tomxor
This blog post does well to remind or educate only for everyone else who's interests are actually aligned with public good.
But then I found this:
https://craci.com/resources/CVE-publication-trends?sev=criti...
Trend for critical CVEs is actually worse, at roughly 25x that of 2020, compared to all CVEs which are roughly 5x compared to 2020.
It's not clear to me from the article if the comparison is with locally compiled binaries, that would be the fair comparison.
I would expect this to be better all rounder in theory, but it would be interesting to see what the difference is from a locally compiled baseline, and therefore if the complexity, obscurity and cost is worth it (again probably application and hardware dependant question).
> it is tempting to view the algorithm as based on cellular automata (Sarkar 2000), yet the lack of parallelism and the strange shape of the 'neighbourhood' of cells surrounding X makes the cellular-automata notion contrived.
If you consider rows as time then dependence is local rather than global. It looks like a 2D automata with a temporal neighbourhood component. And IMO asymmetric or nonuniform neighbourhoods dont necessarily exlude it from the definition, but affects its classification.
Does anyone with deeper academic overview of CA have any insight here? I find many things can look like CA if you stare at it right, but am never sure where to draw the line (maybe there isnt one)
There is a 3rd option: malicious stupidity / aka wilful ignorance.
Google is a collection of individuals, so it's very likely both sides of Hanlon's razor are true: a little malice from those in control, persisting a state of stupidity for those executing the process.
As others have pointed out, there will be resistance to improving a process that negatively impacts their bottom line. Incentives, dictate long term behaviour of organisations; whereas Hanlon's razor works better at an individual level IME.
It's not uncommon practice to omit the security implications on public facing commit messages when fixing secirity issues, so as to not to draw attention until it's ready for distribution.
The problem is the incentives, even though TVs represent a higher turnover for LGE (roughly $1 B), they barely break even, whereas most of the 0.5 B from their advertising division (made through the TVs) is majority profit. They don't want you to use their TVs as monitors (they lose money that way), they are highly incentivised to find a way to track you. This is not unique to LG but they seem the worse affected while having the largest chunk of the market.
I feel a lot more comfortable with a monitor controller attached to the same OLED panel rather than trying to figure out if i've neutered LGs ad department enough, or worrying about it somehow independently gaining network in the future after monitoring everything in isolation as proven in this latest news. I think LG tvs doing something like automatic exfil via their own mesh network in future is not far fetched, it's practical with their market share and they have the incentives.
I haven't finished researching yet but happy to discover this category of monitor is a thing now, with close enough to the latest display tech at reasonable prices. I've never owned a TV either and I keep getting stuck trying to buy one because they are all so horrible.
These are essentially huge TV panels, with basic TV features like a remote control for the OSD. I guess because it's what gamers want... A TV scale monitor for use as a TV without all the smart TV bits which ruin games. There are also a bunch of "Smart Monitors" in this category to be ware, including from LG. The work is in distinguishing the true large format dumb monitors from the smart TVs in disguise.
[0] https://www.trustedreviews.com/reviews/asus-rog-swift-oled-p...
But also vertical scaling seems to be able to handle so much these days that more people probably aught to ask themselves if their application is ever likely to truly need horizontal scaling - Maybe my work is just a small pond, but I suspect we will eventually end up in a place where the vast majority of applications are happy on a single box, and only twitter scale things need to care about this stuff.
.. or maybe I lack imagination of what possible future applications might make use of such massive horizontal scaling on such capable individual boxes (seriously).
If the purpose of down votes is to guide discussion away from uninteresting or counterproductive paths, then it also scoops up divisive comments.
I suppose divisive comments are potentially disruptive if they are particularly flamey. But it seems like they deserve to be distinguished from more objectively negative comments. If the raw up/downs were exposed it would be interesting to experiment with this in the front end.
What's being ignored is the 1/100 of these stories where this judgement pays off, saves aircraft and lives that make the other 99 worth while.
The examples show the concrete use cases... Basically giving you the wiregaurd + DERP quality tunnel but as a one shot point to point cli tool. Which is a nice upgrade from the alternative "in a pinch" tools.
RE "how much tailscale" I guess it's the DERP bit + this minimal point to point control plane. Without which it's significantly more configuration to get the wiregaurd tunnel working, or impossible because of NAT, unless both machines are on the same ipv6 network.
TS basically sell the full control plane with Auth and ACL style management etc as their product so this doesn't really compete.
Trust, stability, security. The reasons many people run Debian.
Although I think the main incompatibility in philosophy here is in "hand that off", e.g. direct agentic usage eroding opportunity for human judgement, which seems unlikely to be adopted anyway. The realistic proposals are essentially AI use with various guard rails and rules to preserve that human judgement (my interpretation).
Actual Proposals (scroll down): https://www.debian.org/vote/2026/vote_002
LLMs operate in abstractions. "Reasoning" is bolted on.
Large groups of people in a poor country steal from rich countries, and your explanation is a morally corrupt culture? not the obviously extremely poor prospects of it's citizens?
> They have none, or worse they can talk themselves into this "Robin Hood" psychosis, where stealing the pension from the elderly is just fine, because they are part of the upper crust of the world.
You're describing a cartoon character. Most of these people are trying to survive, not make some kind of twisted moral stand. Please try to recognise the privilege your place of birth affords you and how much of a global minority you are in. Incentives are everything here.
