@Aissen@social.treehouse.systems

Anisse @Aissen@social.treehouse.systems · Jul 28, 2026

Replying to @ariadne@social.treehouse.systems

@ariadne@social.treehouse.systems seems reasonable as a whole; your project, your contribution rules. Wouldn't you ban Google's Project Zero with these guidelines?

0

1

0

Anisse @Aissen@social.treehouse.systems · Jul 26, 2026

I'm wondering if the biggest LLM trap is that they solve their own problems by LLM-ing more.

For example, people are seeing the influx of valid security issues being found and overflowing maintainers. Even the most anti-LLM people can't deny this fact.

But people are also complaining about the slop adding new security issues. So if you want don't want to ban slop wholesale, the fix is to use the same tools: pre-commit and mandatory LLM-based security review. Spend even more tokens.

So that means depending on LLMs just for managing the influx of LLM-assisted contributions. I understand how many people want to live in an LLM-free world.

I'm not sure how well that will work for security-critical Free Software.

1

0

Anisse @Aissen@social.treehouse.systems · Jul 24, 2026

While working on Emoji Anki, I found a Chrome bug/limitation when using hardware acceleration: the CSS `text-shadow` will have a maximum size that depends on the emoji, font size/zoom level, and text-shadow blur radius (and probably the platform, too). Probably some limit somewhere deep within Skia.

It does not happen on Firefox or Chromium-based browsers that have hardware acceleration disabled.

Playground to repro: https://anisse.github.io/text-shadow-playground/

#chromium #chrome #css

0

Anisse @Aissen@social.treehouse.systems · Jul 23, 2026

I'm at the Rust Paris meetup and Nadri is improvising a talk on variance in Rust 🤩. cc @imperio@toot.cat

#RustLang

5

1

0

Anisse @Aissen@social.treehouse.systems · Jul 22, 2026

RE: @DavidJBianco@infosec.exchange

So it turns out the "agentic system" that hacked HuggingFace was a *benchmark* running at OpenAI that escaped its sandbox environment.
Oh, and the attacker (OpenAI) had no constraints because these were guardrails-free frontier models, the ones companies and govs pay $$$ OpenAI and Anthropic for "defending".
https://openai.com/index/hugging-face-model-evaluation-security-incident/

infosec.exchange

David J. Bianco (He/Him): "HuggingFace got hacked by an agentic system. That…" - Infosec Exchange

1

0

Anisse @Aissen@social.treehouse.systems · Jul 16, 2026

Replying to @zhuowei@notnow.dev

@zhuowei@notnow.dev thanks 🙏

0

Anisse @Aissen@social.treehouse.systems · Jul 16, 2026

Replying to @zhuowei@notnow.dev

@zhuowei@notnow.dev is this still working in browsers? Many ISP's DNS block RFC1918 address resolution. Firefox blocks them when using DoH by default. I wonder how that applies to local (127.*) addresses.

0

1

0

Anisse @Aissen@social.treehouse.systems · Jun 09, 2026

Replying to @monkeyninja@10base2.dev

@monkeyninja@10base2.dev Glad it works for you. One does not need the best deal to be happy.

0

Anisse @Aissen@social.treehouse.systems · Jun 09, 2026

Replying to @monkeyninja@10base2.dev

@monkeyninja@10base2.dev unfortunately this does not work, as has been said bye others. You'll get a worse TV for more money because the market is structured around Smart TVs and there's a lot of economies of scale. Just don't connect it, and refuse the EULAs, the effect is the same.

0

1

0

Anisse @Aissen@social.treehouse.systems · May 10, 2026

Replying to @janne@social.treehouse.systems

@janne@social.treehouse.systems https://forge.fedoraproject.org/asahi/docs-site/pulls/28 https://github.com/AsahiLinux/AsahiLinux.github.io/pull/121

0

Anisse @Aissen@social.treehouse.systems · May 08, 2026

Replying to @janne@social.treehouse.systems

@janne@social.treehouse.systems I am not sure. The install script or the doc mention Calamares though.

0

1

0

Anisse @Aissen@social.treehouse.systems · May 07, 2026

Replying to @Aissen@social.treehouse.systems

@adamw@fosstodon.org thinking a bit more, launching Calamares after copying the image might already be diverging quite a lot from what Fedora does.

