🚨 TODAY’S THE DAY 📚

After years of work, my new book HYPERSCALE is finally on bookshelves!

It chronicles the data center boom just as the backlash is reaching a fever pitch.

Get your copy today: https://hyperscalebook.com

#tech #books #newbooks #techbooks #datacenters #ai #artificialintelligence #politics

This time Geordi finds out the true meaning of Christmas however they’re trapped in the stick-clicking German-alien’s board game and have to move along home

when you log out of the fedi and then log in again within 10 seconds that is the Reverse Abe Simpson manouver ' src='https://fedizen.net/files/redir/s3/data/uploads/0AND0MSTRANGERS0FF1NTERNET/emoji/01M4FDK464GC5ZVG4SD6M1NDRF.png' />

#fediverse #simpsons #tips #oldguy

Also https://deadsimpletech.com/blog/no-such-thing-as-just-a-tool.

@mastodonmigration

@strypey

Just to be a pernickety ex animator, using voice actors facial expressions to inspire animated facial expressions is an artist thing and not in the slightest limited to Disney.

Yes, it could be argued that Disney were some of the first to do it in films, as they were the first making animated films in general, but even before then you had other animators making shorts (eg Max Fleischer) using this technique and even before animation, artists were using the technique in drawings and paintings (ie making a facial expression in a mirror and using it to model the character they're drawing/painting).

Yes, most people first hear about his technique though, through Disney "making of" docuvertisments which always seem to have a shot of animators doing it.

#Animation #History #Disney

あと田舎の舗装状況もみていいョ

"i'm sorry i'm sure i'm gonna butcher all these foreign names" JUST LOOK THEM UP AND LET GOOGLE READ THEM TO YOU

@georgetakei
She choose him and enjoys luxury and power.

@jalefkowit 4 adjoining server cabinets could be converted into like 5 sleeping platforms. What will be the rent on that after the bubble pops?

デカフェという言葉を聴きましたら、ふつうデカいコーヒーの略称であると考えるのが自然でありますが、いま一般にデカフェと言いますとカフェインの抜かれたコーヒーの名称とされておりまして、わたくしはこれを聴きますと、適当ではないと思っております。そこでわたくしは、是非とも皆さんに、デカいコーヒーの略称としてのデカフェを、愛していただきたいと思っております。

@aburka, absolutely nobody could have predicted that outcome.

@mrgtwentythree CGI was and still is a bad idea: so many of PHP’s issues have come from passing stuff in via env vars.

@mgorny maybe baking certificate stores into absolutely everything was not the greatest idea

It's kinda funny that the certificate compromise comes just after another round of upstreams bashing at distro packaging.

Let me get this straight for the people in the back. In a perfect world, you'd just upgrade a single package on your system and be good. Unfortunately, we're far removed from even a reasonably good world.

Pretty much everything that matters in #Python uses certifi. dev-python/certifi in #Gentoo is a fork that uses system certs, so our system install is good. But in every virtual environment (venv, conda, etc.), you need to upgrade certifi.

certifi is also bundled in a bunch of packages, including pip. dev-python/pip in Gentoo has certifi unbundled, but you need to upgrade pip in your virtual environments (using vulnerable pip!). On Gentoo systems, you also need to upgrade dev-python/ensurepip-pip, which is the upstream wheel which we couldn't figure out how to unbundle.

pip is also bundled in Python to bootstrap venvs. In Gentoo, we're configuring Python to use our system dev-python/ensurepip-pip package, so as soon as you upgrade it, you're good. But where this isn't the case, you need to wait for new Python releases and upgrade, because otherwise venvs will start with vulnerable pip. On the plus side, you can remember to upgrade it after creating a new venv.

Lock files are particularly popular in the Python world, and a dependency cooldown is the new fad. You will need to update certifi in them, and exclude it from dependency cooldown.

Many #RustLang packages (think uv) also use a bundled certificate store. All these packages need a lockfile update and rebuilding, meaning downstream patching or new upstream release. So yes, everyone (including Gentoo users, because Rust doesn't really support dynamic linking, great design for #security) need to update uv, and possibly wait to discover more random Rust packages that are vulnerable.

I'm also going to guess that all flatpakers are affected, all popular browsers, and possibly everyone else who knows better than to use distro packaging. All containers are affected, and will need to be rebuilt, with new system certificate stores and all the packages that bundle their own stores…

And the best part is, most of these upstream package distribution systems have no other security layer except for TLS certificates. You can update Gentoo packages safely, because we are using our own key infrastructure. But pip, uv and so on are subject to a MITM risk while upgrading the vulnerable packages.

This is the true definition of clusterfuck.