WingNews logo WingNews GitHub [2]

nyan4's comments

nyan4 | 9 years ago | on: Researchers crack open malware that hid for 5 years

How about a FLOSS archive that provides peer-reviewed and signed application from a trusted source only? Automated security updates? A security team that can provide fixes independently from the upstream authors?

...because I just described how Debian worked for the last 20 years.

nyan4 | 9 years ago | on: Go Packaging Proposal Process

The two are very connected. Yet, even with dynamic linking, the libraries could be always and only bundled with the application, and the application could be designed to work against the bundled versions and not even tested against other versions. On a practical level this makes it extremely expensive to perform updates.

nyan4 | 9 years ago | on: Go Packaging Proposal Process

...until the unfortunate end user that needs to run tenths of systems runs in a security issue. Then the admins cannot possibly learn how to fork, patch, rebuild, test, deploy in 20 different languages. And they cannot rely on security updates from Linux Distributions because they installed vendorized code blobs.

nyan4 | 10 years ago | on: Alert: NPM modules hijacked

> And people wonder why big enterprises are scared of touching open source stuff.

some open source stuff. Most enterprises dig distributions, especially with LTS.

nyan4 | 10 years ago | on: Alert: NPM modules hijacked

This is a decade old lesson, well understood by few developers that want their code to be around for a while.

The HN "web developers" are a different crowd.

nyan4 | 10 years ago | on: Exploring Rust (from C#)

This criticism usually comes from people that do not use Nim. I was very surprised as well at first - now after 1 year of using Nim I realize I never run into any trouble because of case/underscore insensitivity.

#1: those variables have to be in the same scope or be procs working on the same types to be an issue.

#2: I don't use nimgrep, I just keep a consistent style across my files. When reading somebody else's code, case-insensitive search is usually enough.

nyan4 | 10 years ago | on: I've Just Liberated My Modules

A lot of people like to think that software fragmentation comes without any drawback. Having many tiny libraries and/or multiple versions hurts in the long term.

nyan4 | 10 years ago | on: I've Just Liberated My Modules

> Recursive dependency resolution is nice and all but isn't this going to create a massive technological debt that needs to be maintained?

Spot on. Imagine deploying an application, in 2018, that pulls down 1000 libraries, 300 of which are 6 years old versions and contain vulnerabilities (or just bugs) involving data on transit. Who is going to do all the work to backport fixes in every affected version of each library?

page 1
more