Wouter Verhelst |

Debian Developer. husband. FOSDEM organizer. Tennis lover. Amateur musician.

If it ain't fun, you're not doing it right.

Same place, 58 years apart

Well yes. My point is, calling it 'enshittification' somehow does not seem enough.

Perl. And C, sometimes. C++ is just... *shudders* thanks but no thanks.

There million lines of 'switch off this, do that, perform this hack' etc etc etc ad nauseam, followed by

> The settings changes we've recommended here may not fix everything, but they can at least give you some peace, shoving Microsoft into the background and allowing you to do what you want with your PC without a constant hassle.

This is not enshittification, this is criminal.

One will probably be gone because of the other?

Language lesson.

No, it said macOS, which is what apple operating systems have been called since 2016 😉

Sure it does? Modern Mac mice have multi-touch even.

Positively Bohemian!

Posted by u/The_Black_Jacket 10 days ago Galileo! My daughter was doing her history homework and asked me what | knew about Galileo. | said, "He was a poor boy, from a poor family." with a photo of Galileo Galilei

ISO does just sell their standards. Everyone has access provided they open their wallet. I did that once for one of the DV standards while I was still maintaining dvswitch, although I don't remember what I paid for it.

For ISO 4210-4:2023, e.g., you can go to and pay.

Yes, sometimes the price is prohibitively high though, especially if you need the whole standard on something.

Thanks, fixed

The contact details are at the bottom of that first email, but it's plus a few other options.

Or you can dm me (does the fediverse support that? Not sure...🤷)

banks won't let you use a rooted android phone for "security purposes" but will let you through with a cracked copy of windows vista running opera 12

Thanks for calling my code fancy 😉

We can add an apology note if you like. They look like the second slide on

If you want to go down that route, contact us (contact info in the review invite emails) and we'll get that set up.

Some may say this has already happened. I mean, you get to choose between something superficially resembling a party with reasonable opinions and a bunch of lunatic crazies.

The NLnet Labs crew had a blast at last weekend. @partim presented in the Devroom on the ‘domain' crate, a library in serving as building blocks for developers. Development is commissioned by the @sovtechfund in 2024 and covers client, server and proxy functionality. Watch the recording here: or read the blog post here:

4 February 1925 | A French Jewish woman, Ginette Kolinka (née Cherkasky), was born in Paris.

She was deported to Auschwitz from Drancy in April 1944. She was transferred to Bergen-Belsen and then to Theresienstadt. She survived.

Today she turns 99.

A French Jewish woman, Ginette Kolinka. An older lady in glasses, large earrings, black & white patterned sweater. She is smiling and holding a microphone.

@shortridge While working tech support, I got a call on a Monday. Some VPNs which had been working on Friday were no longer working. After a little digging, we found the negotiation was failing due to a certificate validation failure.

The certificate validation was failing because the system couldn’t check the certificate revocation list (CRL).

The system couldn’t check the CRL because it was too big. The software doing the validation only allocated 512kB to store the CRL, and it was bigger than that. This is from a private certificate authority, though, and 512kB is a *LOT* of revoked certificates. Shouldn’t be possible for this environment to hit within a human lifespan.

Turns out the CRL was nearly a megabyte! What gives? We check the certificate authority, and it’s revoking and reissuing every single certificate it has signed once per second.

The revocations say all the certificates (including the certificate authority’s) are expired. We check the expiration date of the certificate authority, and it’s set to some time in 1910. What? It was around here I started to suspect what had happened.

The certificate authority isn’t valid before some time in 2037. It was waking up every second, seeing the current date was after the expiration date and reissuing everything. But time is linear, so it doesn’t make sense to reissue an expired certificate with an earlier not-valid-before date, so it reissued all the certs with the same dates and went to sleep. One second later, it woke up and did the whole process over again. But why the clearly invalid dates on the CA?

The CA operation log was packed with revocations and reissues, but I eventually found the reissues which changed the validity dates of the CA’s certificate. Sure enough, it reissued itself in 2037 and the expiration date was set to 2037 plus ten years, which fell victim to the 2038 limitation. But it’s not 2037, so why did the system think it was?

The OS running the CA was set to sync with NTP every 120 seconds, and it used a really bad NTP client which blindly set the time to whatever the NTP server gave it. No sanity checking, no drifting. Just get the time, set the time. OS logs showed most of the time, the clock adjustment was a fraction of a second. Then some time on Saturday, there was an adjustment of tens of thousands of seconds forward. The next adjustment was hundreds of thousands of seconds forward. Tens of millions of seconds forward. Eventually it hit billions of seconds backwards, taking the system clock back to 1904 or so. The NTP server was racing forward through the 32-bit timestamp space.

At some point, the NTP server handed out a date in 2037 which was after the CA’s expiration. It reissued itself as I described above, and a date math bug resulted in a cert which expired before it was valid. So now we have an explanation for the CRL being so huge. On to the NTP server!

Turns out they had an NTP “appliance” with a radio clock (i.e, a CDMA radio, GPS receiver, etc.). Whoever built it had done so in a really questionable way. It seems it had a faulty internal clock which was very fast. If it lost upstream time for a while, then reacquired it after the internal clock had accumulated a whole extra second, the server didn’t let itself step backwards or extend the duration of a second. The math it used to correct its internal clock somehow resulted in dramatically shortening the duration of a second until it wrapped in 2038 and eventually ended up at the correct time.

Ultimately found three issues:
• An OS with an overly-simplistic NTP client
• A certificate authority with a bad date math system
• An NTP server with design issues and bad hardware

Edit: The popularity of this story has me thinking about it some more.

The 2038 problem happens because when the first bit of a 32-bit value is 1 and you use it as a signed integer, it’s interpreted as a negative number in 2’s complement representation. But C has no protection from treating the same value as signed in some contexts and unsigned in others. If you start with a signed 32-bit integer with the value -1, it is represented in memory as 0xFFFFFFFF. If you then use it as an unsigned integer, it becomes the value 4,294,967,296.

I bet the NTP box subtracted the internal clock’s seconds from the radio clock’s seconds as signed integers (getting -1 seconds), then treated it as an unsigned integer when figuring out how to adjust the tick rate. It suddenly thought the clock was four billion seconds behind, so it really has to sprint forward to catch up!

In my experience, the most baffling behavior is almost always caused by very small mistakes. This small mistake would explain the behavior.

This is perfection on so many levels.

Changeable letter board saying "why am I the only one naked at the gender reveal party"

@marga @pvaneynd It is GitHub’s fault. They still refuse to publish AAAA records.