• 4 Posts
  • 365 Comments
Joined 3 years ago
cake
Cake day: June 14th, 2023

help-circle













  • Larger standard libraries do a lot. It’s a lot harder to sneak vulnerabilities into the basic C# or Java or C++ libraries than it is to add a vulnerability to something one dude maintains in the javascript ecosystem.

    And since javascript libraries tend to be so small and focused, it’s become standard practice for even other libraries to pull in as many of those as they want.

    And it stacks. Your libraries pull in other libraries which can pull in their own libraries. I had a project recently where I had maybe a dozen direct dependencies and they ended up pulling in 1,311 total libraries, largely all maintained by different people.

    In a more sane ecosystem like C#, all the basics like string manipulation, email, or logging have libraries provided by Microsoft that have oversight when they’re changed. There can be better, third-party libraries for these things (log4net is pretty great), but they have to compete with their reputation and value over the standard library, which tends to be a high bar. And libraries made on top of that system are generally pulling all those same, certified standard libraries. So you pull in 3 libraries and only one of those pulls in another third party single library. And you end up with 4 total third party libraries.

    Javascript just doesn’t really have a certified standard library.

    (This certified standard library doesn’t have to be proprietary. Microsoft has made C# open source, and Linus Torvalds with the Linux Kernel Organization holds ultimate responsibility for the Linux kernel.)





  • I understand the intent, but this is not phrased well.

    prevents your messages being spied on by Signal, but ironically they’re probably one of the most trustworthy actors in this whole chain, so the fact that it’s protected from them, while commendable, is not particularly valuable security

    It’s extremely valuable security, because most companies, even if they don’t want to spy on you might be compelled to by court order. And those companies often think their security is sufficient because they have good intentions, and they expect the government to have good intentions when they’re going as far as getting a court order. (I also suspect more court orders are justified than not, but a few bad subpoenas spoil the bunch.) The fact that they physically are unable is quite important.

    All your points about how things around that can fail are valid.


  • I will say that double posting is a completely reasonable solution. More orgs should be the gateway where they can be seen, and have the visibility of the big platforms, but they also offer Mastodon as an alternative. If enough orgs do that, it enables people to just… move.

    It’s hard for users to move when 75% of their content is exclusive to X. And it’s hard for orgs to move when 75% of the users are on X. Double posting allows this to move to 10% X exclusive content, 60% content that’s available everywhere, and 10% exclusive to open platforms. After the orgs move the content, it’s so much easier for users to move, and after the users move, it’s easier for the orgs to move.

    This should be a cooperative thing. And afaik it doesn’t take that much effort to post the content to two places.