• 0 Posts
  • 31 Comments
Joined 1 year ago
cake
Cake day: June 11th, 2023

help-circle
  • “In general, your GOG account and GOG content is not transferable. However, if you can obtain a copy of a court order that specifically entitles someone to your GOG personal account, the digital content attached to it taking into account the EULAs of specific games within it, and that specifically refers to your GOG username or at least email address used to create such an account, we’d do our best to make it happen. We’re willing to handle such a situation and preserve your GOG library—but currently we can only do it with the help of the justice system.”

    That’s a very fancy way of saying “we’ll comply with a court order”, which is what any business would do.
    This is marketing fluff. DRM free is good enough reason to like them without framing them as fixing literally every problem with steam.






  • https://daniel.haxx.se/blog/2020/12/17/curl-supports-nasa/

    https://daniel.haxx.se/blog/2023/02/07/closing-the-nasa-loop/

    Their process for validating software doesn’t have a box for “open source”, and basically assumes it’s either purchased, or contracted. So someone in risk assessment just gets a list of software libraries and goes down it checking that they have the required forms.

    As the referenced talk mentions, the people using the software understand that all the testing and everything is entirely on them, and that sending these messages is bothersome and unfair, and they’re working on it. Unfortunately, NASA is also a massive government bureaucracy and so process changes are slow, at best.
    The TLAs don’t generally help NASA, and getting them involved would unfortunately only result in more messages being sent.

    As for contributions, I think that turns into an even worse can of worms, since generally software developed by or for the US government isn’t just open source, but public domain. I think you’d end up with a big mess of licensing horror if you tried to get money or official relationships involved. It’s why sqlite is public domain, since it was developed at the behest of the US.

    Mostly just context for what you said. NASA isn’t being arrogant, they’re being gigantic. Doing their due diligence in-house while another branch goes down a checklist, sees they don’t have a form and pops of an email and embarrassing the hell out of the first group.

    The time limit thing is weird, but it’s a common practice in bureaucracies, public or private. You stick a timeline on the request to convey your level of urgency and the establish some manner of timeline for the other person to work with. Read the line again, but extremely literally: “we have a time frame of 5 days for a response”. “Our audit timeline guessed that it would take a business week for you to reply, so if you take longer we’re behind schedule”. The threatening version is “your response is required on or before five business days from the date of this message”.
    The presumption is that the person on the other end is also working through a task queue that they don’t have much personal investment in, and is generally good natured, so you’re telling them “I don’t expect you to jump on this immediately, but wherever you can find a moment to reply this week would keep anyone from bothering me, and me from needing to send another email or trying to find a phone number”



  • Paul Eggart is the primary maintainer for tzdb, and has been for the past 20 years.
    Tzdb is the database that maintains all of the information about timezones, timezone changes, leap whatever’s and everything else. It’s present on just about every computer on the planet and plays an important role in making sure all of the things do time correctly.

    If he gets hit by a bus, ICANN is responsible for finding someone else to maintain the list.

    Sqlite is the most widely used database engine, and is primarily developed by a small handful of people.

    ImageMagick is probably the most iconic example. Primarily developed by John Cristy since 1987, it’s used in a hilarious number of places for basic image operations. When a security bug was found in it a bit ago, basically every server needed to be patched because they all do something with images.





  • Well, I’ll disagree a bit there. The largest stock investors are institutional investors managing funds on behalf of retirement plans. Those investors tend to prefer consistent long term growth over a narrow quarterly growth target, and will actually look at things beyond just stock price, like strategy and long term market prospects.

    Short term thinking from the leadership team is them not having a good idea on how to provide the long term strategy that investors prefer, and instead hoping to appeal to the smaller group of investors who do only care about short term growth so they can secure their own payoff, potentially at the expense of the long term prospects of the company.

    Valve is a corporation. They have shareholders other than Gabe, many of whom are not employed at valve of in their leadership team. Their leadership team isn’t looking to ensure that their paycheck comes in over the future of the company, so they make good choices.
    Compare with companies like Coca-Cola, which are publicly traded but have that long term plan that lets them openly talk about sacrificing revenue to pursue product plans and market growth that leads to more stable long term profits.



  • Totally agree on the sensitive or decisive topics point, but I include a caveat that what some people call “sharing decisive viewpoints in public”, others call “not hiding their gender/sexual orientation”, and similar things, so it’s not always perfectly clear cut.

    I try to avoid being inflammatory in general, anonymous or not, and I’m not perturbed if people know my city, industry, trade, and vague interests. Basically what you could figure out from a polite conversation while waiting in line.

    I’ve got a lot of code up on GitHub, and some of it is absolute garbage. If an employer judges me poorly for sharing my pile of one-off scripts, or “basic human decency and lack of respect for neo Nazis in a casual setting”, then I frankly probably don’t care to work for them.
    Admittedly, other than a script that automates figuring out which web hosts are hosting hate groups, there’s not much political content in my software.

    I do alright, so my system seems to work.


  • I wasn’t actually trying to be contrarian, but okay.

    I’m pretty sure I didn’t explain how it’s actually shareholders, because the board of directors isn’t “the shareholders”, but leadership of the company.

    Valve isn’t publicly traded, but it’s still a corporation with shareholders, a board of directors, and the usual trappings of corporate leadership. They tend to operate in a not shitty way because their leadership isn’t interested in sacrificing greater long term profit for lesser short term profits.
    A private, family owned partnership style business can operate with a focus on short term profits over long term profits.

    The safest way to ensure that the leadership of both of those businesses out as much money in their pockets as possible is to continuously maximize short term profits. “The shareholders” aren’t the cause for that mindset.


  • It’s not shareholders specifically, but management that doesn’t give a shit about the company long term.
    The business has a fiduciary duty to benefit the shareholders, but it doesn’t have to be short term only, or at the cost of long term benefits.

    Most publicly traded companies end up with leadership who are only interested in justifying their employment through the next earnings call or making sure the stock price has gone up between when they last got options and when they next vest.

    Valve does good not because they don’t have shareholders, but because their leadership is not gonna get fired for thinking about next year instead of next quarter. So they don’t squeeze the consumers for every dime, so people stick with them, and developers stay even though their fee schedule is not the best because they have all the people.





  • It’s not a simple task, so I won’t list many specifics, but more general principles.

    First, some specifics:

    • disable remote root login via ssh.
    • disable password login, and only permit ssh keys.
    • run fail2ban to lock people out automatically.

    Generally:

    • only expose things you must expose. It’s better to do things right and secure than easy. Exposing a webservice requires you to expose port 443 (https). Basically everything else is optional.
    • enable every security system that you don’t have reason to disable. Selinux giving you problems? Don’t turn it off, learn how to write rules to let your application do the specific things it needs. Only make firewall exceptions where needed, rather than disabling the firewall.
    • give system users the minimum access they require to function.
    • set folder permissions as restrictively as possible. FACLs will help, because it lets you be much more nuanced.
    • automatic updates. If you have to remember to do it, it won’t happen. Failure to automate updates means your software is out of date.
    • consider setting up a dedicated authentication setup like authellia or keycloak. Applications tend to, frankly, suck at security. It’s not what they’re making so it’s not as good as a dedicated security service. There are other follow on benefits.
    • if it supports two factor, enable it.

    You mentioned using cloud flare, which is good. You might also consider configuring your firewall to disallow outbound connections to your local network. That way if your server gets owned, they can’t poke other things on your network.