nirui

I'm just reading the code here:

  // Before template expansion, .git was removed so that a fresh repo can be initialized; remove it again in case
  // some template variable usage has conflicted with this directory and impacts git operations.
  if err := root.RemoveAll(".git"); err != nil {
    return fmt.Errorf("unable to remove .git folder")
  }

Why the `err` isn't carried by the error message? For security? Then maybe log it internally?

User/operator can't really fix the problem if you keep giving them information this vague.

Hmmm, I was wondering who were the "volunteers or people paid to do fundamental research" (in their project docs), it turned out to be new grads LOL.

But I wouldn't blame Torrent or IPFS, these project maybe less shiny, but they actually work, so :)

If I may guess, given how delicate chem or bio weapons are, even if AI can lay out a method to create one, the first thing the weapon would destroy is likely it's creator(s).

Of course, with the exception that such weapon is created by organized crime groups, such as drug cartels such.

Probably don't worry nation states tho, these guys already got way worse things in their warehouses than what individual baddies could ever imagine.

Speak of that, I'm kinda surprised not one Full Self-Driving enabled Tesla has ever sneak out of their owner's locked garage to rob a bank or something.

Wonder what's up with the GNUnet (https://www.gnunet.org). Apparently there's still activity on it's development, but I didn't see adaptation/integration, even in free software like Linux. Sure it's not 1.0 yet, but the open source world is filled with sub 1.0 software that works great.

A stable online identify is important, that's maybe why you rent those domains etc. But after rent and forego quite a few, I slowly realized that domain at it's current format isn't a stable presence, instead it's more like branding instead of an identify. If an identify can be operated by different people without it's previous operator agreeing, is it truly an identify?

But I do need an identify, always under my control as much as possible, so people can trust the content and service running on it without having to guess if it's still me operating it.

Wow, you guys are really REALLY naive aren't you.

They made it sound like it, but this is not a victory at all, this is a temporary strategic compromise to silence the most sensitive/foreseen privacy advocator for now. But they will not stop here, instead they'll keep advancing the mechanisms, opinions and laws, so one day when the pieces aligned, they can come back to turn this tap off while having people lied to their side.

Forced age verification needs to be abolished completely and people who advocated for it punished to the point that their political career ends, this should be the baseline.

But of course, based on my understanding of everything, no, nobody will do anything effective against it. Everyone will just be "Yeah... they forced a component on my system that could act as spyware to monitor me, then have me pay for it without give me any control. But guess what, I will accept it because they said it's good for the future of mankind", like a peasant would. This is the tax you paid ended up for you, you know?

Fuck! Why I'm just staring at it like I did ~20 years ago. It's not even real!

And it blue screens?

Not sure if it's just me, but I started really dislike the "tech product" these days.

You bought this TV and it might install malware on your computer, so to use it you also have to buy a blocker that might be a scam. Where is the joy in all of this?

My X.com was shadowbanned, I got tired trying to resolve it, so I made the ban permanent with a simple element `.click` against the Like button of one of my post done inside a very quick `window.setInterval`. One of the best decision I ever made during the past few years.

I'm also in the process of getting my Steam account deleted because my friend told me it has been flagged while all I did was just using it as I would normally, no hacking, no cheating etc, paying all with my own money instead of gift card.

Maybe I'm old, I got really tired on performing maintenance on other people's bad intent or mistakes. But you know what, sometimes, cutting things off from your life can be beneficial, it makes you focus on things that truly matter to you, or at least it triggers the review process while you making the decisions.

Do you really need a TV anyway? Just so you can then spend more on it to watch stuff that you'll probably forget within a week? Less stuff, less suffering.

> By algorithmic thinking, I mean defining a set of basic rules to follow and applying everyday...

This is actually kinda a good suggesting for everyday life as well. Many problem people face are too complex to figure out without systematic analysis, and with this method of thinking, complexity can be simplified.

