Posts by drankinatty

In Debian, APT 3 gains features – but KeepassXC loses them

Re: Agree to disagree

Another issue is package sprawl and confusion (as touched on). Keepassxc meant one thing in the Linux community before it was split and stripped in Debian. Just as vlc meant one thing before Arch stripped all plugins and put then into individual packages. The kernel-firmware package(s) are no different - but at least there size was the driver (but if the distro ends up installing all by default - you've accomplished nothing)

The result in each case is more packages for the user to find/install and in the case of keepassxc, the meaning of that package has changed. Just my $0.02, but it would have been far better from a continuity standpoint to leave keepassxc alone and create a stripped version in keepassxc-minimum rather than stripping keepassxc and moving what was keepassxc to keepassxc-full.

Snap out of it: Canonical on Flatpak friction, Core Desktop, and the future of Ubuntu

Re: Good read

Think of immutable distros as "locked down Linux" or "Linux with training-wheels". It provides just what it says, an immutable core, so the normal customizations advances users have made for years in /etc and elsewhere are no longer available. Further complicating matters is the lack of standardization in how apps look for config overrides from, e.g. /usr, /etc/ and then ~/. Not all apps implement the same lookup leaving users who need customization often with nothing but a dive into the package source to see if and what config paths are utilized.

That said, I agree with the assessment of the interview. While I may not agree with the design decisions being made, at least the justifications were given, and they are free to choose their own path forward. For Ubuntu user, the good news is the announcement that a "Ubuntu-Classic" will be available along side. So you can give both a drive and make your own decisions for your use case. There are some where immutable is a great fit - just not for a normal power-user desktop or server.

Invisible npm malware pulls a disappearing act – then nicks your tokens

Re: This is a bug in npmjs.org

This is the type of attack that worries the heck out of me when building source packages that rely on npm or pypi or the like. The build-system sees npm as a dependency and then pulls in npm and the dependent packages as part of an automated build. As a package maintainer performing test builds or a user building from source, you are compromised before you know it.

The only saving grace is most OS level build systems like Arch's makepkg can build in a clean chroot (makechrootpkg), mitigating some of the damage, but the only people that setup and take advantage of the additional steps to setup a chtoot build environment are package maintainers and a few advanced users. These "fetch on-demand" installers provide a wide-open attack path for miscreants to exploit that have shown themselves incapable of being made safe.

I keep notes on npm and pypi compromises, mostly from stories on the Register, and it doesn't seem much more than a month goes by in between revelations of a new compromise in either of them. Yes, I'm old, and likely a curmudgeon, but I'm of the opinion the only way to ensure sources are safe is to include the checksumed source, not "fetch on-demand" schemes as part of source-packages. Otherwise, without the ability to validate the sources before the build begins, we will be playing the game of exploit whack-a-mole forever.

AI browsers face a security flaw as inevitable as death and taxes

Hello Firefox 144 - with perplexity AI!

No thank you Mozilla. (unwanted, un-asked for and completely unneeded). Mozilla seems overcome by FOMO, drank the koolaid, and threw security out the window. How does a professional with a duty to protect confidential information at the risk of losing their license, use any of these tools anymore?

Ex-CISA head thinks AI might fix code so fast we won't need security teams

Re: This...

The orange man promised the "Best People" -- I guess this is what he was talking about. Imagine a government led by the clueless, the corrupt, the mentally challenged, or all three above... If you are here, worry, if you are not, be thankful.

NASA Jet Propulsion Laboratory: Another 550 employees set to leave the building

Re: " the next generation of engineers might choose to pass on JPL and NASA"

The writing has been on the wall since return-to-flight (STS-26). Following the soul-searching and critical review after the 51-L Challenger explosion, the corporate consolidations and name-change game began in earnest. Rockwell (corporate and RSOC), McDonnell Douglas, Martin Marietta Lockheed and Ford Aerospace, were the traditional engineering contractors when Nasa Rd. 1 was still a 2-lane blacktop running between I-45 and Kemah.

Beginning in the early 90's the consolidation and reorganization hit full swing with Loral (previously Ford Aero), Unisys and the like coming onto the scene, station was grabbing more and more of the shuttle budget and DOD flights were waning, ending with STS-53. The "design it, cut-metal, build it and let's go fly" mentality was replaced by "let's have a meeting to determine the agenda for the next meeting"... Deming's TQM got its nose under the tent and the culture it created resulted in the blaze in the sky Columbia cut across Texas.

Through it all, JPL retained the "design it, cut metal, build it and let's go fly" mentality. Sad to see the ax falling there. There is no faster way to destroy young engineering talent than to tell them, in not so many words, their struggles through mind-bending physics and mathematics are no longer valued by your country. The reality, then and now, is there is a very very small market for aerospace talent. It's either space, defense or a very few in aviation.

Shrinking that pool is a loss for the country, which ever country it is. While no government program is perfect, there are very few, that push technical boundaries the same way aerospace does. Producing competent engineers to design to a factor-of-safety of 0.1 or less doesn't happen overnight, and there isn't another engineering discipline that does it.

Climate goals go up in smoke as US datacenters turn to coal

Will history understand how greed justified intentional destruction of the planet?

I doubt history will be kind, nor should it be.

As the Paris goal of limiting total warming to 1.5 degrees Celsius was surpassed last year with no significant reduction in emissions or any real plan to curb emissions in the near future, it's worth taking a moment to look back and understand why 1.5 degrees Celsius was chosen as a target. 1.5 degrees total warming is the threshold beyond which the Greenland ice-sheet enters terminal decline with, at least, 23 feet (7 meters) of sea-level rise baked in.

