• 57 Posts
  • 352 Comments
Joined 2 years ago
cake
Cake day: April 4th, 2025

help-circle



  • Here a comment on this from usernomdeguerre on hacker news (ycombinator.com).

    “His” and “GKH” refers to Greg Kroah-Hartmann, who is maintainer of the stable kernel series and the speaker in the video.

    I’ve included a few slides into text that i thought were eye-opening to me:

    From his Kernel Recipes 2026 slide on Mythos

    
      Mythos's 79 vulnerabilities:
      24 - no detail at all "something crashed"
      14 - not a bug at all
      3 - totally made up data
      15 - already fixed in latest release
        - 11 by others
        - 4 by anthropic
      20 - fixes were needed
        - 7 "assume a malicious filesystem image"
        - 2 "assume you can inject a malicious network packet into the middle of the stack"
        - 2 "NOMMU"
        - 6 sctp networking issues for untrusted devices
        - 2 ipv6 minor network issues 
        - 1 gpu driver for local malicious user
    
    

    GHK called this “10 ‘real’ bugfixes”, which to me sounds like there’s a wild hype machine around these companies and uncritical parroting of every press release they make that falls apart when you engage the affected real experts.



  • Keep in mind that this only relates to the state of the largest LLMs. You can train generative models on consumer graphics cards. Object recognition, classification, etc are all tiny compared to LLMs. These are also AI […]

    The linked Codeberg page refers to LLMs in their current, corporate-controlled shapIe. It is about using LLMs for coding.

    Your argument is rather leading away from that.






  • This is what I do. I use guix shell for local development environments, for example when I need current Rust + cargo or an LSP package in Emacs.

    Guix is typically very little behind of Arch (which I use as well, in a VM), and depending on what you do, it now has a pretty massive package selection (well, less npm stuff or NVidia hardware support).

    It is also quite good for packaging and distributing own software that way, offering for developers and power users a better solution to what flatpaks solve. Since it works across different distributions and across most popular languages, I expect it to become somewhat of a standard for bazaar-style open source contributions.








  • They mean no one can be reasonably be up to date on software security updates, and (ideally) ensuring all packages changes are not malicious (as well as the small stuff like properly integrating to the distro, but idk how void works enough to comment on that)

    Some people do an astounding amount of work.

    And then there are many, many, which help a little.

    Also, if, say, somebody finds that in Debian testing is a malicious package, people which maintain Arch will learn that. Open information sharing between many thousands of people willing to coordinate is a superpower.


  • AI or not, I refuse to believe anyone is capable of being the sole maintainer of 100+ anything while preserving any kind of quality. Most of these packages were probably functionally abandoned already, if not technically.

    He/She was maintainer of the Void Linux packages, that is the package build scripts, updates, etc., not the projects and source code which these packages are based on.

    For example, Guix has now over 32000 packages, including an Emacs package. But of course, they did not re-create Emacs to make that package - they just made a build definition which uses the Emacs git repo, in order to build the Guix package. Or in the case of Ubuntu, it is based on the package definitions in Debian testing, so the Ubuntu maintainers do not have to write all the build scripts or package definitions - but they still have to do significant work in order to adapt them that everything fits together.

    Or with Arch Linux, the packages are taken relatively vanilla from upstream, they package stuff more “as is” as compared to Debian. Which means less work, and often more clarity for experienced users.

    Coming back to Void Linux, this means for these 100+ Void Linux packages which are currently orphaned, it is feasible that other people with good Linux experience adopt these, with a reasonable effort - some are important.




  • i need proof of the already proben impact of AI and AI datacenters over territories in the country i live in?

    No, proof about the maintainers intentions. Because you make a statement about them.

    (And besides, making statements about other people’s intentions is already stirring conflict, because normally only a person theirself knows what is happening in their mind and their heart, so stating what is happening inside somebody else is already a kind of transgression, a violation of boundaries. Which stirs empty conflict, whether you want that or not.)

    I totally agree that there are very strong reasons to avoid LLM use (“AI”). Also fed up with the ham-fisted manners it is shoved in every place by companies, like github copilot. Also, all the BS in advertising it, with dishonest arguments. Also, its glaring links to authoritarianism. And I am extremely worried about the implications of “AI” as well.

    And: Some people which take over this corporate ham-fistedness into personal behaviour might need to be informed about boundaries. This is good. We need to define and keep boundaries on that (such as the above policy of the Void Linux project).

    But: you do not win this discussion by name-calling. Are you aware that the Linux community is also a target of trolling? Have you perhaps heard that polarizing topics (for example right now, gas prices, or migration) are absolutely used in a kind of information warfare to break communities and civil society? This topic is one of them.



  • Also, polarization is another danger, it can seriously hurt communities, and also can be used against them. So, PLEASE be careful about polarization and trolling, as trolls like to play on people’s emotions like a fiddle.

    (Sadly, I saw that with some dance communities during COVID, which went into very personal and hurtful fights about adherence to social distancing rules, which had become a topic of information warfare.) “AI” is a polarizing topic, too, and for the FOSS community much more dangerous than the old humorous dispute whether Emacs or vim is better. We need to navigate between Scylla and Charybdis here, or possibly even avoid an ill-advised journey between them.