News for hackers. Stuff that matters.

throwaway_62022

You are moving the goal posts. You said this memo does not apply to dual intent visa holders and I proved it does. I am not saying if an exception should be made ffor H1B visa holders or not.

I am just pointing out this affects all employment visa types.for countries with long delays in counselor processing this effectively kills any chance of getting Green card because no employer will wait that long.

This is not true. It is not nearly immediate at US consulate and backlogged in US. The parent doesn't know what they are talking about.
No the memo specifically says:

> However, maintaining lawful status in a dual intent nonimmigrant category is not sufficient, on its own, to warrant a favorable exercise of discretion.

Which basically means that, applying AOS while being in dual-intent category is not favorable and you will have to prove extraordinary circumstance for a simple i-485 AOS on H1B. Lacking the extraordinary circumstance, your application may be denied.

What this basically means for millions of people on H1B (especially from countries like India is), they have to go for consular processing. And given the lack of appointments in India and delays they are facing - you could be stuck for months to years and no company is going to wait for you while you go through the process. So leaving would definitely disqualify them.

Ugh - say I wrote a daemon that runs every 2 hours, it exposes no end points and has no metrics. But just because I depend on some library that brings in promethus which in turn brings some http2 library, I am on the hook for fixing this Cve in my code.

Shouldn't it be on security researcher to prove that how this can be exploited if no http end points are created?

So much of security scanning is such bullshit.

Ha ha. The part that isn't being discussed how it is more profitable for certain commercial interests to have more vulnerabilities even if they are bogus.

There is something wrong with security industry and we are all paying the price. At my day job some tool automatically opens security bugs against 15 or so repos we maintain and now we are on the hook for arguing how the report was bogus or fix the vulnerability. Just PR and Jira dance one has to do is exhausting.

Re:GPT-4o on Monday May 13, 2024 @03:54PM (#40347584)
As John Stewart says in https://www.youtube.com/watch?v=20TAkcy3aBY - "How about I hold the fort on making peanut butter sandwiches, because that is something I can do. How about we let AI solve this world climate problem".

Yet to see a true "killer" feature of AI, that isn't doing a job badly which humans can already do badly.

Re:Ruby might be faster than you think on Wednesday April 24, 2024 @10:45PM (#40152766)
>The Ruby implementation has a subtle mistake which causes signficantly more work than it needs to.

To be fair, I do not think that is a "mistake" as such. I have written Ruby professionally for 6 years or so and have committed to several Ruby open source projects and haven't seen an innocus `nil` sitting at the end of a loop, to prevent array allocation.

The argument would be fair, if it wasn't idiomatic Ruby.

More like - knowing internals of a language will allow one to gain more performance out of it. That has been true for almost every programming language, but general speaking the goal of a VM based language is to not require that _specialized_ knowledge.

Re:RedHat employee bans Hyprland creator from fdo on Tuesday April 09, 2024 @04:24PM (#39983843)
So, whatever is posted publicly on "polite" forums about what was going on Hyprland discord is tip of the iceberg. See for yourself - https://imgur.com/a/6Po3Paq

Changing someone's pronouns without their permissions seems like least of their offenses.

Hyprland discord appears to be a cesspool and one fermented by Vaxry himself, trans hate or otherwise. Now some people are saying - they have improved (and others are saying they have not). But reading his blog posts and seeing current status, I am not optimistic. I mean you can't make this stuff up. Why use a opensource discord community for sharing porn? (which likely have minors).

Re:RedHat employee bans Hyprland creator from fdo on Tuesday April 09, 2024 @04:21PM (#39983804)
So, whatever is posted publicly on "polite" forums about what was going on Hyprland discord is tip of the iceberg. See for yourself - https://imgur.com/a/6Po3Paq

Hyprland discord appears to be a cesspool and one fermented by Vaxry himself, trans hate or otherwise. Now some people are saying - they have improved (and others are saying they have not). But reading his blog posts and seeing current status, I am not optimistic. I mean you can't make this stuff up. Why use a opensource discord community for sharing porn? (which likely have minors).

Re:Why Are There Suddenly So Many Car Washes? on Sunday March 17, 2024 @06:16PM (#39738570)
I can find them in Georgia (far and few in-between) and they are super useful, if I must say - if not for folks across the border, hand carwashes will entirely disappear from US.
Re:A serious case for dynamic scoring (immigration) on Thursday August 31, 2023 @09:37AM (#37336961)
Yep. Since OP mentions working as IT consultant, I can easily see how that field being dominated by IT shops that merely checkbox one or more of H1B critireas. I can see how his/her perspective is colored.

But if you make visa program too punitive, then folks will simply chose not to come. A person in their 30-40s, want stability so as they can raise their kids, have a place to call home and not be on a perpetual cycle of anxiety.

In my mind, this will disincentivize folks who have most to contribute to US economy. I don't know much about China but for folks who are really good, salaries in India is already pretty high and closer to US salaries and will have fewer reasons to immigrate.

