485300+ entries in 0.31s
trinque: ascii_field: I am referring
to you, not an industry
trinque: ascii_field: seems you should write up what you
think is an appropriate process for maintaining a "mainline" branch
ascii_field: trinque: it is a mistake
to conclude
that i am bringing deep wisdom from some 'respectable society' profession here. i am deliberately and profanely pissing on 'best practices'
trinque: it should be noted
that ascii_field's profession as I understand it is knowing how attacks occur
ascii_field: wtf is so hard
to understand re: 'the canonical representation of
the project must be human-readable' ?
Adlai: it needs
to be written first :)
Adlai: note
that darcs does NOTHING beyond 'patch -p1 <
thingy'
trinque: ascii_field: if people cannot be brought
to obey processes, how can any group activity ever occur?
Adlai: last
thought: a signed-patch-dev mailing list, and some
trivial darcs wrapper
that consumes attachments from
that mailing list
to frob any random repository, whether git, darks, or - for mats's's benefit - cvs. left as an exercise
to
the reader.
Adlai is making
too many
typos
to continue participating in
the discourse
trinque: well,
the social experiment would be instructive, would it not?
ascii_field: and
to have
the canonical representation of
the project be a git
turd
ascii_field: but
this is not what git aficionados want.
they expect -me-
to use it if i want
to participate
ascii_field: notice
that you -can- use git etc personally, no prob
Adlai: and arguing over where exactly
that point is
ascii_field: Adlai: it is a mistake
to conclude
that i
trust
trinque: right, I can guarantee at least
that I have no qualms screaming at a person
that's done wrong
Adlai: ascii_field is just choosing
to
trust intel/amd/etc
Adlai: trinque:
this applies
to
the use of silicon
that you didn't forge yourself
davout: ascii_field: i'm with
trinque here, it's a social problem, not
to be solved by
tools
trinque: shouldn't use
them because an idiot will just end up without an arm?
trinque: ascii_field: doesn't
this apply
to
the use of power
tools?
Adlai: darcs is much easier
to reproduce by hand, since it's JUST applying signed patches
Adlai: davout: it's doable with git, although requires numerous calls
to sha256sum and building 'ls' output by hand
ascii_field: davout: but
that git etc make adding crud easy
davout: according
to Adlai it isn't really practical
to do with git, however, if darcs can output actual clearsigned diffs
that would allow one
to re-construct
the same source
tree by hand and check
the sigs manually
davout: ascii_field: would you have no problem with a
tool
that you can bypass, and build
the source with
the actual signed commits ?
Adlai dogwalks and drinks away
the shittiness of modern computing
Adlai: really
this is all masturbation until we have a by-hand constructible fab
☟︎ Adlai: signed
tarballs are still corruptible, if your
tar (or gpg) binary is diddled
trinque: doing
that manually doesn't make me smarter.
trinque: the process of managing a bunch of feature branches and shit, I want a
tool
trinque: so
the process of establishing
trust should be human and involve eyes
Adlai: williamdunne:
the problem here is more one of convincing ascii_field
that
there exists
trustworthyness outside of his own skull
davout: williamdunne: everybody fucking knows
that
☟︎ davout: williamdunne: look what's your point here?
that one can git-blame?
Adlai: trinque: darcs is even simpler, but has
the disadvantage (which was previously mentioned as an advantage!) of allowing people
to submit changes which cause malicious behavior when combined with previously-signed changes
trinque: but
the data model itself is easily understood
trinque: then you have
the
tool atop
that data model which yes, has all kinds of bullshit
trinque: all
things are blobs, even
the aforementioned
davout: williamdunne: whiskey
tango foxtrot
trinque: commit points
to other commits and a
tree,
tree points
to
tree entries, which point
to blobs
davout: ascii_field: is a
tarball human readable?
ascii_field: git is pernicious for safety-critical code because it - however slightly - reduces
the expectation
that every line of diff is attentively read
davout: Adlai:
that's exactly my point
williamdunne: davout: How is
that different
to git? You can blame individual lines of coding using git
davout: Adlai:
they're functionnaly equivalent, not identical,
the functionality in
this case being
the identification of
the head
to chop off
Adlai: they're not!
the darcs model would've let mircea_popescu submit a single fix
to apache, whereas
the git model requires him
to sign
the entire apache source
tree
davout: they're functionally equivalent, but i guess
that if darcs is a better fit, why not
Adlai: ... but whence
the sed binary?
Adlai: the real problem is
technophobia, "I
trust nothing other
than butterflies and sed"
Adlai: git has
the advantage of a single signature covering
the entire current state; darcs has
the advantage of letting a single signature cover changes alone. it's really a question of use case
davout: Adlai: you're probably right, i
think
the difference isn't
that important
though,
the point of
the wot is
to make an identity valuable
davout: trinque:
that's one
thing,
the other is: whenever i pull i want
to verify it independently
Adlai: so, it's less convenient for signing a patch relative
to an upstream repo; but is exactly what you want if you just want
to have a single head
to put on a stake when heardbleed 2.0 gets uncovered
☟︎ Adlai: davout: an "individual commit" is still just a hash of
the commit message + merkle root of
the source
tree
davout: now, how you verify
them, and how you enforce mandatory signature is something else
davout: Adlai: well, from what i understand of
the docs, you can sign -individual commits- which is a new feature because originally it could only do what you say
Adlai: there's stuff
to be said for either side...
tbh, it seems like signing merkle roots is what yall want
trinque: prudent I
think
to discuss which DVCS
to use
Adlai: davout:
the "sign commits" feature still essentially consists of signing a merkle root of
the source
tree; darks lets you sign
the patch
trinque: having one goddamn
tower
that can get skullfucked by orcs is bad
Adlai: (git only lets you sign merkle roots of
the source code, rather
than diffs)
Adlai: fwiw, darcs is much more friendly
to
the "signed patch" model of modification; git is better for 'signed code'; and neither are perfect
davout: mircea_popescu: i
think you can sign commits, also it can't really be less gpg-friendly
than
throwing
tarballs around
davout: while github is not an option i'm with williamdunne here, git is nice and having a foundation-operated git server would be a good
thing imo
trinque: why have factories in
the US when China will produce everything for us cheaper?
williamdunne: Not like
they can modify
the code or
take it from you, just delete it from
their servers
trinque: williamdunne: enemy
territory
Adlai waits for
trinque
to
take initiative
trinque: not committing
to it while I can't guarantee I'll execute
trinque: if I find
the
time maybe I will
Adlai: stop waiting for other people
to
take initiative
Adlai: so build it
trinque !
jurov: should i make such list? and on
therealbitcoin or some other domain?
williamdunne: mircea_popescu: Still getting; "Looks like you
tried
to comment off a stale page. Reload
the article, count
to
three and
try again."
jurov: would make sense
to have a new mailing list for nonbtc stuff
mircea_popescu: jurov how do i contribute signed non-bitcoin code
to
the great codex ?
mircea_popescu: please everyone do report any bullshit coming from
trilema!