thayne

It isn't just compiling something that works. You need to compile it exactly as specified. And document the entire process so you can prove to an auditor that you did everything correctly. Oh, and there's a list of tested platforms, and if your platform isn't on there, which Debian probably isn't, you need to explain to the auditor why it's ok, and why it isn't reasonable for you to use one of the platforms it was tested on.

What you are paying for is not saving the time of a developer compiling something. It's reducing the friction when you go through an audit.

Add giving up or losing the trademark on Javascript to that list.

> Anyway, needing FIPS is something of a niche requirement.

For sure. Most of the time, Debian is just fine. But sometimes, if you have special requirements, something else might be better.

> "Even if an alternative were objectively better, by whatever metric you care about, it would still be of no interest to Steam users,"

I don't think that's necessarily true. If there was a launcher that was at least as good as steam in every aspect, and also had access to more games it would stand a chance of competing. Especially if its store also had lower prices.

> OpenSSL in Trixie is a version supported.

It isn't a validated build. It works the same, but it isn't sufficient if you actually need a validated FIPS module.

> It's just the library, nothing special about the OS.

If you need validation, then the kernel also need to be validated.

Now, it isn't impossible to get a FIPS validated system working with Debian, but you will probably need to contract with another commercial provider like WolfSSL to get validated components. Or compile things yourself. But that is more complicated and involved than just paying for an OS that is validated off the shelf from Ubuntu, Red Hat, or Suse.

Not always. Notably, if you have compliance requirements like needing FIPS encryption (say because you have government customers), or that requires you to use a commercial vendor, debian won't work. And if you need more up to date system packages, or a reliable release cadence, Ubuntu might be better.

On desktop, if you need proprietary drivers, Ubuntu is easier to set up.

But yes, if debian works for you, I wouldn't use Ubuntu.

I wonder if this is because they are more likely to get away with the lies in the Chinese market. Or maybe the Chinese government even encouraged them to make it that way. Certainly the "FU" probably has a different connotation to the Chinese population.

The name "FU100" makes this seem like it is a joke product, at the customers expense. Interestingly, I haven't been able to find a product listing for this except on chinese websites like Alibaba.

"Intellectual Property" is not, or at least should not, be the same as physical property. Copyrights and patents are temporary artificial, government enforced monopolies to incentivise creativity and publication of the results of that creativity. I don't think it's unreasonable to say that a corporation can't own the copyright itself. Although, they should still be able to hold a license to works from the actual human creators, and granting such a license could be a condition of employment (provided it was created as part of the employment, and not, say, on the employees own time).

It might have all the features it needs, but I have yet to see any non-trivial project that doesn't have bugs, or need occasional updates due to changes in something it interacts with.

I also notice it doesn't say anything about their heirs. I wonder if there is a meaningful argument that copyright extending beyond the life of the original author is unconstitutional.

I've seen several projects like this, where there is a flurry of activity for a few days, maybe a couple of weeks, and then it is abondoned and doesn't see any more updates. Maybe they got bored of it, maybe the code wasn't actually maintanable (which can easily happen with vibed code), maybe they were just trying to get attention and didn't actually care about the project.

IPv6 has private blocks too. See https://en.wikipedia.org/wiki/Unique_local_address

The limits in the license mean it isn't open source.

> IPv6 is... inherently globally accessible.

No, it's not. If you really want a NAT there is no reason you can't use a NAT with ipv6. In fact, it can work even better because instead of using a random port for the translation, you can use a random ip address for each connection.

My ISP is only a few years old, but they don't support IPv6 at all. And when I complain about it to support, their response is basically "we don't see the point".

That's actually one indication of how quality has gone down. When I was a kid, I remember a lot of big ticket items would have "lifetime" warranties or 20 year warranties, but these days it's hard to find anything with a warranty of more than a couple years, unless you buy separate "supplementary" warranty, which is really more of insurance than a warranty.

It isn't a perfect analogy, but I think the weights of a model are closer to a compiled executable than source code.

> I don't recall their being a huge backlash to elasticsearch ELv2.

That's not the way I remember it...

> HashiCorp has the same business model

And Hashicorp's software is no longer open source, after they changed the license.

How about a joint effort by multiple governments, done fully in the open, with all results, including training data and methodology fully open source?

> Open source doesn't mean "anyone can use the source code commercially".

Yes it does. It might have requirements that you release the code for any changes you make to it or link with it. But no OSI (or FSF) approved license prohibits you from using it commercially.

Even before Let's Encrypt was a thing, that is how most DV (Domain Validated) certs were issued. It was just a more manual, more expensive process to do it. GP's point is since the system depends completely on trusing the DNS chain anyway, why not have the registrar [sic. it should actually probably be the registry] act as the CA as well and cut out the middleman, and the need to verify the domain from multiple paths to prevent MitM.

In Physics, if a theory doesn't describe reality, the theory is incomplete. Of course all theories are ultimately incomplete, the goal is to find theories that match reality better than the ones before.

CRLs were a great (ok, maybe just ok) design in the early days when the internet was small and the number of CAs and revoked certificates was small. But it was never going to be scalable. And it has the really big problem of needing to distribute these lists of revocations. OCSP has a different set of tradeoffs.

I would really love to know a reliable way to determine if a product is a reliable before buying.

The newest version of python that PyPy supports is 3.12. CPython is on 3.15.

And from what I understand there are limitations with using libraries that use the CPython API to interface with native code.

I think you are interpreting 2 as offering some large amount of money as a prize for discovering a solution. But I think it was meant more as funding a team of mathematicians to work on the problem.

> We do not seek academic credit for the discoveries produced by our internal models.

Sure. But that isn't what they really cared about anyway. They care about notoriety among the general population, and especially among people who decide to pay for their products.

I don't think there is anything in quantum computing that is specific yo the many worlds interpretation.