As of 2024 the goal is to limit total warming to "as close to 2 degrees Celsius as possible", with the presumption being that 2 degrees will be passed. If you haven't looked at what 2 degrees total warming means for the planet, it's time to take a critical look. The impacts of climate change become exponentially more catastrophic for each 0.1 degree we exceed 1.5 degrees total warming by.

That's not okay. The current tech robber-barons happily trade your children's and your children's children's future for what? To hype the AI bubble further and over-inflate the next quarterly report to keep the capital flowing and the dreams of AI nirvana alive? (note the conspicuous absence of "earnings" between "'quarterly" and "report")

Are we really dumb enough to keep pumping CO2 into the atmosphere in ever increasing amounts despite full-knowledge of the consequences? (I know the answer to that question, and so do you. It is a stunning indictment of capitalism and its oft-touted ability to self-regulate) And now returning to coal for electricity generation? You've got to be kidding me, and I'm not a tree-hugger or climate-zealot, just a dad of three that cannot believe we can't do better. Enough is enough. Time's up.

Texas senators cry foul over Smithsonian's pricey Space Shuttle shuffle

Re: Risks?

This is right on point. When the shuttle carrier aircraft 747's were retired, the shuttles were presumed to be in their final resting places. It is the only feasible way to transport one long distance. Barge is really a no-go for flight aircraft, even though enterprise was moved that way, because of the risk of corrosion. Perhaps if you had an enclosed barge and shrink-wrapped the orbiter, but anything short of that is just playing with fire.

The move of Discovery from it's current resting place is nothing short of a Herculean effort, beginning with dismantling the portion of the current building housing it to get it out, to sawing down every telephone pole and traffic light in route to wherever it will be taken. Not to mention the routing logistics of avoiding all overpasses along the way.

Can it be done? Sure. Can it be done for anywhere close to the current estimated costs, doubtful. Should it be done is the proper question, and the answer to that is a firm "No".

We have a hell of a lot bigger and oranger problems in the US that need solving, moving Discovery to stroke some politicians ego doesn't even register on the list of current crisis to solve.

No account? No Windows 11, Microsoft says as another loophole snaps shut

Linux thanks you M$

Who would have thought M$'s arrogance and desire to extract personal information from the privacy conscious by mandating a M$ account for Win11 would be the helping hand Linux needed for the Linux Desktop to finally become mainstream.

I won't run an OS that doesn't install and run with with the Ethernet cable pulled. Windows isn't something I'll miss anyway, good riddance. :)

Windows 10 refuses to go gentle into that good night

Re: Untested workarounds

Once you make the switch to Linux, you will soon wonder how you ever got along without it. It will spoil you.

The only app missing is a Quickbooks type app, but other than that, from office to development, to graphics, to CAD, to audio, to video processing, to ... whatever, it's all there and much, much, more. I've run Linux as a primary desktop and server OS for (?) ... 23 years now. I also have many windows boxes, and have had during that 23 year period, and don't really have a gripe about that either, but returning to windows as a primary OS would be as limiting as trading in your latest car for a horse-and-buggy again.

Not worth the grief, just load Linux and be done with it. Load it on a new SSD if you will and pull and save your windows drive in a drawer (for emergencies). It won't be long before it's just a forgotten drive in a drawer somewhere.

I'm out, says OpenSUSE: We're dropping bcachefs support from next kernel version

Leap 15.4 was my last openSUSE Release - Tumbleweed is fine, but I will not load 16.0.

I started with a boxed-set of SuSE 7.0 Pro (code name: Air) and have used SuSE, SUSE, and openSUSE (and now SUSE again [1]) ever since, through all the ownership changes, Novell, microfocus, the deal with the devil (M$), no microfocus, Leap, etc.. but with 15.6 and the focus on an immutable root filesystem, it became quite clear that providing a traditional Linux distribution had given way to returning to using its open-source release distribution as a sandbox for its commercial offerings. There's no fault with that, but it did mean losing much of what the distribution had built itself on.

To SUSE's credit it did provide Tumbleweed as a rolling release that retains all the traditional Linux distribution characteristics, and to SUSE's credit again, works amazingly well -- even building and running the Nvidia 390xx driver (the G04 driver in SUSE speak). So while I won't install another Leap release, I continue to happily run openSUSE Tumbleweed.

I've also run Arch since early 2009, thanks to the SUSE move to KDE4 (4.0.4a) as the default desktop with the 11.0 release, which I also continue to happily run today. Compared to Arch, Tumbleweed package rebuild volume is quite a bit higher, not horrifically so, but while Arch updates may run 500M - 1.1G between kernel point releases, it's not uncommon to come close to tripling the update download size with Tumbleweed. The comforting part is that sometimes Arch leads in being current with upstream (including the kernel), and sometimes Tumbleweed gets there first. (they are usually within 48 hours of each other on kernel point releases no matter what)

The final point in the article about the painful nature of a Release update, especially one with no autoyast and no xorg, is something that, to some extent, has always been part of the release model. While you could always 'zypper dup' to upgrade between releases, depending on the changes and your package selection, a "fresh install" had remained the recommendation. (simply dumping the packages names with rpm and then reinstalling) The downside was even for the 'particular' Linux user, that could encompass a few days of moving and validating any version changes between configs, applying desktop tweaks, rebuilding freetype to restore proper hinting depending on the display, etc. Moving to something like 16.0 for an organization that relies on features of xorg that wayland doesn't provide would be a showstopper.

