* Posts by karlkarl

1385 publicly visible posts • joined 10 Apr 2015

Drowning in code: The ever-growing problem of ever-growing codebases

karlkarl Silver badge

Some of them I publish and release, but so many people are only interested in "newer" stuff that it often isn't worth the time.

I rarely offer patches back upstream. Mostly because they wouldn't accept them, gutting build systems, ripping out features is not the direction that these projects go. Hence the article on "bloat" I suppose ;)

Some of my work to replace the Gtk in GtkRadiant with FLTK got upstreamed in FLTK itself though (Fl_Flex): https://github.com/fltk/fltk/blob/master/FL/Fl_Flex.H

I only really care about Windows 7 and OpenBSD platforms. Linux tends to build due to the simplification of the software but I only get the urge to give it a shot once in a blue moon. Part of my work on Half-Life was to *remove* Android support because I find it a mess and was damaging the codebase.

karlkarl Silver badge

One of my personal hobbies is gutting older software projects, cleaning them up and simplifying them, getting rid of the bloat.

I have a number of carefully maintained ports of i.e:

- Blender (2.49)

- Half-Life

- GtkRadiant

- Abiword / Gnumeric

- GTK+2 (sits on SDL2)

- CDE

- DOSBox (direct framebuffer)

Often it is ripping out random dependencies for trivial stuff, replacing GUI libraries and swapping terrible build systems.

Open-source tends to grow and grow. Sometimes it is good to take a step back, have a think about the role of the core software and ultimately to make the codebase a joy to maintain.

I get the temptation though. When a project is public, you are always stretched between keeping the project "correct" and focused vs trying to appease and make everyone happy.

Closure of Windows 10 upgrade path still catching users by surprise

karlkarl Silver badge

Agreed.

I simply don't engage with DRM. It is so easy to avoid these days.

Mozilla CEO quits, pushes pivot to data privacy champion... but what about Firefox?

karlkarl Silver badge
Pint

> Could it have more to do with browser's ever-increasing irrelevance

Firefox was as irrelevant back in 2010 as it is irrelevant now.

Gosh, I wish all software could remain as irrelevant as Firefox.

Here's to the next decade of Mozilla Firefox! Well done, keep going and you will win by default! ------------------>

Rust can help make software secure – but it's no cure-all

karlkarl Silver badge

Re: FALSE

Imagine you have 2 unsafe sections:

1) One that allocates some data and passes it out as a wrapped object.

2) Another that causes the data to dangle.

You are passing that wrapped object around potentially the entire codebase. I would now say that 100% of the Rust codebase is compromised. The issue is the order / state of calls that ultimately called that 2) section. This is likely why Rust is finding it hard to establish a common GUI library; those things are very risky with regards to dangling data when wrapping and making bindings.

Yes, this is better than an entire codebase of C that could also be compromised but that loss of direct interop with C may not be worth the difference. Or at the very least, C++ is a pretty strong compromise between the two.

karlkarl Silver badge

> Because one "unsafe" block can break the guarantees of safe code around it.

Indeed. The unsafe block isolates the "entry" and "exit" points for i.e memory bugs to manifest themselves. However the bug is likely not at these points but within the wider software design.

This is further exacerbated by the fact that almost all Rust software relies on one or more *-sys crates linking it to the underlying OS (almost exclusively a C API). So there is many of these unsafe points that people don't even know about; so how can they know to be careful?

Rust is close to safe. Closer than Ada in my experience, especially where C boundaries are concerned. However in more use-cases than we like to admit, keeping with homogenous C (or even C++ with direct interop with C) is more appropriate.

IBM pitches bite-sized $135k LinuxONE box for smaller biz types

karlkarl Silver badge

"The company said that customers who move Linux workloads from an x86 server setup to an IBM LinuxONE 4 Express could save over 52 percent on total cost of ownership over five years."

Just... How?

Windows 3.11 trundles on as job site pleads for 'driver updates' on German trains

karlkarl Silver badge

Re: Improvement?

For ISA bus and parallel ports, then DOSBox (or another VM/emulator tech) really is your only choice.

ISA and parallel at least are very tricky to track down on "modern" hardware.

karlkarl Silver badge

Re: Improvement?

