Jun 25

A libertarian rethinks immigration

Instapundit recently linked to an article at the libertarian Reason magazine with a premise I found – considering the authors and the magazine – surprisingly dimwitted. No, a border wall is not necessarily morally equivalent to the Berlin Wall, or anywhere near it. Consider Hadrian’s Wall, or the Great Wall of China. Sometimes there are actual barbarians on the other side of it.

But this does motivate me to try to clarify my own thoughts about libertarianism and immigration. Is there, in fact, any libertarian defense of border and immigration controls?

Continue reading

Jun 22

Segfaults and Twitter monkeys: a tale of pointlessness

For a few years in the 1990s, when PNG was just getting established as a Web image format, I was a developer on the libpng team.

One reason I got involved is that the compression patent on GIFs was a big deal at the time. I had been the maintainer of GIFLIB since 1989; it was on my watch that Marc Andreesen chose that code for use in the first graphics-capable browser in ’94. But I handed that library off to a hacker in Japan who I thought would be less exposed to the vagaries of U.S. IP law. (Years later, after the century had turned and the LZW patents expired, it came back to me.)

Then, sometime within a few years of 1996, I happened to read the PNG standard, and thought the design of the format was very elegant. So I started submitting patches to libpng and ended up writing the support for six of the minor chunk types, as well as implementing the high-level interface to the library that’s now in general use.

As part of my work on PNG, I volunteered to clean up some code that Greg Roelofs had been maintaining and package it for release. This was “gif2png” and it was more or less the project’s official GIF converter.

(Not to be confused, though, with the GIFLIB tools that convert to and from various other graphics formats, which I also maintain. Those had a different origin, and were like libgif itself rather better code.)

Continue reading

Jun 18

While I was making other plans, teil vier

I can walk again.

Wearing a joint-immobilizing boot brace, so I lurch around with a gait even more graceless than my usual palsied semi-stumble, but I can walk. And shower. And make my own breakfast. Hallelujah!

Better news: my prognosis is good. The joint had osteoarthritic damage that may be trouble down the road, but I’ve been osteoathritic in both feet for years now without symptoms. The big good news is that the joint cartilage wasn’t damaged, so I should get full use of the ankle back.

Boot brace for three weeks, physical therapy to strengthen the ankle after that. I won’t be back in kung-fu class for a while. Still, the medical level of this saga is going as well as could be expected.

The financial level, not so much, We got socked with a surgery bill of $2,238 today. Followup and PT…I don’t know what that will cost,but it won’t be cheap.

What’s worse, healthcare.gov chose this perfect time to yank our ACA subsidy because we can’t document the regular income streams. Of course we can’t document them because we don’t have them. Which means we have to pay another $2000 to keep our existing coverage for just the next month, and the bureaucrats have told us to apply for Medicaid. Which we may not be able to get before open enrollment in January.

This means the amount of money I need to pull in without burning savings just went up by $2000 a month. Which is doing a good job of keeping me focused on getting Loadsharers off the ground. If it does well, I’ll do well, and have successfully attacked the larger problem of LBIP funding.

There’s going to be a Linux Journal article, and at least one technology-press interview. I’ve even (gasp!) tweeted about this, something that happens approximately once every other blue moon.

I have a list of 11 people who have taken the pledge. I think we need around 11,000 (mostly supporting LBIPs other than me) to make a real dent in the problem. So please, go out and prosyletize to your tech-industry friends, and ask them to spread the word. We need this to go viral.

Jun 16

Sharing the load effectively

At the end of my last post I said I was wandering off to think about scalable, low-overhead recommendation systems.

It’s funny how preconceptions work. I know, I think better than most people, how often decentralizing systems to avoid single points of failure is good engineering. Yet I had to really struggle with myself to jettison the habits of thought that said “If you want to use money to help people, you’re going to have to build a centralized, heavyweight structure around the management of that task.”

But struggle I did. Because I’d already tried that, and failed.

