I don’t know the details of that part directly, but I do remember reading things like this which seemed to indicate delisting of some maintainers (positions of responsibility, as opposed to blocking all developer contributions) who were associated with certain sanctioned Russian companies. This seems to be in line with standard sanctions being imposed by many companies & organisations in various countries (not just USA). Regardless of personal opinions about whether that was “right, wrong, or otherwise” at the time it at least seems a far cry from “an NSA compromise”.

I will try to answer these, and hope someone corrects any potential innaccuracy:

what’s red?

There is a comment there saying “see deep-dive for details” so the red-highlight caveat is likely explained there.

what’s the globe icon?

My assumption is that icon just indicates Free/Open-Source projects which have no “owning company” (not “based” anywhere), just globally scattered contributors.

how come some products marked not majority EU owned have the EU flag?

My guess (merely a guess) is that those are run by EU-based companies, but which don’t have a solid policy guaranteeing “majority of shareholders are in the EU” (…?)

Having not heard of this one, I was curious so checked some sites about it, like:

https://www.reddit.com/r/linux4noobs/comments/kd0yml/does_the_nsa_have_a_backdoor_to_linux_this/

https://www.theregister.com/2022/02/23/chinese_nsa_linux/

https://www.bleepingcomputer.com/news/security/nsa-linked-bvp47-linux-backdoor-widely-undetected-for-10-years/

My quick impression from those seems to match what was said by some commenters on the FreeBSD forum - https://forums.freebsd.org/threads/nsa-linked-bvp47-linux-backdoor-widely-undetected-for-10-years.84258/

msplsh: This looks like an implant that opens a backdoor, not an intrinsic backdoor built into the OS.

and:

sko: From el reg: To us it seems whoever created the code would compromise or infect a selected Linux system and then install the backdoor on it. So if someone already gained privileges to install anything on one of your machines, it doesn’t matter what it is - this host is compromised and has to be nuked from orbit.

So, unless I’m missing something this is not really about “the Linux kernel devs being compromised by NSA” as much as the endless list of Windows-targetting malware is not about “the NT kernel devs being compromised by NSA”.

I’m glad that wording got clarified, otherwise people’s mental images could have taken a disturbing turn. :-D

This little exchange felt so wholesome in a deliberately counterintuitive way. :-D

I agree. I suspect the internet will retrospectively eventually even be looked at as an “information revolution” on par with the industrial one. I know that sounds like an enormous claim but there is a long road yet, so I don’t think it will turn out to sound so crazy. Each revolution (and its increase in power) comes along with responsibilities and potential dark sides, though. I think similarly to how the industrial revolution opened the door to industrial war, we are already seeing the pain brought by various (distributed, automated) information war techniques. I love how we live in an age now where a person with internet access and enough tenacity can eventually learn almost anything, and contribute back, but at the same time I worry deeply about the rolling waves of belligerence, disinformation & selective amnesia coercion, gatekeeping, and fraud that have come with it. I hope humanity can get those under some degree of control soon.

Also, pondering again your comment which spawned this slightly lengthy subthread, namely:

If we say “males and females” and use the equivalent terms for both, is there a problem with this? Because it’s not treating them differently so I don’t really understand

I am not a linguistics expert so I’m probably not using exactly the right terminology here, but I think the bit that matters is using:

1. adjectives as reductionist/caricaturing pseudo-nouns

2. when any such words are used merely as labels vs as signifiers for emphasis

Namely:

A. Calling someone a “human” or “person” is using a less common noun as ambiguous label

B. Calling someone a “woman” or “girl” or “man” or “boy” is using a common noun as general label

C. Calling someone a “female human” or “male human” or “female person” or “male person” is using an uncommon adjective-noun combination as explicit signifier

D. Calling someone a “female” or “male” is using a usually unwelcome adjective-as-pseudo-noun as reductionist signifier

In this context “reductionist signifier” means “reducing the value, worth, and significance of a person to only that defined by a single abused adjective”. So a line in a book which says “The bar full of people fell silent when a female entered the room” is implying that the “people” (probably primarily/entirely male, by inference) are “whole people” (with hopes, dreams, struggles, character arcs), while the “female” is as far as the writer cares merely a one-dimensional representation of a (different) gender, and not “a whole person, who happens to be female”. I remember reading long ago (but can’t remember attribution): “Never trust an author who shows you they don’t care about their characters”. I think the application of that can be extended from authors to people in general, based on how they speak.