0

1

0

Anisse @Aissen@social.treehouse.systems · May 07, 2026

Replying to @adamw@fosstodon.org

@adamw@fosstodon.org I'll open a downstream bug later then!

0

1

0

Anisse @Aissen@social.treehouse.systems · May 07, 2026

On a clean install of Fedora 44 (Asahi), plasma-login-manager does not honor the system locale. It's launched as a different user (plasmalogin) but it has a separate plasma locale rc in /var/lib/plasmalogin/.config. Editing it works around the issue. I might open a bug later, but if you want to, go ahead!
Edit: this seems to be a downstream bug.
#fedora #plasma #asahilinux

0

1

0

Anisse @Aissen@social.treehouse.systems · May 01, 2026

Replying to @corsac@mastodon.social

@corsac@mastodon.social

Not sure how we can do better though

A random idea, not sure how far it is from what you already do: Bump automation where packages from latest stable branches are built and available with no human intervention in specific repositories. Manual promotion for generic repos should be as effortless as possible.

0

1

0

Anisse @Aissen@social.treehouse.systems · May 01, 2026

In light of copyfail yesterday I had a quick look at the stable kernel changelogs, and almost half the patches look like they could have a security impact. Everyone should just regularly update regardless, even more nowadays with AI VCs financing vuln research in open source projects.

0

1

0

Anisse @Aissen@social.treehouse.systems · Apr 30, 2026

@cnes@social.numerique.gouv.fr bon courage ! Opinion perso: continuez à poster (oui même les liens YouTube, ceux que ça n'intéresse pas peuvent ne pas cliquer), écoutez les commentaires constructifs, ignorez (mute) tous ceux agressifs (même celui-ci si c'est trop !), et ayez des objectifs réalistes en fonction de vos moyens!

6

0

Anisse @Aissen@social.treehouse.systems · Apr 23, 2026

Replying to @axboe@fosstodon.org

@axboe@fosstodon.org @hyeyoo@social.kernel.org @ljs@mastodonapp.uk @vbabka@mastodon.social @gregkh@social.kernel.org That seems to be the plan on Jacub's side. https://github.com/linux-netdev/mod-orphan Note: I'm not arguing against any removal, I'm not crazy enough to take on this type of maintenance. I was just commenting on the feeling.

1

2

0

Anisse @Aissen@social.treehouse.systems · Apr 23, 2026

Replying to @hyeyoo@social.kernel.org

@hyeyoo@social.kernel.org @axboe@fosstodon.org @ljs@mastodonapp.uk @vbabka@mastodon.social @gregkh@social.kernel.org I was mostly commenting on the context of network drivers being removed. A modern distro kernel ships those old unmaintained drivers and would allow retro-computing with 3com 3c589 card. Maybe the term isn't well chosen, but Linux got the reputation of having so many drivers, maintained for so long. But every good thing must come to an end.

1

0

Anisse @Aissen@social.treehouse.systems · Apr 23, 2026

Replying to @axboe@fosstodon.org

@axboe@fosstodon.org @gregkh@social.kernel.org @ljs@mastodonapp.uk @vbabka@mastodon.social yes, I did read https://lwn.net/Articles/1068928/ ; it does seem bittersweet though.

1

18

0

Anisse @Aissen@social.treehouse.systems · Apr 23, 2026

Replying to @axboe@fosstodon.org

@axboe@fosstodon.org @gregkh@social.kernel.org something @ljs@mastodonapp.uk would most likely agree with 🙂 cc @vbabka@mastodon.social

3

23

0

Anisse @Aissen@social.treehouse.systems · Apr 16, 2026

RE: @Aissen@social.treehouse.systems

Did you know that lbzip2 implements a N:M task scheduler just so it can (de)compress faster? Basically the equivalent of what is provided by the Go runtime, or tokio (or your OS, etc.).

https://github.com/kjn/lbzip2/blob/724352c0495904ab16e33817fae85b262f319318/src/process.h#L23-L42
https://github.com/kjn/lbzip2/blob/724352c0495904ab16e33817fae85b262f319318/src/process.c#L37-L62

2

0

Anisse @Aissen@social.treehouse.systems · Apr 11, 2026

RE: @CyReVolt@mastodon.social

I'll be at #RustWeek as well !

