15,978 karma · joined January 12, 2011
If you disagree or otherwise think I'm wrong, please reply. I'm always willing to be educated, or to explain myself further if I was unclear before.
If I'm right and this annoys you, downvote without reply and I'll understand.
From what I read last night: that patch fixed a specific case (an over-large index that became a negative number) that could trigger the problem, but did not fix the core problem itself. The new exploits try to trigger the problem in another manner, the new patch does address the core issue.
Even if that were not absolutely wrong¹ these days², if your risk is mitigated by being one of millions the damage done if you are hit could still be so high that you can't afford to³ knowingly take that risk.
--------
[1] if the credentials can be easily linked to the relevant account, cycling through them to see what useful stuff can be accessed using which is not difficult to quickly automate
[2] if it were ever right
[3] or your customers can't afford for you to
Sorry, I should have been specific: the concern is that this will happen faster than even the more fastidious admins (or daily or even hourly automated checks) will spot and apply updates.
> nowadays even the rumour
I think a lot fewer people would have paid attention at all without the rumour. Some ne'er-do-wells might have scanned a larger update for security issues otherwise, but I suspect most of those spending tokens on PHP this week would not have bothered had there just been a standard maintenance release that may or may not have included changes for a security issue that may (but probably not) have been so globally significant.
That is, at least in part, why the question of how to manage the release of updates like this is not a settled debate.
> then many people will be in no rush to upgrade, and will get pwned.
The worst case that we may be heading towards is that for any services on public facing infrastructure we might have to automatically apply updates with little or no time to verify, just to try be ahead of the ne'er-do-wells, with even superficial updates not mentioning the changes until a short time after to avoid giving clues to those who will scan for security issues if any such is mentioned (or nothing is mentioned - saying nothing about a security-only update only works if you say nothing about all updates, and you don't want to hold off on security-only updates on a slow moving project that might not have a non-security patch for quite some time).
Whether keeping the update quiet and including it in the next normal release, where there are more trees obscuring the wood that is the security concern, and announcing the bug a short time later once anyone using distro updates or otherwise keeping on top of things have updated, would be safer overall than what has happened today is up for debate. I can think of arguments in both directions.
--------
[1] which does have a slight whiff of AI marketing about it - would a human-found issue, without the option of a big AI company to claim some credit, have been handled differently?
I have an Android based TV that is connected for the purposes of iPlayer/NetFlix/other, but is mainly used to play off my local media array via a Pi4 running LibreELEC (Kodi) as even though I subscribe to a couple of streaming services I still find getting things otherwise more convenient. Until a recent update it happily stayed on the HDMI source the Pi is hooked up to unless I switched it, now it (almost) always reverts to its own homepage (with the auto-playing video adverts for shows/games/services) when waking from standby.
Things being too much hassle to fight is what a lot of the invasions of our privacy and other rights are based upon, hence 80-page click-through licences, difficult cancellation processes, labyrinthine stalking preference pop-overs on web sites/apps, etc.
• I run (well, I did and will again when my current medical issues are finally sorted out!). There is no way I would ever compete and make anything of it, so it is all for me and occasionally (when not going out solo) a social aspect.
• I like to visit places. Nice bits of countryside, different countries/cities, museums, and other such. I often combine it with the running. None of this is going to affect anyone else at all, except on the few occasions it is a group adventure.
I can still enjoy techie tinkering in the same manner, it just being for me. TBH other hobbies (the running, playing with 3D printing though that does have an aspect of doing things for others, etc.) have left little time for that in recent years, even before AI. I'm a bit of (OK, a lot of…) an AI Luddite, I'm refusing to touch it even though that might be career suicide in the not too distant future, but other people using it isn't going to completely remove my enjoyment of any of my hobbies.
There are some TVs that eventually pop-up a “please connect” or similar message over any display (even if just using it to display content from another device via HDMI) if they have not been connected for some time, so that you can't permanently use them disconnected. I forget which brand(s)/models are involved, it was talked about in at least one of Louis Rossman's rants so you might find some details in the consumer rights wiki he is associated with.
There will be ways around this of course, though they might involve mucking about in a way the average TV user will not want to risk playing aroud with (rooting the device so you can alter an internal clock that is not affected by any clock you can modify on the UI, or pulling a battery backup out so everything resets (assuming the clock's state is not stored in solid state memory than needs no powered at all to maintain)).
Yes. But not using space from the pot that people are usually meaning when they talk about available space, the amount listed in the `avail` column in the output from `du`, or the space free number displayed by Windows Explorer and other GUI file managers.
Not that it usually makes much difference in the grand scheme of things, outside of made up examples like those mentioned above, or specific cases like file-per-message mail/usenet stores where you could easily run it of inodes before running out of main storage space on a filesystem and small files not taking more than the one inode (no extra storage block) could save a significant amount of main space in total.