I also had to get past the idea that identifying good funding targets can be crowdsourced. Nope. Identifying candidates and digging up information on them can be, but actually evaluating merit and centrality will take knowledge most contributors not only lack but have no strong reason to try to acquire.

Once I got my head clear, this is what came out:

http://www.catb.org/esr/loadsharers

The basic trick here is piggybacking not just on the payment transfer capacity of remittance systems but on their patron/client communications channels as well. That way Loadsharers doesn’t need to manage anything itself other a handful of adviser web pages and a bunch of trust relationships.

Also notice the implications of how I designed the Adviser role. By the time we have a half-dozen or so advisers I won’t be key man anymore. That’s intentional.

I also like the fact that there will, in effect, be a (mildly) competitive market in adviser skill, with loadsharer contributors tending to gravitate to advisers who exhibit activity and diligence. That’s intentional too.

Jun 15

Load-Bearing Internet People

I just finished giving a talk – by remote video – at South East Linux Fest, about the Load-Bearing Internet Person problem.

An LBIP is a person who maintains the software for a critical Internet service or library, and has to do it without organizational support or a budget backing him up.

That second part is key. Some maintainers for critical software operate from a niche at a university or a government agency that supports their effort. There might be a few who are independently wealthy. Those people aren’t LBIPs, because the kind of load I’m talking about isn’t technical challenge. It’s the stress of knowing that you are it and you are alone, the world out there has no idea what a crapstorm it would be if you failed at your self-imposed duty, and goddammit why doesn’t anybody care?

LBIPs happen because some of the most critical services can’t be monetized. How do you put a meter on DNS? Or time synchronization? Or having a set of ubiquitous and reliable crypto libraries? Where there’s no profit stream, markets are not going to directly solve this problem.

I know at least two LBIPs whose health has broken under that strain – Dave Taht and Harlan Stenn. Me, I’m still generally healthy, but my recent medical issues have re-focused my mind on the LBIP problem.

I spent seven years trying to solve this problem by founding an organization to collect funds from sponsors and distribute them to LBIPs. That was the Internet Civil Engineering Institute. It shut down late last month because, as it turns out, recruiting people who are both willing and entirely competent to run an organization like that is really difficult. I failed at it.

(I’ve designed and founded two nonprofits that survived my departure and are still on mission, one 17 years on and the other 26 years on. I’m actually good at that game, but ICEI failed anyway. Possibly someone smarter or more streetwise than me could have made ICEI work, but given my previous track record of success I don’t think that would be a smart bet.)

What I said at SELF was this: centralized attacks on the LBIP problem have failed, so we need a decentralized, distributed one. Services like Patreon, recurring PayPal remittences, and SubscribeStar give us the technology to do that. What we need to add is consciousness about the problem and some social engineering.

Here’s the challenge I put to the audience there: If you have a good paying job, earmark $30 a month – the equivalent of a moderately-priced restaurant meal. Identify three LBIPs. Remit them $10 a month.

Then go to every gainfully employed programmer you know and explain to them why they should do the same thing, and also further spread the word.

The fanout is important. One of the failure modes we want to avoid is for all that support to go to a handful of highly visible hackers like, er, me. There are lots of LBIPs working in obscurity; we need to solve this problem at scale, not just for a few prominent figures.

The SELF audience liked this idea – and then somebody raised the question I should have expected: “How can we know who to fund?”

Sorely tempted as I was to say “There’s always me…”, I didn’t. That would have been a humorous answer of the funny-because-it’s-true kind, but the discovery problem is a serious one. Several other questioners chewed on various possibilities. I ended up saying I would try to jump-start a discovery process on my blog by collecting a list of LBIPs.

That’s not going to be a solution that scales well, though. We’ll have to feel our way to a better one; I have some ideas which I’ll develop in future posts.

I do have a name for the effort – thought it up a few minutes ago. Loadsharers. We need to work out how to be effective loadsharers.

For now, my comments are open. Please check in if you (a) want to take the loadsharer pledge – $30 in 2019 dollars to one, two, or three LBIPs every month (ideally three), or (b) have an LBIP to recommend.