Of course you have to do some swaps:

    > Understand data flows                    -> Understand whats, hows and whys
    > Choose appropriate data structures       -> Choose appropriate tools
    > Reason about time and space complexity   -> Reason about cost and effectiveness

BTW: Is this article was about LLMs induced identity crisis? I noticed quite a few blogs written in a similar color trying to realign themselves in the new world of AI.

Of course that's a reasonable thing to consider, but in addition to that, I think it's also kinda useful to remember why you started as a software engineer to begin with, what were you planning that drives you to select this path? Will AIs be a blocker of that plan, or a enhancer?

> The outlandish claim has since spread far and wide

Is this significant? I never saw anyone talking about it on my side of corner.

But, It's not really that surprising. A significant part of human civilization still believes that we humans were created by beings who live somewhere in the sky/atmosphere, and these beings are watching our every move to punish or reward us, and you beg really really hard, they'll help you (if they didn't, you ain't begging hard enough).

Now sure how to "steal" cars, but when I press V to call a vehicle it eventually says "Vehicle unavailable - stay on foot".

But what did available was a glider, so I guess my only form of faster transportation in the city is to glide to anywhere I want :)

What if, instead of a Duress password, the password you gave to the agent was very long and they simply typed it wrong, and the phone now asks for a much stricter authentication that require it to be in a specific location and environment (for example, inside the office of an user-designated lawyer) to continue to the unlock? Will that still counts as a felony? The data is still there, stored safely inside a phone, the agent just need to get their asses to the lawyer office.

What if, by some bad luck, that lawyer moved on to other job ventures, sold his office along with the equipment needed to unlock the phone? Will that still counts as a felony? The equipment maybe still in circulation and the data is still on the phone.

It's like all the other nations were at fault. But maybe these nations "caved" because the strategy implemented by the US worked.

And China, based on my understanding, is looking for ways to reduce US influence anyway at least domestically. So, a worsen-yet-controllable US-China relationship maybe considered beneficial on that end. The tests (lockdown etc) done during COVID time has proven that Chinese people endures much more suffering before they begin to rise up, so the economic problems introduced by not caving to the US is just a small cake for the lead party to handle.

> I asked him about the incident - he talked about how they built the SMS infrastructure, what they did to secure it, how they prevented spam, and how one day armed men arrived.

Maybe this confusing can be resolved if you view the authority, spammers, and "armed men" as equals. For example, you can treat them as interest groups, but with different level of power. It's a game, it's about incentives, desire, promise and payment, nothing about "do the right thing" or "for the people".

Now it's the Armed Forces got the top power, so you obey them until either they get replaced, or your own power grown so you don't have to continue pretending. The rule is just that simple.

And on the referenced "Civic Hygiene" article:

> But! Shock horror! After creating the database, the Government loses the election and the homophobes at UKIP get in to power! Now they have a database of every gay in the village, and can harass then, try to "cure" them, or make their lives a living hell.

Then, you just get cured ;) It's like a magic. Previous day you are a guy with a deeply lovely boyfriend, today you are seeking to marry the most beautiful woman available, because the cure they give you make you realized how disgusting the hairs on man's legs really are, ew! puke! Just lie, everybody can do that. Truth only belongs to people you love and love you, not the people who don't care about you, not even the neutral public.

BTW: Completely off-topic here: There was an article titled "Incentives are for losers" posted few weeks ago: https://news.ycombinator.com/item?id=49227652. It was beautifully put together, the leftist part of me almost convinced.... But, the rest of me realized that if you look the real "successful" people out there, the rich and powerful etc, you'll found that they all succeed by chasing the right incentives. Interesting uh?

Based on all the historical events, I'm guessing it'll eventually balance itself out. The violent vigilante groups are one critical weight on the scale. Without it, the cartels will have free-range to commit whatever atrocity they want without needing to think about the consequences.

