upvote
Thank you for making and maintaining rclone. It is truly a blessing.
reply
I came across rclone at work because "Copy or move data to Azure Storage by using AzCopy v10" is a lie, it literally can't `move` files, only `copy` them.

I can't express in polite words how pathetic it is to see the only official blob storage bulk transfer CLI tool from a multi-trillion-dollar company fail to do the simplest, most essential functionality after ten major revisions.

Meanwhile, rclone Just Works(tm).

Thank you from me too!

reply
Do not try and move the files; that's impossible. Instead, only try to realize the truth... Delete them after you copy.
reply
Right? If you move between file system or device I would expect "move" to be impossible. At best you could copy a logical block and then delete a logical block. If you share a filesystem then perhaps a logical block is a few hundred kilobytes. If you don't then I'd expect the smallest logical block to be the file itself.
reply
Moving on the same filesystem moves the pointer to the file.
reply
deleted
reply
Bend the spoon*

* for people who don’t know the ref

reply
The star only confuses me more...?
reply
> I was considering just merging the fixes straight to master just to make my life easier

I felt that. The problem with doing that is you hate yourself afterwards so not a good solution either, gotta do it properly.

Thanks for working on rclone, Nick!

reply
> Not sure what the solution is

Possibly some sort of ai agent code review system that churns through code looking for these vulns before the code is published. It feels like it's all about who has the resources to find bugs at the moment but that it should be a standard to catch issues before prod moving forward..

reply
Yea, AI bug finding over entire projects, at least on SOTA models is super expensive, hence those with the resources setup to find the most bugs in an automated way.

That said there are a number of people and companies working on more focused means of driving the LLM to look were bugs would be the most dangerous and in doing so reduce the token spend of each bug found.

In some ways the better you are at security stuff the more you can reduce your spend by better driving the LLM to problem spots.

reply
Thank you so much for maintaining rclone! That project is literally the only thing that makes Google Drive an acceptable experience on Linux.
reply
Thank you for the insight! Are you going back to the changelog and editing the CVE-PENDING? I think this would be a justifiable edit of the release history that I'm not sure is possible on github.
reply
As long as you are not running a paid bounty program. Otherwise now you are getting 40 per day.
reply
> GitHub assigns CVEs for the advisories. Before the AI apocalypse they took 2-3 days for an assignment but now it they are running at 3-4 weeks so I have to send the point releases out with CVE-PENDING in the changelog which isn't ideal.

A strange bottleneck; anyone know why that would be so slow?

reply
Trying to keep the rest of GH online?
reply
human triage in review
reply
You can add CVE info later in a git note, if you want something git-managed to point to it. Might take some habit-tweaking to include notes in log output though, to see them later.
reply
I feel like someone somewhere is working on an opensource GPU compute resource pool you guys could pull from as part of a donation type framework. I got a bunch of local gpu resources just relaxing, and if I could load up a a binary to provide compute for X hours a day overnight or whatever, that'd be cool.
reply
I got a 6 month free subscription of Claude Code Max under Anthropic's open source program which has been very helpful.
reply
http://github.com/buzz/block is quickly becoming a reasonable approach to shared agent compute, though it's still a bit more hands-on than the older 'compute donation' projects like SETI or Folding@Home.
reply
I can’t comment on if it applies to your workflow, but one process I’ve used is to aggregate and land ~10 security patches at a time. Eg,

- grab a group of (related) bugs/defects/vulns

- fix them on a branch like bug-batch-XXX

- run that group through the verification, landing in main, CI/CD flow to amortize process cost

- repeat as needed to process backlog

My experience is that process often has irreducible time (eg, two days due to reviews by various parties); but that time slot can be shared between several bugs in a single PR — especially if you have several related to the same feature.

reply
> even using AI tools to triage

Can you discuss this? I might be able to help.

reply
[dead]
reply