Brief items

The bounty hunter did this all without deploying a hacking tool or having any previous knowledge of the phone's whereabouts. Instead, the tracking tool relies on real-time location data sold to bounty hunters that ultimately originated from the telcos themselves, including T-Mobile, AT&T, and Sprint, a Motherboard investigation has found. These surveillance capabilities are sometimes sold through word-of-mouth networks.

Whereas it's common knowledge that law enforcement agencies can track phones with a warrant to service providers, IMSI catchers, or until recently via other companies that sell location data such as one called Securus, at least one company, called Microbilt, is selling phone geolocation services with little oversight to a spread of different private industries, ranging from car salesmen and property managers to bail bondsmen and bounty hunters, according to sources familiar with the company's products and company documents obtained by Motherboard. Compounding that already highly questionable business practice, this spying capability is also being resold to others on the black market who are not licensed by the company to use it, including me, seemingly without Microbilt's knowledge.

Fast-forward a decade or so into the future. We might say to each other, "Remember those years when software vulnerabilities were a thing, before ML [machine learning] vulnerability finders were built into every compiler and fixed them before the software was ever released? Wow, those were crazy years." Not only is this future possible, but I would bet on it.

Getting from here to there will be a dangerous ride, though. Those vulnerability finders will first be unleashed on existing software, giving attackers hundreds if not thousands of vulnerabilities to exploit in real-world attacks. Sure, defenders can use the same systems, but many of today's Internet of Things systems have no engineering teams to write patches and no ability to download and install patches. The result will be hundreds of vulnerabilities that attackers can find and use.

But if we look far enough into the horizon, we can see a future where software vulnerabilities are a thing of the past. Then we'll just have to worry about whatever new and more advanced attack techniques those AI systems come up with.

IOWs, the question we need to focus on now is not "does breaking mincore affect anyone", it is "how the hell do we mitigate and isolate an information leak exposed by fundamental OS functionality that *everything* depends on for performance"?

I've said this before, but I think it's an important reality check: it doesn't matter nearly as much who uses Debian, or how many people use Debian, because we are not a company or a product, we don't sell something, we're not trying to make a profit or maintain some growth curve, and we're not part of this capitalist system. We are building a Linux distribution, to a very large extent, for each other, and delightfully other people also find it useful. Sometimes those people even join us! Which is great!

This example is relatively friendly. Some chunk of user interactions are much less friendly – criticizing the product, attacking the project for not fixing their particular issue on their timeline, or investing in their particular problem. A peripheral, but amusing pathology is of users from time to time augmenting the urgency of a request by generously offering a $50 donation to TDF to cover the (often) multiple-person-week of (pet) feature work needed.

By setting a more realistic expectation around support, enterprise suitability, and particularly by encouraging people on our main properties to contribute – it is possible to build a consumer, community brand – rather than a pure product brand. This may have a positive impact on reducing the feeling of entitlement that some of our users have.