A tiny mouse, a hacker.

See here for an introduction, and my link tree for socials.

  • 0 Posts
  • 39 Comments
Joined 1 year ago
cake
Cake day: December 24th, 2023

help-circle
  • If any of those end up interacting with me, or I otherwise see them on my timeline, they’ll get treated appropriately: reported, blocked, or in extreme cases, served garbage interactions to. Serving garbage to 500+ bots is laughably easy. Every day I have over 5 million requests from various AI scrapers, from thousands of unique IP addresses, and I serve them garbage. It doesn’t make a blip on my tiny VPS: in just the past 24 hours, I served 5.2M requests from AI scrapers, from ~2100 unique IP addresses, using 60Mb memory and a mere 2.5 hours of CPU time. I can do that on a potato.

    But first: they have to interact with me. As I am on a single-user instance, chances are, by the time any bot would get to try and spam me, a bigger server already had them reported and blocked (and I periodically review blocks from larger instances I trust, so there’s a good chance I’d block most bots before they have a chance of interacting with me).

    This is not a fight bots can win.


  • Personally, I do not have any automatism to detect LLMs larping as people. But I do review accounts that follow or interact with mine, and if I find any that are bots, I’ll enact counter measures. That may involve reporting them to their server admin (most instances don’t take kindly to such bots), blocking their entire instance, or in extreme cases, start serving them garbage interactions.


  • None, because they typicially open up a larger attack surface than the system would have without them. It’s been like that for a while now. For references, I’d recommend this article from Ars Technica, who reference some very knowledgeable people (including Chrome’s Security Chief at the time).

    There was a time when AV software was useful. We’re a decade past that, the world has changed, software has changed, defenses have changed, and AV software did not keep up.






  • If they have no desire to maintain/sysadmin their own linux systems, then the best distro to recommend is whatever you can help them with, and possibly even maintain for them.

    Case in point, my Wife is a very happy NixOS user, despite knowing absolutely nothing about Linux. Yet, she’s on a distribution that’s as far from being newbie friendly as a distro can possibly be. She’s still happy with it, because I set it up for her, and I maintain it for her, she never has to install, upgrade or configure anything, ever.


  • I’d say “under no circumstances”. When building for production, you want to build on a stable foundation. LFS isn’t that, it’s an educational tool. It does not result in a maintainable, robust system. It requires tremendous amounts of work to keep it secure and updated: there’s no package manager, no repository you can pull from, no nothing. You have to build an entire distribution on your own. Outside of educational purposes, I’m having trouble to imagine any situation where that might be a good idea.

    No, not even embedded. There were always distros targetting embedded systems, LFS was never a good choice there either. It was much more straightforward to strip down - say - Debian for a limited device, than to build something from scratch for it. (I spent a few years building and operating embedded Linux systems at the early 2000s, we built it on a stripped down Debian.)






  • Again, you’re misunderstanding the problem. Keeping applications up to date is not a problem. Keeping things working the way my family got used to is an entirely different matter, and it’s actually worse on Android & iOS (thus, most phones and tablets).

    The main reason the family even has desktop PCs is because we couldn’t make tablets work for them. Something as simple as reading email was a problem, because the various email apps (gmail, k9, etc) changed their UIs, confusing the heck out of my parents. It would’ve been possible to improve that situation, but the tooling to remotely manage an android phone are far more limited than on a bog standard Linux desktop.

    A lot of people do use phones tablets as their main computer, yes. Ask them how happy they are about it, how much trouble updates and random UI changes cause. Just because they “can live with it” does not mean they enjoy the experience, or want to live with it. Chances are, they don’t have other options. My family does. I think more people should have those options available to them.

    (Also, the blog post is about desktop, specifically, and is a critique of distros trying to aim at non-enthusiasts. When it comes to mobile, those efforts are even more futile, because those specialised distros will have absolutely no chance of working on anything but a very tiny subset of mobile devices.)



  • That does not address the problem at all, though. That solves the upgrade and maintenance problem, but does nothing for users who just want things to work as they always did. It does not address change.

    By maintaining a system for my family, I can address that: either by undoing things, working them around, or preparing them in advance. No amount of automation will solve that. It’s not a technical problem.



  • It’s not even the upgrades. Automatic, unattended upgrades have been a thing for a long while, and in general, they work remarkably well. At least in the sense that nothing “breaks”: programs will still work, and start up, and all that.

    But automatic upgrades can change things. Change an icon, move things around, change behaviour, introduce new features, new bugs, and so on. That is the hard part of maintenance, not the technical “go from version A.B to A.C”.

    Most immutable distros I’ve seen aim at improving the A.B->A.C upgrade scenario. They do very little, if anything at all, to keep the system familiar. Because they can’t, unless they control the entire stack. And even if they do, like in the case of the proposed GNOME OS, the UI still changes - often considerably - between major versions. If I maintain a system for others, I can prepare them in advance. If they do it themselves, they do not have that luxury, they’re not going to follow the development of the software they use, and I wouldn’t expect them to do so either. I can do it, and I am doing it, because I’d be doing it anyway for myself.


  • I’m supporting three people, only one of them lives with me. My parents live in a different city, pretty far away (far enough that just randomly visiting them for in-person troubleshooting is not an option). I maintain three separate computers for them. It doesn’t take much effort nowadays, because I used a system I am familiar with, a general purpose distribution, and set it up so that I can manage it remotely.

    I wouldn’t be able to maintain a more limited system for them, because it would lack the tools I need for remote maintenance. Hence my assertion that distributions focused entirely on non-enthusiasts are a futile attempt.


  • There seems to be a big gap between what people think others “ought” to understand. Like the expectation that changing tires is something someone needs to be able to do. Or one should be filing their own taxes. I can do both, but I’m never going to do either, because it’s more practical to let someone with way more expertise and knowledge do it for me.

    When it comes to taxes, for example, doing it would take a considerable time for me, to double check and verify everything, and it would be a frustrating experience. By hiring an accountant to do that for me, I save a lot of time and frustration, and can turn that time into work, which ends up netting me more money than my accountant’s pay. So why exactly should I be doing my own taxes?

    And changing tires: since we got our car some 8 years ago, we only ever had to change tires unexpectedly once. We called help, they were there in 10 minutes, meanwhile we nursed our one year olds back to sleep. A lot more convenient - and a lot faster! - than if we had to change tires ourselves.

    To bring this back on topic: I believe that it is perfectly fine to be an end-user who can use their system, their programs, but delegate the administrative tasks to someone else. Installing, upgrading, and in general, maintaining an operating system is not a skill that everyone ought to know. It certainly helps if they do, but it should not be a required skill.