IRC channel logs
2021-05-13.log
back to list of logs
<melg8>@fossy done, but current build is timing out because it takes more than 2 hours to build on ci. <OriansJ>I know this is a bit late (I planned on getting done last week but life happens) <OriansJ>but I am proud to present ungz.c (buildable by M2-Planet+M2libc) <OriansJ>(It requires the latest commit of M2-Planet for __M2__ definition or -D __M2__=1 passed to the version that supports the -D flag ) <OriansJ>So now live-bootstrap will be able to use Mes's .tar.gz file directly (after a sha256sum check of course; since we did have a version buildable by M2-Planet if I remember correctly) <OriansJ>There may be a few bugs left in it as I've only tested on a handful of .gz files (might not work on files greater than 200MB in size) <OriansJ>an example build command is: M2-Planet --architecture amd64 -f sys/types.h -f amd64/Linux/sys/stat.h -f stddef.h -f string.c -f amd64/Linux/unistd.h -f stdlib.c -f amd64/Linux/fcntl.h -f stdio.c -f bootstrappable.c -f ungz.c -o ungz.M1 --debug && blood-elf -f ungz.M1 --64 -o ungz-footer.M1 && M1 --architecture amd64 --little-endian -f amd64/amd64_defs.M1 -f amd64/libc-full.M1 -f ungz.M1 -f ungz-footer.M1 -o ungz.hex2 && hex2 <OriansJ>--architecture amd64 --little-endian --base-address 0x10000 -f amd64/ELF-amd64-debug.hex2 -f ungz.hex2 -o ungz <OriansJ>Now I just need to make a proper mescc-tools-extras to hold all of these pieces and so that I can integrate their builds with stage0-posix <fossy>stikonas: 2hr was max right? <melg8>@fossy in .cirrus.yml is set to timeout_in: 180m, but Cirrus ci documentation says "There is a hard limit of 2 hours for community tasks. Use compute credits or compute service integration to avoid the limit." <OriansJ>(It is a response to crypto currency miners who abuse CI jobs) <stikonas>section about guile is a bit outdated, wasn't it also "debootstrapped" by mihi <stikonas>OriansJ: are you going to push ungz.c and untar.c to some repo? <civodul>someone worked on psyntax, but outside Guile unfortunately <OriansJ>stikonas: I think the correct term is rebootstrapped as mihi's work is still functional (excluding regressions made by the guile team to break the work) <civodul>"regressions made by the guile team to break the work"? <civodul>the guile team is known for breaking other people's work or what? :-) <stikonas>well, ppsyntax bootstrap was done after newer guile versions were released <OriansJ>civodul: accident or intensional isn't knowable but changes to psyntax in guile can break the psyntax bootstrap work that was done <civodul>yes, that's why it should be done in Guile proper <OriansJ>and the guile version after the release wasn't compatible with the work <OriansJ>civodul: That was requested at the time <civodul>my recollection is that the person chimed in one day on #guile to say they didn't want to include it in Guile <OriansJ>civodul: we will certainly find a way to make guile bootstrappable (and properly bootstrapped) <stikonas>well, in the worst case, I guess it's possible to build ppsyntax using old guile <OriansJ>civodul: people here on bootstrappable <OriansJ>stikonas: sadly no, that is why we needed up doing that work <civodul>i'm here too, and work on Guile (a bit) *civodul would like to feel more inclusive vibes <OriansJ>it is also licenced gplv3 or later so it should be compatible with guile <OriansJ>but civodul if you could help with getting it into guile (assuming mihi has no objections; of which I couldn't see why). <OriansJ>So hey are fine with guile incorporating it, they just don't want to be the one to do it. <stikonas>always bootstrap the later versions from an earlier Guile. <xentrac>but you still have to build the older guile, which involves building its macro system <xentrac>which requires a working Scheme of some sort, doesn't it? <stikonas>but isn't that done as part of building guile 3.0.2? <OriansJ>stikonas: there are breakages between versions but yes in some cases it is possible o build newer version's psyntax with an older version. <OriansJ>and the original guile's psyntax doesn't have anything that can bootstrap it either. <stikonas>what I meant guile 3.0.2 + guile-psyntax-bootstraping <OriansJ>So in a way guile 3.0.2 is the most bootstrappable version of guile ever <OriansJ>xentrac: If we can keep all future guile releases psyntax bootstrappable from a previous version, guix will save the day for us. <OriansJ>That is why civodul being someone here who could help nudge guile in that direction will really help us all <xentrac>OriansJ: oh, that's wonderful news. I didn't know mihi had gotten syntax-case to bootstrap fully from non-syntax-case things <OriansJ>xentrac: yes, it absolutely is. and it deserves far more praise then it received. <OriansJ>in a way mihi's work is the key to guile and guix's bootstrap from human written sources only. <xentrac>I think that's a very significant achievement <xentrac>but we shouldn't be surprised that the guile folks don't value that; if they had valued it, they would have done it that way in the first place <OriansJ>xentrac: civodul is a guile developer too and being here means they do value that work too. <OriansJ>They might not have valued it as much as making guile more robust or fast or this feature or being compatible with that standard but it is valued. <OriansJ>Now let us trust in our fellow bootstrappers who have ties to the guile community to help incorporate the work and encourage its continued improvement. <xentrac>well, sure, there's a diversity of values within any project <xentrac>and I don't mean to dismiss the Guile folks, whose work is uniformly excellent and of the highest caliber from my