The way .name worked you could directly register <name1>.<name2>.name instead if getting <name2>.name and setting up <name1> as a subdomain. It meant john.smith.name and dave.smith.name could be completely separate registrations. You can't generally register <name1>.<name2>.tld like that.
Money out > money in. https://isaiprofitable.com/
That can't go on forever, which is why the big AI companies are crying for regulation to slow things down - they need to make some of that money back before others come along and start eating what little moat they have.
That, and a lot of that investment money seems to be moving in a rather circular fashion, which usually means that when things change it will happen quickly as there is effectively one pot that will all dry up at the same time.
Yes, but it is a pre-allocated somewhere (part of the MFT) so no extra space is taken until a directory grows really huge or there is enough stuff using the MFT that it needs to be expanded. IIRC each directory will be taking a 1Kbyte block in the MFT in an experiment like this, plus a bit for the directory they are in needing to consume more blocks to describe them.
Similar to creating lots of very short files might not initially take any space on common Linux filesystems, as they use nothing more than the pre-allocated inodes.
So far I've seen relatively little anger of that level, except perhaps aimed at MS for the state of Windows. And unfortunately for the humans most companies high on AI juice are more likely to follow the path of finding better ways to use AI (or switching to what they think is a better model) rather than re-engaging with the meat workers, is such a user revolt seems imminent.
My DayJob is riding high on AI AMT, though quality is not currently falling (in fact by some metrics there is an improvement) because people are properly reviewing everything that comes out of it. I'm still planning on not touching the stuff though, if it comes to a choice of “AI or be redundant”, I'll be redundant, but even the Luddite that I am can see there is a benefit if it is used well.
At least until the investment capital starts to be called in and use of decent AI models becomes noticeable more expensive, assuming that happens long before open free models are good enough to replace them.
Of course that will lead to there being very few experienced people in a couple of decades, as most of the remaining ones age out, but I'll be long done by the time that becomes a big problem, I'm not on the right side of the mid-life divide!
Essentially that was the same for Ethernet too, everything on the same leg needs to talk at the same speed, though IIRC a different speed device wouldn't take down everything, it would just cause a significant excess of collisions due to the out-of-sync cross-talk and not be able to talk to anything itself. It wasn't until switching hubs and full switches were around that you could mix speeds on the same leg (with a switching hub you'd actually have two legs, one at each speed, bridged, with a full switch you have a separate collision domain per port so can mix speeds quite freely).
I would not go into teaching, that is something I considered earlier in life and rejected the idea of, and AI is a big thing there too, both dealing with students having it do their work and teachers using it to generate their materials.
Jobs where I'm more-or-less only dealing with people all have the “I dislike the general public” and “the pat is crap” problems, but won't have the “I'm sat on my own”, “everyone who is around me is turning into a meat relay”, and “to even just get by I'll have to interact with the giant purloining polution machines” problems.
> is soul-crushing on another level
They say a change is as good as a rest… :)
I've done sitting/standing in front of a screen for nearly three decades. I'm not looking for something I'll actually like doing to earn a living, it would be the height of naivety to even hope for that, but moving away from more & more of the same in ways I'm liking less & less might be good for me.
You need to backup to an independent network in any case, surely? If not self-hosting with, for example, Imich, how do you assure backups of what you chose instead? I wouldn't trust a cloud service's promises to keep everything securely backed up and available to you, not because I simply don't trust cloud services but because with that arrangement they are a single point of failure so you can lose your data and your backup at the same time if something drastic happens at their end.
Things I run out there backup to home and things I host a home backup out there, in both cases via an intermediate to get “soft offline” behaviour (sources can't directly connect to backup hosts and vice versa meaning in the case of malicious damage both have to be independently hacked for me to lose both the source and the backup), with snapshots (a source can push a corrupted backup to the intermediate and the backups will happily pull it down as they'd not know, but the older snapshots would be untouched on the backups). Both sources and backup hosts could damage data on the intermediate if hacked or broken by my carelessness, but the damage can't spread further than that.
I'm interested in the new DNS-persist method² which will make this even easier, though with some obvious trade-offs, but despite the announcements in Feb/May suggesting it would be rolled out in Q2, I've heard nothing recently and we are now in Q4.
There are various ways to separate managing certs via regular ACME renews and the hosts that actually use the certificates, meaning that hosts which can never see or be touched by the outside network (except via whatever VPN you may use when away yourself) can have ACME certs instead of you setting up your own CA arrangement to serve them. One option if you don't mind all your services having one private key, is to get a wildcard cert on one host (a small server just answering the top level domain.tld for HTTPS based validation, or again one of the DNS options) and have your other services regularly refresh the certificate they use by reading it from there.
----
[1] Docs for acme.sh: https://github.com/acmesh-official/acme.sh/wiki/DNS-alias-mo... (other tools work just as well with it)