• 0 Posts
  • 94 Comments
Joined 2 years ago
cake
Cake day: September 1st, 2024

help-circle



  • I keep seeing these comments where AI is hailed as the next industrial revolution, but I think they all miss the point.

    Industrialization created jobs. There were fewer skilled jobs lost than new skilled jobs created. It then created the need for more knowledge based jobs, like civil engineers.

    The AI lobby is doing the opposite. It targets higher paid skilled jobs. If they were to succeed, they would give birth to the opposite of the Industrial Revolution.












  • What you describe is a very recent phenomenon. They all were Windows exclusive until around when Microsoft announced the Windows 10 EoL date. Up to that point, pretty much every single video touching Linux, and especially those with Linus as the protagonist, were quite negative, sometimes for no reason at all, e.g. when he complained about UI elements that weren’t aligned with the Windows UX.

    And this isn’t new either. Linus has a bias, like everyone else, and that’s fine, but one cannot play personal preferences as the gold standard, see his long term opinion about the iPhone vs Android, or his early videos trying to use Linux. The latter especially are famous in the Linux community of creators, you can find several reaction videos commenting on the topic.



  • 2FA should probably be enforced for the process of publishing packages

    The most successful recent attacks haven’t relied on stolen user credentials, so this point is kind of moot. API tokens are way easier to obtain and use. Typo squatting and phishing are more effective, and attackers generally don’t need to bypass 2FA.

    Linux distros usually rip out build scripts and build systems in order to replace them with their own, but this also further limits the code you have to audit.

    Linux users who routinely download and compile src packages is a minuscule attack vector. Most users download binaries, so this point isn’t true either.

    And look, I agree that MFA should be mandatory everywhere, and sandboxing is great, but the truth is that the JS ecosystem is chock full of lazy and sloppy devs. That’s just how it has been for the longest time, and no amount of security measures targeting them specifically is going to fix the current state of affairs, because as soon as one is implemented, someone will find it too cumbersome and will find a way to override it. The whole ecosystem needs adult supervision.

    But honestly, I believe that JS in the backend has been a massive mistake and we all should abandon it as soon as possible. There are plenty of better languages and ecosystems out there, no need to keep self inflicting this kind of pain.