As for bcachefs, it's impact will not be as bad on my use as the loss of ReiserFS in the kernel. Let's the hope Kent doesn't suffer the same fate as Hans...

[1] I'm not sure openSUSE is a thing anymore, there was discussion about it being just SUSE now, but I'm not sure SUSE is even clear on what it is at this point.

Internet mapping and research outfit Censys reveals state-based abuse, harassment

Re: Build that Wall!

Moving ssh to a high port takes care of 99% of the bad guys, and if you want to take care of the other 1%, you can implement port-knocking enable ssh only after the proper sequence of knocks is received. I too am fairly strict on geographic blocking, but I tend to only do that by CIDR rather than top-level domain. Though no approach is perfect. The fragmentation and resale of IPv4 blocks has made it almost impossible to get a consistent listing of geographic origin anymore.

Says a lot about humanity when you look at what the internet has become since the naive days when Mosaic was the only browser in town ... and what it says about humanity, isn't good.

These "Research" Companies are a Cancer

Censys, Shodan, Digital Ocean and the lot are a research cancer that has grown on the internet that abuses and then catalogs your IP and public-facing services and makes that information available to the bad guys for free. I have near daily fail2ban bans of IPs similar to (among other services):

"2025-08-31T01:11:13.452946-05:00 valkyrie postfix/smtpd[19354]: improper command pipelining after CONNECT from 216-131-108-38.zrh.as62651.net[216.131.108.38]: €€ü[WË8…z*)QáÙ©·85§Ž7°ÂÏÄ øµQC ıÃB¶’ºBx³¶2唾6쬡ÄÜv—K“Ô€>À,À0€ŸÌ©Ì¨ÌªÀ+À/"

or

"2025-08-31T09:10:49.166588-05:00 valkyrie postfix/smtpd[25479]: improper command pipelining after CONNECT from unknown[104.248.30.84]: ¥€¡fi.baßÞ!P _ эÐÀД¦Í²½K˜dwÂ} s7òöó£ãÕ“©—m§‘í[׿€3™t 怊€€gÀžÀ¢€ž€9€kÀŸÀ£€Ÿ"

If you check the information collected, not only do they provide complete reports on the services, but also the software running behind them, version and patch-level (e.g. PHP, etc..). No wonder the bad actors flock to these "research" sites, they do most of the work for them.

Further, very few of these "research" sites provide an "opt-out" by providing a list of IPs they operate on (I can think of one that does). I've literally got ipset lists with hundreds and hundreds of IPs from researcher's past IPs that have been blocked, but it is just a temporary game of whack-a-mole.

There is a fine line between "research" and "hacking", and these sites fall further toward the latter.

Programmers: you have to watch your weight, too

While the tech aspects are pressing, the final paragraph touching on geo-politics and climate is the most telling:

"High-tech chips and software will be the least of our worries, but we will have to deal with artisanal software that can be maintained by hand"

We ignore geo-politics and climate at our peril. While those younger than 50 may have little memory of conversations with WWII veterans, or "'duck and cover" drills of the Cold-War, we have done little to protect against aspects of human nature that thrive on greed, strive for power and disseminate propaganda to satisfy the need for either. If you don't understand "AMOC" or the implications of its stoppage, best do a quick refresher on the current state of climate. The prediction of "Annual Maximum High Temperatures" in the desert southwest of the US easily exceeding 150 degrees Fahrenheit by 2100 will get your attention fast.

Kudos to the author for keeping the big picture in mind.

Linux Foundation says yes to NoSQL via DocumentDB

I dunno, I think the first two comments may be a bit harsh. Adding what is to eventually be a standard NoSQL storage option under PostgresSQL is a win-win for the community. The MIT license protects the project from redis style hijacking and if you haven't worked both with SQL and NoSQL, then you are in for a treat. While there are rocks to be thrown at The Linux Foundation, it also does an equal measure good. M$ is giving up the code (has), so what is needed is a long-term reliable steward for it. From the community's standpoint what matters is the source for the extensions stays open and allows the standardization of how you interact with it.

While I used to pooh-pooh NoSQL, it has solid benefits. It's not a replacement of what SQL does, they are apples and oranges. It's benefit is in bson document handling -- eliminating the field-by-field integrity requirement between records in SQL and just allowing you to slap another document in storage and retrieve it based on a loose key/value relationship. Add jq to the mix and you pretty much have a Swiss Army-Knife storage solution for all your loosely related documents.

(think systemd journal spitting out all comm-auth failures of bad guys knocking on your server door, a quick jq translation of add or separate wanted information into key/values (e.g. ruser and rhost or some such) and add the whole thing as a new document in your NoSQL database of intrusion attempts that you can query by any of the key/value pairs in the document)

For the purpose it serves, it takes a fraction of the technical resources to do that in NoSQL compared to SQL. TLF picking the project up as the steward for the extensions to allows you to do in Postgres what now takes a Mongo or similar to replicate is a great addition.

While anything can go south, if this works out and you have the extensions actively supported and developed and made available as a set of extensions to Postgres, I'll happily trade-in building mongo from source for it. I just don't see the same doom and gloom in the announcement. It may work out that way, but at least at this stage it as having an equal chance of being a solid benefit for all.