Now, with these vigilante groups that speaks the exact same language that the cartels too understands, it gives those cartels a reason to think before they bully civilians. Because if they did it wrong, there's a chance some of them will start to lose bodyparts in a very unanesthetical way. If a few once incontestable cartel leaders puts on a show of crying and begging for mercy in a darknet video, it tends to educate everyone on what power really means potentially in a good way.

Of course, none of it is reasonable and civil, it's the darkest part of human behavior, but sadly sometimes it's the only way to communicate with the bad people. Mr. Hitler didn't surrender because the allies did a good job showing him that killing is bad, instead they bomb that rat in his own hole and scared him to death.

I don't like violence and I don't like people who uses it unnecessarily, but it's still a tool in the toolbox just in case the opponent is that unrecoverably bad.

Investment or business do also have some gambling factors in it. And both usually cost extreme amounts of money to get started.

However, I found that if the bar of doing business is high enough, "investing" in stock market maybe safer than start a proper business. Because if a business failed, you likely lost a huge amount wealth, including everything you put into the business and maybe more. Whereas if you buy stock responsibly (for example, DCA VOO/&QQQ), there's a high chance you'll eventually bounce back.

Maybe that's one reason the young Koreans invested so much in their stock markets. Their country failed them by restricting them from opportunities, the only way they can save themselves is by gambling.

Not here against Generic methods, but I feel the Go team is in a mid-age crisis where they lack of new things to do to prove themselves. See their iterators mini-drama not long ago?

I feel the sumtype/emum/routine demanders should yell a little harder so Go team can find their purpose again.

Yes, it only work if the scraper, or rather scrapers cannot collaborate in a smart way (for example, doing Cookie sharing among themselves). That's limited by how Cloudflare page rule work, it don't really support anything that is too "dynamic", for example you can't concat/mix a Cookie with a Request date and then compare it, you can only check if there's a Cookie or Request date match a static value.

If you want something more powerful, there's also Cloudflare workers, which you can program to do whatever you want. But that one may cost you to run.

Also in my case, the scraper IPs are all over the globe, and almost each access is from a different one, so simple IP blocking don't work unless I block Vietnam, Brazil, Bangladesh, Argentina and the US etc (https://i.imgur.com/eWI5meM.png). But then, the scrapers might just go to another country next month.

Since I deployed those rules, the access from scrapers has almost stopped, while normal search engine crawls are almost unaffected. So it do still work for me, even if it's very rudimentary. But hey, security though obscurity it alone is not enough, but it sometimes do delay the attacks.

> not take down systems

"Block on pages with ads" is probably about preventing the AI crawlers from clicking on the ads which maybe considered cheating by the ad company.

If you want to prevent "bot attacks", maybe the "Block" option will do the trick.

But of course, to do all that you need to put some trust on Cloudflare, because they're the one identifying the bots from normal users.

For me, as someone who's hosting a Gitea instance behind Cloudflare, I have a Configuration Rule set that says: if the client is trying to access a URL that is beyond certain length limit, then trigger "Browser Integrity Check" and "I’m Under Attack", a.k.a stricter security checks.

The match expression of the rule looked something like this:

    (
      len(http.request.uri) > !!!!!SET LENGTH LIMIT!!!!! and
      not lower(http.request.uri.path) contains ".git/" and
      not lower(http.request.uri.path) contains "api/"
    )

(The `!!!!!SET LENGTH LIMIT!!!!!` is an integer of the length limit you wanted to set)

This rule alone basically blocked all abusive bot traffic to almost zero for my site (https://i.imgur.com/LaOjjvV.png, see the traffic drop around 10 clock and Cloudflare mitigation kicks in).