If I’ve read your comment correctly I think we actually agree on all points, but my hurriedly written comment didn’t communicate two of them as clearly as I would’ve liked.

1. We concur that consistency of terms matters, words are the skeletons of thought-processes and therefore biases, etc.

2. I realise my emphasising the phrase “biological descriptors” was a bit misleading and strictly speaking actually wrong, but in my partial defence I was trying to avoid more scientific words when not necessary (not wanting to drift into pretentiousness). In light of your observation about biology vs gender identity (which I agree with), probably my point would be more correct if I’d used a phrase like “reductionist differentiation descriptors”. Even if accurate that sounds a little pretentious so I’d love any domain-expert to chime in with a more accurate-yet-concise phrase.

3. I used the rat example purely as an example of a research context divorced from social/political connotations, not as a human-animal vs non-human-animal differentiator (not implying any double-standard there), hence why I followed it with the example of how paramedics also use it. My point could equally have used a “10 humans…” example.

I think, as with many things, it is about context. When doing a scientific reproductive study about “rats - 5 male, 5 female” it makes sense to use biological descriptors, and when paramedics do it in a biological emergency, etc. A good way to understand it is via other similar trajectories, like racism. Would you consider it reasonable to refer to a “white man” while referring to another “man who’s a black”? For example only a few decades ago you might have heard a cop in the US (or South Africa, in Afrikaans) say e.g: “I saw 5 men leave, and 2 of them were blacks” vs what you would (hope to) hear now: “I saw 3 white men and 2 black men leave”. Look at those 2 sentences substituting “white, black” -> “male, female” and “men” -> “people”, and that should highlight the point (in a slightly grammatically clunky way though because I don’t have time to come up with a more elegant example).

I understand your point and to avoid two apparently valid points talking past each other I suggest these both look like cases of suffering under the general “stay in your lane” mentality. In that context the “counterpoint” you are replying to seems to support the initial point rather than conflict with it. To clarify, that context is the very outdated mentality of “Women ‘should’ raise the kids and keep the family healthy, while men ‘should’ go out and do society-stuff. Girls ‘should be’ raised to handle interpersonal challenges and ignore other stuff, while boys ‘should be’ raised to ignore interpersonal challenges and handle other stuff”.

…and not just movies. My partner and I steadfastly try to do all “interacting with kid’s school, extracurricular and social groups” stuff 50/50. We always strive to go to (and host) such important events together. We always indicate we should both be added to mailing lists, and give both our phone numbers as contacts, etc, etc. However, much (sometimes most) of the time people only ever call her about kids playdates, medical professionals default to discussing his issues with her exclusively even though I am sitting next to her and commenting too, when there is a parents’ chat/mail group for his classes or other activities usually she gets added and then has to help me muscle my way in to the group (and the groups are often all women). Once at a preschool party a parent saw me interact with my kid, came and asked me to point out his mother, then went to her to invite our kid to a birthday party. It’s never-ending for a father who strives to be a “caring father”, and not just an infantile “toxically masculine, one-dimensional, emotionally stunted cliché” in terms of “role model”. It is exhausting for both her and me, but is also extremely demoralising for me because trying to be what you believe to be the right kind of role-model is one of the most important yet virtually undocumented parts of parenting, and even more demoralising because it still happens even after I hugely reduced my external workload in order to be the primary “stay at home” parent. One small positive step is that the country we live in introduced “paternity leave at child-birth” legal requirements (much smaller than for maternity leave though, and only introduced after my kid was born [sigh]). In popular culture it has become a trope that women suffer endlessly trying to play the role of both parents to compensate for idiotic (or selfish prick) fathers, but it glosses over the fact that a man who actively tries to “be the change” (and any woman who tries to facilitate that change in solidarity) are so often tripped up at every step by this pervasive (and often subconscious) intellectual and emotional inflexibility. One other small positive is that I occasionally find another father who feels the same way (and who is often just as frustrated and burned out by the state of things) …sometimes - just one or two. Having previously lived in many countries/continents I also know that the country I live in is far from the worst offender for this, which makes it even more pathetic globally.

