“No, maybe that wasn’t it. Words precede and surpass me, they tempt and alter me, and if I am not careful it will be too late: things will be said without my having said them. Or, at the very least, that wasn’t the only thing. My entanglement comes from how a carpet is made of so many threads that I can’t resign myself to following just one; my ensnarement comes from how one story is made of many stories. And I can’t even tell them all— a more truthful word could from echo to echo cause my highest glaciers to crumble down the precipice.” - Clarice Lispector

  • 6 Posts
  • 91 Comments
Joined 3 years ago
Cake day: December 9th, 2023
  • supersquirrel@sopuli.xyztoLinux@programming.dev•AURpocalypse now: a look at the recent AUR attacks
    36·
    3 months ago

    Arch is not the only distribution that has a service for providing “use at your own risk”, unreviewed, user-submitted content; Fedora has Copr, the openSUSE project has the Open Build Service (OBS), and Ubuntu has Personal Package Archives (PPAs). Each of those services allow a person to sign up without any review process and build packages for download by other users of the distributions.

    However, there are important differences between those services and the AUR. They provide a build environment that is similar to the ones used for the official distribution packages, and do not allow pre-built binaries or proprietary software. The model for Copr, OBS, and PPAs is that a user creates a project under their own user namespace; users have to add each repository from one of those services separately.

    For example, niri creator Ivan Molodetskikh maintains a Copr repository for Fedora users who want to run the tiling Wayland compositor. To install niri from Copr, a user has to enable that repository specifically. It is possible for other Copr users to create a similar project under their own namespace, but it is not possible for another user to take over Molodetskikh’s repository unless they compromise his credentials. A would-be attacker could create a malicious fork on Copr and try to lure Fedora users to add that package repository to their system instead, but the attacker cannot simply pick up an orphaned Copr repository to compromise users who have already added it.

    The AUR, on the other hand, is much more relaxed about ownership; the PKGBUILD files are all maintained under the AUR namespace. The rules state that, when a new maintainer takes over an AUR package, they are supposed to add their own information as maintainer and then list the prior maintainers as contributors. That, however, is taken on trust and (as seen with the current attack) can be easily abused.

  • supersquirrel@sopuli.xyztoGaming@beehaw.org•Another Xbocalypse begins: Microsoft are reportedly closing or spinning off Double Fine, Ninja Theory and Compulsion
    5·
    3 months ago

    What pisses me off so much about the AI bubble as someone who was trained in science is the basic obvious fact that if you have a magic tool that can “solve any problem” but that takes a nearly impossible amount of energy to do so, taking so much energy that everything else has to be sidelined in order to power this magic problem solving tool… than you are just restating that the tool you have is incapable of problem solving.

    Suppose there are two problem solving machines A and B. Problem solving machine A does not work very well but it takes a small amount of energy and material to function, problem solving machine B is like AI in that it can tackle “any problem” if given nearly all the electrical power and computer chips that humans can produce.

    Both problem solving machine A and B are equally useless even though the owners of problem solving machine B can make grandiose claims about the power of their problem solving machine if they conveniently exclude the “energy required” part, which as someone trained in science ends up seeming pretty damn similar to someone arguing that their perpetual motion machine is capable of perpetual motion so long as we feed all of the electrical power humanity can generate into it…

    If your Oracle requires all the investment, electrical energy and computer chips earth can produce and more to tell you the future, it is not an Oracle but rather your own demise twisted into a promise of absolute power and knowledge.

    Anybody who understands computer science should be able to grasp the basic idea that it is trivially easy to describe infinitely powerful computer programs that take essentially infinite time and energy to compute, that doesn’t mean anything, in fact most of computer science has been the proactive study of how to rigorously talk about programs that are impossible to execute because of outsized material demands and develop an overarching theory of computer science that nonetheless accounts for that theoretical axis. Computer science people thus should be well equipped to understand AI is just bullshit being sold as genius by disguising the cost per unit of intelligence… but they don’t really seem to grasp that basic aspect of physics in how it limits computation and it doesn’t say a lot of good about the whole industry.