21–30 of 102 posts
Earlier quoted context omitted.
I agree with you that the PDF format is insane (I have had my head buried in the spec for the last month) but it has won in the marketplace. It's unlikely anything can supersede it now. Microsoft had a technically strong alternative but it was far too late.
What was that Microsoft alternative called?
It would be fair if we'd see an increase in government funding of open source projects. Or at least the government could pay for security audits.
[flagged]
I'm thinking more: maybe we'll see an increase in commits from dubious hacker groups. Who is going to audit these open source projects?
Most universities have a computer science department, that has a security group.
As a part of European CS bachelor's students study the Linux kernel.
Don't forget, "open source" is not enough: we need _lean_ open source and I do include the SDK (then programing language). That for software/protocol/file formats (and hardware programing interfaces...). It is much easier to say than done, and when you read that, often it is to apply pressure on microsoft pricing only without a real intent to start to "digitally assume themselves". Keep in mind: there is ZERO, Z-E-R-…
We generate pdf files using weasyprint (convert html+css into cool pdf files), I think tools like this are very valuable and practical for building higher-level pdf-generators tools.
When dealing with an ultra-complex file format which cannot be dodged, usually a good way to deal with it is to only use a very simple but coherent subset and enforce this usage with validation tools.
For instance, the web, noscript/basic (x)html (or you are jailed in the 2.5 web engines of the whatng cartel).
With PDF, I dunno much of the format (since I did not manage to download easily the specs), but when I have to print some text, I have a very small PDF generator for that (written ~25 years ago, so no utf-8 for me).
But what's important: such attempt must be sided with re-assessing the pertinence of the usage of the information systems, and yes, it will annoying and much less comfy and that MUST be acknowledged before even trying.
And big tech is not the only one trying hard to do vendor and developer lock-in.
Earlier quoted context omitted.
I'm thinking more: maybe we'll see an increase in commits from dubious hacker groups. Who is going to audit these open source projects?
In particular the people who study and work at the government funded European universities tuition free. Most universities have a computer science department, that has a security group. As a part of European CS bachelor's students study the Linux kernel.
And if they do, it will certainly not be exhaustive. Nor will it be at a pace in which software is typically released.
[flagged]
I'm thinking more: maybe we'll see an increase in commits from dubious hacker groups. Who is going to audit these open source projects?
Seems there's more than one country doing malicious stuff on purpose.
Earlier quoted context omitted.
In particular the people who study and work at the government funded European universities tuition free. Most universities have a computer science department, that has a security group. As a part of European CS bachelor's students study the Linux kernel.
CS students are not expected to do security audits in production software. And if they do, it will certainly not be exhaustive. Nor will it be at a pace in which software is typically released.
Earlier quoted context omitted.
In particular the people who study and work at the government funded European universities tuition free. Most universities have a computer science department, that has a security group. As a part of European CS bachelor's students study the Linux kernel.
CS students are not expected to do security audits in production software. And if they do, it will certainly not be exhaustive. Nor will it be at a pace in which software is typically released.
Security is generally better in linux based ecosystems than windows.
Microsoft also don't do sec audits - if you want a sec audit on your stack then you buy it.
It just turns out that it is much easier to audit a Linux based stack that a Windows based one