[–] 3 points 2 weeks ago

It's definitely possible. I always filed those groups more under the cheerleading (and technical support) column, but it's entirely possible that (especially with much less money in the ecosystem) they exerted some power in the community. I've been thinking a lot about how we lost "the funnel," recently, with even the Software Freedom Day people now strongly recommending against using events to try to sell people on Free Software...

  • source
  • parent
  • context
  • [–] 6 points 2 weeks ago (2 children)

    Here's the real question, though, in my eyes: How do we get and keep it centered on that community? Because it hasn't been, historically. Free Software (and all the related movements) have mostly centered two aspects that got us here.

    • If you don't like it, then just fork it.
    • It's actually wonderful that [Insert FAANG Company] exploits our labor to boost their massive profits and sometimes gives us back pizza money.

    And we get this bizarre "rugged individualism" out of it, where there isn't really any community to speak of. They're happy to see occasional cheerleaders, but once there's criticism, then they don't even know who these agitators are, trying to undermine their freedoms.

    If you think about it, we should have community groups checking quality (through testing and formal verification, maybe) so that it's not on each of us to review every line of code running on our machine out of many millions. When there's an outcry among users and rank-and-file developers that we don't want to sacrifice quality or code provenance (or that certain people are too toxic to run things), then that should get more than a "stop being so mean to people" blog post.

    The answer is "organize," I guess, but I don't know if that's feasible when almost every established voice in the field insists that Freedom is something that you do on your own...

  • source
  • [–] 4 points 1 month ago

    I forget whether it's through the data page or somewhere else, but I gather that they've always made it pretty straightforward to grab the questions/answers/comments. For a while, web searches were a mess, because of all the fly-by-night outfits syndicating all conversations with SEO trickery to sell ad space.

  • source
  • parent
  • context
  • [–] 5 points 1 month ago (2 children)

    It needs more traffic (and that'll require better servers and more moderation with training to make sure that it doesn't follow the same arc) to become a standard place to go, but I've become fond of Codidact. If I remember correctly, the founder left Stack during one of their bigger moderation blow-ups.

  • source
  • parent
  • context
  • [–] 2 points 1 month ago

    Two reasons, three if you include the footnote that already answers the reductive "substitutable service" idea. Thirty-plus years ago, Free Software developers often used proprietary compilers. That was reliance on proprietary products. This is relying on proprietary tools to generate code, unless we want to pretend that people are out there running A/B tests between hand-written and generated code. The tools also generate unmaintainable code while making the developers less capable, making the tools more necessary as teams use them, which also sounds like reliance.

  • source
  • parent
  • context
  • [–] 29 points 1 month ago (2 children)

    Personally, I think that using LLMs is a terrible idea, especially for Free Software. It creates a reliance on proprietary software[^1]. Generated code has uncertain provenance, for the same reason that researchers can provoke LLMs to "auto-complete" famous books, undermining the license. LLMs rewrite instead of fixing, since the latter requires intelligence, so it makes less-maintainable code. And studies show that using models slows work down, rather than speeding it up.

    [^1]: Yeah, some claim to have open source licenses, and the OSI is desperately trying to figure out how to approve AI-specific licenses. But since there's no (useful) way to modify the model without the training data, it's proprietary.

    I've only found two arguments in favor: The technology is (allegedly) here to stay. And sure, the studies say that it slows down work, creates bugs in most of its changes, makes everything harder to maintain, alienates the team, and erodes skill, but don't worry, because I have a system.

    I wouldn't risk it on any project of mine, and especially not for anything released under a public license where it needs to promise people that they can use the code for any purpose.

  • source
  • [–] 3 points 5 months ago

    It's...a web-accessible log file, basically. Timestamp-and-status, line after line, and "clients" read it periodically to report updates. My now-defunct feed has a couple of comments (# ...) at the top for the URL and my "user ID," but I don't remember if they were requirements, conveniences, or just a cargo cult thing.

  • source
  • parent
  • context
  • [–] 2 points 8 months ago

    It seems interesting, and we have needed new thinking on licenses for a long while, but a few details mildly concern me.