I will curate a list of LBIPs I think are worthy. I should not be the only person doing this. Eventually we’ll set up a recommender system and a way for LBIPs to declare funding goals. Mumble web of trust? Something like that should be doable.

Please do not wander off into trying to design a better mediation/discovery system in this comment thread (yeah, I know my audience). Save that for my post on that topic, coming soon.

As final and obvious point: yes, I think I’m a worthy LBIP, go ahead and do that $10 thing at me, initially. (Note to self: create a “Loadsharers” tier.) But I have a relatively low monthly figure that I consider “enough”; above that, I’d really rather the money went to other people.

So don’t be surprised if, a few weeks down the road, you get a patron notice from me saying “Enough! Roll a D6 and if it comes up 5 or 6, drop me and go fund someone else.”

/me wanders off to think about scalable, low-overhead recommendation systems…

Jun 15

In a blatant attempt to attract more Institutional supporters…

Anybody who has visited my Patreon page should know that I have two special support tiers.

At Bronze ($20 per month) level, you get included in the credits of the project pages for all my solo stuff. Here’s a recent example.

Today I’m announcing two new perks for Institutional ($100 permonth) supporters. This tier is intended for people with corporate budgets behind them.

When you sign up, you get to chose a name (possibly your corporation’s) and at your option a URL to back the name; this will be included in the credits pages. You will also get an individual shout-out in the “Acknowledgements” section of my forthcoming book “The Programmer’s Way: A Guide to Right Mindset”

By joining my feed at Institutional level, your company can demonstrate good Internet citizenship through supporting the often thankless and obscure work needed to keep the infrastructure humming.

Thanks in advance for your support.

Jun 13

Fear of COMITment

I shipped the first release of another retro-language revival today: COMIT. Dating from 1957 (coincidentally the year I was born) this was the first string-processing language, ancestral to SNOBOL and sed and ed and Unix shell. One of the notational conventions invented in COMIT, the use of $0, $1…etc. as substitution variables, survives in all these languages.

I actually wrote most of the interpreter three years ago, when a copy of the COMIT book fell into my hands (I think A&D regular Daniel Franke was responsible for that). It wasn’t difficult – 400-odd lines of Python, barely enough to make me break a sweat. That is, until I hit the parts when the book’s description of the language is vague and inadequate.

It was 1957 and nobody knew hardly anything about how to describe computer language systematically, so I can’t fault Dr. Victor Yngve too harshly. Where I came a particular cropper was trying to understand the intended relationship between indices into the workspace buffer and “right-half relative constituent numbers”. That defeated me, so I went off and did other things.

Over the last couple days, as part of my effort to promote my Patreon feed to a level where my medical expenses are less seriously threatening, I’ve been rebuilding all my project pages to include a Patreon button and an up-to-date list of Bronze and Institutional patrons. While doing this I tripped over the unshipped COMIT code and pondered what to do with it.

What I decided to do was ship it with an 0.1 version number as is. The alternative would have been to choose from several different possible interpretations of the language book and quite possibly get it wrong.

I think a good rule in this kind of situation is “First, do no harm”. I’d rather ship an incomplete implementation that can be verified by eyeball, and that’s what I’ve done – I was able to extract a pretty good set of regression tests for most of the features from the language book.

If someone else cares enough, some really obsessive forensics on the documentation and its code examples might yield enough certainty about the author’s intentions to support a full reconstruction. Alas, we can’t ask him for help, as he died in 2012.

A lot of the value in this revival is putting the language documentation and a code chrestomathy in a form that’s easy to find and read, anyway. Artifacts like COMIT are interesting to study, but actually using it for anything would be perverse.

Jun 11

While I was making other plans, pars tres

A day or so after the not-so-thrilling last installment of my medical troubles (previous post), I get my hands on a knee scooter. Rented from a local pharmacy.

This is a big improvement over the wheelchair. I’m more mobile on it, and can pee standing up. If you think that last bit doesn’t matter, pray you never find out what an epic getting on and off a toilet seat is when you don’t have the use of your dominant leg.