On the one hand I think organisations taking pure ideological stands is healthy for society as a general behaviour, rather than appealing to the masses and business insentives as GitHub would; on the other hand that can technically manifest as censorship in some cases.
But that's ok as long as we have more than one of a type. The answer to disagreement with one small organisation or projects ideology is to make another one, which is exactly what the author has done in the extreme (host my own damn git). This is the same thing that democratizes FOSS, projects can be ideological dictatorships, that's ok because they can be forked and no one is forced to stay. It also allows individual projects to efficiently follow their ideology or principles without the machinery of democracy getting in their way... It's the best of both.
I don't disagree with your sentiment, but as someone who manages infrastructure which is literally on the opposite side of the planet (from me) RTT is long enough to be objectively horrible for anything interactive like typing over SSH. At least 250ms capital to capital for Europe to Oceania + last mile latency makes 300ms a more realistic minimum + actual processing time + client side rendering and it really starts to feel like a half second from the full human perspective... Under ideal conditions.
The crux is here somewhere.
A massive group of people (A), don't fully understand or care about code, but they care about arbitrary specific outcomes that serve their needs and desires VS a tiny group of people (B), who initiate, architect and maintain successful projects, who care deeply about the health and cohesion of the codebase over it's lifetime, because that serves everyone.
Group-A is now liberated for better and worse. For the first time they can force their will upon a codebase without understanding. They are making selfish changes, and that's fine, this is hacking for the masses. The problem is they still don't realise these are selfish changes, because they have not been forced to tread the path of the programmer to understand they are selfish changes.
The response from FOSS maintainers seems inevitable from this perspective... But I think what's going to be more interesting is watching how Group-A over time respond to creating their own personal hell.
As group-A accrete more and more unsupervised selfish changes into their forks - at what point will they implode and turn into LLM-token-tarpits, at what point will Group-A notice, and I wonder what their response will be.
This default can affect all consumers of NPM packages, regardless of whether you use yarn, pnpm or npm itself, because most package maintainers use NPM. This is why it's NPM's responsibility to change this default in order to prevent spread of malware in packages.
It's a convenience feature that provides built-in Arbitrary Code Execution (even for transient dependencies), and every one of these widespread NPM worm style attacks has propagated through it, because of the default setting. Also enabling it for one command shouldn't automatically permit all transient dependencies to run lifecycle scripts, it should be required to explicitly mark each dependency to limit it to where it's absolutely necessary.
The vast majority of NPM packages do not depend on these scripts, and you should disable them globally if you haven't already.
OK, Question: Would this outcome still benefit society overall?
In the aftermath of this bubble "AI" will still have utility, like the dotcom bubble. So lets say FANG doesn't make a return, how much should we care? How much of this investment is sunk cost that would continue to provide value, and how much of it is operation costs just keeping the lights, I mean GPUs on, that would become unviable post-bubble? As an immediate effect, what happens to these AI companies? or if they become insolvent, what happens to the assets and tech? and what are the secondary economical effect to society if FANG doesn't get their ROI?
I often feel like I would understand a lot more names if I bothered learning Welsh. It's pretty popular for made up climbing route names too, because Wales is so good for it I guess. Allegedly some of the classics in the Avon gorge are Welsh derived but I could never figure them out to be sure.
No, it's really not.
High severity vulnerabilities are responsibly handled by quietly neutralising them with subtle patches that do not reveal the vulnerability, waiting for those patches to distribute. Then patching or removing the root cause of the vulnerability (at which point opportunists will start to notice), and finally publicly disclosing it when there are already good mitigations in place.
Example: spectre/meltdowm mitigations.
I've been asked to use this approach myself when reaching out to maintainers. Sometimes it's possible to directly fix the vulnerability as a "side effect" by making a legitimate adjacent change.
modprobe algif_aead
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true
Came from Gitlab which started pushing out basic users in 2022 with massive price hikes. I weighed Github as an option but was like "no I don't want to be dealing with this same problem in another 5 years" when some other rug pull or degradation happens with that service. So I'm feeling pretty validated for that decision these days.
The speed improvement was massive (super low latency), and was worth the switch on it's own, but we also saved 90% in immediate cost... probably more in secondary effects from the git host just not being a pain point. The only long or unplanned downtime we've had was 2 hours in that whole 3 years where the tiny Linode VPS host had a total hardware failure and got migrated, which is a pretty damn good number of 9s for a simple easy to host single server solution. We also gained more durable and fast offsite backups (zfs) that Gitlab could never offer, but that's more of a custom self hosted thing not specific to Gitea.
Agreed, it would seem that evolutionary biology peaked in the late 90s then
These used quasi-static walking, where the zero moment point (like a moving centre of gravity) is kept within the support polygon of the footprint. This is what gives them their weird swaying gait and extremely conservative movement characteristics. You could never make a bipedal robot run, jump or respond to large and sudden external forces using this method. It's essentially a balance free movement hack.
At this point I genuinely think people would be blown away at how much of a functional improvement it would be.
There would also be a lot of bewilderment for the younger generations, and people who aren't interested in actually using computers who don't think it looks "sleek" enough or whatever. But in terms of day to day quality of life, those old UIs just got the fuck out the way, and were obvious when you had to interact with it. I have some earned hate for the underlying windows OS, but in terms of UI and desktop, we didn't know what we had until it was taken away.