Tootfinder

Subtooting since people in the original thread wanted it to be over, but selfishly tagging @… and @… whose opinions I value...
I think that saying "we are not a supply chain" is exactly what open-source maintainers should be doing right now in response to "open source supply chain security" threads.
I can't claim to be an expert and don't maintain any important FOSS stuff, but I do release almost all of my code under open licenses, and I do use many open source libraries, and I have felt the pain of needing to replace an unmaintained library.
There's a certain small-to-mid-scale class of program, including many open-source libraries, which can be built/maintained by a single person, and which to my mind best operate on a "snake growth" model: incremental changes/fixes, punctuated by periodic "skin-shedding" phases where make rewrites or version updates happen. These projects aren't immortal either: as the whole tech landscape around them changes, they become unnecessary and/or people lose interest, so they go unmaintained and eventually break. Each time one of their dependencies breaks (or has a skin-shedding moment) there's a higher probability that they break or shed too, as maintenance needs shoot up at these junctures. Unless you're a company trying to make money from a single long-lived app, it's actually okay that software churns like this, and if you're a company trying to make money, your priorities absolutely should not factor into any decisions people making FOSS software make: we're trying (and to a huge extent succeeding) to make a better world (and/or just have fun with our own hobbies share that fun with others) that leaves behind the corrosive & planet-destroying plague which is capitalism, and you're trying to personally enrich yourself by embracing that plague. The fact that capitalism is *evil* is not an incidental thing in this discussion.
To make an imperfect analogy, imagine that the peasants of some domain have set up a really-free-market, where they provide each other with free stuff to help each other survive, sometimes doing some barter perhaps but mostly just everyone bringing their surplus. Now imagine the lord of the domain, who is the source of these peasants' immiseration, goes to this market secretly & takes some berries, which he uses as one ingredient in delicious tarts that he then sells for profit. But then the berry-bringer stops showing up to the free market, or starts bringing a different kind of fruit, or even ends up bringing rotten berries by accident. And the lord complains "I have a supply chain problem!" Like, fuck off dude! Your problem is that you *didn't* want to build a supply chain and instead thought you would build your profit-focused business in other people's free stuff. If you were paying the berry-picker, you'd have a supply chain problem, but you weren't, so you really have an "I want more free stuff" problem when you can't be arsed to give away your own stuff for free.
There can be all sorts of problems in the really-free-market, like maybe not enough people bring socks, so the peasants who can't afford socks are going barefoot, and having foot problems, and the peasants put their heads together and see if they can convince someone to start bringing socks, and maybe they can't and things are a bit sad, but the really-free-market was never supposed to solve everyone's problems 100% when they're all still being squeezed dry by their taxes: until they are able to get free of the lord & start building a lovely anarchist society, the really-free-market is a best-effort kind of deal that aims to make things better, and sometimes will fall short. When it becomes the main way goods in society are distributed, and when the people who contribute aren't constantly drained by the feudal yoke, at that point the availability of particular goods is a real problem that needs to be solved, but at that point, it's also much easier to solve. And at *no* point does someone coming into the market to take stuff only to turn around and sell it deserve anything from the market or those contributing to it. They are not a supply chain. They're trying to help each other out, but even then they're doing so freely and without obligation. They might discuss amongst themselves how to better coordinate their mutual aid, but they're not going to end up forcing anyone to bring anything or even expecting that a certain person contribute a certain amount, since the whole point is that the thing is voluntary & free, and they've all got changing life circumstances that affect their contributions. Celebrate whatever shows up at the market, express your desire for things that would be useful, but don't impose a burden on anyone else to bring a specific thing, because otherwise it's fair for them to oppose such a burden on you, and now you two are doing your own barter thing that's outside the parameters of the really-free-market.