Everything is based around violence. Like really, is that all boys are good for?

Oh yeah, you are so right. It feels at times like - when I’m not teaching him to play football (violently), and not egging him on to emulate (violent) action figures, and not buying him fake guns to play with (violently), and not telling him to “man up” instead of taking time to understand his feelings, etc - there seems to be a degree of subliminal judgmentalism directed at me for not “sticking to the job description”. It seems many people will prefer to see the world burn in preference to accepting someone disregarding parts of the “normality” rulebook based on rational introspection, including those who would never admit it out loud, and even some who haven’t yet consciously realised they are standing on that side of history - perhaps because it holds up a mirror to them not doing so (out of fear?, laziness?, bitterness-fueled pulling-up the ladder?).

Yes, I’ve had that a few times. Although being substantially older than your manager is externally no big deal unless you make it so, in the cold dark recesses of your own mind it can really start to grind some gears if you let it.

In my case not so much “lagging behind” as “stopped caring, ignoring, life’s too short for so much churn over nonessential filler”.

I long ago stopped getting caught up in “that discussion” about recent trends despite a stream of people lobbing leading questions to get the ball rolling. Because I also try to not do so more rudely than necessary, I have developed several diplomatically worded (or at least ambiguous enough to float opaquely off to the side of the offense spectrum) ways of essentially saying the following: The simplest and cheapest way of [A] learning the “computer science” end of software is by becoming proficient in Lisp, [B] learning the “engineering” end of software by becoming proficient in Forth, [C] learning how “busywork” is a dangerous and demoralising thing to confuse with “actual work” by maintaining some Java code, [D] learning how insidious and self-sabotaging “expert beginner syndrome” is by reading a lot of the relevent code-reviews and blogposts when maintaining Javascript & Python projects, [E] learning how mob-mentality and populism can lead to selective blindness and architectural stubbornness by working with large volumes of C & C++ code, [F] learning how it is all really abstraction-layers over something akin to an old-shool phone switchboard by working with Assembler, [G] learning how the only work with longevity is that which stands on the shoulders of giants by using Fortran libraries, [H] learning how the mere act of developing using languages with baked-in discipline can be inherently educational by using DbC/TDD/BDD/dependent-type/formally-verifying/etc based languages (SPARK-Ada, Haskell, Eiffel, ACL2, Rust, etc), and then [I] learning how - after a certain level of experience - the languages, frameworks, and tools become less important than the engineers’s mindset and the work that happens both before and after the fingers hit the keyboard…by finding semi-performant techniques for implementing masochistic things like a VM and a network stack in Bash script (as hobby tasks, not for real use). If they are coming from a more hands-on/hardware background I also recommend [J] how eye-opening it is to maintain your own customized LibreCMC image flashed onto an open router (the older/smaller the HW the better, because you have to be increasingly creative with your kernel & OS configs), and [K] how educational it is getting a RISC-V working on an FPGA. I top it off by saying that [L] despite coding on-and-off since my start with z80 assembler on an Amstrad in the mid-80s I still feel like a beginner with so much to learn, and [M] that fact is by far the part I love most about the field (not just field of “work” but of “mental endeavour”) - far more than status/seniority/raises. I find I don’t get bombarded so much with JS-framework-du-jour zealotry and expert-beginnerism after that.