Arch Linux takes a pounding as DDoS attack enters week two

Ultimately we will need accoutability of the hardware/cloud providers that allow botnets to run

For a DDoS attack against Arch that makes little sense, it does expose an issue with the current provider framework that allows hardware and cloud services to be used for the attack. Yes, granny, and the chump that just can't quit opening e-mail attachments get a pass as far as accountability goes, but not so for the professional hosting or service providers. It isn't unreasonable to expect professional hosting providers and ISPs to have sophisticated tools in place that can spot and stop active attacks within minutes of their start.

How many millions of spam e-mails leave Comcast every day attempting to relay mail to "[e-mail]"? A simple pattern to spot and stop, but apparently big-tech can't be bothered. Chuckling, just checking the fail2ban jail for the last hour, and here's another:

2025-08-24T07:12:47.926493-05:00 valkyrie postfix/smtpd[28213]: NOQUEUE: reject: RCPT from c-73-195-211-98.hsd1.nj.comcast.net[73.195.211.98]: 504 5.5.2 <hypir>: Helo command rejected: need fully-qualified hostname; from=<[e-mail]> to=<[e-mail]> proto=ESMTP helo=<hypir>

Selling rent-a-servers for ~$2 a month provides a miscreant with their favorite asset, unlimited hosts and IP addresses to use freely in any attack they choose. Until we require civil and/or criminal accountability for those providing the tools to miscreants, the exponential growth of this cancer on the Internet will continue. And no it's not a one-size-fits-all problem, but just as tech-companies are expected to have specialized tools in place to defend against data-theft, providers must be required to have same level of specialized tools deployed to prevent the misuse of their platforms.

As long as they are free of this needed regulation, they will continue to take the position "it's not our problem", nothing will change, and the exponential growth of distributed bot-net attacks will continue to wreak havoc across the Internet. Yes, granny and the chumps make up a measurable slice of attacks running from infected machines, but even then, the ISP, properly motivated, by either regulation or threat of a civil liability, would have specialized tools in place to identify miscreant use of their hardware before the ink on the legislation (or judgement) was dry.

Back to being FOSS, Redis delivers a new, faster version

New version or New valkey (the latter)

After all of chaos redis caused in its "I'm FOSS", "oops, now I'm NOT FOSS", I wouldn't touch it with a 10-foot pole. Valkey, a redis fork before the "I'm not FOSS" license change, is a direct drop-in replacement, is FOSS, users are happy... and surprise redis does the license shuffle again to try to appeal to valkey users.

After redis has shown its commitment to FOSS is as reliable as the orange president's commitment to the constitution is -- no thanks, I'm quite happy with valkey.

Torvalds blasts tardy kernel dev: Your 'garbage' RISC-V patches are 'making the world worse'

Re: Dislike the delivery

Nah, we miss the old Linus. Life isn't all sugar-drops and gum-drops. Sometimes ... the truth hurts.

No qualms with the delivery.

Imagine the responsibility for making sure 38 millions lines of code continues to work seamlessly across versions updates. Seems pretty understandable that the one responsible may get a bit upset and need to lay down the law when asked to include poorly written code to the project at the last minute. I can't fault anyone for that and it's reassuring to see a firm hand on the tiller.

Gadget geeks aghast at guru's geriatric GPU

Hardware from the 20th Century is more than enough for 99% of users

Hardware spec outpaced what 99.9% of computer users will ever need at the turn of the century. Just how much compute power do you need to run e-mail, a web-browser, a word-processor and spreadsheet? Okay, so you miss out on being able to spin the Compiz cylinder at 1200 RPM, but other than that, as far as just producing work-product goes, minimal boxes more than mow the grass.

If push came to shove, I could get by with a Pi 3B+ just fine (build times would suffer, but that's just extra coffee).

Don't get me wrong, I'm not against building beast like boxes. I raised 3 kids and have a bone-pile of about 3 of every other year's gotta have Nvidia cards. (yes the 390 and 470 drivers are now a pain to patch with each new kernel version -- but hey, it looks like we will get a free pass with 6.16, no patches seen yet!) And yes, the kids needed the power and graphics power to game with all graphics options turned on. For me, meh, I've got no need. Now that the kids are all grown and out of the house, the bone-pile has quit growing, but looking at the old RTX2070 supers and GTX980s, there is still enough pixel pumping power for anything I'll ever need.

I'd a lot rather make use of older kit, adding a new SSD to replace spinning rust, and take the I/O benefit as that provides a bulk of what the latest and greatest promises as far as responsiveness. With RAM cheap, most old boxes now have 32G (and 64G if their chipsets support it). That's plenty enough to put even large builds on a tmpfs in RAM (e.g. PHP or MongoDB, etc..) which then complete quite quickly, and -- I avoid having to upgrade to a new 750-1000W modular PSU just to support the latest graphics cards.

I guess in sum, this is a testament to the advances made in computing capability over the past 40 years. From the 8080 with a few K of RAM and dual 8" floppy drives that wouldn't hold a single picture taken on your phone today, to Terabyte M.2 drives, processors with more cores than sense, RAM approaching the Terabyte scale and GPUs with more compute power than the system they are attached to. My Tumbleweed laptop powered by an ancient Gen 2 i7 sporting 8G still boots from off to full desktop in just under 12 seconds. Runs all Mozilla apps and libreoffice just fine (as does vscodium, etc..) and will finish most of the large builds I kick off within 30 minutes or so.