“In the US, we have a set of electoral and legislative institutions that drive us toward only having two parties,”
Mark Copelovitch told us.
“That allowed the 20 to 25 percent of people that support the far right to basically take over one of the two parties,
and everything in our system is weighted towards the Republican constituency
— the Supreme Court, the gerrymandered House, the way the Senate is apportioned.
All of these things basically bias the electo…

“Neither our media nor our political system is designed to deal with a far right authoritarian party”
Mark Copelovitch unpacks his signature phrase.

Every company is undergoing an invisible reorg. You report to your boss but your boss reports to an #AI, offloading the job of management entirely onto a bot and then merely communicating its wishes back to the team.
This is the Nothing Manager, surrounded by #LLM tools to avoid having to interact with…

AI is not an assistant – it's your new boss (The Everything App part 2)
As managers continue to outsource data-gathering and decision-making to LLMs, the person above you on the org chart is transforming into a chatbot's clerk – and leaving product teams with the consequences.

This is another horrifying statistic to shelve alongside the composition of global mammalian biomass:
• humans 34%
• livestock and pets 62%
• wild animals 4%
#science #biology #ecology

Jonathan Schofield (@urlyman@mastodon.social)
Attached: 1 image …Here are some highlights (lowlights): “If you drop all that old life into the container that we call Earth, and burn them, it turns out that what we burn in *1 year* weighs 100x more than everything alive today. Everything. All the whales, elephants, forests, insects, grass, crops, birds, fish, people, dogs and cats. Add up all the carbon in everything alive now, and still, in one year we burn a hundred times more.” #climateDiary

“What AI sells is vastly different from what it delivers, particularly what it delivers out of the box.”
The post gives some great context on the study of “the difference between work-as-imagined (WAI) and work-as-done (WAD),” and says:
“If what we have to do to be productive with LLMs is to add a lot of scaffolding and invest effort to gain important but poorly defined skills, we should be able to assume that what we’re sold and what we get are rather different things. That gap implies that better designed artifacts could have better affordances, and be more appropriate to the task at hand.”
5/

Trump’s “two weeks” statement was just one aspect of a broader effort at political and military misdirection that took place over eight chaotic days,
from the first Israeli strikes against Iran to the moment when a fleet of B-2 stealth bombers took off
Trump seemed almost gleeful in telling reporters that he could make a decision “one second before it’s due,
because things change, especially with war.”
All the while, Trump was making blustery statements indicating he…

How Trump Decided to Strike Iran
When Israel began its assault on Iran, President Trump kept his distance. But within days he was on a path that led to an extensive bombing mission aided by political and military ruses.

Building Automotive Security on Internet Standards: An Integration of DNSSEC, DANE, and DANCE to Authenticate and Authorize In-Car Services
Timo Salomon, Mehmet Mueller, Philipp Meyer, Thomas C. Schmidt
https://arxiv.org/abs/2506.13261

Building Automotive Security on Internet Standards: An Integration of DNSSEC, DANE, and DANCE to Authenticate and Authorize In-Car Services
The automotive industry is undergoing a software-as-a-service transformation that enables software-defined functions and post-sale updates via cloud and vehicle-to-everything communication. Connectivity in cars introduces significant security challenges, as remote attacks on vehicles have become increasingly prevalent. Current automotive designs call for security solutions that address the entire lifetime of a vehicle. In this paper, we propose to authenticate and authorize in-vehicle services …

Building Automotive Security on Internet Standards: An Integration of DNSSEC, DANE, and DANCE to Authenticate and Authorize In-Car Services
Timo Salomon, Mehmet Mueller, Philipp Meyer, Thomas C. Schmidt
https://arxiv.org/abs/2506.13261

Building Automotive Security on Internet Standards: An Integration of DNSSEC, DANE, and DANCE to Authenticate and Authorize In-Car Services
The automotive industry is undergoing a software-as-a-service transformation that enables software-defined functions and post-sale updates via cloud and vehicle-to-everything communication. Connectivity in cars introduces significant security challenges, as remote attacks on vehicles have become increasingly prevalent. Current automotive designs call for security solutions that address the entire lifetime of a vehicle. In this paper, we propose to authenticate and authorize in-vehicle services …