Microsoft C/C++ code keeps on giving:
https://msrc.microsoft.com/update-g...

Too sad, that Microsoft is too poor to afford good devs. As a lot of devs here are sure, that good devs surely can code safe and secure in C/C++, Microsoft probably just lacks the resources to get such devs to work for them.

Beware of NPM packages maintained by Brandon Nozaki Miller alias RIAEvangelist. He added IP-specific malware to node-ipc.

https://security.snyk.io/vuln/...
https://github.com/RIAEvangelist/...

Please give us back the simple linefeed.
There is a huge difference between just starting the next sentence on a new line and having it seperated by an empty line.

You can have the best test coverage - even building your own fuzzing framework on the way.
You can have top notch devs adhering to state of the art development processes.
You can have as big a community and as well-funded a bugbounty program as you want...

All of that doesn't matter if you have chosen the wrong language:
https://googleprojectzero.blogspot.com/...

This would just have been an out-of-bounds exception instead of a buffer overflow using an attacker-controlled payload in any memory-safe language.

Language choice matters!
Choose wisely!

In times of darkness and despair break the glass and purge the caches.

Anyone wanting to improve OpenSSL fulltime?

Understanding of Cryptography or ability to write secure code are not required...

https://openssl.org/blog/blog/...

Shopping still keeps being an annoying task in the web age. The research for what i actually want is fine.

But it is a so damn timewasting and boring experience to sift through all that search results filtering out the non-results and overprized hippster shops first, then trying to find the best matching product on each remaining shop...
They all let you sort by price but not even one offers sorting by price per kilo and only a few offer some sort of product detail filter (which often omit relevant products because of insufficient tagging)...

The last part is rather easy though: compare properties of best matching offers and use the shop with the best offer.

P.S.:
I am fully aware of the fact, that part of the problem is my obsession in buying the correct thing combined with a cheapskate mentality.
So don't comment about just picking the first sorta-matching offer as that certainly would be way too easy (and cheaper because time is somehow money too).

"To help you debug your app or extension, when you've loaded it unpacked, there's no limit to how often the alarm can fire."
https://developer.chrome.com/docs/...

So there is no limit while developing - but stuff will start timing out in production...

Just one question:
Why does Google give their devs Crystal for free?

This is a call to rant:
Please rant about your most frustrating asoundrc experiences here because i am still too frustrated to write about mine.

Does a non-awkward way exist to specify a child class as argument type in a parent class method in TypeScript when the classes are defined in different files?

Does a crypto exchange supporting cashout into fiat on a bank account exists, where you actually can get through the KYC process as a foreigner in a european country?

Asking for a friend who already tried
Nominex, Bybit, Binance, Bitmax and Kucoin - all either without ability to transfer funds to a bank account or KYC broken for foreigners.

Is it possible to display a PNG as it is given (without any extra blurring or "smoothing") in Chrome?

Doxing is not a bad thing anymore!

https://nytimes.com/2021/02/...

Sometimes you keep being the product even when paying for the service:
https://twitter.com/LucaBongiorni/...

For the PHP pros: Is there a way of turning notices and warnings into exceptions thrown in the scope of occurence without hacking the interpreter?

The answer most likely is "No!" - but if there is another way i certainly would like to know it...

+++ Sudo team adopting Adobe's Flash player, uniting security with design +++

Could we please stop pretending, that the choice of language has no security impact:
https://sudo.ws/alerts/...

How to download anything in Kiwix flatpak version?

I only get a Javascript alert with "Error: download failed." whenever i click the "Download" button next to an item in the library.

Also: Why are desktop versions almost unusable these days.
Are devs not owning desktops anymore?!

So why does Thunderbird need to be able to speak SCTP?!

https://mozilla.org/en-US/security/...

+++ Windows 10 NTFS file system corruption 0-Day will be fixed soon +++

https://bleepingcomputer.com/news/...

+++ Microsoft Genuine Snake Oil: The purest snake oil on the market now contains even less remote code execution vulnerabilities! +++

https://zdnet.com/article/...

How to disable "New comments on a rant you commented on!" notifs?

As a true narcisist, We are not interested in people's comments as long as they aren't praising Us and Our ingenious words. As all comments mentioning Us are also praising Us, only showing notifications for comments that mention Us would be fine.

Is it possible to base a custom GTK+ theme on Adwaita without having to compile a custom GTK+?

I planned on following https://worldofgnome.org/creating-g... to solve a scrollbar styling issue for myself.
But that guide seems to be horribly outdated as Adwaita seems to be fully compiled in as an engine now - for performance reasons, wich they obviously would never expect to matter to people using custom themes (because else they would have optimized the application of all themes in general instead)...

Mozilla really knows how to nudge one to not use email encryption by default.
Since Thunderbird has native support for OpenPGP encryption, i can only chose to encrypt all or no messages by default. There is no opportunistic mode and there are no per-reciepient encryption preferences. The Enigmail addon had both.
So i obviously have gone for encrypt-by-default.

But since then, whenever i want to send a message to the majority of my contacts, i have to manually disable the encryption or get annoyed by the no-key-found dialog.
I thought, i would get the muscle memory to just disable encryption for recipients for wich i don't expect to have a key.
But they also made the GUI so i have to open a dropdown and then click on the right item to do that. All the items basically look the same, as there is no color coding or specific icon for them. The item labels are also too long for unconscious pattern recognition.
So i didn't got that muscle memory.

I now have turned off encryption by default and will probably forget to enable it for some emails wich i actually could send encrypted...

Freecad isn't open source software!

If it is impossible to get something compiled, it can't be open source.
When you can't compile it, all, that is left, is to use a binary.
If there is only a binary, it isn't open source.

Seriously: If you are participating in an open source project, please make sure, that compiling from source is a viable option for the generic gentoo user. Thank you.

Why are ranters in general only inserting an image instead of quoting or linking the object of the rant?

When imposter syndrome hits me, i just scroll through the latest CVEs. That reminds me, that even the best can't do it properly.
I also am old enough to have seen the latest shit emerge and disappear multiple times. So there is no pressure to keep up with latest crap of the week.
Also, our industry is full of sloppy corner cutters. So that i am not sloppy and don't like to cut corners, already makes me a rare kind of coder.

Know your strengths!

I am here for some days now and still only see downvote buttons everywhere. There are no upvote buttons.
Is that a bug or when does the upvote buttons become available?