For decades I would spec-out the motherboard and chipset wanted, the socket and processor, buy the RAM and graphics card and PSU and put it all in one of Antec's solid cases (and most of those still run!). But today, if I need a box to jut prepare work product, I usually grab an off the shelf refurb HP that meets my needs and costs about $300 US. (many of those are still running too). The custom boxes and the kids custom gaming machines always cost more, but for shuffling documents and occasional builds, literally, just about anything made this century will do. Seems the King Penguin thinks somewhere along those lines too. Good for him. Taking a stand against wasted Watts contributing to global warming and using old kit as long as it meets the need to help prevent us all from drowning in e-waste (most of which is still operational...) That I can respect.

Raspberry Pi RP2350 A4 update fixes old bugs and dares you to break it again

Re: Whoop! (non sarcastic)

You need to temper the "Five Volt Tolerant" joy, as it does not mean you can simply hook up 5v signals to the logic pins. See "New RP235X silicon released" over at the Pico/General forum https://forums.raspberrypi.com/viewtopic.php?t=390423. the commend by "hippy" which clarifies:

<quote>

"I do wish Eben would refrain from using that term when the RP235X silicon doesn't meet the capabilities that term invariably conjures up; mainly that you can arbitrarily connect GPIO (FT) pins to any notional 5V signal, job done, nothing to worry about.

It's not "5V tolerant" as I, and I believe others, would take that to mean. It will only "tolerate 5V under specific circumstances".

At least the datasheet doesn't say "5V tolerant" anywhere, more correctly IMO says GPIO (FT) pins "will tolerate voltages up to 5.5 V, provided IOVDD is powered to 3.3 V".

<end quote>

So this is a pay careful attention to the datasheet on just what is meant by the improved 5v handling on the new pico. I was a bit surprised too.

Arch Linux users told to purge Firefox forks after AUR malware scare

Re: Common sense should always be applied

You got me by a year, I started in 2009. One thing of note is the infected AUR packages, all were "-bin" packages. I've long had a problem with Arch allowing "'bin" packages to be hosted on AUR. (for those not familiar, AUR packages are normally source packages that contain the Archlinux PKGBUILD build script that facilitates downloading and validating source files and building the package from source on your machine, "bin" packages are binaries built elsewhere and then hosted on the AUR for download where the PKGBUILD simply installs the binary package).

The lack of transparency in exactly how the bin packages are built, what they contain and the inability to have a validating checksum on each source component has always been a show-stopper for me. (though you should, in theory, be able to go look and satisfy yourself of the "bin" build contents -- somewhere) I get the balance, for packages like Firefox, or MongoDB, etc.. they are very large builds with a large number of dependencies. There is a "convenience" trade-off made. For those package, the normal "build from source" package is usually also available on AUR, but for convenience, and to avoid the large builds and dependency installs, many user choose the "bin" package to install.

I've long lobbied against including "bin" packages in AUR for just this reason. That "one step removed" layer between you being able to validate all sources on your machine before you kick off the build, and that taking place somewhere unknown by somebody operating behind an e-mail alias and the resulting binary files being package and uploaded to AUR provides too great and opportunity for compromise -- in that one little additional layer.

Arch, as always, did the right thing and warned on the aur-general mailing list as soon as the issue was discovered. As pointed out in the article, the only area of deficiency was the suggestion that affected users "take additional necessary steps" to ensure the malware was removed -- without providing an indication of what was needed to ensure the particular installed RAT was fully exterminated.

Lesson: I'll stick to building from validated sources -- even if the chroot ends up with eight-gig of dependencies and the build take several hours and every core I have available. Security does have its costs.

If you want a picture of the future, imagine humans checking AI didn't make a mistake – forever

I've yet to see demonstration of a "Successful Use Case", lawyers can't get it right.

Scraping the internet and being able to predict the next word, or decompose a cat image into a billion unrecognizable images just to be able to reconstruct another cat image is all good, but so far, other than being an neat curiosity, the AI craze hasn't really born fruit. Sure there have been sizable layoffs, but then the reckoning came that AI really can't replace all those tossed out like a worn-out pair of shoes. The scientific community is having to retract significant number of articles that AI "helped" write meaning the same old hallucination of supporting material found its way in.

None of that paints any type of rosy business picture that AI will ever be anything more than another bubble that pops, 30 years after the pin prick of the dot-com bubble. Unfortunately, the damage done by the hype isn't limited to the "hypsters". The hype comes with serious downsides, caveats and addendums for us all. Such as if AI doesn't take the electric grid down with spiraling energy demands that from a practical standpoint looks to set back the ability to reach net carbon neutral energy by decades as our temperature rise target over pre-industrial level races upward towards 2.5 deg C (which is already worst-case, Greeland Ice-Sheet lost, the AMOC stalled), and life on the blue-ball, third-planet from the sun hangs in the balance with temperature recovery models pushed out past 10,000 years.

No, until AI can beat an Atari 2600 in Chess -- it's all hype with serious downsides.

Firefox is fine. The people running it are not

Add NoScript and Ghostery and you are pretty much bullet-proof. I too have used firefox since 1.x, and I've had to bite my tongue a time of two as the "rabbit-pellet" version race zoomed from 3 to infinity and version numbering lost any meaning. I've also run the gamut trying alternatives, but in the end, with all its warts and the things I have to disable in about:config, I always end up back with firefox.

