Hacker Newsnew | past | comments | ask | show | jobs | submit | piscisaureus's commentslogin


Wow, thank you! That's amazing! Can't believe not only has it been done, but it was 3 years ago and was very popular!


Not sure if I agree with the scoring model here.

I tried two phone numbers: my primary cell phone number gets a great 800+ score but reveals an accurate address history of 9 years.

The second one gets a poor score (415), but none of the data is accurate. Have fun: https://gist.github.com/piscisaureus/03d5ebeeb3e77922a858464....


The scoring model is based on how likely you are to be targeted and hacked. Multiple points of data make it exponentially easier to do successfully. So just one address is not always the worst thing. Having tons of data on your phone (even if some of it is inaccurate) may also make you more of a target.


I found https://github.com/pfpacket/rust-9p to be reasonably good and easy to hack on. My fork (https://github.com/piscisaureus/rust-9p) has some patches to improve support for the 9P2000.W dialect used by Windows.


> However I'm now in situations where the world is divided and asking questions (in order to make my own mind up) is considered some kind of admission of guilt for being part of the "other". For example: Asking someone why they think immigration is good/bad. If it's a belief they hold, I'm interested in knowing the thought process and making my own conclusions based on something I might not have known. But the act of asking the question makes the person, who may not have put too much original thinking in; quite defensive.

It may be a matter of knowing when to stop. My personal experience is that most people will try to answer even sensitive questions when you approach them with genuine interest and make some effort to formulate questions in a way that doesn't imply some sort of value judgement. If this is difficult, just be explicit and explicitly say you're not trying to judge or offend them.

Sure enough, you'll hear people make an argument that you find unconvincing, or they may not answer the exact question that you asked, and some people will even admit they don't know why they believe something. When that happens, you'll have to accept that as their answer (and draw your own conclusions in silence).

People do get hostile when you keep "nagging" - asking more and more questions - when it's clear that they aren't interested in the subject or haven't thought about it much. To the other person it feels like you're either trying to make them feel stupid or change their mind. And you're getting none the wiser anyway because those who do not get offended will just make up their "reasons" on the spot.

Obviously avoid the mistake to ask someone for their opinion, and then immediately returning the "favor" by giving your opinion on the matter.


This is the first time I've heard about a language called C--, thank you for that.

The concept is not so unique as you might think tho; the more commonly used term is "tail call".


i always thought "tail call" means a function call that can be optimized in this way (located in a tail position), not the act of call-by-jumping itself. both uses make sense though

re: C--, i think it's mostly used as a compiler IR. (notably in Haskell's GHC)


Ecma-402 support (the 'Intl' object, locale dependent number and date formatting, etc.) requires linking with the ICU library.

We expect to support that in a future release.


In the meantime there's stuff like this:

https://deno.land/x/date_fns@v2.15.0/locale


I understand that reviewing 27k LoC is daunting and probably not very fun.

But unlike most patches that draw a similar response it's not a narrowly useful patch that mostly serves the submitter. Proper NTFS support benefits a large proportion of Linux users (the jab from the article that there are more advanced file systems out there seems out of place; there are no signs that windows is about to switch its default FS to something else).

Additionally this code has been used in production for years now (e.g. my 2015 router runs the closed source version of this driver in order to support NTFS formatted external drives) so most likely a lot of quality issues have already been found and addressed.

So I feel it's a bit unreasonable to respond with so much negativity to this contribution.


It's also no big deal from either side. Paragon sent in the patch and it's appreciated. There's a few problems to get this in. Reviewers noted the issues and what would need to be done to get this through. The process to get this in is happening.

Split your diff! and Fix your makefile! have to be one of the most benign and common pieces of diff feedback i've seen. I feel that you could make a media story about any submission to the Linux kernel based on there being comments in the review process.


Admittedly I didn't actually read the mailing list discussion. It's entirely possible that The Register made up a big drama where there was none.


I read the discussion. There's no drama at all. Paragon did an unreviewable code dump with intent to maintain and they are warmly welcome in general. David laid out the path to review and probable acceptance https://lore.kernel.org/linux-fsdevel/20200815190642.GZ2026@... If there was any fuss it's because of the unreviewable nature of the patch but especially by kernel standards the discussion was cordial. In fact, aside from Nikolay's outburst by any standard it was a cordial discussion. (Someone should've gently told him this is no way to welcome newcomers especially newcomers carrying such a gift.)

