i see you’re replying to the joke comments but ignoring the ones posted many hours earlier which helpfully explain what is wrong with the premise of your post (eg, this and this and this).

red alert klaxons, or something else from a star trek sound bank like this

AUR is bad, actually

But why rewrite programs that existed for decades and have proven their stability and safety? Rewriting them to Rust won’t make them safer, it will just introduce the kind of issues original versions have got fixed long ago.

Of course rewriting them will introduce some new issues, but it will also eliminate classes of bugs from which there are definitely still a great many in old “stable” C code (bugs which are now being discovered and will presumably continue to be discovered at a much faster pace due to LLMs).

The whole project is about abolishing GPL. And Rust is just an excuse.

I don’t think it is just an excuse; I believe that improving security is also a goal… but removing GPL code is clearly also part of their motivation :(

No, it is not a good time. A project like Ubuntu should now be in freeze as they had about 3 months before release

This bug was reported (and resolved by rolling back to the GNU coreutils version of cp) on June 30, a little over 15 weeks prior to the scheduled release date.

Which distros have a feature freeze that far in advance?

Ubuntu hasn’t even scheduled theirs for this release yet; if you edit that url to look at previous releases’ schedules you can see their feature freeze and debian import freezes are typically about 2 months prior to release. (See here for descriptions of all of the different types of freezes…)

What an absolute shitshow

I’d say the month of June is actually a good time to be breaking and fixing things in a release that is due to come out in (checks notes) October.

see also previous thread in this community on this topic from a month ago

For each participant, Dialog logs a membership status, every retreat the person has attended, a biography, a home city, and a private access token. WIRED is not publishing the tokens, which function as login credentials, or the personalized account links that contain them.

This is an odd thing to say given that neither Wired nor their source (“the Swiss hacktivist maia arson crimew”) appear to be publishing any of the actual data whatsoever, beyond the handful of mostly nonspecific references to it in the article text. (Eg, lots of sentences like “The website directory names sitting Trump administration officials, two US senators, six members of the Paypal Mafia, a former Middle East chief of intelligence, and a sitting ambassador to the United States, along with the founders and directors of many of the country’s largest surveillance, data-broker, and advertising-data companies.” - omitting names of any of these people.)

Also, the linked archive says:

Update 6/16/2026, 5:47 pm EDT: WIRED updated this article to correct a conflation of two people named Jeff Epstein. A small revision was also made to address a security concern raised by a Dialog representative.

Someone helpfully had already made an earlier archive before that, so we can see what information Wired journalists Dell Cameron and Yulia Almazova removed at the request of a Dialog representative: where it now says “The retreat is scheduled for August 12-16 at a venue near Dublin” it originally said “The retreat is scheduled for August 12-16 at the Powerscourt Hotel outside Dublin”.

tuta is (like proton) snake oil. (here and here are two of my old comments about why…)

Mailbox.org lets you keep your own private key.

Every email provider lets you keep your own private key if you do encryption using the interoperable OpenPGP standard using software running on your own computer. Many email providers will recommend that you do exactly that, and will helpfully instruct you about how to do so (eg, the more reputable options in this thread such as migadu.com, mailbox.org, posteo.de, and even fastmail.com all have instructions for how to use some implementation of pgp to encrypt your email).

Meanwhile any company selling non-standard “email encryption” (eg, proton and tuta) which is not pgp-compatible (or, in the corporate world, s/mime is admittedly also a standard…) is firmly in the snake oil business and should be distrusted and boycotted regardless of which shitty youtubers they’re sponsoring this week.

Companies now block older browser versions

Now? This has been happening since the dawn of the web. At least the screenshot you pasted represents all of the big three rendering engines - it used to be common to see “Internet Explorer version XYZ required”, sometimes with javascript to prevent you from using the site with any other browser (even if in some cases it would actually work fine if you simply spoofed your user agent string).

I have used kinda retro devices to surf the web at times

Most websites became HTTPS-only sometime after the snowden disclosures in 2013.

Over time old versions of TLS have been deprecated and eventually support for them is dropped from browsers and web servers alike. So, a browser from even 15 years ago literally cannot connect to most webservers today.

Planned obsolescence is terrible but it’s a minor factor here: it’s actually dangerous to use even (especially?) a slightly-out-of-date web browser because every new release fixes vulnerabilities which can be exploited to run malicious code on your computer. The planned obsolescence which prevents people from being able to have an up-to-date browser comes mostly from proprietary operating system vendors; to have up-to-date software while continuing to use somewhat older computers you need to use free/libre software.

One shot rewriting the whole test suite

tridge’s blog post makes it clear that this was not “one-shotted” at all.

You should read the whole thread

I regret reading it; I’ll assume in good faith that it wasn’t LLM generated but it is ironically as confidently wrong as if it were.

It almost (and should have) lost me when it started by quote-agreeing with someone else saying “rsync was basically done until the maintainer discovered vibecoding” - no, pay attention, it was not “basically done”, there were/are a mountain of CVEs!

But then this got my interest:

This does not “translate tests into pytest” or a unit testing framework, it writes its own testing framework where tests are whole python scripts that redefine basic test functions in every script. Surely there would be a single way to “run rsync and get the results” - nope, well, there is, but then every test file will randomly redefine its own _run_and_capture function.

tridge says he has used pytest on other projects and had good reasons not to use it here; I’m inclined to believe him.

But the notion of every test defining its own way to invoke rsync sounded like a valid criticism, and an easy one to verify, so I checked: It turns out that there is in fact a common run_rsync function which is used by the majority of the tests. One test defines its own _run_and_capture function (which differs in that it writes the output to a file, for reasons I didn’t investigate), and it looks like a few others invoke rsync other ways, but the majority of them use the common function.

So, that rambling thread’s sole concrete criticism of rsync’s new python tests turns out to be false.

The 2021 paper OSRM-CCTV: Open-source CCTV-aware routing and navigation system for privacy, anonymity and safety says they published source code at https://github.com/Fuziih but I don’t see it there now (though there is a related project called cctv-exposure).

The final published version of the paper seems to be paywalled; it’s probably on scihub but there is also a preprint of it here on arxiv.

https://github.com/FNBIP/ghost-route (just 3 commits, from February this year) says it is inspired by the paper and “extended to a production-grade multi-mode threat routing system”. It’s a node app you run locally (there doesn’t appear to be a public instance currently) which would be nice if it could work offline but unfortunately “Offline mode with pre-downloaded OSM tiles” is still on the roadmap and it currently lists “A Mapbox GL JS token (free tier works)” as a requirement (which is probably why there isn’t a public instance - someone would need to pay mapbox if they wanted to run it for other people).

I have not tried it; if anyone reading this has or does please post here about how it works!