5

0

Anisse @Aissen@social.treehouse.systems · Apr 10, 2026

For border-explorer, I made a script to update it regularly against #Wikidata's dumps. Just in case, I put a check in the script to prevent updating if the dump size varied too much. It just triggered last week and blocked the update since a dump was ~71GB instead of ~100GB, preventing border-explorer to temporarily show incomplete information.

2

0

Anisse @Aissen@social.treehouse.systems · Apr 10, 2026

Replying to @CosmicHorror@fosstodon.org

@CosmicHorror @djc it's not about what is claimed, but what isn't clarified.

0

1

0

Anisse @Aissen@social.treehouse.systems · Apr 10, 2026

Replying to @djc@hachyderm.io

@djc this seems a bit disingenuous since it relies on aws-lc instead of being fully memory safe, and does not compare with a vanilla aws-lc stack either. What am I missing?

0

3

0

Anisse @Aissen@social.treehouse.systems · Apr 07, 2026

Fun issue: a performance regression between two Rust versions, only on dual socket Zen4c, and does not happen on dual socket Zen4, nor single socket socket Zen4c. https://github.com/rust-lang/rust/issues/154516

#RustLang #Bergamo #Genoa #Zen4 #AMD #NUMA #MicroArchitecture

4

0

Anisse @Aissen@social.treehouse.systems · Apr 06, 2026

Anyone else still gets a bit of stress as they write a linux live image to /dev/sda, despite using NMVe system drives for many years?

8

1

0

Anisse @Aissen@social.treehouse.systems · Apr 05, 2026

@mattly@hachyderm.io Already reverted

hachyderm.io

Matthew Lyon (@mattly@hachyderm.io) - Hachyderm.io

1

0

Anisse @Aissen@social.treehouse.systems · Apr 04, 2026

Replying to @HalvarFlake@mastodon.social

@HalvarFlake@mastodon.social very in line with what we measured, heavily follows rush hour per geographic area. Yet another advantage for on-prem.

4

0

1

0

Anisse @Aissen@social.treehouse.systems · Mar 30, 2026

Replying to @gustavoars@fosstodon.org

@gustavoars it might be! (though I had not noticed before)

1

0

Anisse @Aissen@social.treehouse.systems · Mar 27, 2026

That's it for me for #RustInParis! There were great talks, great people and nice discussions; it ends a bit early, but let's meet again next year!

4

0

Anisse @Aissen@social.treehouse.systems · Mar 27, 2026

Replying to @Aissen@social.treehouse.systems

Of course, it's not always rosy: there might confilcts between contributors, or external brigading. This needs to be managed properly. #RustInParis

0

Anisse @Aissen@social.treehouse.systems · Mar 27, 2026

Replying to @Aissen@social.treehouse.systems

After Code Maintenance, comes Community Maintenance. The project should make it easy for new contributors, and enjoyable for contributors and maintainers to contribute and review. #RustInParis

1

2

0

Anisse @Aissen@social.treehouse.systems · Mar 27, 2026

Replying to @Aissen@social.treehouse.systems

In rustc, Oli had that as well, with many features being blocked on a complex refactor. Another example is the infamous Rust soundness bug that needs a completely new Trait solver. The project for this Next Trait solver exists, but does not necessarily have funding. (Edit: see reply, this is incorrect). Oli says, this is not something we can rely on volunteers for that: they'll just end up burning-out, like others before them. #RustInParis

3

4

0

Anisse @Aissen@social.treehouse.systems · Mar 27, 2026

Replying to @Aissen@social.treehouse.systems

For feature work, it's "easy" to get contracted for that. Similarly, in big companies, working for months on a feature is something the company can afford. But it adds to the review load, and it might get blocked on complex refactors. #RustInParis

2

4

0

Anisse @Aissen@social.treehouse.systems · Mar 27, 2026

Replying to @Aissen@social.treehouse.systems

After a survey among all 54 teams, Oli found that everyone is busy keeping the lights one, but no one has time to tackle the Complex problems #RustInParis

3

5

0

Anisse @Aissen@social.treehouse.systems · Mar 27, 2026

Replying to @Aissen@social.treehouse.systems

"Maintenance is not just code. We are a community of contributors, not a code repository." Oli says. #RustLang #RustInParis

17

6

9

0

Anisse @Aissen@social.treehouse.systems · Mar 27, 2026

Oli @oli@hachyderm.io closes the day with "Maintaining Rust".

