Jenda_

> virtually none of this stuff is possible with technology any normal citizen has access to

So far, it looks like open-weight models are lagging less than a year behind frontier capabilities. And I think one year diffusion of technology from "insider lab demo" to widely available is actually pretty fast?

There are lots of research fields which "normal citizen" has no access to - medical and biological research, particle physics. Some of it is somehow publicly controlled (LHC), some of it not at all (commercial pharma research, mostly secret until the final human trials). And most of it reaches "normal citizens" in way more than a year.

(and I'm talking about open-weight models. The availability of commercial AI models from private preview to included-in-your-$100-subscription is currently like 4 months)

For a cool example (deanonymization), see https://words.filippo.io/dispatches/whoami-updated/ (discussed at time: https://news.ycombinator.com/item?id=34301768). Someone has crawled public keys from GitHub (tbh I was surprised that GitHub publishes them) and set up a database.

+ making you empty your water bottle, and then on some airports there is no option to fill it afterwards (e.g. only hot water available in the toilets and no drinking fountain)

And some others. https://en.wikipedia.org/wiki/Quotation_mark#Summary_table

Besides an open military invasion (hopefully improbable), I'm afraid of slowly tilting and influencing border states (Slovakia, Hungary) to lean towards Russia, with maybe some future economic extortion, or in the very extreme case, staging an election/referendum to leave EU/NATO.

Oh, OK, I didn't think about lockdown mode, just a regular rootfs encryption.

I still use X, as Wayland does not seem to implement all the features I'm using (but it's improving, so I expect I can go to Wayland in a few years).

Some window managers, such as Fluxbox, support "tabbed windows". You can group windows into one "superwindow" and then switch these in a titlebar. Maybe this is what the GP meant?

Screenshot: https://www.reddit.com/r/UsabilityPorn/comments/bqg9tw/fluxb...

> The lack of hibernation with an encrypted system is an annoying problem, though.

I don't understand. Hibernation to an encrypted swap partition (and even to a swap file on an encrypted rootfs) works normally.

> Not buying hardware from certain vendors (Nvidia) helps improve your chances.

nVidia just works if you accept the proprietary driver. On the other hand, with AMD, you get fun like this: https://www.wezm.net/v2/posts/2020/linux-amdgpu-pixel-format.... Of course, if you don't need high GPU power, use Intel integrated GPU, which works the best.

> They killed at least 561 people

I don't know anything about this case, but "561 deaths have been reported in connection to" does not mean they were all indeed "caused by". They may have reports of anyone who died while using the device, from whatever cause like old age. Now they will investigate and hopefully conclude something.

The GP talked about nose tape (I guess nasal strips), not mouth tape.

I personally use:

- better breath strips from aliexpress

- a 3D print similar to https://noson.eu/

> But in czech language word for Bohemia region is "Czechia" (there is no Bohemia).

No. Bohemia is Čechy, Czechia is Česko.

Yes, they are sometimes confused, and maybe people are unhappy with Česko because it's just too similar to Čechy. People from Moravia and Silesia feel underrepresented when someone mistakenly uses "Čechy" (Bohemia) for the entire Česko (Czechia; Bohemia+Moravia+Silesia).

"habanero eardrum" is actually less than 4 bytes -- let's say 12 bits for a common word (eardrum) + 16 bits for an uncommon word (habanero).

If it were 16 bytes, the other options from the same 16-bytes space would be, for example, "\xa3\x80W%\xa3\x82\xa1\xea\x10\xf9\x8b\x07'\xf93J" or "\xf0\xef\x9b\x8f[0\xe5\xb9,\x0b\xd4^\xb00\xed\x00" (chosen by a fair /dev/urandom roll).

If you want to convey 16 bytes using similar encoding, you need to use about 10 to 12 human words -- see for example Bitcoin wallet 12-word seed phrases or https://xkcd.com/936/ (xkcd correct horse battery staple).

For IPv6, if your addresses are not SLAAC, but DHCP or manually assigned, you can go with half of it - the "random" part is the 64bit network prefix.

Why is there AFAIK no tutorial on how to steal the "app token" (sorry, I don't know the proper term) from Thunderbird or other mail clients?

Because the old algorithm only endangers the communication and the remote device (and this may even not be the case, as such an old device should not be exposed to the world), while the old client may compromise security of the local computer. (fortunately, bugs in SSH client are uncommon; with e.g. browsers it's a different story)

Of course a reasonable solutions would be to run it in some sandbox/VM.

Additionally, the old client will be difficult to use in a current OS because of library and general system incompatibility (Debian with openssh-client-ssh1 is a rare exception, and it's just a command-line ssh, not the library mentioned in https://news.ycombinator.com/item?id=38963372).

> That screwdriver? It used to work when it was first invented and it will still work a thousand years from now.

Maybe it did not and will not -- old screwdriver is probably flat blade, now people use Philips or Pozidriv screws and in some time most will be Torx.

> That car? Keep it maintained and it will take you places for at least the better part of a century. That boat? We can keep boats floating forever.

The same: the fuel and oil is changing (maybe you will not even be able to source gasoline in 2050 if everyone migrated to electric vehicles), and specific spare parts are no longer manufactured.

I guess with large old boats also come expensive support contract - similar to paying someone for a super-long-term individual software support.

