Resharing your transcode would be a violation, even assuming the original was somehow an unencumbered HEVC. Ripping a VHS and encoding would still be a violation even without any DMCA complications

In terms of whether the ‘clean room’ approach is as critical in Europe or not, I can’t be sure. It might be more permissable for someone to use a decompile as a reference and also directly work on a replacement. However I’m pretty sure starting with a decompile of proprietary software as a direct codebase would run afoul of issues.

Otherwise, imagine you have an HEVC encoded rip of a 4K blu ray. You transcode it to AV1. The bytes are totally different, and even the resultant frames are likely not even pixel for pixel identical. I don’t think copyright law would deem that not a violation, regardless of jurisdiction.

Providers like MS at least should have figured out that the hypothetical ability to take your data “to go” is important, but nothing they need to worry about being actually used too much, especially in businesses.

One is the anxiety over screwing up and losing your data when you solely manage it. So huge pressure to use “a” reputable company as a steward of the data.

Another is that the user and the spend are disconnected in business scenarios. If attaching a ‘cloud’ document to something in the app is two clicks, but 4 clicks to do the same from desktop, then the users will want to just stick to the cloud to save them a few clicks at least. They will demand their IT provide microsoft solutions and the IT will shrug and say “well, everyone gets microsoft solutions”. Back in the day my company tried to split the difference by purchasing perpetual licenses only for every third edition. Now Microsoft has made that just not viable so you either just pay for as long as you use it or you go elsewhere.

It’s also why I don’t think any of the providers are actually trying to screw up desktop component prices for fear of local models ruining their day. The tech market has shown they actively jump at the chance to surrender their flexibility to providers, no need to worry about them suddenly deciding to in-house things.

Microsoft already changed what they are selling. Now they are renting document storage that happens to have document modification software integrated.

They long decided that owning access to the data was more leverage than the software used to edit it. Ditto for Adobe. Pretty much immediately software as a service encouraged “don’t worry about ever saving/managing your data” and it wasn’t about user convenience…

You are right no one cares how it is implemented, and on select contexts, right that LLMs can produce sufficient implementation.

However it isn’t generally the case that they can produce quality software. The bad news for a lot of developers is that by volume most software isn’t exactly great quality either, particularly in house enterprise software is already crap, so there is large area where differently crapi isn’t so bad.

I will say that people who want their software well supported are likely to be ill served by “vibed” solutions. It is really tricky to debug complex software that was vibed, whether human or GenAI. If it worked perfectly the first time around and/or the software in question is fairly disposable, well those may be fine.

Well, depends.

Software is subject to copyright. Yes you can implement the same APIs, but when you get into the visual presentation, things can get copyright related even if the code isn’t being ripped off.

If you decompile rather than clone, well then the code is copyrighted even if transformed into plausible source code.

Of course then there are patents…

Probably not even that.

For example: https://nvd.nist.gov/vuln/detail/cve-2026-43073

The short of it is they declared the name of a function to be a vulnerability, because some developers were confused by the name and used it when they shouldn’t.

A fine critique of things, but the CVE is considered closed by merely renaming the function, and downstream misuses were considered separate issues.

A “vulnerability” fixed by:

-SYM_FUNC_START(__copy_user_nocache)
+SYM_FUNC_START(copy_to_nontemporal)

Curl guy has written about a couple of these stupid CVEs, for example: https://daniel.haxx.se/blog/2023/09/05/bogus-cve-follow-ups/

One I recall was that if you asked curl to write out c code example of libcurl usage, you could get it to write out arbitrary code of your choosing. Note that this required you to have write permission and curl and then with your malicious c code, you then had to compile it and make it executable and run it yourself. So a very roundabout way to use curl as a text editor, and they considered it an arbitrary code execution issue, despite not actually executing the code.

Yeah, CVEs are usually nothing when you get down to understanding, especially kernel CVEs, which almost always declares a CVE for almost any bug, because it is easier that trying to think if it is a security issue or not and basically just assume it could be.

Huge pain as in my work we have a security policy where any unpatched CVEs that cannot be updated away must have a fairly significant writeup delving into the nuance of the CVE and what mitigation has been applied or a rationalization of why it isn’t a risk and by policy we have to second guess every CVE assessment from our vendor, who we explicitly pay to triage and fix this stuff so we don’t have to… They used to at least allow us a pass on “low severity” (that’s still pretty flawed), but they decided that didn’t sound “tough” enough and now every single one must have an answer. So every month a few people have to spend a few days just reading tons of CVEs that are not yet (and frequently never will be) patched by vendor and rationalize it away for the security team. Sometimes the security team will get odd and demand we build our own from upstream (most recently, vim of all things we were mandated to build from source).

But to the extent you do buy, it is nice to know.

For example, even for an open hardware design, you need to buy parts.

But some things are either possible, but already nicely packaged by someone else (my opengarage I could have built, but it was well worth it to buy). A video doorbell I don’t see good open designs for, so the “part” is the doorbell itself. A bed cooler has open designs, but they call on you to basically buy a donor commercial product to use for parts.

Ok, time for me to market my new eSpoon. It requires Internet and a subscription fee. It lets your health insurance company know your food intake and lets Google know your favorite foods.

With Linux? Kernel signed with your own key to get out of lockdown mode restrictions?

Yes, the “did I stutter?” If everything is a file philosophy.

The devnode that is used to reference the block is a file, so you come back to blocks just ‘being offsets into some file’.

Though system calls, ioctls and networking credibly get away from file semantics

Missing stage 7: Not everything is a file.

Linux is closer than other *nixes (sysctl equivalents in some platforms are not files, but they are files in Linux).

However get very far into network and the file-like behaviors become more limited. From an application, at least you have a decent chance of having unseekable, but otherwise ‘file-like’ interaction with stream protocols. Then you need recvmsg/sendmsg. Then you want to deal with low level interaction with the network stack and dealing with NETLINK and such…

You could just upgrade, I assume RAM is cheap, haven’t looked in a while, just let me look up memory prices real quick…

True, though not a whole lot of people think as highly about Eclipse or Apache as folks do Linux.

I don’t think companies are jumping up and down to try to manipulate their way to having nominal affinity to those projects compared to how so many companies want to have the ‘Linux approved’ impression with people not paying close attention to the ‘foundation’.

And in fact, I frequently have disagreed with the Linux foundation and think it shouldn’t carry the name Linux, as most of their projects aren’t particularly related to Linux work.

It’s been a way for corporations to attach the Linux marketing value to their pet projects for a long time.

Depends on how the network services are designed/configured.

If the service is allowed to just bind ‘::’, then generally, sure, start it up and more proper networking bringup can happen asynchronously.

But folks often have it bind a specific address/interface, in which case those binds will error and cause the service to error because it was asked to bind to something it could not. This is the use case I think the online target is designed to take the race conditions out of. It’s not that the service is not really useful without networking, it’s that the service will exit with error if the networking isn’t exactly as expected.

Of course, in this world of genericizing things around the worst cases, they end up blocking everything just in case, because they have no idea of the user has done something like make the service only work through one interface.

What I would call out systemd for is that it can make it difficult to know precisely what thing it isn’t happy with. Abstracting a mishbehaving process to “user session” when it could call out the offending process by name.

Similarly, when it’s trying to decide the network is ‘online’, and by all appearances the network interface was configured, but systemd isn’t so sure, sometimes it’s hard to tell why.

A lot of the bad experience with Windows similarly could be attributed to something workable, but the design obfuscates the underlying behavior. Systemd has been bringing some of that sentiment over, and that can be more aggravating.