Is there room for improvement, sure. The loss of focus on the browser engine and making it the best has been apparent. Handing development over to the group of "kids with crayons" that tried to add every unnecessary bell and whistle they could dream up was a classic "Do the opposite" move. But, until some other FOSS browser emerges that will have a continue existence longer than a year and has less warts than firefox, I'll stick with the familiar warts I know, and know how to turn off. But, here's to hope....

This article places blame exactly where it should be, and provides a colorful (and correct) explanation of how it ended up that way. A point well made. If all the Mozilla "execs" had their salaries divided by 20, there would be a good chance those that remained, remained because they were dedicated to developing the best browser possible rather than being dedicated to the trappings of seven-figure salaries. The ad company sell-out and user-agreement modification to profit off user-data are symptoms of the cancer that has grown within the company's management.

Critics blast Microsoft's limited reprieve for those stuck on Windows 10

Re: Quite whining

Choose whichever distro you like, it's all Linux under the hood. The only difference between any of the ditros is how they choose to put the pieces together, subtle choices on how various configs are handled, what package manager is used and the package selection offered. Matters not whether you choose an RPM based distro, deb/apt, pacman, or good old install from tarball manage it yourself flavor. All depends on what you want. Whether a gui install/config tool to use, or whether you just want to spend the extra hour to really learn how Linux works and manually prepare the disks and setup the filesystems and then install and configure everything by hand.The result is the same.

There's nothing magic about mint. It's just another Ubuntu derivative. Works fine, as does Ubuntu, Debian, openSUSE, Slackware, Archlinux, etc... Try them all. Most provide live media you can simply boot and test drive before committing to your hard drive. It simply becomes a matter of taste at that point. Most have welcoming communities and mailing lists to help and many provide excellent online documentation. It can be a very enjoyable experience. The price is right. It costs less than a year of extended M$ security updates. (though you should make an effort to give back to the community -- that's what makes it all work -- quite well)

Proton bashes Apple and joins antitrust suit that seeks to throw the App Store wide open

Why does a Switzerland-based company route western e-mail through China?

Perhaps Apple would be more accommodating if Proton didn't route most (all) of the e-mail proton-mail handles through Chinese mail servers. Huh? Yep. (e.g., mail.protonmail.ch[185.205.70.128], [185.70.42.128], [176.119.200.128], and so on)

I've had no end of issues with US (Texas) based local-government's use of proton-mail being blocked at the firewall and having to specifically whitelist IPs to have city and county engineer's e-mail delivered. There may just be some valid concerns Apple has with this "Swiss" company's practices. (it's also begs the question -- what are these local governments thinking... all they hear is "proton" and "secure" without ever understanding more)

Frozen foods supermarket chain deploys facial recognition tech

Re: Hmm (double Hmm)

The company specifically says it will reduce "violent crime" -- when the hell did frozen food shoppers all turn violent? Did I miss that part? The data isn't stored? (how long does it exist? long enough to be transferred or sold? and ... we're just supposed to take that a face value? ... not.).

The solution seems readily apparent -- fresh salad anyone? If non-violent frozen-food consumers vote with their wallet, I bet the CEO changes his tune of the privacy infringing facial recognition escapade. What's the world coming to?? Beam be up Scotty, and if the Enterprise isn't available, I'll take the TARDIS.

CloudBees CEO says customers are slowing down on 'black box' code from AIs

Did you ever notice...

People that have very little to say like to misapply technical terms to sound important? "the velocity that they need to prosecute this trend at"? Really, "velocity"? And just how do you calculate the dot, cross or triple product of that "velocity"? Use "speed" or "pace" when you mean speed or pace. (</language nerd rant>)

I guess when what you are saying is "we've figured out that creating systems based on AI generated code can lead to significant reliability problems later on because nobody really knows HTF the code is put together" ... you have to come up with a whole lot of words to obscure what was readily available to most early on. But hey, you're drawing CEO pay, so you gotta make it sound complicated.

WD escapes half a billion in patent damages as judge trims award to $1

Re: $500 million to 1 ?

It's the republican way - dismantle the axiom that "a jury's verdict remain inviolate".

There is no justice when a jury's verdict is set aside (absent clear reversible error not relevant here). For the life of our legal system, the one thing that business couldn't control was a jury verdict. That's changing. There has been a 35 year concentrated effort to chip away at that legal foundation. Follow the money. Look at the amounts poured into state judicial races that were never supposed to be political to begin with. Look at the political appointments and bastardizing organizations like the Heritage Foundation and right-wing operators like Leonard Leo. Look at supreme court justices that receive more from their Dallas billionaire backer than they are payed in salary. The corrupting influence on the judicial system is by design.

Each new hurdle raised, such as evidence from a "damages expert" to sufficiently "tie" the amount of lost royalties to damages, becomes a tool an inclined judge (or reviewing court) can use to alter or set aside the decision of the jury. The entire judicial approach has changed from upholding a jury verdict if there is any way the verdict can be upheld, to one where the jury verdict means nothing unless supported by proof beyond any reasonable doubt. Essentially turning the legal system on its head.

On the flip side, $1 in compensation is called "'nominal damages". It is the minimum a court can award and still uphold the judgement which is a predicate for the victor recovering attorney's fees, etc. So it could have been worse...

Uncle Sam seeks time in tower dump data grab case after judge calls it 'unconstitutional'

What are the odds of an appeal?

Government will be spoiling to appeal to attempt to create a split between the 5th and 9th circuits teeing the case up for the high-nine. We can presumably guess that the it will be a sad day for the 4th amendment with the current makeup of the court. Sad.

