Is Linux collapsing under its own weight? (News)

0:04What up nerds? I'm Jared and this is Changelog news for the week of Monday September 9th, 2024. After our conversation with Alia Abbott last week, we decided to try Zulip in earnest for a while. So far, so good. The overall experience isn't quite as polished as Slack, but it's nerd-built, and you can tell they've put a lot of love into it. If you'd like to kick the tires with us, I'll put the link to join at the top of this week's newsletter. Okay, let's get into the news. Is Linux collapsing under its own weight? A Rust 4 Linux developer, Wedsen Almeda Falho, resigned from the project after an unfortunate interaction with another maintainer.

0:54Wedsen's parting words, quote, I am retiring from the project. After almost four years, I find myself lacking the energy and enthusiasm I once had to respond to some of the non-technical nonsense. So it's best to leave it up to those who still have it in them, end quote. After that, Asahi Lina, who is a developer of the Apple GPU drivers for Linux, sounded off with her own frustrations with maintainers and Rust from the DRM perspective. Her conclusion, quote, But I get that feeling that some Linux kernel maintainers just don't care about future code quality or about stability or security anymore.

1:36They just want to keep their C code and wish us Rust folks would go away. And that's really sad and isn't helping make Linux better. End quote. The post I'm linking to is in response to those two events. The author, who goes by CB, thinks they, quote, signal deeper issues in Linux, both technical and cultural. End quote. Some of the technical and cultural issues are explained in the post. What does this mean, though, for the Rust for Linux project? CB says, I think Rust for Linux as a project is in danger, not because of technical reasons, but because of social ones. It's trivial for a maintainer who doesn't want Rust to sandbag integration efforts for their subsystem for whatever reason, not liking it, not wanting the workload, etc., just refusing to help, end quote.

2:24So what does this mean for the future of Linux? The author seems to believe an eventual fork is likely. Brett Victor introduces DynamicLand. Brett Victor, a well-known interface designer and computer scientist who's best known for his amazing talks on the future of technology has been working quietly on a new project, Dynamic Land, for many years. Turns out he's done being quiet about it. Dynamic Land is essentially making the real world computational then giving people what they need to compute it however they like. You really should watch the six-minute introduction video which is filled with amazing statements like You don't have to simulate a virtual world when the real world simulates itself.

3:07And this one, which is just bonkers. So everything I've shown is taking place in our communal computing system called RealTalk, and this is it. RealTalk is not a code base. It's a poster gallery, or a bulletin board, or a binder. To call this endeavor ambitious would be an understatement. Here's the sum, which, if they pull it off, and maybe they already have, would be a big technical achievement and an enormous cultural achievement. Dynamic Land is non-profit, and Real Talk is not a product. You don't buy communal computing. You don't download communal computing. Our goal is to invent a form of computation which local communities of non-specialists can make for themselves, from the ground up, for their own needs, which they fully understand and control.

3:50A form of computation which is learned and taught, not downloaded and used, like reading and writing, or mathematics, or the arts. Not a product, but a practice. SRE doesn't mean anything useful anymore. Rachel, by the bay, laments her realization that site reliability engineer, SRE, has become useless as a way to categorize people with a very particular set of skills, much like every other title has before it. Quote, Clearly, somewhere along the line, someone lost the thread, and it has completely destroyed any notion of what an SRE was supposed to be. Just so we're operating on a level playing ground here, I'll lay down my own personal definition of the term and what I expect from people in that role and what I expected from myself.

4:39To me, an SRE is both a sysadmin and a programmer, developer, whatever you want to call it. It's a logical and, not an XOR. End quote. She goes on to detail what is meant by sysadmin and what is meant by programmer. but what she's been seeing in her attempts to hire are SREs who are just ops people. I agree with Rachel, but not just about SREs. I found most job titles in the software world to be relatively useless and so much more so as each title ages. Let's do some sponsored news. 3.7 million fake GitHub stars. How much weight do you put into a project's GitHub star count? No matter how much it is, it's probably too much.

5:22Socket researchers have uncovered 3.7 million fake GitHub stars, highlighting a growing threat linked to scams, fraud, and malware with these campaigns rapidly increasing over the last six months. Based on this research, Socket is launching a new suspicious stars on GitHub alert that utilizes the low activity and clustering heuristics to detect packages associated with repos that have fake stars. If you want to get proactive alerts and check your entire organization for suspicious star packages, plus 70 more indicators of supply chain risk, install the free Socket for GitHub app in just two clicks.

6:02Whenever a new dependency is added or updated in a pull request, Socket analyzes the package's behavior and security risk, alerting you before any malicious code has the chance to land in your project. Check it out by following the link in the newsletter. And thank you to Socket for sponsoring ChangeLog News. Your company needs junior devs. Doug Turnbull does a good job laying out the case for hiring junior devs, a drum that I've been beating off and on for years. Quote, lately, big tech only wants elite squads of staff devs that can, quote, hit the ground running on the big, often AI initiative.

6:42It's been remarked over and over that AI will completely replace junior developers. Juniors, after all, exist to do code monkey work, easily replaced with an LLM. However, that misses the mark on why we have junior employees. Coaching junior employees becomes its own force multiplier for innovating at scale. It's not about the added labor. It's about a psychologically safe culture that values teaching and learning and the innovation that this unlocks. End quote. Doug makes a lot of great points in this article. I'll add one. Junior developers are plenteous. That means you can take your time and find the ones that will really gel with your organizational culture.

7:26Also, you don't have to pay them as much while you train them up and make them more valuable so you can pay them more. You may be asking that age-old question, but what if we train them up and they leave? The answer to that is, what if you don't train them up and they stay? The LLM honeymoon phase is about to end. Balder Bjarnason has been consistently bearish on the current crop of AI tools and products since I've been following him. I don't agree with him in all aspects, but he does a good job of arguing his position, so I appreciate his writing on the subject. In this latest post, Balder explains how weaknesses and how LLMs work are making them great targets for manipulation.

8:09Quote, We've also known for a while that prompts are effectively impossible to secure. It should not come as a surprise that some researchers decided to see if prompt security could be bypassed with a malicious token stream that completely bypasses the whole comprehensible language part. The process for discovering these malicious token streams is quite similar to what Profound, the company mentioned earlier, seems to be doing. You automate a process of shoving customized prompts into one end of the LLM black box, and you map the output to discover token streams that have an unusually big impact on the output.

8:46End quote. Given the opportunity for businesses to gain an unfair advantage, we all know what they'll do with it. balder thinks this is going to go from bad to much much worse as these techniques are uncovered quote this is going to get automated weaponized and industrialized tech companies have placed chatbots at the center of our information ecosystems and butchered their products to push them front and center the incentives for bad actors to try to game them are enormous and they are capable of making incredibly sophisticated tools for their purposes. That is the news for now, but also scan this week's ChangeLog newsletter for even more news worth your attention, like creating a Git commit the hard way and grippability as an underrated code metric, plus a whole lot more.

9:38Get in on that newsletter by popping your email address in at changelog.com slash news. we have some great episodes coming up this week on wednesday eres zuckerman talking ergonomic keyboards and on friday natalie pisanovic from go time talking ai coding tools have a great week leave us a five-star review if you want some free stickers and i'll talk to you again real soon