This describes my life as an open source maintainer at the moment!
In the first 10 years of the rclone project we received about 20 security disclosures through GitHub. We had to deal with over 40 in the last month! That has taken a huge amount of my time, even using AI tools to triage and come up with fixes for review.
The hit rate for those security disclosures is pretty good - about 75% of them have a nugget of something which needs looking at. The configurations for rclone have got increasingly unlikely so I'm hoping they will dry up eventually.
I was considering just merging the fixes straight to master just to make my life easier rather than holding a dozen independent security fixes on branches and merging them at the point release and hoping not to have too many conflicts to fix up. I've decided to stick with the process for the moment.
GitHub assigns CVEs for the advisories. Before the AI apocalypse they took 2-3 days for an assignment but now it they are running at 3-4 weeks so I have to send the point releases out with CVE-PENDING in the changelog which isn't ideal.
Not sure what the solution is, but it is definitely a problem for us.
I came across rclone at work because "Copy or move data to Azure Storage by using AzCopy v10" is a lie, it literally can't `move` files, only `copy` them.
I can't express in polite words how pathetic it is to see the only official blob storage bulk transfer CLI tool from a multi-trillion-dollar company fail to do the simplest, most essential functionality after ten major revisions.
Right? If you move between file system or device I would expect "move" to be impossible. At best you could copy a logical block and then delete a logical block. If you share a filesystem then perhaps a logical block is a few hundred kilobytes. If you don't then I'd expect the smallest logical block to be the file itself.
Right! When I wrote that I made a mistake and thought that there were filesystems that used multiple drives but still had the meaningful distinction of "what drive is that file on?"
Like, yeah, RAID, several drives, one filesystem, right? Except no, because it's just one virtual device.
I can’t comment on if it applies to your workflow, but one process I’ve used is to aggregate and land ~10 security patches at a time. Eg,
- grab a group of (related) bugs/defects/vulns
- fix them on a branch like bug-batch-XXX
- run that group through the verification, landing in main, CI/CD flow to amortize process cost
- repeat as needed to process backlog
My experience is that process often has irreducible time (eg, two days due to reviews by various parties); but that time slot can be shared between several bugs in a single PR — especially if you have several related to the same feature.
Possibly some sort of ai agent code review system that churns through code looking for these vulns before the code is published. It feels like it's all about who has the resources to find bugs at the moment but that it should be a standard to catch issues before prod moving forward..
Yea, AI bug finding over entire projects, at least on SOTA models is super expensive, hence those with the resources setup to find the most bugs in an automated way.
That said there are a number of people and companies working on more focused means of driving the LLM to look were bugs would be the most dangerous and in doing so reduce the token spend of each bug found.
In some ways the better you are at security stuff the more you can reduce your spend by better driving the LLM to problem spots.
Same with some of the projects I maintain. The reports came in for one project over a few months and then once those dried up, and they did become increasingly unlikely or appear to be edge cases, the reports started to accumulate for another project.
Great to get these issues addressed but it's exhausting.
I feel like someone somewhere is working on an opensource GPU compute resource pool you guys could pull from as part of a donation type framework. I got a bunch of local gpu resources just relaxing, and if I could load up a a binary to provide compute for X hours a day overnight or whatever, that'd be cool.
http://github.com/buzz/block is quickly becoming a reasonable approach to shared agent compute, though it's still a bit more hands-on than the older 'compute donation' projects like SETI or Folding@Home.
> GitHub assigns CVEs for the advisories. Before the AI apocalypse they took 2-3 days for an assignment but now it they are running at 3-4 weeks so I have to send the point releases out with CVE-PENDING in the changelog which isn't ideal.
A strange bottleneck; anyone know why that would be so slow?
As mentioned by another commenter, they intentionally have a human reviewer in the process before a GitHub Security Advisory (GHSA) becomes "official" post-publish
(this is separate to getting CVE ID assigned, if wanted)
Thank you for the insight! Are you going back to the changelog and editing the CVE-PENDING? I think this would be a justifiable edit of the release history that I'm not sure is possible on github.
You can add CVE info later in a git note, if you want something git-managed to point to it. Might take some habit-tweaking to include notes in log output though, to see them later.
I was looking at the reed Solomon implementation. I've done a few of those in the past! I note that you are using logs for multiplication. I always used to use a 64kb table for direct lookup, though maybe that isn't faster on modern processors?
Interesting. I'll have to give it a try. If I understand your suggestion, you're saying that rather than doing 2 lookups for logs, then an addition, and then another lookup to exp back, we could just precompute the whole thing for any 2 arguments and do one lookup in a table? It's worth noting that some of the operations already use the mul_log format which just does an add with wraparound, but I could certainly see the big table option helping when we truly need field.mul
As far as LDPC, I'd love to, but I need to get a better understanding of them first. I'll probably go for Turbo next just because conceptually they feel closer to the convolutional codes I have already. But time willing, it'd be fun to do both.
I used and developed software for RISC OS for many years and it was there I cut my teeth as an open source developer.