KDE Plasma 6.4 ships with major usability and Wayland improvements

KDE Team note: Plasma 6.4.0 will need manual intervention if you are on X11

For some distros, like Arch, Plasma 6.4.0 removes default X11 session install requiring manual intervention to install the plasma-x11-session package. The note for Arch reads, in part:

"With the recent split of kwin into kwin-wayland and kwin-x11, users running the old X11 session needs to manually install plasma-x11-session, or they will not be able to login."

That's a pleasant surprise for your update if you just don't happen to be subscribed to the arch-dev-public mailing list....

Florida man expands crypto empire with new wireless service and phone

Proof Positive

A fool and his money are easily parted. Cheeto has fleeced his supporters time and time again. His wireless will likely end no better than his university.

Ubuntu 25.10 and Fedora 43 to drop X11 in GNOME editions

Re: Stupid

If it looks like freedesktop and quacks like freedesktop -- then the duck is likely in the background pushing the changes (along with the kids-with-crayons that took over Gnome over a decade ago). I wish freedesktop would put as much effort into fixing the Intel graphics driver issues as it does trying to push wayland to the exclusion of X11.

NASA to silence Voyager's social media accounts

It feels a little like a step backwards in terms of outreach

That hits the nail squarely on the head. For an agency whose life-blood is public support and stirring the public's imagination, this seems quite counter-productive. I'm hesitant to take at face-value the claim this will improve the public experience. I can hope that will be so, but hope can only be dashed so many times. Though JPL is a center that does tend to get things right more so than the others by comparison. Let's hope they are heading the consolidation of the feeds under the new solarsystems locale.

Microsoft slows Windows 11 24H2 Patch Tuesday due to a 'compatibility issue'

Strange, I haven't had a single issue with Win11 updates

$ uname -r

6.15.1-arch1-2

How sweet it is to be free!

Texas warns 300,000 crash reports siphoned via compromised user account

Who's Responsiblity Is It??

"Texan drivers would do well to contact their insurance companies and warn them against fraudulent claims." Huh?? Texas drivers are the ones that screwed this up. Really? 300,000 people should contact roughly six carriers because the state screwed up? Instead dear governor, did you think about the state contacting the insurers?

A typical "Governor Hotwheels" pass the buck, avoid responsibility statement that just puts the burden on Texans instead of fixing anything. Ann Richards was the last Texas governor to actually try to fix anything. Shub, Prick Perry, and governor Hotwheels all took the Cruz fly-to-Cancun approach leaving Texans holding the bag. Glad to see nothings changed. (well, except old Kenny boy found out how to get out from under felony indictment for securities fraud...)

Trump administration's whole-government AI plans leaked on GitHub

Re: First time?

From the article, that pretty much sound like the entirety of the feature set of ai.gov with employee-monitoring. Hopefully it does something more than just aggregating the chatbots in one location. How the hell that's supposed to do anything government is supposed to do is a bit nebulous and bewildering. Sounds like a pipe-dream from one of Muskies mushroom trips.

Ex-NASA Admin pick blames Musk ties for pulled nomination

Good Riddance

Isaacman was the wrong man for the job, and another abominable nomination. His only strength was he wasn't a Fox news weekend anchor with a history of drunkenness and financial mismanagement. NASA has been on the wrong path for several decades. The loss of corporate knowledge as the "public-private" partnerships drained funds from the agency driving up overall launch costs and leaving us showered with private rockets that keep experiencing "rapid unscheduled disassembly" over varying launch azimuths. NASA has long needed to return to doing the things instead of pretending that it "manages" while others "do". Under that model NASA did little except dole out its funds to a few well connected companies while starving the organization. (okay, not all NASA centers adhered to that model, but it has been the hallmark of recent administrators and administration in Building 1)

While one can always throw rocks at NASA for x, y or z, it, with all its flaws, was a nation treasure that did great things. It needs to get back to doing the great things and let the technical developments be spun-off into private industry (remember Velcro?), instead of spinning itself off into private industry. NASA needs to retain its core business of manned and unmanned spaceflight and science and get out of the "management" business.

The contracting paradigm has always been NASA's Achilles heel. More of a jobs-project for middle-income engineers and "managers". Now don't get me wrong, I'm not raining on the whole contracting idea. There were some damn good contractors employing talented and dedicated engineers that made the system work. But NACA/NASA was in the aviation/spaceflight business, not the management business for much of its existence, up really until return to flight post 51-L and then the the number of contractors and organizations grew from something you could list on one page to something that more resembled weeds in a vacant lot than any sane organization chart.

Isaacman would have overseen the continued intentional deterioration of the agency and loss of agency spaceflight and science knowledge on a historic scale. Good riddance he is going the way of the chief Doggy Bro.

AI kept 15-year-old zombie vuln alive, but its time is drawing near

The Scary Part

We have trained the next generation of programmers to rely on LLM code generation for "productivity" reasons (greed, profits, etc..) Instead of being taught how to program, they are being taught how to prompt. Some of the biggest players in the IDE and OS world are pushing every type of AI in just about every programming tool they can shoe-horn "AI" into. "Don't think, just use your assistant." Let it do the thinking and work for you -- like magic!

The three-spinners have certainly woven a wicked fate for us all. A digital future with built in vulnerabilities -- as a "feature". It's cliche, but what could possibly go wrong?

More than a hundred backdoored malware repos traced to single GitHub user

Is MS just asleep at the switch?