Others noted it needs to pass the existing test suite and that it is close.


Not sure if this counts as drama per Linux kernel mailing list standards: https://lore.kernel.org/linux-fsdevel/2911ac5cd20b46e397be50...

> So how exactly do you expect someone to review this monstrosity ?


It seems from the link that the kernel developers would rather have one patch per new file plus a patch that does the integration, instead of one big patch with everything. That's a bit unconventional, perhaps because they tend to use git alone instead of higher-level software that would help them break down a big single commit; but whatever they're doing clearly works for them.

The entire dispute seems to be that minor question of style, nothing substantive. I don't think anyone's specially unhappy on either side. The controversy seems manufactured, perhaps by a reporter who noticed the gruff language but lacked the technical knowledge to understand what's actually going on.

Most people developing free software (probably including both the submitters and recipients of this patch) could make a lot more money elsewhere, but have chosen to instead to do work with considerable public benefit. That's thankless enough already without some reporter inventing drama for clicks.


> perhaps because they tend to use git alone instead of higher-level software that would help them break down a big single commit

git is capable of breaking down a large diff into manageable pieces (e.g., limiting a diff to a single file), but reviewing code in a mailing list means replying to the message that contains a patch and replying inline to certain parts to comment on it.

As for higher level software that could break down a large commit, what specifically do you have in mind? I can't think of any feature that other review tools like Git??b, gerrit, reviewboard, phabricator, etc. that would make something like this easy to review.


I meant like GitHub and competitors, which let you attach comments to specific lines and files and such, and perhaps follow references into the full code faster than you could flipping between your mail client and your editor (and save you the effort of applying the patch to a local tree for that review). Since the kernel developers prefer to discuss on a plain mailing list and not use such tools, it makes sense that they prefer smaller chunks.

27 kLOC will be a big project to review no matter what, but I'd probably rather take them in a single commit--the files presumably depend on each other, and there's probably no order in which the files could be reviewed in isolation without reference to files not yet reviewed. (Obviously we try for hierarchical structure that would make that possible, but not usually with perfect success.)

That's a matter of personal preference, though, and people who want a project to merge their contributions should adhere to the maintainer's preferences. In any case, it seems Paragon intends to do exactly that. I doubt Paragon expected their reward for their contribution would be an article read by thousands of people that called it "half-baked" over this minor point, and I can't imagine such publicity encourages others to make similar contributions in future.


> I meant like GitHub and competitors, which let you attach comments to specific lines and files and such

Github does allow you to filter the diff down to the commit or jump to a particular file within the diff. Commenting on a line in the diff isn't really any different than positioning one's comment inline below the relevant line(s) of code in an email reply. I know that in Github, it's also possible to comment directly on a commit (though those comments are not displayed with any context in the general PR view), unlike an email reply to a particular patch series.

Depending on one's email client, it's certainly possible to search for things like /^diff/ or /^@@/ to jump from file to file or hunk to hunk within the compose window.

> perhaps follow references into the full code faster than you could flipping between your mail client and your editor (and save you the effort of applying the patch to a local tree for that review).

For some, the email client doubles as an editor (i.e., gnus). And, at least in my experience, it's far faster to navigate code in an editor compared to the web interface that Git??b provides.

> 27 kLOC will be a big project to review no matter what, but I'd probably rather take them in a single commit--the files presumably depend on each other

While that's true, the dependency can be preserved when merging the branch of the series of commits in the mainline repository. Plus, many may find it easier to review declarations, definitions, and calls in that order.


> Most people developing free software (probably including both the submitters and recipients of this patch) could make a lot more money elsewhere

I think most free software developers are normal corporate employees. I work on tons of free software as my job, like most of my peers, but that’s normal in the industry. I don’t consider myself a free software developer.


Fair--depending what "most" is weighted by, I may have overstated, and a Google employee who happens to get assigned to work on Chrome stuff is certainly making no personal sacrifice.

I meant independent volunteers or people working for free-software-focused companies (which I believe usually offer well below FAANG-level compensation, especially at the high end, though still enough to live quite well). Excluding hardware vendors porting Linux to their own products, I believe the core kernel developers tend to fall in to that last category. I have no specific knowledge of their individual compensation, but the technical leads responsible for closed-source projects of similar scope make incredible amounts of money.


