• 0 Posts
  • 805 Comments
Joined 3 years ago
cake
Cake day: June 10th, 2023

help-circle



  • Well, first of all populism isn’t really a defined concept that everyone can agree with. Because of the question you’re asking I’m assuming you’re talking about populism as represented by such politicians as Trump/Milei/Bolsonaro/etc.

    In that case the answer is that Populism is not fascism in the same way that elections are not democracy. As in, you can have one and not the other, but they tend to go hand in hand often enough to be very strongly associated.

    Sure, you can have a democratic populist, but in history most examples of populism were preludes to fascist. And a fascist government usually uses populism to keep some sort of approval.



  • In short the answer is this: you have two companies selling you boxes, one that it’s literally impossible to look inside, and another one that’s very easy and encouraged to do so. Even if you know nothing about bombs, if both those boxes claim to not explode, which one do you trust more?

    It’s sorta the same thing, it doesn’t necessarily means that the closed box is inherently less safe, but even if you personally haven’t verified that the open box doesn’t contain anything dangerous you can be somewhat safer in the knowledge that people COULD have verified it.





  • It absolutely is the shape that matters. A blue circle with an arrow indicates you MUST follow it, a blue square with an arrow indicates you CAN follow it. A blue circle with an arrow pointing forward can be replaced with a red circle with arrows pointing in every other direction, because it indicates a mandatory, I.e. you must eat the banana.






  • I’m glad they’re doing it, but I’ll believe it when I see it. This seems like a marketing thing more than anything else, like most things GoG does. Which brings me to:

    They are right about the DRM

    Except they don’t believe that themselves: https://www.gog.com/forum/general/drm_on_gog_list_of_singleplayer_games_with_drm/page1

    Plus, if you disconsider the whole “having to use Steam to download binaries is a form of DRM”, AFAIK the same games that are DRM free on GoG are DRM free on Steam.

    I’m all in favor of no DRM in games, but being able to play the games on my OS of choice is miles more important than them being DRM-free, because I honestly don’t care about the DRM status of a binary I can’t use. So I’d rather keep giving money to the company that’s investing in making me able to play games. I used to buy games from GoG back before Proton and DXVK, but those projects made Steam so much more attractive for Linux users that it is not even a contest.




  • This reads like someone asking whether it’s safe to leave your front door unlocked again because he read about a bunch of people using open front doors to rob them.

    It never was safe, it never will be safe, you’re trading convenience for safety, you’re supposed to review the PKGBUILDS to ensure they’re safe, if you can’t do that you shouldn’t risk it.

    This is why I hate when Arch (yes, even Cachy or whatever is the current “easy” Arch) is recommended for new users. Arch assumes you know what you’re doing, it expects you to read the manual, and it doesn’t have kid gloves. You will get hit in the face by this and many other similar things, and will be told “it was in the manual”.



  • Even though programming is also known as hacking, I’m going to assume you’re using hacker to mean red teaming in general, i.e. offensive cyber security, as that’s what most people have in mind when they think of “hackers”.

    We’re about to enter a golden age for that profession, the reason is LLMs, AI, vibe-coding, etc. See, a long time ago things were very insecure, no one was worried about security as it was all just so new, that was the era when you could sniff on network traffic very easily, crack your neighbor password in a few minutes or login to most things using admin/admin. Over time people started to realize that security mattered, that there were enough malicious people out there that you had to at least make some effort to secure things. This brought us to today, where things are fairly secure, your router has a preconfigured long random password and uses at least WPA for security, most companies no longer store passwords in their databases so it diminishes the risk of leaks, etc, etc. A lot of thought is put into security by serious companies, but there were some cracks starting to show because small devs wouldn’t take security as seriously, be it for lack of resources or care, so while large stuff would be safe, smaller apps and sites are still very vulnerable, and people being people they use the same password for both and don’t enable 2fa, so once you grab credentials somewhere you can try the in other places.

    What changed now? Well, recently people started to vibe-code, i.e. give prompts to an LLM to generate some code. The problem with that is that in the database of things an LLM is trained in it might have lots of bad examples, be it because the code was insecure, or because it was exactly an example of insecure code. Asking the LLM to make it secure is not going to work, as it lacks the comprehension to understand what security is. It’s possible to make things better in an iterative process where you feed the output code to itself and ask it to check for security vulnerabilities, but it might introduce new ones while fixing the existing ones, because the majority of examples online are incomplete as they’re meant to be small examples of small parts of a system to showcase how to do that in a secure manner (but they leave other parts insecure as that’s not the purpose of the example). For example, a login example code might use a simple text comparison for the password field, because it’s trying to show you the structure of the API, not the content, and assumes you will know now to do that, but an LLM doesn’t know that.

    And with many people vibe-coding apps and sites it’ll become more and more easy to find those serious security holes in the wild.

    And how to learn it? Well, the short version is doing. You don’t need to buy expensive books, or anything of the sort, just start reading online, and poke around stuff. I used to play around with https://www.hackthebox.com/ and found that very interesting way to learn, however you might need to read on some stuff first before you’re capable of logging in there (although I just gave it a quick look and I think they removed the most interesting part about it which was you had to hack the website to create an account).