Unfortunately, life is tradeoffs. You can fall off a knee scooter; I have, twice. No serious harm done, but that kind of thing is another increment of pain and exhaustion in a process with quite a sufficiency of those, thank you.

The ankle started hurting yesterday, seriously enough that I briefly considered actually taking a Percocet, but only when it was horizontal in bed. I think my sensory feed from that extremity must still be a bit disturbed by the aftermath of the nerve block, because it took me almost a day to figure out that the pain was due to external pressure from some of the support scaffolding in the ankle dressing.

I think those rigid parts have shifted around in an unhelpful way due to my crawling around and/or mounting the knee scooter. We’re going to try to get an appointment at the orthopedist’s office today to have someone there inspect and rewrap the thing.

Which means I’m going to have to deal with getting down (and later up) the steps in front of my house. Yeek! Neither scooter nor wheelchair is well adapted to this; I’ll probably have to bust out the kneepads and crawl again.

It hasn’t been all bad. Saturday a couple of my friends from our Friday night game group came over to boardgame with me; Xia: Legends of a Drift System. A good time was had by all.

My far friends on the net have come through as well. My Patreon feed is $356 per month thicker than it was a week ago. And there have been a bunch of one-off donations. John Carmack (yes, the John Carmack) sent $1000, for which I am humbly grateful.

SELF is definitely a scrub, but we’re making plans for me to video in my keynote. Topic change: I’m going to talk about infrastructure sustainability considered as a problem of load-bearing people, and the fact that the hacker culture doesn’t have any customs about how to support our old maintainer/warhorses or arrange an orderly succession when they die in harness.

I’ve actually been worrying about this problem for years, but mostly because of load-bearing people near me who weren’t me. Now my attention is seriously focused. :-)

I am able to work, and a good thing too or I’d be going bonkers. NTPsec is in a bit of a quiet period right now; we’ve delivered NTS, and the next big push I have in mind will have to wait until Go has a TLS 3.0 binding. So I’ve been making progress on the Go port of reposurgeon.

The Patreon is up to $1709 now. At $2000 it would cover monthly mortgage and bills; that’s starting to look attainable, which is a damn good thing given that I still have no clearer idea what the medical stuff will end up costing than “a lot”.

I increasingly think that software users and engineers who care about the infrastructure commons they rely on not collapsing out from under them are going to have to adopt something like the old custom of tithing, in self-defense.

In simpler times, before state-welfare schemes or insurance companies, community citizens in good standing were often religiously required or strongly encouraged to “tithe” – give a small fraction of their income to a church expressly for relief of the poor.

Nowadays we can cut out the middlemen and attendant risk of corruption. We have Patreon and SubscribeStar. Can we grow a social norm that hackers with regular jobs in the profit-making sector should use services like these to split (say) $30 a month among three infrastructure developers of their choice?

Yes, I am asking this for me, now. But I noticed the problem before it was personal. The problem is bigger than me, and the solution should be too.

The point of suggesting a fan-out of three is to avoid a situation where all that goodwill gets captured by a handful of hackers with high visibility (like, er, myself), and people who want to help have a reason to seek out developers who are doing important work in more obscurity.

UPDATE: A few hours after I initially posted this, I went in in to have my dressing remade – something had gone awry inside it and was griping my foot. A mere resident was enough for that, but since I was there anyway Dr. Miller quite properly came for a look-in.

It was pretty amusing to see the “WTF?” expression on his face when he got a look at the week-old incision site on my foot. Completely healed over, no drainage, the only way to tell there’d been an 5-inch-long entry wound was by the purple stitches. As a friend of mine who’s a GP put it on Saturday, contemplating the place on my scalp where I’d gotten a laceration from that fall two weeks before that required three surgical staples, “Who are you? Wolverine?”

Good genes. Goes with the factory-installed brawler package. Makes me guardedly optimistic about the cartilage in the joint repairing itself. Dr. Miller hadn’t been planning to even see me until the 25th, but now he wants the stitches out a week ahead of the original schedule.