point of view <OriansJ>and we have diversity of groups here too. We can bootstrap the world and keep it bootstrapped working together. <xentrac>but bootstrappability from human-readable sources is not a thing the Guile project was setting out to do, so we shouldn't be surprised that they didn't shower mihi with praise and awards <OriansJ>xentrac: that I am quite aware but even if they didn't celebrate the work; we should have. Every language we bootstrap is a miracle forged from sweat, blood and tears. <OriansJ>and these days proper celebrations are in short supply. <Hagfish>i think xkcd probably did the best job of conveying what a debt of gratitude we owe to certain under-appreciated developers, with that tower of blocks image <Hagfish>show a dependency graph, with each node coloured based on who worked on it, would partially communicate it <Hagfish>but that doesn't quite capture how difficult the different pieces were, and how stubbornly they've resisted previous generations (or how stubbornly the upstream communities have ignored their duty to make their code bootstrappable) <xentrac>they don't have such a duty, Hagfish. it's up to us to make the case as to what benefits they can expect <OriansJ>One must remember most programmers don't share the FSF values like the need for the 4 essential freedoms. Which bootstrappable is a very aggressive interpretation of <Hagfish>i suppose you could say that they don't even have a duty to avoid security vulnerabilities, because the software is provided "as is", but i'd hope that as an industry/community we would hold ourselves to a better standard than "builds fine on my machine" <Hagfish>in other news, apparently Biden cares about reliable builds now: <Hagfish>(x) ensuring and attesting, to the extent practicable, to the integrity and provenance of open source software used within any portion of a product. <OriansJ>Hagfish: as someone who works in government and deals with a great deal of commercial software, I must say only a few "crazies" care about security and they generally are not the people writing software. <OriansJ>Vendors treat security as a checkbox, not something to work towards. <OriansJ>contractors find ways of avoiding the work involved in securely writing anything if they can turn it into something they can milk forever. (XSS blacklisting instead of whitelisting for example) <xentrac>Most governments are not really in a very good position to assess security. They don't have the competence <xentrac>XSS blacklisting being a perfect example — it's the same kind of cheat as special-casing 3-D benchmark code in your video card <xentrac>or the Volkswagen diesel emissions scandal <OriansJ>xentrac: it isn't lack of competence but rather incentives that drive only one direction (don't look bad in public and keep costs below what will show up in the news.) <xentrac>I'd almost go so far as to say that in an ideal world anyone caught doing XSS blacklisting instead of real security would be indicted, but it could happen by accident if the blacklist was part of defense-in-depth strategy that mostly faile <xentrac>OriansJ: the perverse incentives come from the lack of competence <OriansJ>xentrac: the incentives come from history of what was required to survive a hostile political environment. <xentrac>the reason fake security doesn't look bad in public is that nobody competent is auditing the systems <xentrac>yes, that is definitely also a crucial piece of the puzzle <OriansJ>for years companies and governments didn't care about security; until some of them became publicly shamed. <xentrac>they still don't, except for a few exceptions like the NSA and FSB <OriansJ>even the NSA and FSB don't make security the top priority. It is always about money in and money out. <OriansJ>if you don't believe me, ask William Edward Binney. <xentrac>oh, I didn't mean they made security the top priority; I meant they have the competence to audit for security when they care about it <OriansJ>money going out is used to buy political favors (not even counting the scholarships or negative interest rate home loans given to the people who encourage the deals). <xentrac>most companies and agencies, though, are unable to prioritize security at all, high or low, because they can't observe it <xentrac>(if they're lucky, ever; if they're unlucky, just until it's too late) <xentrac>their management is in the position of blind people trying to judge an art show in which the submitted pieces are paintings <OriansJ>xentrac: management is far from stupid; they just value things differently than those trying to do good engineering. <OriansJ>different assumptions lead to different conclusions. <OriansJ>Like the fact that this year alone, I found $40 Million in waste, fraud and abuse that the State of Michigan could reclaim from a contracting company using the existing contract. <OriansJ>In response, I have been once again reassigned to a new set of tasks that have absolutely nothing to do with what I was previously supposed to be working on. <xentrac>The fact that sometimes management has different values does not mean that they never lack the knowledge they would need to make decisions that would be good according to their own value systems. <Hagfish>this may be naive, but why doesn't the government require that contractors buy cyber-insurance? <Hagfish>the insurance could cover the cost of a bug bounty program, which pays out at industry standard rates for various types of vulnerability <Hagfish>the insurers would then have an incentive to do a proper security audit <xentrac>incentives don't help without competence <melg8>i think additional problem is too long feedback loop from "bad