Porting Willows TWIN (A Win16/Win32 emulator that started in 1993) to modern-ish Linux. Making some progress, but I saw an error from #skifree that probably very few people have seen!

Yer outta memory, duuuude!

#retrocomputing

Godot is free and open source for everyone, and it only survives through community support. To keep it independent and sustainable, we need your help. Please donate, and thank you to everyone who makes Godot possible.

https://fund.godotengine.org/

“I read your latest draft”

Feel bad about hoarding RAM that could be used by Sam? No worries, I just launched https://uploadyourram.org/ so you can give your RAM to those in need

The trillion dollar monsters are all focusing on *finding* issues at high speed in large volumes. Hardly any of them care about *fixing* these problems with any sense of quality.

okay now that we have some attention on alpine Linux and other under-resourced major-used projects that are flooded with AI security reports and fixes, can we get some funding uwu?

once again i advise anyone relying on qtwebengine to not because as far as i can tell, its chromium 140-based branch has been mostly untested since september

i've done 5 or 6 bumps in it since then because they pull in secfixes, every bump has so far been a bunch of haphazardly done secfixes where at least one of them should be impossible to build in any configuration because they omitted inclusion of some other upstream part + maybe a fix for the breakage that happened last time

using the tarball is dangerous because it's riddled with vulns, using the branch is better but leaving making sure it builds and works to distros seems kind of bad (even though i'm doing my best to ensure it does work)

new startup idea: domain hoarding for possible vulnerability names

Every time I see rust people saying rubbish like "Can we stop using C already?", I want to use C for my projects just to spite them.

How about you let me use language I want, huh? It's *my* project, not yours.
Besides, if you want more people to use language you like so much, fix the cargo mess first.

@uecker @tychotithonus @mirabilos The problem was OpenSSH checking one user's password against another user's hash to waste time (to mask timing leaks) then *still trusting the result of that check* to let them log in (rather than hard-coding failure when doing this).

@damienmiller

We consider the root cause of this bug to be outside OpenSSH itself

This has since been questioned; OpenSSH never held crypt(3) right #ifndef BSD_AUTH (just using "xx" as seed sometimes), and https://hachyderm.io/@dalias/117566592992427860.

Thank you @sunweaver for this well considered objection to #Debian handing more control to a wasteful, unreliable, proprietary #LLM for core workflows.

“Designing Debian's package submission process in a way that it makes it depend so strongly on LLM technology creates a massive dependency on companies and politics I would never want to work with or work for. Ethically, this is a total no go. From digital sovereignty perspective it is just sad.”

https://lists.debian.org/debian-devel/2026/10/msg00345.html