And still later in the day J. Storrs Hall (yeah, the nanotech pioneer guy) showed up on my doorstep with a knee scooter his wife had had to use for a while after knee surgery. Means we can stop renting one.

Jun 05

While I was making other plans, part deux

Thanks to everyone who joined my Patreon feed or upped their contributions. I’m still worried, but a little less so now.

Some good news. The post-op pain has stabilized at a level where the occasional Tylenol will handle it nicely. If Dr. Wilson the anesthesiologist is listening, damn! You are good at your job. The timing of the fadeout on the nerve block spared me agony without overdoing intrusive chemicals. This means I will not have to touch the opiates, an outcome for which I am deeply thankful.

The kneepads I ordered yesterday arrived this morning. Big win – crawling doesn’t hurt now, which improves my options. Also helps with dismounting to the floor off a toilet, which is one of those things you will never realize is a big deal until you have to do it.

But the biggest win is the real wheelchair. My mother is connected to a neighborhood non-profit in West Chester that loans out this kind of equipment. When she first went there the only visible option was a service chair, a wheeled chair designed to be moved by a nurse or assistant rather than to enable the user to self-propel, so that’s what she brought back.

It was awful. A service chair doesn’t cope well with rugs or doorsills. The caster-like wheels on the front are perverse; any kind of turning or backing motion inevitably leaves them in a twisted state that make maneuvering nigh-impossible unless the person moving the chair can brute-muscle it around, which Cathy can’t do.

Mom went back and found out about the basement where they keep the good stuff, and now I have a real wheelchair – that is, the kind designed to be driven by the user’s arms. Massive improvement! The lesser part of it is that the big wheels cope better with sills and rugs; the much greater part is that I can move myself around. Having some autonomy back is, for someone with a psychology like mine, as precious as jewels.

Reduces the burden on Cathy, too. Hoicking my 245lbs around in that service chair was barely within the limits of her strength, hard work. I feel better because I can take that load off her now.

Excuse me while I wheel myself out to the kitchen for a ribeye steak from the Outback. And if, dear reader, you fail to comprehend that this, too, is therapy, you are certainly not qualified to take care of the likes o’ me.

Still trying to get my hands on a knee scooter.

EDIT: Tale continued in next post…

Jun 04

While I was making other plans

Today I had to – literally – crawl from my wife’s car to my house. Because I couldn’t walk. Life is what happens while you were making other plans.

About six months ago I sprained my right ankle in kung fu class. It gave me occasional pain, mostly in cold weather, but I thought it was healing and I could just let it heal. Until about two months ago when I was out with friends on a chilly evening and my ankle folded up under me, just lost the power to support me entirely.

I escaped serious injury from the concrete pavement because I am really good at falling down without hurting myself. This is a skill you learn in early childhood when spastic palsy compromises the motor control in a leg. But it meant I had a prompt need to find out what was going on in there.

A couple of visits to doctors and an MRI scan later we determined that I had developed one of the more unfortunate possible sequelae of a sprain, a thing called an osteochondral lesion. This is what happens when an area of bone in the load-bearing area of the joint erodes away, so the cartilage above it is no longer supported. If the unsupported cartilage is then damaged, the long-term result can be crippling arthritis of the joint.

In my case, it seemed I had gotten lucky. The cartilage seemed undamaged in the MRI images. The indicated procedure is to go in with an arthroscopic probe and squirt synthetic bone into the lesion. Once it hardens it can support the cartilage so it doesn’t take additional damage.

I waited nearly a month for the surgery. Two weeks ago, while still waiting, my ankle folded under me as I was cooking breakfast. This time I wasn’t so lucky. I tucked in the right way to avoid injury from the floor, but the back of my head hit an errant chair leg, producing a laceration that bled copiously on the kitchen linoleum.

I picked myself up, applied pressure with a towel, called my wife, and informed her that when her errand was done she’d need to take me to the ER. A short but extremely expensive visit later I returned with three staples in my head and an MRI scan reassuring everyone that I probably hadn’t taken any permanent damage.

