PieFed.ca
Kissaki, kissaki@programming.dev
Instance: programming.dev
Joined: 3 years ago
Posts: 68
Comments: 560
Posts and Comments by Kissaki, kissaki@programming.dev
programming
Kissaki
security
gamedev
dotnet
uiux
github
linux
cybersecurity
programming_languages
Comments by Kissaki, kissaki@programming.dev
I have no explanation for the March thing.
an easter surprise? 🤔
Looks like StatusGator mentions “Codeberg reported an issue on their status page” multiple times, but links neither to the status page nor the reported incident? That seems… lacking.
https://status.codeberg.org/status/codeberg
Performance degradation for unauthenticated traffic
We’re facing severe traffic spikes for unauthenticated traffic, impacting performance and availability. Our primary goal is to avoid interruptions for authenticated users of Codeberg.org.
Unrelated, the Mastodon instance used by the Codeberg.org status account is currently unavailable.
Date Created: 2026-07-31 18:27:32 (16 hours ago)
All Systems Operational
Looks like the mentioned platform does not exist yet. ETA 2027.
A new online European repair platform will help connect consumers with repairers. The platform will have sections for each member state, helping consumers find available offers and boosting visibility for repairers.
The platform, which will be an extension of the “Your Europe” portal, should become operational in 2027.
Sophos VPN is a rebrand of OpenVPN. How many of those are simple branding reusing existing VPN client infrastructure?
If it’s only about branding, it’s pretty obvious to me why they do it. I doubt they [all] rewrite entire clients without a need?
Keyboard is a central part of my workflows and input, but CLI only narrowly.
I regularly fire up Nushell, and occasionally use specific or dedicated tools (git, edit, …), but generally, no, relatively to other usage, I wouldn’t say I leverage CLI tools much, although that’s subjective and relative. I wouldn’t call it unusual either, though. Relatively common, actually.
I certainly have no problem firing up a shell and using Shell, CLI, or TUI, and if a tool or util is good or important enough, I will do so and use them when I need or want to use them for (specific) things or work.
This HTMX article on security says it’s not ok to call HTMX with external sources.
Where does it say that? It says “Only call routes you control”. As I understood you, you do control those routes.
7-Zip 26.02, released 2026-06-25, undisclosed vulnerability fixes. Quite a while ago, if you keep stuff up to date.
They mention Landon Peng as the one finding the vulnerability, but their blog has only a post about a vulnerability fixed in 25.01.
Web Development@programming.dev
several Member States are now blocking the EU Commission’s proposal to get rid of the cookie banner
Which ones? Why’s there no list here when the “take action” lists by country?
Web Development@programming.dev
The EU never asked for cookie banners. The industry is just really bad at 1. following the law 2. following the spirit of law 3. designing good UI/UX
So banner data-sharing dialogs don’t offer a simple reject button. That’s not lawful.
From the linked webpage readme:
2.1 Classify. Each file is labelled permissive (at least one permissive license detected, no conflicting non-permissive license), no_license (no licenses detected, or only non-license legal texts such as CLAs), or non_permissive. The permissive allowlist follows the Blue Oak Council list plus licenses categorized as Permissive or Public Domain by ScanCode. Files classified as non_permissive are excluded from both released datasets.
From https://www.bigcode-project.org/docs/about/the-stack/:
v1.1: The three copyleft licenses (MPL/EPL/LGPL) were excluded and the list of permissive licenses extended to 193 licenses in total. The list of programming languages was increased from 30 to 358 languages. Also opt-out request submitted by 15.11.2022 were excluded from this ersion of the dataset. The resulting near-deduplicated dataset is 6TB in size.
So MPL/EPL/LGPL are already not part of the dataset.
So… why were they in there? Was this added for v1.1?
“one permissive license” - So if my project includes a lib and I include the license file for that for the license notice…?
with a Markdown list with all your repositories you want removed.
The repo readme linked FAQ says
You can choose to request either (1) all repos, or (2) you can specify select repos that you own to be removed.
so “all of them” should be acceptable
Noteworthy: They crawled only the default branch HEAD and inlined all source content.
- The file contents are included inline. The decoded UTF-8 source text is embedded directly in the dataset, so it is fully self-contained — you can start training the moment the download finishes.
- It reflects the state of GitHub in August 2025. The corpus is a direct crawl of GitHub repositories at their default-branch HEAD, capturing roughly two additional years of open-source code compared to The Stack v2.
We want to give developers agency over their source code by letting them decide whether or not it should be used to develop and evaluate machine learning models.
crawled directly from GitHub and built to pre-train code LLMs with full-repository context
Repositories that opted out are removed from the dataset before each patch release.
“agency”
Which AI company will not use v1 which has all of the data but will use later patch releases instead which have less data?
It’s somewhat long for two policy changes, but a very well-written, wide assessment. It lays out good reasons for the [further restricting] changes.
