Hacker News Reader

akerl_on AURpocalypse now: a look at the recent AUR attacks

You get a lower risk of them pulling in a bleeding edge vulnerability, but a higher risk that you'll get stuck with an old bug waiting for the maintainer to pull in a patch. Then there's the risk that in their attempt to cherry pick, they don't actually mitigate the issue (or introduce more issues based on how they diverge from upstream).

There's no silver bullets here.

akerl_on AURpocalypse now: a look at the recent AUR attacks

> where packages are more thoroughly reviewed

Where are you drawing your conviction that non-rolling-release distro maintainers are doing a more thorough review of upstream changes?

> such as TOTP

What?

akerl_on AURpocalypse now: a look at the recent AUR attacks

It seems like you may have mistakenly inferred that I have issues with the AUR?

I don't; I use Arch on 100% of my personal servers, have done so for something approaching 20 years, and don't see myself changing.

But I treat the AUR for what it is: a place where anybody can say "here's a PKGBUILD for folks" and it's on me to evaluate it on its merits.

I was legitimately asking the person upthread what other distro they felt had a better model for this kind of sharing, because they seemed to think this was a reason for Arch users to jump ship and I was curious what they thought would be the elements of a better system.

akerl_on AURpocalypse now: a look at the recent AUR attacks

Gentoo's model appears to be basically the same? Like the AUR, anybody can submit basically anything they want. The requirements amount to containing valid packages, having a bugzilla account, and putting your package definitions in VCS somewhere.

akerl_on AURpocalypse now: a look at the recent AUR attacks

AUR isn't just the testing repo of Arch; it's explicitly just an open spot where anybody can put up "here's a PKGBUILD for folks". I don't see how it's like either the Nix or Debian examples.

akerl_on AURpocalypse now: a look at the recent AUR attacks

Is there another distro that has an equivalent of the AUR with handling you think is preferable?

akerl_on AI Engineer Claims to Have Cracked Linear A

This would ruin my Linear A keycaps!

akerl_on "No Feigning Surprise"

She's not DMing you, is she?

akerl_on "No Feigning Surprise"

With respect, I think you're seeing what you're looking for.

akerl_on "No Feigning Surprise"

It's not telling people to assume anything at all.

akerl_on "No Feigning Surprise"

You're the one who's extrapolated that the rule asks you to assume ignorance. The post, and the Recurse Center guidelines it's built on top of, don't make that claim.

If I say it's a social guideline to not tell somebody about something wrong with their outfit unless they can fix it in under 5 minutes, I'm not suggesting you go around assuming that everybody knows they have a stain on their shirt. I'm telling you it's net-negative to point it out to them.

akerl_on "No Feigning Surprise"

> It's entirely possible that people can be decent to each other. I know, I know, that's crazy talk

This is nearly comical phrasing given the topic of the page.

I provided enough context about the specific kind of comment I found to be in bad faith that I don’t understand why you felt concerned that I took offense to any mentions of xkcd.

akerl_on "No Feigning Surprise"

The concept of not feigning surprise may be related to the linked xkcd comic, but I don’t see any indication that it’s the “original”, and I downvoted several comments that seemed keen to steal thunder from the post by trying to frame it as just a rehash of a popular comic.

akerl_on "No Feigning Surprise"

If somebody says something rude to me, why would my reaction be to try to decide if I’m glad they were rude unintentionally?

akerl_on "No Feigning Surprise"

> Is being surprised somebody doesn't know something putting them down

Yes.

> is being unsurprised they are ignorant putting them down

Again, the whole reason to just declare this as a rule is so that you’re not put in a position to try to decide if somebody is ignorant or not. You set a social guideline, and if people break it, you point it out, and it doesn’t matter why they did it.

akerl_on "No Feigning Surprise"

The whole point of making it a rule is so those people can learn it and avoid accidentally putting other people down.

akerl_on "No Feigning Surprise"

The Recurse Center, and Julia Evans, have correctly identified that it's a net negative social practice for people to on-the-fly decide that somebody needs to be mocked for not knowing something, regardless of how much you think they ought to know it.

Even your "calm" version probably doesn't need to exist. If there's something they want to do and they're asking you about how to do it, by all means, it may be relevant to tell them that learning a new thing would potentially help them.

Otherwise maybe worry less about what other people should or shouldn't know.

akerl_on "No Feigning Surprise"

> What they are saying is when you are surprised somebody didn’t know something, don’t let it show.

Thats about 50% of what they’re saying. The name comes from the other half.

akerl_on "No Feigning Surprise"

Did you mean to link to https://wizardzines.com/comics/no-feigning-surprise/

akerl_on U.S. science is in chaos

Are we just ignoring all the major societal factors that happen to children before and during childhood?

akerl_on Hetzner Price Adjustment

Don't get me wrong, I think it would be nice if the skillset I happened to hone turned out to be the one field that stays lucrative for my entire career. I just don't think the market owes me or people in my field a job, and if we get displaced and have to learn new roles, we'll be in good company with most other humans alive in our generation.

akerl_on Hetzner Price Adjustment

Isn’t this the same thing every other industry and market has been experiencing with technology, automation, etc. for decades, while tech workers basked in their joy at being safe from being replaced because we were the ones powering the replacing?

akerl_on I Love the Computer

That seems pretty par for the course for every major advancement in technology. So maybe just “capitalism”?

It’s hard for me to think of any piece of new tech that hasn’t been over hyped by the people selling it.

akerl_on Curl will not accept vulnerability reports during July 2026

https://curl.se/support.html

What do you mean by non-existent?

akerl_on Curl will not accept vulnerability reports during July 2026

Reminder that what you're describing is "coordinated disclosure", and that there are in fact plenty of people who consider "full disclosure" to be preferable in some or all cases.

akerl_on Curl will not accept vulnerability reports during July 2026

Curl maintainers are clearly going to still be using computers to provide support for paid customers.

But the message is pretty clear: if you’re not a paid customer, you are not getting patches or support from upstream during this month.

Plan accordingly.

akerl_on Why Is Claude Turning into an a**Hole?

> If you ask it for a cute picture of you and somebody else it has no way of telling if you’re trying to improve your relations with your spouse or be a delusional creepazoid stalker. The chatbots which can make images are programmed to assume the latter, which is more than a little bit offensive.

Are people actually using AI in this way, other than “creepazoid stalkers”?

If I want a cute picture of me and my spouse, usually the part where me and my spouse actually participate in the taking of the picture is pretty key to the goal.

akerl_on Twenty One Zero-Days in FFmpeg

No matter what you do, there will be some group of people that thinks you’re wrong.

It’s up to each of us to decide which peoples’ opinions we actually care about.

akerl_on Twenty One Zero-Days in FFmpeg

Nobody is obligating open source maintainers to accept or read these reports.

akerl_on AMD Stiffs Researcher $10k Bug Bounty

Generally the vulnerabilities you can sell for money are ones that somebody can easily use to make money, as part of an existing money-making scheme they have.

If the vuln can’t be used to make money, or the way it makes money requires that a criminal enterprise make up a whole new set of workflows, it’s not going to have much of a market.