It seems the technique you’re describing is a kind of societal “good cop, bad cop”. Similar scenario to an interrogation too (trying to get information from someone who does not want to share the information) because in this case the challenge is “how to get people to share the capacity for self-determination, quality of living, and dignity when they clearly prefer to hoard it, even to the detriment of others”.

Although I entirely agree with the spirit of your point I’d like to add a long-winded side-note (essentially “and also”, not “but”). I guess when treated as a “title” Veganism is an inherently philosophical stance, but many conflate “Veganism” with “Having A Strictly Vegan Diet/Lifestyle” so my comment is for those people. Some who identify with the latter of the two (like myself) may be as such - or at least have become as such - for various other “logical reasons”. In the early-90s I inadvertantly became “mostly vegetarian, sometimes pescaterian” due to living with a vegetarian girlfriend. Working in an extremely physically strenuous career, and also coming from a childhood littered with various unexplainable health “issues”, I noticed (with hindsight) huge and surprising physiological benefits from that change. Due to that, and reading about how fundamental human classifying parameters are at the very herbivorous end of the spectrum (nails not claws, very long intestines, low-acidity digestive system which struggles to break down harder animal cell-walls in food, sweating through skin not tongue, mostly non-canine teeth, not having predatory close-set eyes, etc), I proceeded within a year to full vegetarianism - this time consciously. It took years to overcome the n00b mistakes (lack of nutritional knowledge, cooking skills, motivation) that usually eventually turn people back off vegetarianism, and at that point as some of the “fog of war” cleared I noticed a few lingering “issues” from my youth. I had researched food intolerances so did a test to find I was moderately intolerant to 3 types of meat and a few other odd things, and more importantly strongly intolerant to milk (and milk products). The followup consultant told me such a strong reaction indicates all animal-milk would be problematic, not just cow’s. That prompted going vegan in about 2013, with such a dramatic further health-improvement I had to tell myself not to obsess with “if only I’d known this 30 years ago”. Even though I have since become increasingly “philosophically vegan” through a kind of mental osmosis, the point I want to make here is that was really post-hoc, as a side-effect. My original drivers were “purely by accident, then conscious but for functional reasons”. These days - nearly 30 years after going vegetarian and more than 10 years after going vegan - I just do some resistance/weight-training each morning yet I’m far more healthy and “built” than I ever was throughout an effectively “acrobatic” career (even when training for that career 45hrs/week and eating half-kilo mincemeat-based meals as a teenager), even though I ended that career years ago. Those are also very “logical reasons” in addition to the usual “logical ethical vegan reasons regarding treatment of animals”, as also are the “logical ecological reasons” too (particularly the extreme amount of deforestation that is done to create grazing land for livestock).

If you’re only talking about Storage (data at rest) or Network (data in transit) then encrypt/decrypt offsite and never let symmetric keys (or asymmetric private keys) near the VPS, or for in-transit you could similarly setup encrypted tunnels (symmetric/private keys offsite only) where neither end of the tunnel terminates at the VPS. If you’re talking about Compute then whatever does the processing inherently needs access to decrypted data (in RAM, cache, etc) to do anything meaningful. Although there are lots of methods for delegating, compartmentalising, obfuscating, etc (like enclaves, TPM/vTPM…) the unavoidable truth is that you must trust whomever owns the base-infra ultimately processing your data. The one vaguely useful way to use “other people’s computers” trustlessly is with SMPC (secure multi-party computation) spread sufficiently widely across multiple independent (preferably competing - or even adversarial!) virtual-computation providers, with an “N-of-M keys” policy that avoids any single provider being able to attain a meaningful level of access to your data independently, or being able to view tangible portions of your data while providing functionality during SMPC. That stuff gets super-niche though.

Not all made up though. I’ve been following this one’s mailing list for a while https://en.wikipedia.org/wiki/Zephyr_(operating_system)

But… but he’s not a hurricane… I guess they could fix him up with horse tranquilliser and bleach afterwards though. (adding a /s here for the terminally oblivious)

TMBG :-)