It’s a legitimate concern - I would not assume malice. How exactly would someone review a 25k loc .patch file?


It would be tough, no doubt.

But it's not like splitting the feature into 100 patches of 250 lines each would make it any quicker to review. Or merging code that was known not to work, as it was only a fraction of what was needed for the functionality.


> But it's not like splitting the feature into 100 patches of 250 lines each would make it any quicker to review. Or merging code that was known not to work, as it was only a fraction of what was needed for the functionality.

That would also be rejected, because the kernel maintainers aren't idiots and their standards aren't the stupid arbitrary rules you construe them to be. They generally want big changes to be broken up into logical, sensible chunks that each leave the tree in a usable state, so that git-bisect still works.


How do people merge big new filesystems in practice though? Especially one with years of pre-existing out-of-tree development?

I guess one could start by merging a skeleton of the filesystem which supports mount/unmount but then returns an IO error on every operation? And then a patch to add directory traversal (you can view the files but not their contents), and then a patch to add file reading, and then a patch to add file writing, and then a patch to add mkdir/rmdir, and then a patch to add rename/delete of regular files.

Breaking down an existing filesystem into a sequence of patches like that, no doubt it is doable, but it is going to be a lot of work.


My guess is that given the history of this filesystem implementation, most of the review effort will be focused on the interface between this FS and the rest of the kernel. It's typical for all the changes touching communal files or introducing generic helper functions or data structures to be broken out into separate commits. If any of those helpers are a reinvention of stuff that's already in the kernel, there will need to be a justification for why NTFS needs its own special versions. It's not typical for a large patch series adding genuinely new stuff to be broken up into absurdly tiny commits. For the stuff that's truly internal to the filesystem implementation, it looks like one patch per file will be an acceptable granularity.


I didn't mean to imply otherwise. Drama is often not malice and rather due to legitimate concerns on one or both sides.


I assume malice because of the tone. The concern is legitimate, the tone is offputting.


Welcome to Linux kernel development. By lkml history, this tone is very mild. There are many examples of far worse commentary and personal attacks on devs. I’m not justifying this by the way. Linus can be a very smart jerk, and as a leader (THE leader) he sets the tone for what’s acceptable in the community.

https://www.zdnet.com/article/linux-developer-who-took-on-li...


There wasn't much drama in the mailing list discussion as I read it. Mostly comments asking "can you make this easier for us to review?".


There were two specific concerns in the initial review that I think were reasonable:

1) The Linux kernel already has an in-kernel read-only NTFS driver. What should be done about it? (There are a number of reasonable options here, including just getting rid of it and replacing it with Paragon's, but that requires at least some buy-in from the maintainers of the existing driver.)

2) The patch didn't actually build, which was a one-line Makefile fix, but raised some concern about how it wax tested/how the patch was generated.


> Facts (like someones net worth) cannot be copyrighted. However a compilation of facts can be.

... in the US.

In the EU and UK there is separate copyright-like legislation that covers this, so-called "database rights".

https://en.m.wikipedia.org/wiki/Database_right


This is something that we'll further work out in future versions. For now you can use a lockfile: https://deno.land/manual/linking_to_external_code/integrity_...


> Deno can store and check module subresource integrity for modules using a small JSON file. Use the --lock=lock.json to enable and specify lock file checking. To update or create a lock use --lock=lock.json --lock-write.

HALLELUJAH that there is a clear, simple separation of when (a) you expect a lock file to be checked to guarantee integrity and (b) when you want it to be generated. The complete insanity that was npm shrinkwrap and lockfiles for years, summed up in this stackoverflow post https://stackoverflow.com/questions/45022048/why-does-npm-in... , always baffled me in that it seemed like it could have just been so easily avoided about being explicit when you're writing a lockfile vs. when you're using it.

That said, why not be even MORE explicit about it, i.e. "--use-lock=lock.json" vs. "--write-lock=lock.json"?


This looks really promising.

However, it still seems risky to me in case a library is not available. Is there a central repository planned? Or are you expected to vendor everything and ship your project with dependencies included?


Instead of referring to the version could you refer to the hash? Then a simple integrity checker could confirm file changes.


If PayPal says it is not a security issue, the researcher should just publish the details of how it's done.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: