Alexis Mousset

@amousset
90 Followers
284 Following
12 Posts

🇧🇪 Some Rudder team members will be at @cfgmgmtcamp next week

Will you be around?
You should come to attend @amousset &@nico_charles ’ talks on configuration auditing & automating system security 🚀

#CfgMgmtCamp

Repeat after me: if #Firefox stops being maintained, #LibreWolf is not a viable long-term alternative (nor is any other Firefox-based web browser).

"On considère que Mastodon, c’est un bien commun, surtout vu l’environnement médiatique et politique actuel. On essaie de faire notre part et de porter un peu cette parole, surtout en contrepoint à ce qui existe, que ce soit X, Meta [propriétaire de Facebook, Instagram et WhatsApp, ndlr] mais aussi BlueSky."

Très intéressante interview de @renchap, membre de la core team de Mastodon à lire chez @bastamedia

https://basta.media/mastodon-bien-commun-surtout-vu-environnement-mediatique-politique-quitter-X

« Mastodon, c'est un bien commun, surtout vu l'environnement médiatique et politique »

Avec le soutien de Musk à Trump et aux extrêmes droites européennes, un mouvement se forme pour quitter X/Twitter. Mastodon, réseau social non lucratif et respectueux des données, est la première alternative. Rencontre avec son responsable technique.

Basta!

The enshittification of AI has lead to the choice of AI used by VLC to be groaned at. I even saw a post cross my feed of someone looking for a replacement for VLC.

VLC is working on on-device realtime captioning. This has nothing to do with generating images or video using AI. This has nothing to do with LLMs.

(edit: There's claims VLC is using a local LLM. It will use whisper.cpp, and not be using OpenAI's models. I don't know which models they will be using. I cannot find any reference to VLC using a LLM.)

While it would be preferred to use human generated captions for better accuracy, this is not always possible. This means a lot of video media is inaccessible to those with hearing impairment.

What VLC is doing is something that will contribute to accessibility in a big way.

AI transcription is still not perfect. It has its problems. But this is one of those things that we should be hoping to advance.

I'm not looking to replace humans in creating captions. I think we're very far from ever being able to do this correctly without humans. But as I said, there's a ton of video content that simply do not have captions available, human generated or not.

So long as they're not trying to manipulate the transcription using GenAI means, this is the wrong one to demonize.

#AI #Transcription #VLC #HearingImpaired #Deaf #Accessibility

Re last boost: this is something people often don't get about Rust.

Preventing mutable-aliasing bugs is substantially orthogonal to temporal or spatial memory safety. Rust does both! Having GC only addresses one of these. And mutable aliasing bugs are super pervasive and terrible.

(Yes yes FP people: GC + purity addresses both -- and purity also means your GC can be really simple! -- but .. now you have a different problem)

I wrote about this a while back but it was a longer post connected with formal verification implications so was probably TL;DR
https://graydon2.dreamwidth.org/312681.html

graydon2 | Some notes on Rust, mutable aliasing and formal verification

@victorhery @rudderio Les vieux OS passent effectivement en souscription-only au bout d'un moment (et c'est le cas de CentOS 7 en Rudder 8).

Bonne année 🎉

I’ve told LF (and others) repeatedly that “education” as the leading point is insulting. Many maintainers know exactly what they need to do, but they lack time and energy for it. Lecturing them, I mean “giving them skills”, is… rarely the need or solution.

But “education” allows LF (and friends like GH) to continue elephant-in-the-room-ing the actual solution, which is paying maintainers for the trillions of dollars of value they create.

https://fosstodon.org/@donmccurdy/113512775802077660

Don McCurdy (@[email protected])

I've been expecting something like this since the XZ hack, but still ... frustrated/annoyed/sad to see Microsoft and 13 (!) partners jointly announcing that their answer is to “educate” open source maintainers. It's nice that they're compensating maintainers for the time spent on that training, but ... compliance with corporate security policies is still a whole lot of ongoing, unpaid work after that? Sigh. https://github.blog/news-insights/company-news/announcing-github-secure-open-source-fund/

Fosstodon

Went back to this slidedeck by @fanf42

https://speakerdeck.com/fanf42/devoxxfr-2021-systematic-error-management-in-application

to find a point, and it’s so good it’s hard to pick what to draw attention to!

DevoxxFR 2021 - Systematic error management in application

"Our work as developers is mainly to discover and manage non nominal case of applications" Under that stated simplicity lies a complex reality that i…

Speaker Deck

🚀 Envie de booster votre sécurité IT ?
Avec Rudder 8.2 à venir, vous pourrez évaluer votre conformité aux référentiels de sécurité !

Et le petit plus : un score de sécurité pour contrôler facilement la conformité de vos systèmes IT.

#Conformité

I've long warned against the Rust "ahash" construction, which is the default in `hashbrown` (but fortunately not `std`), due to what I thought was a poor cryptographic design which misuses cryptographic primitives, including using the AES round function with insufficient rounds (i.e. 1 round!) to achieve required diffusion.

Turns out someone found a full key recovery attack against it:

https://github.com/tkaitchuck/aHash/issues/163

Critical vulnerability: complete key recovery of AES-based hash through side-channels · Issue #163 · tkaitchuck/aHash

The AES version of aHash only performs a single round of AES between inputs. This is not sufficient, a single-bit difference only gets amplified once in the SubBytes step, leading to one of 256 pos...

GitHub