> replacement hardware -- Windows 3.1 doesn't run well on modern hardware

Since DOSBox is so portable, and Windows 3.1 is so light, this setup could run on much more hardware than current Windows.

Cory Doctorow has a plan to wipe away the enshittification of tech

karlkarl Silver badge

Enshittification is a great term.

For almost any dead tech product, you can go through screenshots of their releases and see the exact stages of enshittification occurring.

Oracle quietly extends Solaris 11.4 support until 2037

karlkarl Silver badge

Re: I guess no further extention to the deadline possible

I don't disagree.

But the Lindy Effect is currently suggesting that Solaris 10 will likely be the last remaining OS on earth, outliving all of us.

I mean, seriously, if I knew the lifespan that Solaris 10 was going to have in 2005, I would have absolutely prioritised it over even Linux. 20 years is almost an entire career length.

The real significance of Apple's Macintosh

karlkarl Silver badge

Re: In the early versions of MacOS it just blew up..

Indeed. Though, I would have thought that in a "debug runtime" build expensive checks could have been done to alert the programmer of this error. This wasn't done and I am slightly surprised it wasn't.

Same with C++ actually, in debug builds, similar to Microsoft's debug iterators we could:

- Lock operator-> to prevent use-after-free of "this"

- Lock operator[] to prevent invalidation of elements during access

- Return some lock passthrough on operator T& to prevent use after free during use as a parameter reference

Yes, it would run slowly (possibly slower than ASan) but in this kind of debug build who cares? It would be a really good compromise.

karlkarl Silver badge

I had a few very good fundamental ones I used as part of my thesis. I will try to dig them out. However for a quick immediate example, this article explains it quite well:

https://oberoidearsh.medium.com/dangling-pointers-tombstones-and-lock-and-keys-f6bd0791810f

This is quite good too, following this reference leads down a more academic path / approach.

https://books.google.com/books?id=To3xpkvkPvMC&pg=PA392

karlkarl Silver badge

Sure, its relating to this:

https://en.wikipedia.org/wiki/Classic_Mac_OS_memory_management

"To solve this, Apple engineers used the concept of a relocatable handle, a reference to memory which allowed the actual data referred to be moved without invalidating the handle. Apple's scheme was simple – a handle was simply a pointer into a (non-relocatable) table of further pointers, which in turn pointed to the data."

(You are right though, this doesn't *have* to be C but there was an API that provided this at the time. It is a technique that can be used by most languages utilizing pointers)

Basically, pointers went "through" a validation table containing "validity" records (formerly called "tombstones") to check memory errors.

Think along the lines of struct Employee ** pointing to a struct Allocation * and thus passing through to the first member (void *).

struct Allocation {

void *data;

size_t size;

int valid;

};

I attempted to implement my own standalone approach here:

https://www.thamessoftware.co.uk/forge?repo=stent

It has been moderately successful with a websocket proxy / web server I wrote using it here:

https://www.thamessoftware.co.uk/forge?repo=wsstent

But... can't seem to find a way to comply with strict aliasing rules.

karlkarl Silver badge

Behind that interface is an even cooler thing. A really portable approach to dealing with memory safety in C. Their pointer tombstone approach was quite inspired for the time.

(that said, it likely violated strict aliasing rules).

Linus Torvalds flames Google kernel contributor over filesystem suggestion

karlkarl Silver badge

Re: A better long-term approach...

Yes it is. Its all of ours to weaponise. So long as software freedom is our aim.

Have a read up on the recent article on the ways that the free software community is approaching this:

https://www.theregister.com/2023/12/27/bruce_perens_post_open/

karlkarl Silver badge

Re: A better long-term approach...

To isolate them from the wider community. Yes.

Then if they can no longer contribute, they will lose relevance and market-share. It is an open-source weapon that really can keep commercial machines in line.

Native Chrome arrives fashionably late to the Windows on Arm party

karlkarl Silver badge

Its amazing how much of a big deal "an ARM version of a program is" on Windows.

On BSD / Linux, you just kind of expect it. Whether the C or C++ becomes Intel or Arm machine code out the other end is barely exciting.

The Land Before Linux: Let's talk about the Unix desktops

karlkarl Silver badge

> but Linux has already become a top end-user operating system, thanks to Android and Chrome OS

Isn't Chrome OS still a tiny minority? Some schools were tricked into buying a fleet and a some elderly use it as a web browser thin client perhaps?