> Computers are one of the few, if not only, piece of tool that demands it be replaced every few years, and it probably hasn't even broken down yet which would merit a replacement.

Computers are also relatively new and quickly advancing in features, while the other examples you have mentioned were mostly "stable" for 100 years.

> That kind of attitude is why Windows continues to dominate the desktop market.

On the other hand, macOS is also pretty common on desktops and they don't honor backwards compatibility very much.

Maybe try to have a look at it as permutations: the mapping "hex of the hash" → "its actual hash" is a (presumably random) permutation. And it's quite probable that such permutation has a fixed point: http://laurentmazare.github.io/2014/09/27/fixed-points-of-ra...

The problem is that we currently don't know how find it more efficiently than with exhaustive search, AFAIK.

Edit: previously on HN: https://news.ycombinator.com/item?id=614079

> because optical attenuation rises exponentially with length

I believe the attenuation is stated in dB/km, therefore rises linearly (or even logarithmically if you look at it from the uncommon energy-wise point of view) with distance. Why should exponential be the case?

If I understand this correctly, the paper only shows a particular attack of complexity 2^102. Someone may find a different attack with much lower complexity. That's the usual way how cryptography gets broken -- people find better and better attacks, and suddenly the latest attack has low enough complexity to be practical.

I think Ubuntu has some kind of notifier in "tray". For me, I am subscribed to debian-security mailing list and update when something that is running on systems that I manage seems to be affected.

> versus the more automated update systems MacOS or Windows

I'm not sure -- it is better with Microsoft Store, but other apps solve updates on their own, with various success. I have little experience with Windows and no with mac OS, so I cannot comment.

> Syscall hooking kernel root kits largely only vary in how exactly they hook the syscalls

I don't understand how this survives major kernel upgrades. I have problems keeping out-of-tree modules working, intentionally. Do rootkits ship with fancy DKMS these days? Do the authors test with upcoming versions of major distros and push an upgrade to support the new release?

The malicious weblink can be an advertisement, or a legit webpage that got compromised/XSS'd, or a formerly legit webpage whose domain has expired. (AFAIK this is pretty common)

The email attachment may come from your friend/business partner which themselves got infected and the malware is now attaching itself to their legit emails. (AFAIK not very common)

The GP was talking about Linux desktop, you seem to be talking about Linux server.

There are many more files that will need this protection:

- autorun and keyboard shortcuts of your window manager -- one can hook an evil command to Ctrl+C

- ~/.mozilla -- you can add arbitrary javascript to your profile or extensions

- any application which does not expect to have its config externally tampered with and this may result in various errors including RCE

- ~/work/FooProject/Makefile, configuration of your IDE (which contains list of commands that shall be executed to compile)

etc.

An explicit allowlist would be a better option, IMHO perfectly manageable - with a popup window "the app wants to access <file>, allow once | allow permanently | deny".

Of course - the point is not to get the home folder owned.

There is no reason why Evince/Okular or mpv (to name a few apps which handle files with complex formats from untrusted sources) should have the right to access anything beside their ~/.config/<application_name> and the file they are currently viewing/playing, or maybe read-only ~/Music. If you want to do a "Save as", you will do this through a OS-controlled file dialog, or save it to /tmp and copy it.

This can be achieved with AppArmor, with a caveat that in X, applications can steal each other's windows, but unfortunately this is not the default and easy configuration on most distros.

> attaching a compromised PDF

This means either:

- a 0day, which would require the AV to have a PDF parser better than the standard document viewer, and the ability to sense that this PDF is "weird" -- I would expect AV companies to publish ads "our AV has detected a 0day in XXX"

- a vulnerability was recently discovered in a PDF viewer, and the AV company can push their definitions earlier than the standard "package the fixed version - send to debian-security - let users upgrade" route. This would shorten the attack window by a few hours. Again, I would expect AV companies to boast "we were X hours earlier than the official fix".

Which one is the case? Or is there another option?

Actually, this whole "buggy PDF parser" thing should be solved by application sandboxing -- there is no need that document viewer needs any other access to my system. Unfortunately, Linux is lagging behind. There are some AppArmor experiments with not so great UX, and then there is QubesOS, which is difficult to use. The average Linux desktop is AFAIK almost unsandboxed.

> Two, because a genome is > 700MB, so it won't fit on a single disc.

I would hope it compresses well (lots of repeating stuff), though I have no practical experience.

> I'm not so sure. I mean obviously this is very complicated and we still know very little of the brain.

At least, there are people who have lost most of their gut due to disease or trauma, and their human intelligence is still working unharmed. You may say it is needed for development of the brain, but it does not seem to be needed for function once at least partially developed.

> Pretty much most and Thinkpad or Dell works out of the box.

…except for AMD ones with AMD GPU :( https://www.wezm.net/v2/posts/2020/linux-amdgpu-pixel-format...

or Intel ones with a particular wifi card https://bugzilla.kernel.org/show_bug.cgi?id=203709

I however agree with you that at least for me, the Linux desktop on almost all laptops and desktops "just works". Especially when comparing with Macbooks - you have way less hardware choice there.

So, what should they do? No certificate without DNS record? Would this really help the overall state of affairs, or would most sites just not use HTTPS at all because it's "too complicated"?