> So, a bad actor can now know when I'm at my house or not.
A bad actor who wants to act on that information can just wait near your house on a workday morning and watch you leave, likely not to return for the better part of the day. No techno-voodoo required.
The upstream has no public repository, neither on GitHub nor anywhere else.
JWZ might not even use git in the first place, the source might be in a local SVN repo, or just a series of tarballs and patches, assuming it is version controlled at all.
I didn't criticize the motivations to ditch GitHub. I applaud that.
I criticized the intentional creation of a GitHub account just to write a README file wherein they say that there's no repository, instead of providing any useful information for people looking for a repository.
If there's no repository and you go to such great lengths just to clarify that there isn't any, then maybe you can just push your code to codeberg or gitlab or a selfhosted gogs instance if you don't trust them?
Nobody said that he MUST accept pull requests or MUST engage with any community at all. You can just disable all the features, I do that too since 4chan raided my repos in 2021 and GitHub didn't do shit about it.
But this way at least there's no risk for people installing malware infiltrated forks of xscreensaver on their machines. And that's what is the important part that wasn't actually solved/avoided/prevented with that README file.
The page provides useful information. It tells you where you can download the XScreenSaver source code (from https://www.jwz.org/xscreensaver/), and how you can send patches (via email)
It doesn't need to provide anything else. Nobody is required to sign up to your preferred platform, or make their work available in a way you prefer to consume it. Get over yourself. If you want to contribute, contribute as requested. Or don't, the license allows you to host your own version, just be clear it's your version.
JWZ went to great lengths on github.com, solely because some other shitheel registered the "xscreensaver" organisation and went out of their way to make it seem like it's official, and github.com's google juice means it outranks the real site. Hence the need for the effort to solve that problem (reputation management and SEO after a copycat misrepresents themselves as you)
Putting a repo on Github, versus putting a notice on Github that there's no repo, does not change the risk of people installing malware. While someone else still has the top ranked page for your software, they remain the most likely place a moron in a hurry[0] will download from. You adding a repo doesn't help, you getting their repo removed, and salting it to prevent recreation, does help.
Having spent (way too much) time on HN, I have come to realize that there are people in this industry -- in fact quite a few of them -- who cares nothing about being nice/cooperative/helpful/pragmatic and getting things done, but just want to show off their ego/opinion and make a statement.
Many names come to mind but I am too scared to post that list.
Given that MED-EL, the company mentioned in the article, has been around since 1990 and is constantly expanding, I would assume that this is indeed viable.
I live in Innsbruck, Austria, where MED-EL is headquartered. Like most people I know, I too have briefly worked there in 2008. I currently live 5 minutes on foot from where the entrance used to be back then, before it was walled off, they massively expanded the building and added another building behind it, where in 2008 a bunch of office containers with clean rooms used to be. There is now a raised walk way to the other side where they used to rent just a few units back then and now co-opted the building, plus a patch work of smaller rental spaces all around.
The implants themselves are not cheap and (at least at the time?) eventually needed to replaced. From what I recall, some of the technology involved was also licensed out or sold for other applications. Ultimately, I would also guess that all the licensing, approval and red-tape involved in actually making implants for humans also kind of limits competition quite a bit.
> Given that MED-EL, the company mentioned in the article, has been around since 1990 and is constantly expanding, I would assume that this is indeed viable.
I think currently it is viable because MED-EL is not a publicly traded company or in the hands of some private equity or some MBA. I know that there are serious concerns how MED-EL will develop when the Hochmaiers are not in charge anymore.
> and (at least at the time?) eventually needed to replaced.
All cochlear implants from any of the cochlear implant companies have a % chance of needing to be replaced. Failure rate is something like 4% in the first 10 years, and 10% in the first 20 years.
Any patch that is back ported to a stable kernel, indiscriminately. And they have also started assigning CVSS scores with the same kind of malicious compliance.
Take for example, this patch in the device mapper RAID code:
Reasoning behind it being that theoretically, a RAID could be accessible over the network via NFS, iSCSI, etc... so if it gets corrupted, the buggy code path in the recovery (CVE-2026-89558) is effectively triggered over the network.
There's nothing malicious about the CVE. It lets people use it to index issues, like it was supposed to, and stops dumb people from using it as an indicator of work done or vulnerability level, things that it was never useful for.
The argument is not esoteric. An Apple employee working on a reverse engineered GPU driver might (intentionally or not) incorporate internal knowledge that they are contractually obligated to keep secret or write an implementation that is too close to proprietary code they had access to, to the point that it could be argued that it is a derived work.
This sort of thing has always been a concern for projects that re-implement some existing piece of software, e.g. there were concerns early on during development of the GNU project about people contributing after having been exposed to Unix source code. Similarly, it is an ongoing concern for the Wine project[1], as well as ReactOS. The later even had a code freeze and internal audit in 2006, after allegations came forward that code had been derived from disassembled Windows binaries[2].
Exactly! That’s why companies create a clone every time they hire someone, put a clone into vat, and upon person quitting, the person is disposed of and the clone is sent to his family to take upon his role, without leaking company’s internal knowledge.
> the "IDunno" of archeology - "It most likely served ritual and cultural purposes"
If all you know about archeology is from daytime television and clickbait articles, all you know about history is what you vaguely remember from school, you never met anybody working in those fields and actually don't even have a passing interest to engage with the subject, then yes, you might be inclined to believe that's how it works.
EDIT: of course this comment accumulates nothing but drive-by down votes from arrogant computer touchers, presumably before heading off to other comment sections to discuss law, macroeconomics, quantum physics and whatever else they are experts at, having watched YouTube videos. You see, only CS requires years of study and is divided into dozens of intricate sub fields, everything else is simple, straight forward and can be "disrupted".
Remember, when it was "dig" even if it is destructive. Now its scan, map- return when the scanners get better, read scrolls of ash via scanner. We are 10 years away from a "Do not disturb ground" sign on every suspected digsite.
> Then it would be possible to reuse old embedded equipment.
Unlikely, virtualization/emulation has been a thing well before this project and you can just buy USB to RS232 adapters. There are GPIO solutions for industrial PCs other than the parallel port. Or you can simply buy new industrial PCs which have those ports.
If you find an industrial appliance controlled by genuine old PC hardware that hasn't been replaced, the RS232 ports are the least of your concerns.
In my experience, such machines usually have something insanely proprietary plugging into a custom ISA card, and whatever is connected to it usually doesn't take too kindly if the bus timings are off. And neither does the accompanying bare metal software that relies heavily on timing loops and hardware peculiarities.
I've been holding on to a couple of fanless industrial PCs as much for their cases (I could drive my truck over one, and it wouldn't even make a dent) as for any possible future uses. As time moves on, being able to use them looks less and less likely.
supposedly with a minimum of 4M RAM even! [1] I have a machine with twice that clock and twice that RAM that a friends parents wanted to toss out[2]. I spent the better part of a day getting Windows 3.11 and Office 4.3 to run. Playing around with it for a bit, I highly doubt that Windows 95 on minimum requirements would be anything but endlessly frustrating. I was not masochistic enough to try.
I ran Windows 95 on a 386SX-16 with an 80387, with 5MB of ram for a year as my main machine. It ran about as well as 3.1 did. The only real drawback was the disk space required for 95 over 3.1 + DOS.
A bad actor who wants to act on that information can just wait near your house on a workday morning and watch you leave, likely not to return for the better part of the day. No techno-voodoo required.
reply