tomxor

no profile record

comments

29 giorni fadiscuss

> For many people, LLMs are the first time that computers do what they tell them to. Not what some big tech PM has decided is or isn’t possible.

The crux is here somewhere.

A massive group of people (A), don't fully understand or care about code, but they care about arbitrary specific outcomes that serve their needs and desires VS a tiny group of people (B), who initiate, architect and maintain successful projects, who care deeply about the health and cohesion of the codebase over it's lifetime, because that serves everyone.

Group-A is now liberated for better and worse. For the first time they can force their will upon a codebase without understanding. They are making selfish changes, and that's fine, this is hacking for the masses. The problem is they still don't realise these are selfish changes, because they have not been forced to tread the path of the programmer to understand they are selfish changes.

The response from FOSS maintainers seems inevitable from this perspective... But I think what's going to be more interesting is watching how Group-A over time respond to creating their own personal hell.

As group-A accrete more and more unsupervised selfish changes into their forks - at what point will they implode and turn into LLM-token-tarpits, at what point will Group-A notice, and I wonder what their response will be.

2 mesi fadiscuss

That's helpful to prevent individual secret harvesting, however it does not protect you from potential silent downstream effects in packages. i.e. inclusion of malicious code in libraries you depend on, this could be as simple as inserting a cryptominer, or as severe as data exfil in a front end package.

This default can affect all consumers of NPM packages, regardless of whether you use yarn, pnpm or npm itself, because most package maintainers use NPM. This is why it's NPM's responsibility to change this default in order to prevent spread of malware in packages.

2 mesi fadiscuss

At this point lifecycle script should be disabled by default in NPM.

It's a convenience feature that provides built-in Arbitrary Code Execution (even for transient dependencies), and every one of these widespread NPM worm style attacks has propagated through it, because of the default setting. Also enabling it for one command shouldn't automatically permit all transient dependencies to run lifecycle scripts, it should be required to explicitly mark each dependency to limit it to where it's absolutely necessary.

The vast majority of NPM packages do not depend on these scripts, and you should disable them globally if you haven't already.

2 mesi fadiscuss

> You are not recovering these investments

OK, Question: Would this outcome still benefit society overall?

In the aftermath of this bubble "AI" will still have utility, like the dotcom bubble. So lets say FANG doesn't make a return, how much should we care? How much of this investment is sunk cost that would continue to provide value, and how much of it is operation costs just keeping the lights, I mean GPUs on, that would become unviable post-bubble? As an immediate effect, what happens to these AI companies? or if they become insolvent, what happens to the assets and tech? and what are the secondary economical effect to society if FANG doesn't get their ROI?

2 mesi fadiscuss

Hah TIL. So it's the river Welsh river on the English side of the Bristol channel.

I often feel like I would understand a lot more names if I bothered learning Welsh. It's pretty popular for made up climbing route names too, because Wales is so good for it I guess. Allegedly some of the classics in the Avon gorge are Welsh derived but I could never figure them out to be sure.

2 mesi fadiscuss

> Immediate public disclosure is the only choice that isn't irresponsible as far as I'm concerned.

No, it's really not.

High severity vulnerabilities are responsibly handled by quietly neutralising them with subtle patches that do not reveal the vulnerability, waiting for those patches to distribute. Then patching or removing the root cause of the vulnerability (at which point opportunists will start to notice), and finally publicly disclosing it when there are already good mitigations in place.

Example: spectre/meltdowm mitigations.

I've been asked to use this approach myself when reaching out to maintainers. Sometimes it's possible to directly fix the vulnerability as a "side effect" by making a legitimate adjacent change.

2 mesi fadiscuss

FYI it's dynamically loaded on demand, so lsmod will show it after you try run the exploit, or you can explicitly load it with:

  modprobe algif_aead

The following mitigation (from the article) does work for Debian 12 and 13, I've tested this:

  echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
  rmmod algif_aead 2>/dev/null || true

First line blocks it from loading, second line is unloading it if it's already been loaded. You can test with the same "modprobe algif_aead".

2 mesi fadiscuss

Another happy self hosted Gitea user here for ~3 years now.

Came from Gitlab which started pushing out basic users in 2022 with massive price hikes. I weighed Github as an option but was like "no I don't want to be dealing with this same problem in another 5 years" when some other rug pull or degradation happens with that service. So I'm feeling pretty validated for that decision these days.

The speed improvement was massive (super low latency), and was worth the switch on it's own, but we also saved 90% in immediate cost... probably more in secondary effects from the git host just not being a pain point. The only long or unplanned downtime we've had was 2 hours in that whole 3 years where the tiny Linode VPS host had a total hardware failure and got migrated, which is a pretty damn good number of 9s for a simple easy to host single server solution. We also gained more durable and fast offsite backups (zfs) that Gitlab could never offer, but that's more of a custom self hosted thing not specific to Gitea.

3 mesi fadiscuss

> aaand we have Quake and Comand&Conquer - Red Alert

Agreed, it would seem that evolutionary biology peaked in the late 90s then

3 mesi fadiscuss

These robots weren't really "walking" in the sense that humans walk through continuous dynamic balancing, i.e falling forward.

These used quasi-static walking, where the zero moment point (like a moving centre of gravity) is kept within the support polygon of the footprint. This is what gives them their weird swaying gait and extremely conservative movement characteristics. You could never make a bipedal robot run, jump or respond to large and sudden external forces using this method. It's essentially a balance free movement hack.

4 mesi fadiscuss

Go back to Win98 UI, I know it will never happen but can you imagine...

