@landaire Good point that's actually genius. Would be very interesting to have agents crawl vulns/patches, group and create queries for them. With a massive query DB, hit all OSS repos and have agents triage matches.
@landaire AIs still need tools to efficiently query data while saving on tokens. CodeQL provides this, right?
Just like AI can reverse assembly snippets, but on large projects is more effective paired with Ghidra/IDA to inspect xrefs, CFGs or reason over decompiled pseudocode.
It is, when easily available in manifests/DLLs, but static vendored dependencies in binaries with stripped symbols are often overlooked.
Gets worse as layers increase, e.g. app depending on libA -> libB -> libC. A vuln in libC requires up to 4 independent parties to fix, though those hellish scenarios occur usually in langs with easy dependency management.
Agreed with OP on vendoring. Langs with hard dep management incentivize vendoring, which in turn disincentivizes dep bloat, and reduces exposure to vulns.
Probably no special meaning. In such moments (sometimes very brief), the brain send unable to "fix" the magnitude of any dimension of a mental image (in extreme cases, real life objects too).
Objects feel simultaneously large/small, close/afar, full/empty, bright/dark, loud/silent, etc.
This "jitter" induces discomfort. Not sure what causes it. For me, it's a bad fever. For some, drugs. Not terrible but still pathological, as if some function is "degraded".
@foley2k2@unix_byte That would very quickly exhaust the TLB. Also, while slightly less wasteful, you would need to dedicate more memory to page table entries. Many trade offs, but 4~16 KiB seems indeed the sweet spot.
"Have a responsibility"? Haven't you read the NO WARRANTY section of LGPL v2.1? https://t.co/3MIyQZIXuF
The current ffmpeg team out of good will chooses to act promptly and fix vulnerabilities, but that's not a requirement. If you run a business around it and host (say) customer PII, *you* are liable. Not a take, just law.
If you consider it "Linux", GrapheneOS seems (for now) the closest we'll get to the year of Linux on phones.
Any non-AOSP Linux alternative will struggle with adoption because of heterogeneous hardware/libraries and lacking ecosystem (apps).
We wouldn't have a major privacy-oriented browser like Brave if @BrendanEich built outside Chromium. For the same reasons, OSS phone distros need AOSP.
@PetrBenes@komercka If enough people change their scribble "signatures" to dicks, maybe it would finally sink in that they are a joke, just like the banks/governments requiring them.