decision" until some nuclear centrifuges stop working. <Hagfish>insurers tend to be competent, and if the contractors are paying for the insurance then that will make their bid go up <Hagfish>i guess it might be hard for an insurer to work out a premium for software that hasn't been created yet, but they can look at the quality of previous projects by that manufacturer <Hagfish>and require periodic audits by auditors which the insurer chooses, who can force the contractors to make changes to their design or fix bugs <xentrac>Hagfish: nobody is competent at everything, and insurers' involvement with computer security so far has been disastrous --- heard of the PCI SSC? <xentrac>I think melg8's comment here is extremely insightful <OriansJ>Hagfish: Most government contracts are also given out not based on who can produce results but who helped a certain someone's daughter get a scholarship to Yale. <OriansJ>Or who's mortgage got bought and converted to a negative interest rate with a zero monthly payment. <OriansJ>No bid contracts are the standard in Government. <OriansJ>There is only one company that can sell Dell Computers, or Microsoft Windows or Oracle Database software. <OriansJ>Migrating away from that to a competitive bid is surprisingly difficult <xentrac>Hagfish: do you know the story about the length of the nose of the emperor? <OriansJ>(see previous 4 year brutal war required to introduce Git as a State of Michigan Enterprise Standard) <OriansJ>or the 2 year long war involving lawsuits, counter lawsuits and hookers shot via catapults through windows to replace one piece of statistical software (SAS) with another (R) <OriansJ>and I am dead serious about the hooker catapult thing, it actually happened; I have photos to prove it. <xentrac>but I think the incentive alignment problem is actually easier to solve than the incompetence problem <xentrac>and although they are not entirely unrelated they are distinct <xentrac>as you correctly point out, OriansJ, injecting competence alone is not sufficient to align incentives <xentrac>but without competence, incentive alignment is insufficient <OriansJ>xentrac: well that is the thing. If one actually looks closely at Government, I can't say there is much incompetence (it is roughly on par with what you would find in the private sector) But rather a logical alignment with local survival and thrive behaviors. <xentrac>I think what you find in the private sector is appallingly bad in this case, though. <xentrac>I'm not saying government is uniquely incompetent at computer security. I'm saying competence at computer security is very rare <OriansJ>xentrac: or more simply. Most places are average with average people doing average level work. <xentrac>Yes, but the average right now is very low. Consider the average competence of 17th-century French peasants at 386 assembly debugging as an example. <xentrac>consider the Rumpelstiltskin situation: the miller's daughter has a strong incentive to spin straw into gold — she will be beheaded if the sun rises and she has not done so. But she lacks the competence to do it. At least, though, she has the competence to recognize gold when Rumpelstiltskin presents her with it. <xentrac>The average programmer, with his 17th-century-French-peasant-level level of infosec competence, cannot even distinguish the gold from the straw. <xentrac>He can present it to his manager, but she cannot distinguish the substances either. So it is delivered to the government to operate their centrifuges, and five years later, the centrifuges break. <xentrac>The software was straw, not gold. Now who do the Iranian insurers blame? <xentrac>Somebody is surely going to be beheaded, but chances are it's whoever is worst at bureaucratic ass-covering, not whoever is worst at spinning C buffer-overflow straw into reliability gold. <OriansJ>xentrac: hence why I am still a P11 after 5+ years at the State with a track record of almost $100 Million in savings. <xentrac>Since the blue-ribbon incident investigation commission is not selected by Dark Tangent. It's selected by Ali Khamenei, who can't tell the difference between Dark Tangent and Mr. Robot <xentrac>So he has no way of selecting people who can actually identify the vulnerabilities that permitted Stuxnet, or who can tell the difference between the correct explanation and self-serving delusions. <hendursaga>OriansJ: Pardon, what exactly is P11? Some sort of bureaucratic level or other? <OriansJ>hendursaga: P11 is a pay classification for the State of Michigan which corresponds to junior grade technical employee. <hendursaga>Pay grades. Ugh. Well, it IS the gov't, so not surprised. <OriansJ>That goes from $19.22/hr to $44.75/hr depending on your seniority/step <OriansJ>hendursaga: IBM mirrored governments because there was a great deal of swapping of staff with them. <hendursaga>Can't wait to see their century of reign come to an end soon <OriansJ>The system is rigged towards too big to fail. Only a progressive revenue tax would work against it. <hendursaga>Well, have fun with bureaucracy, I wouldn't want that kind of job <OriansJ>hendursaga: completely fair. It isn't for most people but it is one of the few places where ethical software development is funded and you get to feel good about helping people escape poverty. <stikonas>yay, psyntax in guile 3.0.7 now works too <xentrac>02:32 < OriansJ> hendursaga: IBM mirrored governments because there was a great deal of <xentrac>also armies were the only existing organizations for IBM to model itself on before WWI, and still very influential afterwards <stikonas>xentrac: well, I haven't checked the repo <stikonas>although, I'm not too familiar with guile