I think the medical staff got that before the MRI, because my main coping mechanism for hospital stress is wry humor aimed to make the people attending me laugh. I do it because this helps me feel in control of my situation, but in this particular case it conveyed something else that was useful. Comic wryness is, after all, pretty much impossible to maintain when you’re concussed or shocky.

Home again home again. It’s nice that even at 61 I’m a physically tough person with a high pain threshold and a thick skull who is actually rather difficult to injure – my school name over at the kung fu kwoon is “The Mighty Oak”. And I like that I can be self-reliant and stoic under stress. But thank you, I’d prefer not to have this confirmed by repeated injuries…

I had that surgery about eighteen hours ago. And ended up crawling from my car because none of the medical people talked about or planned for my post-operative problems until after I was out of anesthesia. Pain management was as far as they got.

It was not made clear to me in advance that I wouldn’t be able to put any weight on the joint for a minimum of two weeks, at risk of compounding my troubles. A nurse handed me a pair of crutches as an afterthought, but everyone’s specialties we so siloed that it didn’t occur to anyone to ask if I knew how to use them, let alone whether the impaired motor control in my uninjured leg might disqualify me.

So now it’s oh-dark-thirty the next morning, I’m writing this because the anesthesia and the four hours or so of shut-eye after I got home have left me all slept out for the moment, and I’ve learned from experience that quietly coding or writing until I’m tired enough to sleep again is better for me than tossing and turning.

I was scheduled to give the main keynote at South East Linux Fest on the 14th (this was well before I even knew I was going to need surgery, let alone how close to the event it would be). I’d have to do it from a wheelchair, now. I don’t have a wheelchair yet; we’re hoping to get one tomorrow. It may not be practical at all depending on my medical state, and I can’t even get my post-op check until after SELF. It’s hard to predict whether I’ll be able, and in a mere ten days I don’t think the odds are very good.

Part of the reason this is a public blog post is as my subjunctive apology to everyone who was expecting to see me at SELF, in the all-too-likely event that I can’t be there. Right after I post this I’m going to put a link to it on SELF’s IRC channel and recommend to the organizers that they find someone else to keynote.

I’m not entirely sure a wheelchair will fit in the corridor and through the doors of my house. Until I can verify that, I move by knee-walking or crawling. Besides forcing one to learn how to fall well, another perverse benefit of a palsied leg (or legs) is that the body compensates by making the arms and shoulders abnormally strong; this is helping me now as I frequently have to hoist myself around by main strength. Just getting from the floor to a toilet seat isn’t entirely trivial even so.

I’ve ordered a pair of carpenter’s kneepads for next-day shipping from Amazon. Improvise, adapt, overcome!

Cooking isn’t practical; the ritual of The Breakfast is denied to me until I’m back on my feet. Fortunately I can sit at my desk and type with my right leg elevated, as I am now doing.

There’s no real pain yet; the nerve block is still operating. That will probably change within the next 24 hours. When it does, there’s a vial of Percocet (oxycodone and acetaminophen) pills a’waitin. Which I’m going to try hard not to take, because opiates scare me shitless. Still, my stoicism has limits and they might be tested this time.

There was some damage to the cartilage. The orthopedist said that if it fails to heal well I may need an ankle joint replacement. I am guardedly optimistic about this, as I do have a history of healing quickly and well from trauma (that nasty scalp laceration cleared up inside of a week). But the downside could be dire.

Finally…if you’ve ever thought that you might join my Patreon feed, now would be a really good time. This…adventure..has blown a $6000 hole in my budget and the expenses aren’t over yet. There’s that post-op check at minimum, and probably physical therapy afterwards, and that’s if all heals well; otherwise it’ll be much, much more expensive.

UPDATE: For the rest of the story, read the next post…

Jun 01

The dangerous folly of “Software as a Service”

Comes the word that Saleforce.com has announced a ban on its customers selling “military-style rifles”.

The reason this ban has teeth is that the company provides “software as a service”; that is, the software you run is a client for servers that the provider owns and operates. If the provider decides it doesn’t want your business, you probably have no real recourse. OK, you could sue for tortious interference in business relationships, but that’s chancy and anyway you didn’t want to be in a lawsuit, you wanted to conduct your business.

