• 0 Posts
  • 91 Comments
Joined 3 years ago
cake
Cake day: July 2nd, 2023

help-circle



  • Either Linux’s built-in display drivers are black magic or microslop is incompetent

    Why not both :) ?

    I just realized that since switching to cachyos 4 months ago I have never had to install any driver or driver updates (outside of just running the system update).

    Even during initial setup I don’t think I installed anything driver related.

    It’s really a step up from Microslop. Last time I installed my W10 I had to prepare all the necessary drivers and collect them on each manufacturers websites.

    It is so much more streamlined on Linux.


  • They could also put a checking tool into CachyOS Hello, which is shipped and pops up by default.

    What would this “checking tool” look like? What would it check?

    I personally have deactivated the opening cachyos Hello a long time ago. Why would I need that popup once I setup everything?

    And I’ve definitely gotten “urgent” text notifications that all-but-required manual action through pacman.

    Pacman has no idea if it is installing something malicious. It notifies you only on functional actions that are required.

    Basically, none of the suggestions you make would have avoided the AUR attack to work. Nor a future one?

    The only thing I would maybe agree is for some notification system that let’s the cachyos maintainers send an urgent message but that would mean they would have to sign that message in some way. If that signature verification ever fails someone could send malicious notifications to all cachyos users and that would create another threat.

    And even then if the malicious package is noticed after a few days, if you already installed/updated it, it’s too late. You could receive a notification giving guidelines to cleanup but that’s too late. The infection could disable these notifications or worse.

    And if you have an emergency notifications systems, is it a “pull” or “push” notification? Is it your computer that checks if there is a notification? How long between pulls? If that’s a push then the notification servers basically has a full list of cachyos IPs which would suck too.

    Sorry if I look nitpicky but I just want to illustrate that this is a very very complex problem to solve while respecting user privacy and “sovereignty” over their system. Supply chain attacks are extremely difficult to defend against and open source projects have increasingly numerous dependencies…


  • How else would you have wanted to be warned ?

    In my opinion that’s the other side of the privacy coin.

    What happens on my system is only for me to check. And in that case that means I’m on my own to be aware of its current state.

    I mean the cachyos devs or the AUR maintainer have in some way by design no way to reach me. And creating some kind of malware monitoring or scanning tool included by default would be against the ethos of the OS…

    So it’s up to each user to determine if they want to use random scripts or just read the blog of their OS and do everything manually. There isn’t an adequate universal solution there.



  • I think you understand correctly.

    Your setup seems quite insecure considering your keyring seems to be always open and that you use a password that is already used to login.

    On the other hand a keyring can be unlocked only when used and could also have it’s own dedicated password for it. Security is more a gradient than something binary.

    Also if you store keys that are particularly sensitive in it they are as vulnerable as the container that stores them.

    Not blaming you of anything of course, I think you are asking the right questions. 👍



  • Tetsuo@jlai.lutoAsklemmy@lemmy.mlSnap experience as a man
    link
    fedilink
    arrow-up
    4
    arrow-down
    1
    ·
    17 days ago

    Is this normal for snap? Is it because the algorithm knows that I am a upper 30s man and it just assumes we want to be fed with porn and funny videos? What are you experiences of snap? What is snap showing to women? Snaps feels like a distinctly sexual app, not to mention that it encourages very very unrealistic standards, some women there don’t even look real, like they are using some filter or something.

    Duh, I’m sorry if this feels rude but obviously the algorithm sees men allocating their attention to ““porn like”” content and will therefore serve that to these demographics. And the fact that women receive them too in my opinion doesn’t invalidate that either.

    The other aspect of it is that easily influencable kids will look around and think being this sexually suggestive is just the norm and will think “why shouldn’t I do it too ?”.

    I know I have male friends that are on Instagram solely and admittedly just for this “softcore porn” content and when I tried the app myself it was clearly pushing me toward that too.

    Since I was not interested I uninstalled but I have no doubt that if you are a man these algorithm will go out of there way to push porn like content and at the other end will encourage inadvertently the content creators to go for that type of content.


  • Tetsuo@jlai.lutoLinux@lemmy.ml*Permanently Deleted*
    link
    fedilink
    arrow-up
    6
    arrow-down
    1
    ·
    19 days ago

    I suspect the AI use is the problem.

    AI are very keen on recommending deep modification of your system. And then they quickly forget they asked you to recompile your own kernel based on a 2014 forum post. I’m fairly knowledgeable on Linux and if I would have naïvely listened to Deepseek I would have destroyed my system many times. And that’s even with prompts asking the AI to avoid outdated sources and to ask me for current configs.

