Unmaintained code is a security issue in of itself, so this is of course a net benefit.

This can be accurately generalized: code is a security issue in and of itself.

That’s reductionism, not generalization.

Generalizations that lose accuracy are not valid. “Ice cream is sweet, and candy is sweet, so food is sweet” is reductive.

Now if only I could get the product team to fully understand that implication.

The website of this blog and their connections listed are a sight to behold. I miss that version of the internet.

As long as it's not hydrofluoric acid...

I have an experiment at work that is generating gaseous hydroflouric acid at 800 degrees F. It's inside a triple containment system that takes a full day to set up and take apart, and we have all sorts of quality checks to validate that it is safe to access and has been fully titrated after the experiment has run. We accidentally ruined a very expensive ion chromatography machine a few weeks ago... Acid gasses are just no fun to work with.

I bought a light HF acid (rust remover) so I can properly clean titanium parts before anodizing. Worked like a charm...

just don't let any of it get on your skin. only takes a splash to land you in intensive care.

FreeBSD works perfectly on intel MacBooks if you've got one laying around: https://joshua.hu/FreeBSD-on-MacbookPro-114-A1398

From the link: "Note: The inbuilt WiFi chip is not natively supported by FreeBSD, so you will need to (temporarily) use a USB WiFi or Ethernet dongle, or (as I will explain) copy some files from a different system to the Macbook. You could also just transplant a different chip into the system."

You say "works perfectly". I do not think it means what you think it means.

To be fair, Linux also has trouble with the Broadcom chip, the driver needs to be installed as a separate step on most distros.

I assume this is what is meant:

                       | Works Perfectly | Mostly Works | Has Lots Of Bugs
    -------------------+-----------------+--------------+-----------------
    Default Install    |                 |              |
    -------------------+-----------------+--------------+-----------------
    With Add-Ons       |       X         |              |
    -------------------+-----------------+--------------+-----------------
    Major Config Work  |                 |              |

i.e. Declare its working quality after the install is done. The install may take multiple steps. (In this case, copying some files over, apparently.)

> Broadcom

Here's the real problem.

It's sad how a company that spawned the raspberry pi in earlier times got so evil so quickly.

Broadcom (and to a lesser extent, Realtek) devices had always been anywhere between hit-or-miss and completely unworkable on Linux, LONG before Raspberry Pi came around.

My experience too. Sometimes I did manage to eventually get their cards working under Linux after pulling some proprietary firmware blobs.

Every Raspberry Pi ships with a closed source OS, ThreadX, that boots Linux, BTW.

It's MIT licensed now, which isn't particularly useful when it comes to Pi (there's some Broadcom crap in that boot loader so it won't be open sourced) but otherwise is kind of interesting.

https://github.com/eclipse-threadx

RaspberryPi Foundation spawned the raspberry pi and used a Broadcom SOC.

I always saw Broadcom as evil, and saw Raspberry Pi as just reusing cheap parts from set top boxes or similar, with all the proprietary stuff that that comes with.

I imagine that is because modern Broadcom is a different Broadcom, Avago bought and took the name in 2016.

I think the intersection between BSD users and people who will buy a dongle or use Ethernet is a perfect circle.

> You say "works perfectly". I do not think it means what you think it means.

Copying some files from a different machine is not that burdensome. The point is, it works.

By that logic, every piece of software ever made can be said to work perfectly in every situation, because there is always some amount of additional work which could be done to make up for its native deficiencies.

That's quite the leap. The work is already done, they just can't/won't ship the driver in base, right? Isn't it comparable to installing Debian and needing to load in non-free drivers separately?

I was mostly objecting to the "perfectly" part. And I couldn't resist making a Princess Bride reference for amusement.

Probably not T2 MacBooks though.

Those barely work with Linux.

And I have found the WiFi to be incompatible with some networks.

> Also, a note to those who make fancy "me+someservice@somedomain.com" addresses:

Just wait until one of these companies demands an email from the registered email address of your account!

My email provider allows me to send from + email addresses, just change the from header.

Ah, finally catching up to ... The UK, Australia, Ireland, France, the Netherlands, and probably a lot more.

  こすり箸 Kosuribashi:
 To rub waribashi (disposable chopsticks) together to remove splinters.

I don't know about Japan, but everybody does this in Taiwan.

> I don't know about Japan

It is definitely not appropriate. If you break the chop sticks and use them correctly your fingers will never touch the surface where there are splinters.

I always do it under the table; something I instinctively do without ever being told to. Now I wonder if I might have picked up on nonverbal cues at some point in the past. If I were someplace where chopsticks were the norm, I would probably just carry my own as I find the disposable wooden ones very off putting. I have to wonder if there is a rule about using your own chopsticks though.

Sandpaper and dremel aren't on the forbidden list yet.

I don't often bring sandpaper or dremel tools to a restaurant.

Well, that's just against traditions.

The offending commit seems to be: https://github.com/aquasecurity/trivy/commit/1885610c6a34811... which updates the action to `actions/checkout@70379aad1a8b40919ce8b382d3cd7d0315cde1d0 # v6.0.2`. https://github.com/actions/checkout/commit/70379aad1a8b40919... is not actually in `actions/checkout` but a fork, and it pulls malicious code from the typo-squatted "scan.aquasecurtiy.org" (note the _tiy_).

Any system with Trivy 0.69.4 on it (and being run) can be assumed to be compromised.

GitHub advertises itself as warning about those Unicode characters: https://github.blog/changelog/2025-05-01-github-now-provides...

Of course, it doesn't work though. I reported this to their bug bounty, they paid me a bounty, and told me "we won't be fixing it": https://joshua.hu/2025-bug-bounty-stories-fail#githubs-utf-f...

The exact quote is "Thanks for the submission! We have reviewed your report and validated your findings. After internally assessing your report based on factors including the complexity of successfully exploiting the vulnerability, the potential data and information exposure, as well as the systems and users that would be impacted, we have determined that they do not present a significant security risk to be eligible under our rewards structure." The funny thing is, they actually gave me $500 and a lifetime GitHub Pro for the submission.

That's bizarre. They won't be fixing it, and yet the changelog post is unretracted.

Tangential, but that's quite interesting, I had no idea you could get GitHub Pro for life, and certainly not through something as "accessible" as bug bounties.

Require dual sign off