    First, while not universal, brevity improves readability, but often leads to loopholes. Mature licenses grow so long because lawyers have needed to repeatedly game out threats and how to resolve them before arguments break out.

    Then, I don't quite know how to phrase such a thing, but it'd be nice to bar Contributor License Agreements and other copyright assignments. Prior to LLMs laundering Free Software and helping novices flood everybody with low-quality patches, the biggest threat to Free Software was (and probably will be again when the AI bubble pops) was projects exercising the copyright holder's authority to re-release without a license, taking the community's work with them behind the paywall.

    The LLM condition also seems concerning. I don't like how the big companies have behaved either, but the problem is corporate exploitation, not the technology. If a teenager wanted to train their own model with a selection of projects, we don't want to tell them to stop, and if a company wants to repeatedly scrape projects for a PowerPoint deck, that's just as bad. Plus, training a neural network probably falls well inside the bounds of Fair Use, though publishing the output probably wouldn't.

    Otherwise, you might want to reach out to the folks working on Copyleft Next, which has a similar interest in building on the GPL, since Kuhn and Fontana have been at this for a long time.

  • source
  • [–] 5 points 1 year ago

    I'm another conflicted person on this. I ran Tiny for years, so I never hated it. But it had so many updates that assumed that I'd know in advance to update something on the system (PHP libraries, database schema, etc.), and then putting the git repository behind Cloudflare led to a cycle of notifications that I needed an update and then waiting for Brigadoon to reemerge so that I could pull the latest source. And any time that I needed to look for a solution to a problem, reading through the forums made me regret the choice a tiny bit more.

    It's reasonable software, but I ended up moving to Fresh RSS on an in-house server, and that has gone better, but I hope that the Tiny community pulls together something better to keep the space diverse.

  • source
  • [–] 4 points 1 year ago

    In my case (not necessarily your case, of course), the cheapest selling-point has become that I already have a browser open for almost everything else, so that's one less thing to install and check in on. But it's also easier to keep up to date reading when individual computers have problems and usually has a nicer API for scripting, if you need that sort of thing.

  • source
  • parent
  • context
  •  

    (Apologies in advance if this is the wrong spot to ask for help, and/or if the length annoys people.)

    I'm trying to set up 2FAuth on a local server (old Raspberry Pi, Debian), alongside some other services.

    Following the self-hosting directions, I believe that I managed to get the code running, and I can get at the page, but can't register the first/administrative/only account. Presumably, something went wrong in either the configuration or the reverse-proxy, and I've run out of ideas, so could use an extra pair of eyes on it, if somebody has the experience.

    The goal is to serve it from http://the-server.local/2fa, where I have a...actually the real name of the server is worse. Currently, the pages (login, security device, about, reset password, register) load, but when I try to register an account, it shows a "Resource not found / 404" ("Item" in the title) page.

    Here's the (lightly redacted) .env file, mostly just the defaults.

