Stephen Crane

73 Followers
272 Following
166 Posts
Still trying to make software more secure, now at Apple. Formerly @ Immunant. Also, gaming, music, D&D, and mountain biking.

Been mulling something... (No, this is not actually a sub-toot) Not sure I have it _quite_ articulated well yet, but getting close... Here is my current best attempt...

I think one thing that really misses the mark in culture efforts, inclusivity efforts, and things like codes-of-conduct for organizations & companies is trying to replicate the approach taken by government/state structures.

For example, using legalistic language to try and establish precision of wording in a CoC. Or structuring moderation rules or response policy as-if rules of law and governments. Or demand "adjudication" of moderation/CoC claims with an innocent unless proven guilty, shadow of a doubt, precise evidentiary rules, etc.

Fundamentally, the context here is critically _different_, and trying to apply the approach of one to the other is a mistake. In both directions.

Open source communities, even companies, are not sovereign states. They do not employ an armed police force or military to backstop their rules. If the state decides "you may not say that", they mean, "you may not say that and live as part of this state". And that determination is backed by the threat of violence. The state and the government _should_ be held to the highest possible standard. Judging someone guilty of a crime and enforcing it through state-backed violence of incarceration had _better_ be innocent until proven guilty, and proven with the highest standard of evidence, oversight, and rigor.

Getting banned from an open source community, or even being fired from a hot-shot tech job is _incredibly_ different. That's not to say that either of these is an inconsequential event -- they can be very consequential. And so folks I think feel motivated to push them to the higher standard. But we also need to be realistic, as these are not state-violence backed judgements. This is not the literal forced removal of your freedom or life. This is at _most_ the loss of an especially lucrative career that must be replaced with a categorically less lucrative career. And that's the worst case. Most moderation decisions are _hilariously_ less consequential. And it's entirely reasonable to use a less consequential process to arrive at them.

The MacBook Neo is such an interesting machine that it coaxed a thousand-word-essay out of me: https://samhenri.gold/blog/20260312-this-is-not-the-computer-for-you/
“This Is Not The Computer For You” · Sam Henri Gold

Sam Henri Gold is a product design engineer building playful, useful software.

Oh! I still have a little bit of time in #Internationalwomensday, don't I? Some of the *great* sf/f writers are/were women.

I just spoke in another thread of CJ Cherryh's extraordinary skill at exposition in fiction.

But there are plenty more.

Andre Norton lit my youth, and is probably the oldest exemplar I know of.

Zilpha Keatley Snyder was there, too, with delightful tween-level fantasy, especially _Black and Blue Magic_.

I just beat the Guinness world record for speed-picking by 4 seconds!

Single-pin-picking, 8 differently-keyed, 4-pin, standard¹ padlocks, in 56 seconds.

And I did it while wearing a fluffy bear suit.

¹ the current record holder used laminated Master locks with no security pins, but I didn't want all the comments on my video to be "Master lock sucks" jokes, so I used Brinks instead.

#AlicePics #Locksport #Lockpicking #GuinnessWorldRecord

Reminder that Apple is hosting an event on March 5 for developers building software on Apple’s platforms focused on Security.

We're going to present all the technologies that we utilize to make iOS the most secure platform in the world. This is a comprehensive event covering writing security-sensitive components in Swift, Memory Integrity Enforcement (MIE), Pointer Authentication (PAC), hardened allocators, and sandboxing/attack-surface reduction.

Sessions are led by Apple engineers working directly on platform security and security tools.

in-person https://developer.apple.com/events/view/D4MG4S3PJ7/dashboard
online https://developer.apple.com/events/view/TUHA23T82K/dashboard

Meet with Apple - Apple Developer

Join us around the world for a variety of sessions, labs, and workshops — tailored for you.

Apple Developer

Hey guess what!

Apparently, a "Feb 11" release date with KDP means "It's Feb 11 SOMEWHERE."

Which means NAMELESS is OUT!!! Available on DRM-Free ebook, paperback, and hardcover!!

Nobody survives winter alone!

https://www.amazon.com/Nameless-Zoe-Ann-Wendler/dp/B0GKWT97XN

Amazon.com: Nameless: 9798218929794: Wendler, Zoe Ann: Books

Amazon.com: Nameless: 9798218929794: Wendler, Zoe Ann: Books

If federal law enforcement is doing everything on the up and up, why are they so afraid of the press and cameras? This isn’t how democratic governments should behave. https://www.youtube.com/watch?v=wHzI6MbDNUw
Federal officers push AP reporters back to their car as they document operation

YouTube

D&D taught me that sometimes you see an exciting magical object, pick it up, and discover that you can't put it down and now you are cursed.

This post is about linkers.

if Intel x86 processors had consistent versioning (inspired by https://sharkey.skydevs.me/notes/ahj2cr1lojtd005z)
Remarkably, iOS also integrates the UDC in a 1-click context, but this bug is not exploitable, because the codec is compiled with -fbounds-safety, which inserted bounds checking instructions, making the bug unreachable.