Unfortunately, these crawlers instead try to read every single page from Codeberg, no matter if it makes sense. This includes all the different issue filter variants, Git history, as well as the actual files at any point in Git history - even if they are still equal.
I’m surprised they don’t lock some things behind account logins. Is it that hard to decide what would be acceptable to no longer serve without an account?
Does the full commit and change history have to be available without an account, under these circumstances? If we think about what would be minimally enough:
- Current branch head tree
- Tag trees (you can link to release source state and [potentially/manually] compare between releases)
Not having a change log history nor code change diff seems like a big loss to me, but you have to draw the line somewhere, and that seems acceptable to me.
To me, Codeberg is in a better position to do so than smaller instances. I already have an account because it has many [relevant/significant] projects, is a home of public good, and is under an appropriate org.
Where’s the programming part? I would like to see the source or docs and know how it solves endless render depth without hitting number calc limits.
Godot@programming.dev
When did you first hear of Godot? *
I love required questions with very specific answers I don’t know how to answer. I guess I’m out.
Earlier I did the StackOverflow survey and everything was optional. I liked that.
Opensource@programming.dev
Granular repository watch settings
Ooh, very nice. Watching for release notifications is something I use excessively on GitHub. Looking forward to being able to use that on Codeberg.
Opensource@programming.dev
Forgejo v13.0 added the capability to remove EXIF metadata from images that are uploaded in a user’s avatar. Unfortunately, a licensing mistake was made and Forgejo relied on an AGPL-licensed library to accomplish this work. While other options are being pursued, Forgejo has removed this capability to bring us into license compliance.
😬
an easter surprise? 🤔
Looks like StatusGator mentions “Codeberg reported an issue on their status page” multiple times, but links neither to the status page nor the reported incident? That seems… lacking.
https://status.codeberg.org/status/codeberg
Looks like the mentioned platform does not exist yet. ETA 2027.
Sophos VPN is a rebrand of OpenVPN. How many of those are simple branding reusing existing VPN client infrastructure?
If it’s only about branding, it’s pretty obvious to me why they do it. I doubt they [all] rewrite entire clients without a need?
Keyboard is a central part of my workflows and input, but CLI only narrowly.
I regularly fire up Nushell, and occasionally use specific or dedicated tools (git, edit, …), but generally, no, relatively to other usage, I wouldn’t say I leverage CLI tools much, although that’s subjective and relative. I wouldn’t call it unusual either, though. Relatively common, actually.
I certainly have no problem firing up a shell and using Shell, CLI, or TUI, and if a tool or util is good or important enough, I will do so and use them when I need or want to use them for (specific) things or work.
Where does it say that? It says “Only call routes you control”. As I understood you, you do control those routes.
7-Zip 26.02, released 2026-06-25, undisclosed vulnerability fixes. Quite a while ago, if you keep stuff up to date.
They mention Landon Peng as the one finding the vulnerability, but their blog has only a post about a vulnerability fixed in 25.01.
Which ones? Why’s there no list here when the “take action” lists by country?
The EU never asked for cookie banners. The industry is just really bad at 1. following the law 2. following the spirit of law 3. designing good UI/UX
So banner data-sharing dialogs don’t offer a simple reject button. That’s not lawful.
From the linked webpage readme:
From https://www.bigcode-project.org/docs/about/the-stack/:
So MPL/EPL/LGPL are already not part of the dataset.
So… why were they in there? Was this added for v1.1?
“one permissive license” - So if my project includes a lib and I include the license file for that for the license notice…?
The repo readme linked FAQ says
so “all of them” should be acceptable
Noteworthy: They crawled only the default branch HEAD and inlined all source content.
“agency”
Which AI company will not use v1 which has all of the data but will use later patch releases instead which have less data?
It’s somewhat long for two policy changes, but a very well-written, wide assessment. It lays out good reasons for the [further restricting] changes.
I’m surprised they don’t lock some things behind account logins. Is it that hard to decide what would be acceptable to no longer serve without an account?
Does the full commit and change history have to be available without an account, under these circumstances? If we think about what would be minimally enough:
Not having a change log history nor code change diff seems like a big loss to me, but you have to draw the line somewhere, and that seems acceptable to me.
To me, Codeberg is in a better position to do so than smaller instances. I already have an account because it has many [relevant/significant] projects, is a home of public good, and is under an appropriate org.
Protecting our FLOSS commons from LLMs — Codeberg News (blog.codeberg.org)
In Brief:
Cursor 0day: When Full Disclosure Becomes the Only Protection Left - Mindgard (mindgard.ai)
After loading a project, Cursor attempts to find git binaries at various locations including the current workspace. By creating a repository with a planted malicious git.exe in the root, the IDE will execute it with no user interaction and no prompting of the user. This occurs repeatedly on a cadence.
Where’s the programming part? I would like to see the source or docs and know how it solves endless render depth without hitting number calc limits.
I love required questions with very specific answers I don’t know how to answer. I guess I’m out.
Earlier I did the StackOverflow survey and everything was optional. I liked that.