This is why “software as a service” is dangerous folly, even worse than old-fashioned proprietary software at saddling you with a strategic business risk. You don’t own the software, the software owns you.

It’s 2019 and I feel like I shouldn’t have to restate the obvious, but if you want to keep control of your business the software you rely on needs to be open-source. All of it. All of it. And you can’t afford it to be tethered to a service provider even if the software itself is nominally open source.

Otherwise, how do you know some political fanatic isn’t going to decide your product is unclean and chop you off at the knees? It’s rifles today, it’ll be anything that can be tagged “hateful” tomorrow – and you won’t be at the table when the victim-studies majors are defining “hate”. Even if you think you’re their ally, you can’t count on escaping the next turn of the purity spiral.

And that’s disregarding all the more mundane risks that come from the fact that your vendor’s business objectives aren’t the same as yours. This is ground I covered twenty years ago, do I really have to put on the Mr. Famous Guy cape and do the rubber-chicken circuit again? Sigh…

Business leaders should learn to fear every piece of proprietary software and “service” as the dangerous addictions they are. If Salesforce.com’s arrogant diktat teaches that lesson, it will have been a service indeed.

May 23

The low-down on home routers – how to buy, what to avoid

Ever had the experience of not realizing you’re a subject-matter-expert until someone brings up a topic on a mailing list and you find yourself uttering a pretty comprehensive brain dump about it? This happened to me about home and SOHO routers recently. So I’m repeating the brain dump here. I expect I’ll get some corrections, because at least one of my regulars – I’m thinking of Dave Taht – knows more about this topic than I do. But here goes…

If you’re looking to buy or upgrade a home router, I’ll start with some important negative advice: Don’t go near hardware with a Broadcomm chip in it. The current too-weak-to-thrive threshold for router hardware is <4MB flash or <32MB RAM; if you buy less than that your forward options will be seriously limited. And most importantly: Don’t trust vendor firmware! Always reflash your router with a current version from one of the major open-source firmware stacks.

If your prompt reaction is “I ain’t got time for that!”, then the Romanian, Bulgarian, and Russian cyber-mafias thank you for your contribution to their bot networks and promise they won’t do anything really bad with your router. But they will sell control of it to the highest bidder, all right.

Yes, it’s that bad out there. You’ll understand something of why by the time you finish reading this.

Continue reading

Apr 30

Friends of Armed & Dangerous 2019

Once again I will be at Penguicon and hosting a party for all friends of this blog. This coming Friday evening, room number not yet known, it will be posted at the con.

Those of you who participated in the design of the Great Beast may be interested to know that I expect to receive its successor at Penguicon – a Greater Beast built from a 64-core Threadripper chip. The machine might well be at the party.

UPDATE: room 507, 9pm, Friday

Apr 30

Spotting the wild Fascist

The term “fascist” gets thrown around a lot by people who have no actual clue what Fascism was about. I know what it was about because when I was about 11 or 12 I read Shirer’s The Rise and Fall of of the Third Reich and became fascinated by the question which has driven my study of politics and history for all of the fifty years since. Which is: how do we prevent the genocidal horrors of the Nazi regime from ever recurring?

In the process of trying to answer this question I have read deeply about Naziism, Italian Fascism, Francoite pseudo-Fascism, Marxism, Irrationalism, and several political tendencies related to these. I know their theory, I know their history, and I know what Fascists believed about themselves. Most of all I think I have a pretty firm grasp on how a revival of Fascism in the 21st century would look. And it’s not beyond the bounds of possibility, either…but if it happens, it’s not going to come from where most people currently throwing around the term “fascist” expect.

Hence, a field guide to spotting the wild Fascist. And avoiding false alarms.

Continue reading

Apr 28

Gun voodoo and intentionality

There’s a recent article about gun violence in Haiti that features the following quotes:

But the anthropological lesson from Haiti is that the truth is more complex. It isn’t just the technological lethality of guns that makes them dangerous: They also exert a power on human agency. They change us. It is both the technology and the symbolism of a gun that can encourage someone to shoot.