Saying that Android is providing Linux to the masses is very true but I personally find it a little bit... sad. I feel Linux can do so much better than that as a proper general purpose operating system. And this is wasted when misused as an over-engineered phone OS.

Wait, security courses aren't a requirement to graduate with a computer science degree?

karlkarl Silver badge

There is more to computers than the network. (Contrary to Sun's slogan ;)

An offline solution is pretty darn secure.

The rise and fall of the standard user interface

karlkarl Silver badge

Since CDE / Motif is the last GUI system that was ever standardized by IEEE. We should all just keep using that.

Or we could... wait for another to become standardised *snigger*.

Russia takes $13.5M bite out of Apple over in-app purchases

karlkarl Silver badge

Re: Apple in Russia?

It exists to extract money from people without giving them much in return.

So I can exactly see how a US company has the relevant blessings to extract money from the Russian people.

Eben Upton on Sinclair, Acorn, and the Raspberry Pi

karlkarl Silver badge

I like the Pi but using a low powered (by design) hardware to use in order to emulate another platform is ultimately a pretty daft idea.

So, are we going to talk about how GitHub is an absolute boon for malware, or nah?

karlkarl Silver badge

Re: GitHub

Not just source, I used to dump loads of random binaries on there too (basically a poor man's dropbox).

That said, I haven't engaged with GitHub since they forced consumer 2FA. It was finally the kick up the butt I needed to jump back to my own infrastructure. Everything is just cleaner and more fun again now.

Microsoft suggests command line fiddling to get faulty Windows 10 update installed

karlkarl Silver badge

> When did Windows turn into Linux?

Windows as a whole never did. But certainly the GUI experience regressed to such an extent since Windows XP that it is now on par with the Linux offerings.

A true race to the bottom!

Microsoft prepares Visual Studio 2013 for retirement

karlkarl Silver badge

Indeed. As I mentioned "offline backups just feel like a random cludge of files with no real versioning"

karlkarl Silver badge

I can't recall, is 2013 the last one with proper deterministic install media via DVD before it went, "just grab a bunch of random crap off the servers and call it an install"?

These days even the VS offline backups just feel like a random cludge of files with no real versioning.

What if Microsoft had given us Windows XP 2024?

karlkarl Silver badge

It would just be funny to see people say how "modern" it looks. It would be good proof that people's opinions of aesthetics are entirely what Microsoft dictates.

It would bubble down to something far more important though; we would have a good push to get rid of defective shite like Gnome 3+ and KDE 4+ and go back to something more useful.

Asahi's Fedora remix dazzles and baffles on Apple Silicon

karlkarl Silver badge

Re: Why?

> I guess all those apps I have installed, not from the App Store, must have been compiled on my machine then...

> They're all signed (an ad hoc signature is fine). This is not necessarily a bad thing, but some people are concerned that over the long run Apple will seek to "iOS-ize" macOS and have only known signatories, certified by Apple.

Its worse than that. Those apps, not from the App Store have been signed by a certificate that the authors have had to beg Apple for (and pay for the privilege). This is the same as Microsoft's Windows RT developer license.

As I mentioned, try compiling a binary on your machine and try running it on your second machine. I bet you can't run it without also begging Apple (and paying) for the privilege. Basically the developers who write software you enjoy using are being forced through stupid hoops by Apple.

karlkarl Silver badge

Re: Why?

MacOS has online DRM (you can't get through the installer without activating). Since Big Sur I believe.

MacOS has code signing issues since the M1. A binary compiled on your machine won't run on your second machine. There is (for now) a workaround but this will get stricter over time: https://github.com/Homebrew/brew/issues/9082

The userland is not entirely BSD; you have some GNU stuff in there (particularly Vim and gmake). It also has lost the ability to do Jails (or even a decent chroot) along the way.

To save the hardware from the inevitable landfill, I feel being able to install Linux does help. Installing a proper BSD (i.e FreeBSD) will be nice too.

Microsoft nixed Mixed Reality: This Windows VR didn't even make it to the ER

karlkarl Silver badge

> This Windows VR didn't even make it to the ER

Where I work, they kept sodding trying to bring it into the ER. I kept rejecting it for all our projects because the hardware was expensive, unreliable to source and criminally locked down. It was basically Windows RT with a different form-factor.