Re:Keep Linux Open and Free–We Can’t Afford Not To on Tuesday July 11, 2023 @03:05PM (#36685791)
I tried to find some Oracle contributions to gcc and I could find none. See gtk contributors - https://puri.sm/posts/proud-to-be-top-contributor-to-gtk4/ and being a RHEL clone, they actually ship this stuff by default.

They might have an occasional commit or two but clearly they can't stand behind their own promise of developing/supporting an EL distro the way Red hat does. I also don't see it changing tbh. I don't see troves of Open source engineers at Red Hat(or other companies) making a bee line for joining Oracle.

Re:Keep Linux Open and Free–We Can’t Afford Not To on Monday July 10, 2023 @02:30PM (#36670881)
> Red Hat does not maintain all of the code in RHEL - they repackage and patch everything taken from other developers.

This is false. Red Hat does maintain code that is shipped by default with RHEL. It should be noted though, the number of packages that are part of default RHEL installation is small. Also upstream first policy basically means, any proposed patch must first be merged in upstream before being backported to rhel. If that does not make them maintainers, I don't know what will. Being sole author and maintainer are not the same thing.

Re:Keep Linux Open and Free–We Can’t Afford Not To on Monday July 10, 2023 @12:59PM (#36669207)
> Oracle does care about open source, to the extent that they have been the top Linux kernel contributor several times.

Linux kernel is not entirety of Linux. Given that there is Oracle cloud and various hardware Oracle has to support, it will be almost unthinkable if Oracle did not contribute to Linux kernel.

But - I will be interested in Oracle's support for broader Linux ecosystem. How about contributions to GCC, Gnome (or any other DE as a matter of fact), Wayland/xorg etc? Oracle strictly contributes to projects from which it can benefit immediately.

Re:News Is Bad for You on Wednesday July 05, 2023 @12:53PM (#36603176)
I think there has to be a middle ground. Once I read a foxnews article about a toddler getting shot in some sort of road rage just when I was about to sleep and his last words haunted me all night and I couldn't sleep (I have kids of similar age). I am not even a regular fox reader fwiw, but clearly there are news outlets that are putting news out there to cause certain anxiety in their audience. I have since made a rule that, avoid news articles before going to bed (and I mean from all sources).

I still read news and I can handle a lot more with a cup of coffee and clear head in the morning. But my mind is just not ready to deal with stuff at night (reminds me of song - "Why do the monsters come out at night?" )

Re:A response to the git.centos.org changes on Monday June 26, 2023 @03:54PM (#36484938)
In general I think, if there is a package which is part of RHEL, there is an engineer working on it and contributes patches and is well versed in the code of it. Otherwise if there is a bug reported by paying customer, they won't be able to fix it. Opening a bug against any of supported Red Hat products by paying customers have consequences and it isn't like a bug on gnome or kde that goes unanswered/unresolved for years.

But RHEL by default doesn't have as many packages as Debian or even Fedora. See recent announcement about LibreOffice. Red hat can't by default ship a package that it can't fix and support.

Re:Sourcehut will blacklist the Go module mirror on Monday January 09, 2023 @11:27AM (#34312156)
Comes around $8-11 of egress monthly traffic on AWS. I would think twice before signing up for a service that charges me $10/month - not sure why this should be any different.

Also, how do you opt-out? Imagine a random developer in a startup, running a Gitlab instance and then pushing a Go module there and only to be left with inexplicable traffic pattern(and bill). I have no skin in the game but this default _does not_ sound reasonable to me, whichever way you slice it.

Re:Sourcehut will blacklist the Go module mirror on Monday January 09, 2023 @11:05AM (#34311883)
I think it is problematic that we are using github issues as "support forum" for asking a git host provider to be excluded from the refresh list. This should not have come to that. Whatever happened to "reasonable defaults", so as a random person hosting a single Go module doesn't get DOSed - https://github.com/golang/go/issues/44577#issuecomment-86087... ?
As I mentioned above - criticism of any kind of religion can get you in trouble in India[1][2]. But we should not lump that with criticism of government.

Do you have any examples, where someone was arrested for simply criticising govt actions?

1. https://www.independent.co.uk/news/world/asia/editor-arreste...

2. https://en.wikipedia.org/wiki/Weeping_crucifix_in_Mumbai

Folks belonging to majority can get caught on the wrong side of the fence too - https://www.independent.co.uk/news/world/asia/editor-arreste...

I believe the problem is laws related to religion and hate speech. They are stupid. Section 295 is non-bailable offence and can be easily abused by either side to placate group that feels offended.

The discussions about India sliding into authoritarian is interesting because strictly speaking many of these laws are pretty old. I wish that these laws did not exist but strictly speaking these laws have been abused to placate Hindus, Muslims, Christians(https://en.wikipedia.org/wiki/Weeping_crucifix_in_Mumbai) at different times.