[…] There is a lesson to be gleaned from understanding the supernatural potency of guns. We cannot think about guns and people as separate entities, debating gun restrictions on one hand and mental-health policy on the other. The target of intervention must be the gun-person composite. If we are to truly understand and control gun violence, we need to accept that guns have potent technological and psychological effects on people – effects that inspire violent ways of being and acting in the world.

This article has come in for a great deal of mockery from gunfolks since it issued. Representative bits of snark: “Apparently, the ‘magic’ of a professorship can turn you into an imbecile.”, “Gun owners in US- approx 100 million. If this bozo was right, everyone would be dead.”, and a picture of an AR-15 with speech balloons saying “Pick me up…Shoot me at unarmed people…you are powerless.”

I’m probably going to startle a lot of my readers by asserting that the article is not entirely wrong and gunfolks’ dismissal of it is not entirely right. In fact I’m here to argue that almost the entire quoted paragraph is exactly correct, and the last sentence would be correct if it replaced the word “violent ways” with “both violent and virtuous ways”.

So keep reading…

Continue reading

Apr 17

Contributor agreements considered harmful

Yesterday I got email from a project asking me to wear my tribal-elder hat, looking for advice on how to re-invent its governance structure. I’m not going to name the project because they haven’t given me permission to air their problems in public, but I need to write about something that came up during the discussion, when my querent said they were thinking about requiring a contributor release form from people submitting code, “the way Apache does”.

“Don’t do it!” I said. Please don’t go the release-form route. It’s bad for the open-source community’s future every time someone does that. In the rest of this post I’ll explain why.

Continue reading

Mar 19

Am I really shipper’s only deployment case?

I released shipper 1.14 just now. It takes advantage of the conventional asciidoc extension – .adoc – that GitHub and GitLab have established, to do a useful little step if it can detect that your project README and NEWS files are asciidoc.

And I wondered, as I usually do when I cut a shipper release: am I really the only user this code has? My other small projects (things like SRC and irkerd) tend to attract user communities that stick with them, but I’ve never seen any sign of that with shipper – no bug reports or RFEs coming in over the transom.

This time, it occurred to me that if I am shipper’s only user, then maybe the typical work practices of the open-source community are rather different than I thought they were. That’s a question worth raising in public, so I’m posting it here to attract some comment.

Continue reading

Mar 08

Declarative is greater than imperative

Sometimes I’m a helpless victim of my urges.

A while back -very late in 2016 – I started work on a program called loccount. This project originally had two purposes.

One is that I wanted a better, faster replacement for David Wheeler’s sloccount tool, which I was using to collect statistics on the amount of virtuous code shrinkage in NTPsec. David is good people and sloccount is a good idea, but internally it’s a slow and messy pile of kludges – so much so that it seems to have exceed his capacity to maintain, at time of writing in 2019 it hadn’t been updated since 2004. I’d been thinking about writing a better replacement, in Python, for a while.

Then I realized this problem was about perfectly sized to be my learn-Go project. Small enough to be tractable, large enough to not be entirely trivial. And there was the interesting prospect of using channels/goroutines to parallelize the data collection. I got it working well enough for NTP statistics pretty quickly, though I didn’t issue a first public release until a little over a month later (mainly because I wanted to have a good test corpus in place to demonstrate correctness). And the parallelized code was both satisfyingly fast and really pretty. I was quite pleased.

The only problem was that the implementation, having been a deliberately straight translation of sloccount’s algorithms in order to preserve comparability of the reports, was a bit of a grubby pile internally. Less so than sloccount’s because it was all in one language. but still. It’s difficult for me to leave that kind of thing alone; the urge to clean it up becomes like a maddening itch.

The rest of this post is about what happened when I succumbed. I got two lessons from this experience: one reinforcement of a thing I already knew, and one who-would-have-thought-it-could-go-this-far surprise. I also learned some interesting things about the landscape of programming languages.

Continue reading