Microsoft should be ashamed of themselves for adding more to landfill sites across the world.

What comes after open source? Bruce Perens is working on it

karlkarl Silver badge

Heh, quite a good hack.

I know one version of SFU/Interix/SUA used OpenBSD as the base, but I didn't know any that were binary compatible with a certain Unix. I don't suppose you recall?

There was that BSD on Windows I recently heard about: https://virtuallyfun.com/2023/12/08/bsd-on-windows-things-i-wish-i-knew-existed/

I *think* QuarterDeck's DESQview/X provided a Motif implementation on a "commercial OS" too but perhaps that was licensed.

karlkarl Silver badge

> Theoretically, I am free to run that code on that Windows installation, am I not?

Microsoft gives out a lot of free licenses to their OS, but the OS itself is not free. Sorry, I should have clarified. By free, it means Open Source. The full statement is here:

"The rights granted under this license are limited solely to distribution and sublicensing of the Contribution(s) on, with, or for operating systems which are themselves Open Source programs. Contact The Open Group for a license allowing distribution and sublicensing of the Original Program on, with, or for operating systems which are not Open Source programs"

License:

http://www.opengroup.org/openmotif/license/

karlkarl Silver badge

I do agree. However wouldn't the mentioned OpenMotif license prevent this misuse?

RHEL is a paid for operating system. Not only the support but also the binaries. If most open-source software embraced this license, RH would not be able to use it unless it delivers the OS (in its entirety, repo, source and all) for free.

For reference, the OpenMotif license also excluded Cygwin from providing packages. Whilst Cygwin is free, the platform that it ran on was not.

karlkarl Silver badge

I quite liked the "Open Motif" license (before it went GPL) which stated, quite simply:

"This software must not be compiled or run on a paid-for operating system".

But I agree, open-source software is pretty darn powerful. I do feel that we can afford to weaponise the license a little more than the GPL does currently. The AGPL gets a little closer.

Doom is 30, and so is Windows NT. How far we haven't come

karlkarl Silver badge

Re: Telemetry

It came with DRM.

People should have said "no" back when it was introduced in Windows XP.

Too late now.

Apple's easiest to replace battery is in... an iMac

karlkarl Silver badge

Re: "twice as repairable"

Hah, indeed. The reparability doubles, year on year!

0 * 2 * 2 * 2

= 0

... but to Apple's defense. At least the machines are getting thinner and thinner so they take up less space in the landfill :)

Shame about those wildfires. We'll just let the fossil fuel giants off the hook, then?

karlkarl Silver badge

Re: When will Big Oil face the heat?

> Oil companies don't use fossil fuels - people do.

No we don't, our boilers do. Lets pass the blame further and shout at the (warm, toasty) metal box!

The 15-inch MacBook Air just nails it

karlkarl Silver badge

At least...

At least it won't take up much room in the landfill.

Memory-safe languages so hot right now, agrees Lazarus Group as it slings DLang malware

karlkarl Silver badge

DLang is more important in this area in that it can directly consume C APIs (which is fairly important for malware accessing various operating system subsystems, almost exclusively exposed as C APIs).

Rust via bindgen to generate a fairly rough 80% of bindings and then fetching the rest of the bloat from NPM-style crates.io is less than ideal for anyone's software development pipeline, including malware authors.

C and C++ are still the malware language of choice though. It mirrors much of the industry at a systems-level to be fair.

Datacenters feeling the heat to turn hot air into cool solutions

karlkarl Silver badge

> the most unusual scheme remains that of a datacenter in Hokkaido in Japan, which is using snow to cool its IT infrastructure then taking the resultant warm meltwater to cultivate eels for sale at market.

In the video, it just looks like a bitcoin mining operation.

So is that really a Data Centre? Possibly there isn't much actual "Data" involved.

Dump C++ and in Rust you should trust, Five Eyes agencies urge

karlkarl Silver badge

Re: Bull

Have you read through the commits?