But of course, you need to figure out your own rules based on the characteristic of the website. Also, you can be more creative: for example, my actual rule is more complex than that, it also checks to see if a cookie is not set, and only triggers when all condition are met:

    (
      len(http.request.uri) > !!!!!SET LENGTH LIMIT!!!!! and
      not lower(http.request.uri.path) contains ".git/" and
      not lower(http.request.uri.path) contains "api/" and
      not http.cookie wildcard "*!!!!!COOKIE NAME!!!!!=!!!!!COOKIE VALUE!!!!!*"
    )

then, as part two of that rule, I have a Response Header Transform Rules that says:

    (
      len(http.request.uri) <= !!!!!SET LENGTH LIMIT!!!!! and
      not http.cookie contains "!!!!!COOKIE NAME!!!!!=!!!!!COOKIE VALUE!!!!!"
    )

and if this Response Header Transform Rules is triggered, it sets the cookie `!!!!!COOKIE NAME!!!!!=!!!!!COOKIE VALUE!!!!!`.

(Note: `!!!!!COOKIE NAME!!!!!` and `!!!!!COOKIE VALUE!!!!!` are the variables you need to customize)

When you put the two rules together, it forces clients to access "shallow" (short URL) pages first as an user would normally do, before they can access "deeper" (long URL) content hosted on the site without triggering more strict security checks. If that makes sense.

Also, don't forget the cookie basically also dug a hole in the security setting. So it's really a balance between avoid annoying the user and protect your site. You need to be smart and be flexible about it, otherwise your users will just leave.

One question here: Why you don't see a lot of good American open weight models on the market? I'm guess it's about money? Could there be ways to lower that cost? Sharing idle GPUs through network (like Folding@home, BOINC), open and fair market for training data, open source training framework, and such?

This whole Chinese AI thing makes me giggle at these American AI companies, but the ultimate solution/long-term goal is still to make the technology universal. I don't think China alone can make it happen.

Also, if Americans can too offer open weight models, that could change the logic of their laws, making it more open rather than protective.

That's why it matters for people to hold the control of the tech, not companies, as I've already mentioned quite clearly.

LLM is here to stay, keep denying the fact won't work. What does is to make the tech so abundant, it flushes the bad actors, such as for-profit AIs, completely out. It's either this, or get crushed by for-profit AIs, pick one.

All the emotion of speculations aside, how it runs? It boots faster yeah, but what about RAM and CPU usage? Weird dead loop or dead locks?

If it run as good as before or even better, then that's kinda impressive.

I'm a developer so I really don't like it when AI might took my job, but if everyone on this planet could create a software for themselves exactly as how they wanted with just a few simple demands, that will change the world for the better.

Think of it as a democratization of technology. You don't want Microsoft stealing your data? Just ask a AI to write an OS for you. You don't want Google to listen to what you're saying? Just ask a AI to design a phone for you. If one day the AI ended up doing that, it will be the ultimate technology self-sufficient. In front of that, your job security is insignificant.

It is also why keeping the tech open source is that much important. Otherwise, it's still the same old shit again and again, and, you lose your job too.

The USB-C idea is great, but the port design is not. If you search with the keyword "USB-C" and "tugged", you'll find a lot of horror stories ranging from bent socket/connectors to fried systems.

A few samples:

    - https://news.ycombinator.com/item?id=11021665 (read comments)
    - https://www.quora.com/Is-it-just-me-or-are-USB-C-ports-not-actually-very-durable-or-stable
    - https://www.reddit.com/r/PSVR/comments/11mdfn8/so_this_happened_accidentally_tugged_cable_ps5/
    - https://www.reddit.com/r/daddit/comments/1s1kk4i/pro_dad_tip_if_your_kids_have_lights_or_toys_that/

I really like the idea of single port all capable, but the current design of USB-C port is just not up for the task. At least you need a port design that is fail-safe, not fail-dead, to do this job.

I mean, even the victims themselves came out and explicitly emphasized that scanning chat messages does not help.

I'm feeling these politicians was not doing it for the victims. Instead, it's almost like the victims are providing reasons to allow the politicians to expand their own power.

The Accelerationism (see note below) part of me think it's a good thing, because a heavily regulated country is often also a backward country. Doing things like this long enough, then you get out competed by everyone else, your population shrinks to zero and your land gets reused.