At this point I genuinely think people would be blown away at how much of a functional improvement it would be.

There would also be a lot of bewilderment for the younger generations, and people who aren't interested in actually using computers who don't think it looks "sleek" enough or whatever. But in terms of day to day quality of life, those old UIs just got the fuck out the way, and were obvious when you had to interact with it. I have some earned hate for the underlying windows OS, but in terms of UI and desktop, we didn't know what we had until it was taken away.

4 mesi fadiscuss

Yes, by generally I really mean all the defaults are pretty permissive, but I understand some people tune both TCP and SSH on their servers to drop connections faster because they are worried about resource exhaustion.

But if you throw up a default Linux install for your SSH box and have a not-horrible wifi router with a not-horrible internet provider then IME you can sleep your machine and keep an SSH connection alive for quite some time... I appreciate that might be too many "not-horrible" requirements for the real world today though.

4 mesi fadiscuss

If hung SSH connections are common it's likely due to CGNAT which use aggressively low TCP timeouts. e.g. I've found all UK mobile carriers set their TCP timeout as low as 5 minutes. The "default" is supposed to be 2 hours, you could literally sleep your computer, zero packets, and an SSH connection would continue to work an hour later, and generally speaking this is still true unless CGNAT is in the way.

If you are interested there are a few ways you can fix this:

Easiest is to use a VPN, because the VPN's exit node becomes the effective NAT they usually have normal TCP timeouts due to being less resource constrained. Another nice benefit of this method is you can move between physical networks and your connection doesn't die... If you use Tailscale then you already have this in a more direct way.

Another is to tune the tcp_keepalive kernel parameters. Lowering the keepalive timeout to be less than the CGNAT timeout will cause keepalive probes to prevent CGNAT from dropping the connection even while your SSH connection is technically idle. For Linux I pop these into /etc/sysctl.d/z.conf, I have no idea for Windows or Mac:

  # Keepalive frequently to survive CGNAT
  net.ipv4.tcp_keepalive_time   = 240 
  net.ipv4.tcp_keepalive_intvl  = 60
  net.ipv4.tcp_keepalive_probes = 120

This is really a misuse of these settings, they are supposed to be for checking TCP connections are still alive and clearing them up from the local routing table. Instead the idea is to exploit the probes by sending them more frequently to force idle connections to stay alive in a CGNAT environment (dont worry the probes are tiny and still very infrequent).

_time=240 will send a probe after 4 mins of idle connection instead of the default 2 hours, undercutting the CGNAT timeout. _intvl=60 and _probes=120 mean it will send 120 probes 60 seconds apart (2 hours worth) before considering the connection dead. This will keep it alive for at least 2 hours, but also allows us to have the best of both worlds so that under a nice NAT it keeps the old behaviour, e.g if I temporarily lose my network the SSH connection is still valid after 2 hours, but under CGNAT it will at least not drop the connection after 5 mins so long as I keep my computer on and don't lose the network.

There are also some SSH client keepalive settings but I'm less familiar with them.

4 mesi fadiscuss

> It’s who’s looking at your profile; it’s the profiles that you’re looking at. That was the holy grail

Facebook actually implemented this as a user facing feature.

I think it was very early days, but I used it, it was fucking creepy, and everyone hated it. I think Facebook probably removed it because it drove people away. It made you feel like a creep for checking on your friends page.

4 mesi fadiscuss

Yup, in a word, ownership.

But that's an unpopular approach these days where many companies are obsessed with minimising the bus factor to the point that their IP is as replaceable as their employees.

4 mesi fadiscuss

> I cannot think of a technology more diametric to 'plug n play' than VR, which is very unfortunate.

Ironically that's exactly what the Quest solved with SLAM, it really is plug and play, otherwise I would not have bought one... and it sucks that Meta now owns it, but it really is still the best "just works" VR.

I also don't think VR has much potential to solve real world problems for enough people, but it doesn't have to because it's pretty good entertainment as a gaming device (albeit still fairly niche).

4 mesi fadiscuss

Not Maybe, I owned a 2009 MBP. Everyone with a macbook from that period that I knew had the same issue, they were absurdly bright, you could not keep it anywhere near a bedroom without putting very thick tape over the light.

It was a poorly thought out design of aesthetics over ergonomics.

5 mesi fadiscuss

> I started making deliberate grammar and spelling mistakes in professional context.

I've also noticed an increase of this in myself and others, I used to edit a lot more before sending anything, but now it seems more authentic if you just hit send so it's more off the cuff with typos, broken sentences and all.

I'm sure an LLM could easily mimic this but it's not their default.

5 mesi fadiscuss

> the number of bus stops might matter at the margins, we’re not talking about a system where marginal improvements will matter

The central argument of reducing stops is increasing bus speed, not reducing margins, It's in the second paragraph.

[edit]

Top comment is a straw man, attempt to correct course downvoted... I'm not sure how much value HN has left for useful discourse, who the fuck are you people, if you even are people.

5 mesi fadiscuss

Yes, I ambiguously said "started this space"... and to be honest even in the most generous interpretation that's probably incorrect, maybe ZeroTier started "this space", in that it had NAT busting mesh networking first.

As far as I understand Tailscale brought NAT busting mesh networking to wireguard + identity first access control, and reduced configuration complexity. I think they were the first to think about it from an end to end user perspective, and each feature they add definitely has this spin on it. It makes it feel effortless and transparent (in both the networking use sense and cryptography sense)... So i suppose that's what I mean by started, TS was when it first really clicked for a larger group of people, it felt right.