Eric Stokes

Claude code's secretary

[Eric Stokes @eestokesOSS]

Graphix now has a web site

https://t.co/7NC4Ykpjkb

[Eric Stokes @eestokesOSS]

@CDoombeard And TBH it's probably working

[Eric Stokes @eestokesOSS]

crate libgssapi 0.10 released with 5 soundness fixes that were triggerable from safe code found by Claude and Codex. AI Securmageddon continues.

[Eric Stokes @eestokesOSS]

This is brutal for a library this old. I thought I was good at this 🤣

- SOUNDNESS: Oid is now Oid<'a>, tracking the lifetime of its BER bytes.
OIDs borrowed from an OidSet can no longer be copied out and used after
the set is freed. Pre-defined constants and gssapi-returned mechanism
OIDs are Oid<'static>. Add `assume_static` and `from_raw_desc` (both
unsafe) for the rare cases that need them.
- SOUNDNESS: removed the safe `From<gss_cred_id_t> for Cred` and
`From<gss_OID_desc> for Oid` conversions. Use `Cred::from_c` /
`Oid::from_raw_desc` (both unsafe) instead — wrapping a raw handle is
not a safe operation.
- SOUNDNESS: dropped `Sync` from ClientCtx/ServerCtx. GSSAPI forbids
concurrent use of a single security context; share via Mutex if needed.
`Send` is retained.
- SOUNDNESS: removed `DerefMut` for GssIov (stream unwrap_iov can alias
buffers); use the new `unsafe fn as_mut_slice` when you need mutation.
- SOUNDNESS: fixed a dangling pointer where an Oid passed by value to a
mechanism argument could be dropped before the FFI call read it.
- BUGFIX: Cred::store wrote its outputs into stack temporaries, so it
always returned an empty OidSet and CredUsage::Both. It now returns
what gssapi actually stored.
- BUGFIX: GSS_NT_ANONYMOUS had a wrong BER encoding (an invalid `\01`
escape produced 7 bytes instead of 6). It is now 2b 06 01 05 06 03.
- BUGFIX: ServerCtx/ClientCtx flag handling no longer discards all flags
when gssapi returns an unrecognized flag bit.
- BUGFIX: the wrapper no longer fails to build against Heimdal. It named
MIT-specific struct tags (gss_name_struct, gss_cred_id_struct) to spell
null handles; it now uses the portable handle typedefs, which both MIT
and Heimdal provide. The s4u feature remains MIT-only (Heimdal has no
gss_acquire_cred_impersonate_name / gss_store_cred_into).
- API: OidSet no longer implements Index; use `OidSet::get(i) -> Option`.
`OidSet::new` is now infallible (returns OidSet, not Result), wrapping
GSS_C_NO_OID_SET until the first `add`.
- API: SecurityContext inquiry methods (info, source_name, lifetime,
mechanism, flags, local, open, etc.) now take &self instead of &mut self.
- API: methods that took `&Oid` now take `Oid` by value (it is Copy).
- BUILD: new LIBGSSAPI_IMPL env var (mit|heimdal|apple) forces the
implementation, overriding autodetection. Useful when both MIT and
Heimdal are installed and the probe order would otherwise pick MIT.
- BUILD: new LIBGSSAPI_PREFIX env var (colon-separated install prefixes)
adds <prefix>/include to bindgen and <prefix>/lib to the linker, and is
searched during autodetection. Replaces the old recursive `find` over
the system lib dirs, which has been removed in favor of a cheap
non-recursive check.
- Switched to edition 2024 with #![deny(unsafe_op_in_unsafe_fn)].
- Added a local integration test suite (tests/test.sh) that runs against
both MIT and Heimdal, plus pure-Rust tests under Miri.

[Eric Stokes @eestokesOSS]

It's amazing how many soundness problems AI can find in the safe interface of a carefully thought out rust -&gt; c binding like libgssapi. Big 0.10 release incoming. AI securitymageddon is real.

[Eric Stokes @eestokesOSS]

@Devon_Eriksen_ Those of us (genX) who actually did well should prepare to bend over after the boomers die off as a voting block

[Eric Stokes @eestokesOSS]

Historically software engineers have been wildly optimistic in their time estimates. Claude has decided to fix the average.

[Eric Stokes @eestokesOSS]

When you can do 80% of every project you ever dreamed of in a few prompts, it's so easy to end up with 5 desktops full of unfinishable ambition.

[Eric Stokes @eestokesOSS]

@carlrichell How can they even post publicly about this. When your latest OS is missing a feature windows 95 had, you just add it an hope no one noticed it wasn't there before.

[Eric Stokes @eestokesOSS]

@Devon_Eriksen_ Don't say model collapse

[Eric Stokes @eestokesOSS]

@AgustinLebron3 Simple solution, you have two choices, learn them now, or hold out your hand for the ruler. I wish someone had given me that choice.

[Eric Stokes @eestokesOSS]

Google buys a minority stake in EVE Online to use the historical data to train AI. You just can't make this shit up.

[Eric Stokes @eestokesOSS]

@FrameworkPuter @i2cjak Keep the battery and call it a plug in hybrid 😂

[Eric Stokes @eestokesOSS]

@AgustinLebron3 Your best option to achieve this is to replace your coffee creamer with whiskey

[Eric Stokes @eestokesOSS]

That's the big one, blank gray screen on wake from sleep, try explaining to a less technical user that now you have to switch VTs and kill cosmic-comp.

Other issues include, cog icons for launched apps instead of the app icon, duplicated windows for xwayland using apps (electron should die, but ... we all know it won't). Plus you can't print from cosmic-edit. It's all small stuff, but when you don't know how GUIs work in the first place it can be very confusing. My wife is one of the three people on earth who has learned bash, but still isn't quite sure how to use a mouse.

That said, I too am a big fan of Cosmic, and for it's age it's quite stable, and feature complete, but there are still papercuts compared to KDE.

[Eric Stokes @eestokesOSS]

@esrtweet I do use snapper, and I have grub set up so I can reboot into a previous snapshot. Not to mention home dir snaps directory every hour, which is awesome.

That said, so far, I've never actually had to use it to recover from a broken update

[Eric Stokes @eestokesOSS]

@esrtweet Do it! I did it 6 months ago and I have not looked back once. I'm considering switching my wife's machine now as she keeps hitting cosmic papercuts and KDE is just so good these days.

[Eric Stokes @eestokesOSS]

@AutismCapital cannibalism

[Eric Stokes @eestokesOSS]

@esrtweet @heatloss1986 It's almost as if playing thousands of simulated naval battles for fun yields deep strategic insight on par with professionals. That couldn't really be the case though right 🤣

[Eric Stokes @eestokesOSS]

@serpentza People like it when things are cheap right 🤣

[Eric Stokes @eestokesOSS]

@mbacarella @shaunmmaguire Are you kidding me. Look at tax raised as a percentage of GDP under the two systems. The government was extremely small when funded by tariffs, the income tax is what allowed it to grow into the current leviathan.