I wrote the very popular !Director application which let you customize your Desktop and add lots of nifty shortcuts. It could be expanded with BASIC plugins to do just about anything! It was distributed by the Arcade BBS to start with then Acorn User magazine put it on the floppy disk that came with the magazine.
Amazingly Director was written entirely in ARM assembler (with the help of lots of macros). I used to really enjoy writing ARM assembler and used to grit my teeth whenever I had to read the assembly output of the C compiler! I remember writing quicksort in ARM assembler as part of this (to sort menu entries) which was a lot of fun.
I still have a RiscPC under my desk, but I don't think I've turned it on for nearly 15 years :-(
32bit ARM remains my absolute favorite instruction set. And yeah, C compiler output was criminal! I wrote products entirely in the BASIC assembler. What a time to grow up!
I went down a rabbit hole a few summers ago and I ended up writing a calculator from scratch in assembly for RISC OS. Interesting experience having GUI routines at the syscall level
I have a RiscPC in the shed and a half-repaired A3000. I don't fire them up them often, but both have !Director launching on boot; it is a wonderful program. Thanks!
[after a pretty scathing review which I mostly agree with]
> Despite all this, the release of The Odyssey is still an event to celebrate. In what we are told is the streaming era, this epic is bringing audiences back to cinemas. In what we are told is a time of declining literacy and the ‘death of the humanities’, translations of The Odyssey, including mine, are flying off the shelves. Some of those who buy the book or show up in cinemas to watch Tom Holland may go on to study ancient Greek. Perhaps the film will persuade a few college administrators not to cut their literature, language and history departments. Nolan, who studied English at University College London – where students still study The Odyssey as a first year ‘foundational text’ – is doing his best to get the general public reading again, and I am grateful.
> "doing his best to get the general public reading again"
This seems very detached from reality. I very much doubt that many people seeing a movie like this will think "oh, I should read The Odyssey", or "I should read more." And most people who try the former are unlikely to get very far.
The author recently published a retranslation of the Odyssey, that has rocketed to the top of best seller lists thanks to the movie. I'm sure her bank account provides her plenty of direct evidence that this is happening.
“ Nevertheless, Wilson acknowledged the impact the film is already having on cultural awareness of ancient Greek literature as well as cinema itself. Saying “the release of The Odyssey is still an event to celebrate,” she suggests: “This epic is bringing audiences back to cinemas … translations of Odyssey, including mine, are flying off the shelves … [and] perhaps the film will persuade a few college administrators not to cut their literature, language and history departments.”
It reminds me of the recent claim about how AI is resulting in a booming job market for philosophers. Then when you look at it, it turns out single-digit numbers have been hired at Anthropic and OpenAI, and that’s about it.
The point is it’s unlikely to have some sort of significantly or lasting cultural impact, any more than say “The 300” or “Beowulf” or “Gods of Egypt” or any of the other quite long list of such movies did.
That was never to be the majority of the audience, but enough to keep the flame alive.
A lot of them will criticise the movie from departing from a text they never read, that they never understood the historical context. They’ll criticise it from being based on a relatively recent adaptation by a female author, which, BTW, is the author of the article. They will criticise not because they see a flaw in something, but because that’s their nature: in order to see themselves as sufficient, they need to see all others as lacking.
Nope, they want shared artifact(s) between web and desktop (not sure what do they have in mobile apps) clients (Chat/Cowork/Code/CC-cli), so TS is the way to go. It’s a reasonable choice made by engineers.
I had a look through the code to see how it manages not to use a pile of C libraries with cgo like other Go GUI libraries.
The answer is platform dependent:
Windows loads the relevant DLLs by hand and calls them. This is a well established technique in Go programs and due to the super stable DLL interface works well.
Linux has an x11 and Wayland backends and these implement (through a library) the wire protocols directly in Go which is nice and will make cross compilation and distribution easy.
macOS does appear to use cgo to access the cocoa libraries. macOS doesn't like statically linked Go programs anyway though as they don't use system name resolution so this isn't a bad compromise, but will mean macOS stuff needs to be built on macOS I think.
I didn't see Android or iOS support.
A nice innovative approach to GUI building. Since the lowest common denominator for the backends is an RGBA buffer, this will bypass all accessibility things the OS provides.
The above gleaned after a few minutes reading the source so may not be 100% accurate.
Theres is another new project which does NOT rely on CGO https://github.com/gogpu/ui Its basically the whole WebGPU implemented in Go. Theres also Gio, but not sure if its still active. CGO is a huge pain…
> Mobile is under consideration (no decision yet). If it is supported, it will be limited to utility-style apps — not games or rich multi-touch experiences.
No Multiple Windows so even desktop apps will be limited to "utility-style apps".
I compiled and ran the process_monitor example on linux: it works, compiles fast and is about 10mb. Also cross-built for windows and it's 8.4mb. Can't build for macos/arm64
(Under wine the windows exe doesn't render text. weird.)
One of the disappointing realisations I got from my physics degree was that as you move into the real world with non-spherical cows you can no longer solve any of the equations.
It is a worthy winner in my opinion. Fantasy with a sci-fi element along with a story which takes some untangling. Five stars from me :-)
reply