With all the supposed software sophistication, how does Microsoft just let something like this run rampant on Github? Are they supposed to have systems and tools that are on the lookout for suspicious activity -- just the type described in the article? Isn't AI supposed to be able to spot this stuff -- the same way it is supposed to be able to spot breast cancer before human eyes can? It seems like a world full of hype and no results as far as platform security and AI goes? No?

Dem senators pen stern letter urging Noem to reinstate cyber review board

A venerable barn-yard sniper she is.... don't forget the goat. In addition to animals, she's shown herself quite adept at shooting herself and the nation in the foot. Morons and Fox news hosts -- those are the "best" people we were promised?

Ukrainians smuggle drones hidden in cabins on trucks to strike Russian airfields

Re: Ukraine did

Volodymyr: 1 Vladimir: 0 - brilliant operation, Go Ukraine!

Stargate to land its first offshore datacenters in the United Arab Emirates

Says it will serve half of humanity

That's going to be a bit difficult with many UAE addresses blocks blocked by company firewalls. A decade of harboring bad actors has its price.

Eeek! p0wned Alabama hit by unspecified 'cybersecurity event'

Speckled Trout

Oh great! That means all the e-mails from the Alabama Department of Conservation and Natural Resources asking me to renew my non-resident saltwater license now have to be considered suspect. Nothing is sacred anymore.

No-boom supersonic flights could slide through US skies soon

Re: American leadership in aviation ?

"If it's not Boeing, I'm not going..." {strike that} "If it's Boeing, I'm not going..."' Okay, brought forward to modern times.

Unfortunately, most of those pushing to lift the restrictions were not alive in the early 70's and don't remember just how well reasoned the prohibition on supersonic flight over populated area were. Growing up in the late 60's and early 70's in far north Dallas, the sonic booms generated by military aircraft were quite regular and teeth jarring at times. (even though calling the area populated back then may have been a bit of a stretch)

While drone sized models may show promise of being able to reduce the intensity of the shock wave, a full-scale aircraft is a different thing altogether. Forgive me if I'm a bit skeptical of claims of 90 dB shock wave from a plane going Mach 1.7... but then again, 2049 has left 24 years to meet the goal (or revise the shock wave intensity up).

I guess with delays at the departure and arrival terminal ballooning by hours, they are searching for any way possible to shorten the travel time in between. Here's to hope. I still believe in magic...

VPN Secure parent company CEO explains why he had to axe thousands of 'lifetime' deals

Trust is a quaint ideal like legacy accounts... Sue them. An entity acquires a companies assets and liabilities at acquisition unless explicitly excluded -- that includes legacy accounts.

If there are enough of them to make a case viable, there are plenty of lawyers that will take it. "we didn't dig deep enough" isn't a legal excuse, it's an admission of pre-transaction negligence and doesn't serve as a legal avoidance of the obligation or any company liability.

Seems the CEO is as diligent in his public facing comments as he is in his pre-purchase digging...

Metal maker meltdown: Nucor stops production after cyber-intrusion

How else can the execs watch Tik Tok between batches and catch up on facebook and xitter?

CISA mutes own website, shifts routine cyber alerts to Musk’s X, RSS, email

When it's over - Uncle Sam will be raising a tin cup for help....

The 5hit-show continues with a wrecking ball being swung at critical US infrastructure while the orange-turd tries to stuff a 747 from Qatar in his pocket. Destroying the people's house while packing boxes with the spoils for his own personal benefit.

As anyone with public-facing infrastructure can tell you the need tor threat tracking and dissemination of that information to help quell the attacks is vital. Though that thought likely never had time to enter the addled orangutan's mind between the 7 hours of right-wing news watched each day, orange face painting, wig gluing, golf, airplane tours, tariff roulette, deporting brown people to El Salvador while granting special immigrant status to white people from South Africa.

I mean where else would he turn to find "the best people" to head critical government agencies were he to watch less propaganda. God knows we need another crazed South African immigrant thrown into the mix. You just can't make this stuff up, and it would be comical if it were not so serious and so tragic.

Can you spare a dime and hand for the cup... We will need it when this story ends, and I doubt very much that it ends well.

openSUSE deep sixes Deepin desktop over security stink

R.I.P Leap

After using SUSE since 7.0 Pro and then openSUSE from 11.0 on, with the immutable filesystem coming and other atypical Linux changes being made to the Leap distro, we jumped from 15.4 to Tumbleweed (the openSUSE rolling-release offering that still supports i586 and full X.org without the immutable filesystem). No complaints. The 2/25 TW installed changed base security from AppArmor to SELinux - which came with more than a few growing pains, but those have been largely resolved. So as Leap looks less like Linux, there is still an openSUSE option in Tumbleweed.

Pentagon declares war on 'outdated' software buying, opens fire on open source

Re: Morons Are Governing America

We're Doomed...

Microsoft tries to knife passwords once and for all – at least for consumers

M$ Wants Biometric ID - Sure Hold-on a second ... - NOT.

Perhaps I'm just a curmudgeon, but I think you would have to be literally daft to turn over your biometric identifiers to log into consumer software, or any software for that matter. Maybe for intelligence agencies (before brother Pete), but not for windows, word or the Microsoft account.

Given the entire industries track record of keeping customer data safe, trusting them with your immutable identifying factors is a bridge too far. In case of a breach, you can change your password or ssh cert, but if your bio ID is leaked, stolen, whatever, you are a bit out of luck. No thank you.