    APP_NAME=2FAuth
    APP_ENV=local
    APP_TIMEZONE=UTC
    APP_DEBUG=false
    SITE_OWNER=mail@example.com
    APP_KEY=base64:...
    APP_URL=http://the-server.local/2fa
    APP_SUBDIRECTORY=2fa
    IS_DEMO_APP=false
    LOG_CHANNEL=daily
    LOG_LEVEL=notice
    CACHE_DRIVER=file
    SESSION_DRIVER=file
    DB_CONNECTION=sqlite
    DB_DATABASE=/var/www/2fauth/database/database.sqlite
    DB_HOST=
    DB_PORT=
    DB_USERNAME=
    DB_PASSWORD=
    MYSQL_ATTR_SSL_CA=
    MAIL_MAILER=log
    MAIL_HOST=my-vps.example
    MAIL_PORT=25
    MAIL_USERNAME=null
    MAIL_PASSWORD=null
    MAIL_ENCRYPTION=null
    MAIL_FROM_NAME=2FAuth
    MAIL_FROM_ADDRESS=2fa@my-vps.example
    MAIL_VERIFY_SSL_PEER=true
    THROTTLE_API=60
    LOGIN_THROTTLE=5
    AUTHENTICATION_GUARD=web-guard
    AUTHENTICATION_LOG_RETENTION=365
    AUTH_PROXY_HEADER_FOR_USER=null
    AUTH_PROXY_HEADER_FOR_EMAIL=null
    PROXY_LOGOUT_URL=null
    WEBAUTHN_NAME=2FAuth
    WEBAUTHN_ID=null
    WEBAUTHN_USER_VERIFICATION=preferred
    TRUSTED_PROXIES=null
    PROXY_FOR_OUTGOING_REQUESTS=null
    CONTENT_SECURITY_POLICY=true
    BROADCAST_DRIVER=log
    QUEUE_DRIVER=sync
    REDIS_HOST=127.0.0.1
    REDIS_PASSWORD=null
    REDIS_PORT=6379
    PUSHER_APP_ID=
    PUSHER_APP_KEY=
    PUSHER_APP_SECRET=
    PUSHER_APP_CLUSTER=mt1
    VITE_PUSHER_APP_KEY="${PUSHER_APP_KEY}"
    VITE_PUSHER_APP_CLUSTER="${PUSHER_APP_CLUSTER}"
    MIX_ENV=local
    

    Then, there's the hard-won progress on the NGINX configuration.

    server {
        listen 80;
        server_name the-server.local;
    # Other services
        location /2fa/ {
            alias /var/www/2fauth/public/;
            index index.php;
            try_files $uri $uri/ /index.php?$query_string;
        }
        location ~ ^/2fa/(.+?\.php)(/.*)?$ {
            alias /var/www/2fauth/public/;
            fastcgi_pass unix:/var/run/php/php8.3-fpm.sock;
            fastcgi_split_path_info ^(.+\.php)(/.*)$;
            set $path_info $fastcgi_path_info;
            fastcgi_param PATH_INFO $path_info;
            fastcgi_index index.php;
            fastcgi_param SCRIPT_FILENAME $document_root/$1;
            include fastcgi_params;
        }
    # ...and so on
    

    I have tried dozens of variations, here, especially in the fastcgi_param lines, almost all of which either don't impact the situation or give me a 403 or 404 error for the entire app. This version at least shows login/register/about pages.

    While I would've loved to do so, I can't work with the documentation's example, unfortunately, because (a) it presumes that I only want to run the one service on the machine, and (b) doesn't seem to work if transposed to a location. They do have the Custom Base URL option, but it doesn't work. That just gives me a 403 error (directory index of "/var/www/2fauth/public/" is forbidden, client: 192.168.1.xxx, server: the-server.local, request: "GET /2fa/ HTTP/1.1", host: "the-server.local", and again I emphasize that the permissions are set correctly) for the entire app, making me think that maybe nobody on the team uses NGINX.

    Setting both NGINX and 2FAuth for debugging output, the debug log for NGINX gives me this, of the parts that look relevant.

    *70 try files handler
    *70 http script var: "/2fa/user"
    *70 trying to use file: "user" "/var/www/2fauth/public/user"
    *70 http script var: "/2fa/user"
    *70 trying to use dir: "user" "/var/www/2fauth/public/user"
    *70 http script copy: "/index.php?"
    *70 trying to use file: "/index.php?" "/var/www/2fauth/public//index.php?"
    *70 internal redirect: "/index.php?"
    

    And the Laravel log is empty, so it's not getting that far.

    Permissions and ownership of 2FAuth seem fine. No, there's no /var/www/2fauth/public/user, which seems to make sense, since that's almost certainly an API endpoint and none of the other "pages" have files by those names.

    I have theories on what the application needs (probably the path as an argument of some sort), but (a) I'm not in the mood to slog through a PHP application that I don't intend to make changes to, and (b) I don't have nearly the experience with NGINX to know how to make that happen.

    It seems impossible that I'm the first one doing this, but this also feels like a small enough problem (especially with a working desktop authenticator app) that it's not worth filing a GitHub issue, especially when their existing NGINX examples are so...worryingly off. So, if anybody can help, I'd appreciate it.

    view more: next ›