There’s Dropbear SSH, which is the most common choice for a minimal SSH server and client, but even that is around 50,000 lines of code.

Technically they’re correct though, in a way. If every account has a password, the system isn’t vulnerable.

You’re also not vulnerable if you use two factor auth, because all 2FA modules require PAM, whereas this vulnerability only exists when PAM is disabled or not installed.

Not just rootless and read-only, but distroless/chiseled too. There’s no reason to have unneeded parts of an OS in your Docker containers. It should just be one app along with any libraries it needs (or just statically compile the app)

“passwordless” here means that the account doesn’t have a password. What the person you’re replying to means is that password authentication should be completely disabled in the SSH config, as that’s the only way to exploit this issue.

Wireguard and apps based on it (like Tailscale) don’t respond at all unless the data is signed with the key of a configured peer (or with Tailscale, a system on your tailnet that passes the ACL). It’s literally impossible for an outsider/attacker to detect with a port scan since it just ignores unauthenticated packets.

The Wireguard codebase is also extremely small. The core Wireguard implementation (the version in the Linux kernel) is around 5,000 lines long, so an experienced developer can read through all the code if they dedicate a day or two to it, and understand how it works.

For comparison, OpenVPN is around 70,000 lines of code and OpenSSH is around 150,000 lines of code. There’s a huge number of features in SSH!

Gzip is old-school. The majority of modern sites use Brotli now. It’s slower to compress, but that’s not normally an issue for static resources (CSS, JS, etc) because they can be pre-compressed during the build and the web server serves the pre-compressed files instead of dynamically compressing them.

Some sites and apps have custom scrollbars. I don’t like it, but they do exist.

Websites can change the colour of the scrollbars, in which case they’re no longer system-rendered ones.

The recommended ESLint rules catch most of the bad stuff, and these days this is all you need in your ESLint config to enable them:

import {defineConfig} from 'eslint/config';
import js from '@eslint/js' 

export default defineConfig([
  js.configs.recommended,
]; 

There’s one use case where == is still commonly used: == null matches both null and undefined. Lint rules that block == usually allows the null case as an exception.

I think a lot of “modern” scrollbars are just there as an affordance so you know that the content is scrollable and how far you’ve scrolled down, not to actually click and drag. Not entirely sure about the UX research for this but my guess is that it’s because most people either physically drag (like with a touchpad or touch screen) or use a mousewheel to scroll down.

Some websites / web apps have the opposite problem: too many scrollbars.

MacOS has a setting to hide scrollbars when a mouse isn’t plugged in (i.e. when just using the trackpad on a laptop), and it’s enabled by default. Even if you force a scrollbar to appear using CSS (overflow: scroll), it won’t appear.

I’ve seen sites where some boxes had two or three sets of scrollbars, because the developer didn’t test on desktop OSes other that MacOS (or on MacOS with a mouse plugged in) and didn’t realise that their CSS was adding scrollbars to too many elements.

In any case, your design should have an affordance to show that there’s more content that can be scrolled to. A common way to do it is fading out or having a shadow on the scrollable edge. This technique is close to 15 years old but I still see it used today: https://css-tricks.com/books/greatest-css-tricks/scroll-shadows/. The Chrome dev site has some brief notes on some more modern techniques: https://developer.chrome.com/docs/modern-web-guidance/guides/ui-atoms/scrollability-affordance-hints

It’s a bigger issue in the US than other countries though. Not all countries value companies based on ridiculous amounts of speculation.

It’s estimated that Anthropic’s IPO will value them around $1.5 to 2 trillion even though their S-1 has 93 pages of risk factors, including that 20% of their revenue comes from their top 2 customers (and I guarantee that both would be looking into moving AI inference in-house), and they literally say that they may never be profitable:

We have a history of net losses and may not generate sufficient revenue to achieve or sustain profitability in the future

They also don’t own any infrastructure like servers or racks - it’s all rented.

Yet they’re still going to have a large amount of people purchasing stock, based purely on vibes rather than actual data.

At least the S&P 500 still has some sense. Companies can only be added to the index if they’ve been trading for at least a year, and if they’re profitable. They refused to change the rules for SpaceX, unlike Nasdaq-100 and Russell 1000.

Don’t even get me started on Nvidia. There’s no reason that a company that makes GPUs should be the most valuable company in the whole world. Actually they don’t even make the GPUs - TSMC does.

Well… https://www.youtube.com/watch?v=vU1-uiUlHTo

ctOS from Watch Dogs was supposed to be a warning… It wasn’t supposed to become a real system.

How’s it a whoosh? I thought their question was genuine.

Different philosophies.

On Linux, you can delete a running application and it’s fine, because files aren’t actually deleted until the last process that has it open closes it. This applies for all files, not just executables.

Internally, files are mainly identified by an inode rather than the file path. If you delete a file then create a new one with the same name, the new file will have a different inode number to the old file. Anything that had the file open will still have a valid reference to the old file. If you’re running a program and upgrade it while it’s running, the currently running version will still be using the old inode, while any new instances will use the new one.

Windows doesn’t do that. On Windows, the file path is the main identifier for the file. Files that are in use and executables that are running are locked and can’t be modified. It tells you to restart so that it can swap in the new files after closing everything. When updating a program, you just need to close it to be able to update, but OS files need reboots because they’re locked the whole time the OS is running.

Note that some versions of Windows don’t require that any more. Some editions of Windows Server 2025 support hotpatching. This patches code (both OS code and program code) directly in memory, avoiding the need to restart to apply the update. On Linux, there’s a proprietary system called Kernelcare that does the same thing for kernel patches.

It makes sense from a business perspective… Earning the same amount of revenue from a smaller number of clients reduces their overheads like support costs, marketing costs, etc. and thus increases their profit margin.

It just sucks for companies that have to spend a lot of time and effort migrating away.

For Nginx on Debian, I need to figure out if just updating the libbrotli1 package is sufficient, or if libnginx-mod-http-brotli needs to be updated too. I suspect it’s dynamically linked (since that’s standard on Debian) and thus just updating the Brotli library and restarting Nginx is sufficient.

Makes sense… Broadcom really are speedrunning the destruction of the VMware brand, and Proxmox VE and xcp-ng are reaping the benefits.

Some major changes Broadcom has made to VMware licensing are that they’ve killed off perpetual licenses, and subscriptions are now billed per CPU core rather than per socket. They enforce a 16-core minimum, and were trying to increase that to a 72-core minimum (but rolled that back). Competitors with enterprise support plans, like Proxmox VE, still bill per socket.

That and all the features in Proxmox VE are free (both in cost and in free software). A company has to pay a license for all their VMware servers, whereas with Proxmox they can decide to only pay for enterprise support for production servers, while using the free version for dev/test/staging environments that don’t need stability or SLAs.