(Note: The word "Accelerationism" in the Chinese dissidents circle means that, if a bad future is certain and it trends to destroy itself eventually, we might as well just let it happen faster, so the pain maybe shorter. More: https://en.wikipedia.org/wiki/Accelerator-in-Chief)

Look, EU obviously have a few good regulations. But a regulation must be correctly designed and implemented, and it must not punish good people. Scanning private messages is a punishment to all.

If EU must scan something, I'd say scanning all messages/phone calls sent out by the politicians might do more good, consider how much trust people put on them (maybe they shouldn't).

No, I mean just let them host the instance themselves, and they can decide to do whatever.

Many of these publishers already got a podcast/video publishing routine anyways and they just put ads directly in the podcast/video. I guess maybe it's not that hard for them to add another publishing channel.

Getting one of the proper news agencies on board is very beneficial for the PeerTube network, because currently there's not much good quality content on it. News videos maybe a good baseline to keep user engaged (as long as they're not too political).

If PeerTube is my software, I'll probably pay my own money to get the agencies on board. I'll even host their site myself if it needs to (at least for the first few years, to demonstrate the value of the software).

Hasn't cared about PeerTube for a long time, but this software is getting really impressive. Maybe it's time to move towards the next step: getting publishers on board.

I could totally see myself hooked if I can watch news on it. Can someone from a proper news agency, such as BBC, DW, Reuters, NYT etc test the software and maybe make a pitch? If these agencies are hosting their own PeerTube instances, that would be a major win.

You can put the biggest warning on the phone, make it as annoying as possible. Then, the user sees the warning, as well as the fact that all the other people are ignoring the warning, click "Accept" 10 times and got surprised when someone comes to collect the testicle they just donated by themselves.

That's the same reason why desktop computer has so many malwares, that's why phones now has permission systems to restrict what an app can do on it.

If you want to create a system for everyone, including your 60 years old mom and her mom, you need similar of not better permission systems. Linux currently don't have that, and DON'T except an old fashion car mechanic will delicately configure AppArmor etc with his oily fingers in the middle of fixing a client's car.

Emotional talk aside, there's not many good solution to this problem, unless of course F-Droid starts to make their own phones.

But then, Librem 5 Phone was just failed few years ago, telling the story that people who care about their rights are still sensitive to how much they would pay (which is a form of rights too).

Also but, there is the thing, making a phone is not easy. If you reach deep enough, you'll eventually reach the layer where you realize how solid the monopolization has become. The global telecom standards if you read them is in the hands of few companies, Boardcom, Motorola, Huawei, Nokia and such. They'll control whether or not your phone can access the network. Then there's telecom companies who runs the network, and they might have to approve your device/modem as well since they got their channel allocation from the government.

It's not easy, and it's not just the software problem.

Oh and yes, we also have the software problem. Linux, if you want to go that route, cannot be used as a mobile OS, as least not for the public, because the average people don't know how to properly secure their system, and Linux is not a restrictive-by-default system. It will be a malware nightmare if you ship Linux on a phone as is.

The best hope for now I think is for geek vendors to make more mobile/4/5G enabled Fairphone or uConsole-like product to the enthusiast market, and then you can load whatever OS on it as you want.

How many of you noticed that this is also a form of arguing?

> These HTTP servers will typically be private, inaccessible to other devices on the network. Instead, you’ll use them over SSH, or locally.

So, if I read it correctly, SSH is there to provide connectivity and security, and the core app idea is based on HTTP and web?

On the HTTP side, there are already some "app managers" such as Dokku and Coolify, and you can already `ssh ...-L...` map their ports to your local. But I guess the browser you build will do that (or something similar) automatically to make it more convenient for the user, so that's nice.

Not sure about the Outerframe idea tho. Right now you can already build things with webasm and have it send commands to draw stuff on to a canvas to create very rich custom UI elements, that is in addition to the standard HTML UI elements provided by the browser. Why another standard?