They peck at the code because no-one understands it anymore since the Rotor SSCLI days.

karlkarl Silver badge

Re: Bull

> Feel free to point out the 'rot' in C# 12

Is a 1.8 MB C++ source file containing the .NET Core VM garbage collector alone enough for you?

https://raw.githubusercontent.com/dotnet/runtime/main/src/coreclr/gc/gc.cpp

Can you spot any memory errors in that? You have 24 hours. Go! (During my thesis I found 2. They are there... So much of that code is ancient rot).

Anything built on-top of this is basically on a foundation of sand. That is pretty much any .NET language.

(Note: Careful; opening that monster of a file outside of raw mode might freeze your browser).

karlkarl Silver badge

> CISA suggests that developers look to C#, Go, Java, Python, Rust, and Swift for memory safe code.

Your code will only be memory safe because you will have implemented nothing and instead spent all your time writing / maintaining generated bindings rather than writing code that does actual stuff...

Besides, these guys have clearly never looked at the code behind the .NET or Java VMs... That memory safe code is floating ontop of a cesspit of rot.

Rather than talking about Rust, perhaps CISA should actually have a play at implementing something with it. They basically are falling into the same category as all the other 14 year-old Rust developers on reddit.

Apple and some Linux distros are open to Bluetooth attack

karlkarl Silver badge

Firstly, I agree wholeheartedly with OpenBSD ripping bluetooth out. It is a pretty disgusting stack. It barely works consistently on any platform I have dabbled with.***

However, Bluetooth can't entirely be blamed for this; it is like blaming USB in general for the risk of plugging in and autorunning a dodgy .exe in the Windows XP days. Bluetooth is just a transport layer that carries the data, it is the dodgy HID drivers at the other end that have the flaw. The problem is that so many drivers that make up the Bluetooth ecosystem are so terribly written and curiously, I am not so sure why.

*** For things like Bluetooth headphones, you can actually get adapters that use bluetooth transparently. This might be a good compromise for some.

I.e https://www.amazon.co.uk/Bluetooth-MaedHawk-Microphone-Streaming-Headphones-Metal-Grey/dp/B086VZQG55

Microsoft touts Visual Studio Code as a Java juggernaut

karlkarl Silver badge

The stats would suggest that:

"Since VSCode has appeared, Java has taken a massive downfall in popularity. So from this we can infer that VSCode is bad for Java..."

I know they are unrelated properties but I think Microsoft being able to swing a good narrative is impressive in terms of their marketing prowess.

Steam client drops support on macOS, but adds it on Linux

karlkarl Silver badge

> That won't help, 32 bit games won't be usable either, unless the developer releases 64 bit binaries

What? Of course they will. My old 32-bit compatible mac will still run 32-bit software fine... Why wouldn't it? If I ever by a computer, I don't send it to landfill when the next chip comes out... Is that a rare use-case these days? haha.

But by the 32-bit Steam DRM platform no longer being able to activate against Valve's servers, it *will* break it in an artificial (and in my opinion, criminal) manner.

This is all theoretical of course. I would never engage with a DRM product.

(unless someone suggests never being able to reformat my machine again or replace the hard drive once the games are activated? Of course that is a daft suggestion).

karlkarl Silver badge

>> The only similar event(s) I can recall were on GNU/Linux before I had even heard of it: the switch from libc5 back to glibc, and on a smaller extent (with the same borkage capability), the switch from a.out to ELF

You will see it a little with the introduction of Wayland. There will be a few few software titles (not necessarily games) that will fall through the cracks. Xwayland as an Xephyr replacement will help with some but as things progress more, you will see breakage. The problem is that games ultimately *aren't* important. There will be no real drive to maintain them.

Small but mighty, 9Front's 'Humanbiologics' is here for the truly curious

karlkarl Silver badge

Re: As I wrote about something else a month or so ago ...

These days I honestly find "good" and "for everybody" to be mutually exclusive properties. Many projects have to walk a very gray wall, full of compromise.

I personally have found 9front to be very welcoming, particularly through my (admittedly brief) chats about git9 with Ori Bernstein (ori@) a while back.

X fails to remove hate speech over Israel-Gaza conflict

karlkarl Silver badge

Twitter (temporarily known as X) is basically a chatroom...

Who gives a shite what people write in chatrooms?

Censoring a chatroom is like removing pieces of corn from a random dog turd on the street. It has no impact.