    I believe you would boot a liveUSB of cachyos, install that terrible idea of a browser and it would work straight away. Well if you ask AI on how to install it then it will probably recommend you to compile it yourself etc… Or to use some weird AUR repo… So maybe that’s the right context to actually use the Arch Wiki on an arch based distro ? But please, enough improvisation with AI, you breaking your system in a subtle but critical way is just one AI hallucination away.

    So basically my advice is to try on cachyos without ever using AI. Just the wiki for cachyos, then the Arch wiki and finally the cachyos forum asking politely and in a detailed manner for help and being patient.

    The very premise of all of this is still crazy though. There is no feature in Brave that would justify tossing a whole operating system for…




  • I worked for years on a large email infrastructure for a job and for me it’s absolutely not worth it either.

    I would prefer to take a subscription on a reputable host.

    Why?

    Because even if I do everything perfectly at setup (TLS, SPF, DKIM, DMARC) that will still be precarious.

    The security of SMTP is a patchwork of protocols added on top of it and a bunch of opaque reputation systems. If anything ever goes wrong with my email my domain’s reputation would fall. And that’s the thing, once your domain reputation goes too low, you can’t fix right away and say “my bad” and recover. Your mail will be silently blocked like Spam until a few days of sending perfectly clean emails. You need time to recover.

    So mail self hosting is accepting that at any time if you make a slight mistake, your communications to other will be almost impossible for days. And again since a lot of it is reputation based you can’t fix the issue and recover immediately.

    The business I was working for had everyday scenarios like that. A client that failed to update its DKIM and didn’t notice right away. When they do their reputation on for example Cisco’s platform is super low and we filter them as spam. And then it took days for them to recover even if they fixed the DKIM just one or two days after their mistake.

    On the other hand I could take a protonmail subscription and use a domain that has so much volume and is tracked so carefully in term of reputation that I know my mails will be received and have all the necessary security done right.

    These reputation systems are inherently difficult for small volume mail domains. There is no other users ln your domain so one mistake is all it takes to start having delivery issues and most importantly silent failed deliveries that you dont know about.

    Is it possible? Yes. Is it necessary? Not really. If you can pay for a privacy respecting host…

    Hence for me it’s not worth it because there are privacy respecting providers so it’s not like I absolutely have to self host it.




  • I think it wasn’t for APT but I once worked for a business with a lot of RHEL, the script that was updating hundreds of servers was using the user wrapper instead of the binaries. A warning was displayed in the script to warn not to use the wrapper for scripts.

    I warned my team leader of the issue and was completely ignored and was said that it was an issue for the team that made the script in the first place.

    I gave up.

    A few weeks later, the poorly designed script botched a major update on hundred of servers because the wrapper had a tiny change and the update script didn’t handle it well.

    It’s insane to me how much money a business can waste for stupid shit like that. The devs warned us not to use their wrapper to script on, the linux team did it anyway, my warning was ignored, many hours of engineers work was wasted fixing the chaos that ensued.


  • I tried doing manually a gamescope command line arguments for Overwatch and it didn’t work.

    I activated the necessary flags and took close attention to the resolution in game and of my display, made sur the game had HDR enabled etc and it never worked.

    So if I can’t get HDR to work even with gamescope on a stable game like OW…

    But your tip to setup gamescope for the session is interesting. I might try that out sometimes.

    But honestly HDR is quite anecdotal for me. It’s not that visible. I much prefer to focus on optimizing FPS and input delay than tweaking for HDR.


  • Well I don’t know what you don’t understand either.

    These Luigi’s “exceptional tasks” are pretty explicit to me.

    The comment author is saying that we will need more Luigi Mangione to do targeted killings.

    I don’t think it’s ok to encourage people to do their own justice no matter the ideology and beliefs you have.

    it’s a lot of effort to engage with you

    Hey you choose to do so. If you don’t want to engage with a commenter, don’t.

    I’m honestly just as confused as you on why nobody calls out someone that says that we will need more Luigi’s type of assassinations to be done.

    Again, we have regularly people that are condemned by the justice system for such type of speech encouraging violence so for me it’s pretty shocking to see how casually people talk about killing people in the street.


  • Here is a quote of the original commenter I was responding to :

    and there’s definitely gonna be a need for some more Luigi’s to carry out those exceptional tasks that don’t benefit from “too many cooks”, but IMO we need the proletarian majority to *organize* and *collaborate* to overthrow the system.

    Is saying that we need more Luigi’s to carry out exceptional tasks just “organising” ?

    So this is just non-violent organization ?

    And if you are referring to the other commenter he straight up said that sometimes we need a little bit of violence to make the world better.