• 0 Posts
  • 36 Comments
Joined 2 years ago
cake
Cake day: August 4th, 2023

help-circle


  • The binary executable for Fossil is a single file (repos are also single files, sqlite databases). That one executable does all the VCS functions but it also has a built-in web server that will host repos as a little customizable website. That’s how you access the wiki, chat, forums, and ticketing system. You can also configure the repo, view timelines, view code, and all that stuff.

    One can set up a proxy and publicly self-host the repo over the internet. That’s what the official fossil site is, a hosted repo of it’s own source code. I didn’t feel like setting up a local web host, an ngnx reverse proxy, figuring out vpn for remote access, etc etc. So i just use synching and only run locally, because it’s easier for me.

    That’s another nice thing about fossil, it’s quite flexible and can grow with the needs of the project.


  • I love Fossil and use it for all my personal projects! I use syncthing to keep my all my repositories updated across devices and it works great!

    I do wish I better understood either self-hosting or that there were more web hosts though, it would make collaboration easier when I feel like sharing. A git(hub) bridge could do it too I guess…



  • Remember when Humble Bundle was actually a charity and not just a charity-themed storefront owned by IGN?

    Well, technically owned by IGN, a subsidiary of Ziff-Davis, formerly J2 Global, formerly Ziff-Davis.

    I’m sure firing what was left of the employees with any commitment to the concept of HB and folding the brand under the rest of your e-commerce verticle will have no further adverse effects on the quality or usability of HB as a service.




  • But then I decided, I wrote my own solution, a thing of 1,600 lines of code, which is, yeah, it’s like thousands of times less than the competition.

    And it works. It’s very popular. … I got 100 emails from people saying that it’s so nice that someone wrote a small piece of software that is robust, does not have dependencies, you know how it works.

    But the depressing thing is, some of the security people in the field, they thought it was a lovely challenge to audit my 1,600 lines of code. And they were very welcome to do that, of course. And they found three major vulnerabilities in there.

    He makes a ton of excellent points, but the succinct impact of this little example really hit for me. As someone who often rewrites things so that I can both understand and fully trust in what I’m depending on, it’s always good to be reminded that you literally can’t write 500 lines of code without a good chance of introducing a major vulnerability.

    The tech stack is so dizzyingly high today, and with so many interlocking parts, it continually amazes me that anything at all functions even in the absence of hostile actors.


  • I’ve gotten back into tinkering on a little Rust game project, it has about a dozen dependencies on various math and gamedev libraries. When I go to build (just like with npm in my JavaScript projects) cargo needs to download and build just over 200 projects. 3 of them build and run “install scripts” which are just also rust programs. I know this because my anti-virus flagged each of them and I had to allow them through so my little roguelike would build.

    Like, what are we even suppose to tell “normal people” about security? “Yeah, don’t download files from people you don’t trust and never run executables from the web. How do I install this programming utility? Blindly run code from over 300 people and hope none of them wanted to sneak something malicious in there.”

    I don’t want to go back to the days of hand chisling every routine into bare silicon by hand, but i feel l like there must be a better system we just haven’t devised yet.





  • What people should be worried about is Meta (or anyone) trying to extend the AP protocol with proprietary stuff or trying to create fake regulations around their own “standards.”

    You see this today with Gmail, where even though you can host your own email server, most major services (like gmail) will autoblock you as a spammer. Even though email is an open federated protocol, it’s become captured both by big business and failures in the protocol (to prevent spam and abuse).

    AP and the fediverse are maybe more resilient than that. And existing fediverse servers seem to be somewhat diverse and figuring out ways to pay for hosting. That will be the biggest danger is that Threads becomes a default choice due to: low/no cost to join, good uptime, and lots of people you know.

    But I think the rest of the fediverse will be around for a long time yet, it’s only really just started to take off!






  • I finally got around to beating Doom Eternal’s DLC, which I often found more of a grind than entertaining (some of the Ancient Gods fights just go on and on, and I hated the final boss.)

    Then I started on Turbo Overkill, which does have a lot of Doom’s DNA but the pacing is a lot more fun so far! Been trying to get back into Hitman (3+2+1) as well.

    But mostly I spend a shocking (to me) amount of my quick gaming time on Xenotilt: Hostile Pinball Action. I did not expect to get so completely absorbed into virtual pinball (been meaning to post about it on the pinball communities) but little by little I’ve been getting better at it. My current high score is only 1.2 billion, which feels good to get into the billions club but the ceiling is still so much higher!