josephc

I used to hate this. I still hate it, but I used to hate it, too.

More seriously, something that has helped from my managers is getting a “product requirements doc” or PRD. Management and customer reps put together a requirements document that says what they need built. Then you can break it down into work units for yourself and estimate the size with milestones and deliverables. It helps a bunch, even if it’s extra overhead at the start.

Unlike javascript, where at least it is an interpreted language people can audit, you would have to reverse engineer these binaries to figure out what they do.

If you cargo install something you get source code (unless the library packages a binary, but that’s the same as if it were JS or Python or C). Rust dependencies don’t become binary until the final product.

Auditing Rust binaries isn’t much worse than auditing minified and uglified JS. I’ve done both.

EDIT:

Rust

Rust is doing pretty poorly right now.

among the 999 most popular crates on crates.io, around 17% contained code that do not match their code repository.

https://kerkour.com/rust-supply-chain-nightmare

I just went through the article and I don’t think I agree with the assessment that “Rust is doing pretty poorly right now.” It feels disingenuous, given the content of the article you linked:

826 crates match their upstream repositories at the revision they were built at. 74 crates have revisions that cannot be found in their repositories, whether due to later squash merges, rebases or revisions simply not being pushed. 73 crates do not have VCS info, either because they were built with old Cargo versions, built with --allow-dirty, or not built from a repo clone at all. 77 crates do not declare a repository in their Cargo manifest. 7 crates would match their upstream repository but for one or more symlinks being incorrectly handled. 3 crates declare repositories that do not exist. 3 crates have submodules that do not exist. 3 crates cannot be found within their repositories. 3 crates cannot be built due to cargo package errors. … Only 8 crate versions straight up don’t match their upstream repositories. None of these were malicious: seven were updates from vendored upstreams (such as wrapped C libraries) that weren’t represented in their repository at the point the crate version was published, and the last was the inadvertent inclusion of .github files that hadn’t yet been pushed to the GitHub repository.

Multiclass warrior bard. Hmm. 🤔

Going from Photoshop to GIMP 3, it’s just not the same. I have a lot of respect for the project, but there are so many rough edges that it’s demoralizing at best.

Here’s an example: in Photoshop, I select an object with the smart select brush (not available in GIMP), copy and paste it and it ends up on a new layer. I can drag the new layer around and draw on it. In GIMP, I paste a rectangle and the layer bounds are exactly locked to the paste area, so if I do something like feather the edges or try to draw on it I get a block of pixels. Without looking it up, can you tell me how to make the active layer size match the canvas size? And if I drag that layer, will it move the pixels or will it offset that layer and force me to rerun the “layer to document size” process?

Not that Adobe hasn’t done a ton of Enshittification, but CS6 was pretty great for me.

Perhaps the parent commenter has apps they need to run for work? I know Microsoft Authenticator isn’t supported on Graphene, which is admittedly bullshit but it’s a requirement if you work in the government or high security industry like utilities. If that’s the case they should be given a work phone, but companies don’t do that most of the time in my experience.

Or perhaps they’ve had a bad experience with an older version. I know that Ubuntu Mobile couldn’t even make calls on a lot of devices for a while. I recently had an experience where DTMF signaling didn’t work, which meant I couldn’t navigate phone trees to do things like get prescriptions filled.

Point being, there are lots of real reasons folks are stuck in their predicament.

The temptation to be snarky is strong, but we risk hurting imperfect allies instead of fighting our real enemies.

Agreed. And someone on this side of the Atlantic with the teeth to bite Apple’s face off when they pull shit like they did with right to repair or not allowing progressive web apps.

“You need to let end users be able to repair your devices.”

“Okay we will sell a $700 repair ‘kit’ and each replacement part is $1000 and also they’re hardware locked to the original device so you can’t reuse older devices for parts. BTW you need our certification.”

Adding on to that:

Obama had only the house for the first two years. The Senate has the filibuster rule which means control takes 60 seats.

On January 20th, 2009, 57 Senate seats were held by Democrats with two Independents (Bernie Sanders and Joe Lieberman) caucusing with the Democrats for 59 kinda’ Democrat-ish votes in the Senate. Two more needed for “both houses”.

Also, that included Ted Kennedy and Al Franken. Kennedy had a seizure basically at the start and never returned to vote. Al Franken wasn’t seated until July 7th, 2009 because of repeated recounts.

So really 57 Senate seats. Three or four more for him to have both houses.

Kennedy was replaced by Paul Kirk in September and three other people swapped parties. So Obama had full control of the House and Senate from September 24, 2009 through February 4, 2010.

Four months.

If you’re looking at that and thinking, “isn’t that when they wrote and passed the ACA?” then you’ve got a good eye and a better memory.