if being shamed into patching the occasional vuln is equivalent to security best practices.

Open code which can be independently audited is only a baseline for trustworthy code. A baseline none of those three meet. And one which by itself is insufficient to counter a reflections on trusting trust style attack. For that you need open code, diverse open build toolchains, and reproducible builds. None of which is being done by those three.

Are you getting your ideas about security from the marketing department?

1: https://arstechnica.com/security/2024/03/hackers-can-extract... 2: https://www.wired.com/story/google-android-pixel-showcase-vu... 3: https://blog.morphisec.com/5-ntlm-vulnerabilities-unpatched-...

Go ahead and put that cup of kool-aid down for a minute. There are so so many OSS packages out there that have never been audited? Why not? Because people have better things to do. How many packages have you audited? Personally, I don't have the skillz to do that. The people that do expect to be compensated for their efforts. That's why so many OSS packges have vulns that go unnoticed until after they are exploited, which is the same thing as closed source.

OSS is not the panacea that everyone touts it to be.

> There are so so many OSS packages out there that have never been audited? Why not? Because people have better things to do.

I'm not aware of any major open source projects that haven't experienced some level of auditing. Coverity alone scans everything you're likely to find in a distribution like Debian or Fedora: https://scan.coverity.com/o/oss_success_stories

> How many packages have you audited?

Several on which I depend. And I'm just one pair of eyeballs.

> Personally, I don't have the skillz to do that.

Then why are you commenting about it?

> OSS is not the panacea that everyone touts it to be.

I don't know who's touting it as a panacea, seems like a strawman you've erected. It's a necessary pre-requisite without which best practices aren't possible or verifiable.

"Fractals are not self-similar"

https://m.youtube.com/watch?v=gB9n2gHsHN4

If you want to learn more about the fascinating world of fractals.

The parent comment didn't mention self-similarity; did you maybe intend to reply to another comment?

i am guessing that most people think that the cognitive load cost is usually not worth the benefits.

i agree that the cognitive load in a language like js which is not prepared to accommodate this paradigm is not worth it

even when deciding to use Haskell we need to weigh the pros and cons wrt the project's goals

I used Affinity tools as a better alternative. Are they not a player anymore?

you're worried that they'll explain 3rd degree polynomials with a leftist bias?

The overwhelming majority of their publication on organics has an unmistakable bias toward D- sugars ...

I mean, look at all the insane places leftists have shoehorned gender crap into lately. I wouldn't put it past them.

Ah yes, leftists shoehorning gender into checks notes elliptic curve math discussion.

first thing i did when i read "3rd degree polynomial" was search "elliptic curve 3b1b"

146 in how many? 80 in how many?

80/557

146/1109

that's above 12% on both.

now correct it for number of sold phones each (estimated by looking at the 70 most popular models) and we'll get why they said 1/4.

These days?

Had the same thought from the headline, but the punchline is that he's using the VPN he completely built himself and can't even trust that one.

He most likely wouldn't have this problem if he used a VPN product for clueless users. It has nothing to do with trust towards a class of technology and all to do with the fact that computers are hard.

... which is entirely a PEBCAC-type error in this case, as he never tested if his configuration worked as expected.

Which is not surprising because according to him, all it takes is running a simple bash script

vimgolf.com is a classic

so you're not so worried that they do this analysis (this is very tame comparing to what they really do), but rather that they are transparent about it?