#RustInParis #RustLang

12

7

2

0

Anisse @Aissen@social.treehouse.systems · Mar 27, 2026

Replying to @Aissen@social.treehouse.systems

This presentation is also available in the form of blog post: https://donsz.nl/blog/externally-implementable-items/ #RustInParis

4

0

2

0

Anisse @Aissen@social.treehouse.systems · Mar 27, 2026

Replying to @Aissen@social.treehouse.systems

After discussion with Miguel Ojeda from Rust for Linux, support for EII outside of cargo was also needed. But it turns out there is already a linker feature that can be used for that: weak symbols. It allows exactly what Rust does: having a default implementation (that is weak, and has less priority) that is a fallback in case no other implementation is found. #RustInParis #RustForLinux

1

2

0

Anisse @Aissen@social.treehouse.systems · Mar 27, 2026

Replying to @Aissen@social.treehouse.systems

During the EII implementation, it needed a big attribute refactor in rustc. And the community stepped up and helped Jana and Mara on this project. Many were first time Compiler contributors, and some even became team members. Which is a big reason Jana resents LLM PRs on the Rust project: it robs the opportunity for community-building, and learning in general, she says. #RustInParis #RustLang

12

2

4

0

Anisse @Aissen@social.treehouse.systems · Mar 27, 2026

Replying to @Aissen@social.treehouse.systems

For their implementations, Mara and Jana decided to have a core definition that is empty but shows the type. It has an attribute to be used to decorate the external implementation. It allows separate implementation and name resolution. #RustInParis

1

3

0

Anisse @Aissen@social.treehouse.systems · Mar 27, 2026

Replying to @Aissen@social.treehouse.systems

A few weeks later Jana and Mara implemented a fourth solution, which has no RFC. And realized that Rust already have Externally Implemented Items (EII). One of those is the Panic Handler. When building, the core expects a function to be marked #[panic_handler]. With std there is one already provided. The second one is the Allocator, which is a trait with four functions that also needs to be externally implemented. #RustInParis

1

4

0

Anisse @Aissen@social.treehouse.systems · Mar 27, 2026

Replying to @Aissen@social.treehouse.systems

At RustNL 2024, the RFC on Externally Implementable Functions was discussed. It led to a few discussions, and then another RFC which changed the goal to externally implement static insteads, which has less safety impacts, but does not allow unsafe. Then it led to a third RFC for externally implementable traits. At the time, no one knew the best way forward, and no code had been implemented yet. #RustInParis

0

5

0

Anisse @Aissen@social.treehouse.systems · Mar 27, 2026

Replying to @Aissen@social.treehouse.systems

Within a crate, order is mostly independent (except macros), but the crate graph is definitely order-dependent. This leads to a very small crate (6 lines) in the rustc dependency graph, done only to prevent circular dependencies. #RustInParis

1

6

0

Anisse @Aissen@social.treehouse.systems · Mar 27, 2026

Replying to @Aissen@social.treehouse.systems

It's not only a technical talk, but it starts with a technical discussion order independent name resolution, which Rust has, but not C for example. #RustInParis

0

7

0

Anisse @Aissen@social.treehouse.systems · Mar 27, 2026

Jana @jana@fedi.xirion.net Dönszelmann is now presenting "It's the people that matter"
#RustLang #RustInParis

15

9

4

1

Anisse @Aissen@social.treehouse.systems · Mar 27, 2026

Replying to @Aissen@social.treehouse.systems

Each module is declared in the monolith with a macro, which exposes the module API. Each module's API is checked at compile-time, and can be mocked for testing. And calls between modules stay in-process with an mpsc channel. #RustInParis

0

Anisse @Aissen@social.treehouse.systems · Mar 27, 2026

Replying to @Aissen@social.treehouse.systems

At Bertrand's company, Hyli, they have a monolith that can be run modularly as micro-services, built in Rust, and those communicate through a message bus. #RustInParis

0

1

0

Anisse

Posts

David J. Bianco (He/Him): "HuggingFace got hacked by an agentic system. That…" - Infosec Exchange

Matthew Lyon (@mattly@hachyderm.io) - Hachyderm.io

Remote instance

Media