Max_P

Max_P, 9 days ago

It would be nice if they’d make “web” search the good old keyword search we used to have that made Google good, now that normies will just use the AI search and it doesn’t have to care about natural language anymore.

Max_P, 12 days ago

The quality of what the community is doing vs what they shipped with NSO especially on launch is laughable.

Native OoT and MM on the switch would have been really sick. Instead they went with 90s level of emulator quality.

Max_P, 15 days ago

Basically, the SUID bit makes a program get the permissions of the owner when executed. If you set /bin/bash as SUID, suddenly every bash shell would be a root shell, kind of. Processes on Linux have a real user ID, an effective user ID, and also a saved user ID that can be used to temporarily drop privileges and gain them back again later.

So tools like sudo and doas use this mechanism to temporarily become root, then run checks to make sure you’re allowed to use sudo, then run your command. But that process is still in your user’s session and process group, and you’re still its real user ID. If anything goes wrong between sudo being root and checking permissions, that can lead to a root shell when you weren’t supposed to, and you have a root exploit. Sudo is entirely responsible for cleaning the environment before launching the child process so that it’s safe.

Run0/systemd-run acts more like an API client. The client, running as your user, asks systemd to create a process and give you its inputs and outputs, which then creates it on your behalf on a clean process tree completely separate from your user session’s process tree and group. The client never ever gets permissions, never has to check for the permissions, it’s systemd that does over D-Bus through PolKit which are both isolated and unprivileged services. So there’s no dangerous code running anywhere to exploit to gain privileges. And it makes run0 very non-special and boring in the process, it really does practically nothing. Want to make your own in Python? You can, safely and quite easily. Any app can easily integrate sudo functionnality fairly safely, and it’ll even trigger the DE’s elevated permission prompt, which is a separate process so you can grant sudo access to an app without it being able to know about your password.

Run0 takes care of interpreting what you want to do, D-Bus passes the message around, PolKit adds its stamp of approval to it, systemd takes care of spawning of the process and only the spawning of the process. Every bit does its job in isolation from the others so it’s hard to exploit.

Max_P, 1 month ago

Seen similar stuff on TikTok.

That’s the big problem with ad marketplaces and automation, the ads are rarely vetted by a human, you can just give them money, upload your ad and they’ll happily display it. They rely entirely on users to report them which most people don’t do because they’re ads and they wont take it down unless it’s really bad.

Max_P, 2 months ago (edited 2 months ago)

I miss the simplicity and the focus on the information due to the technical limitations.

Websites just had the information, well presented. None of that blog spam with a massive story on how error code -21 could suck and seriously impact your business and that you should hire professionals. But anyway here’s a command copied from a 10 year old StackOverflow answer that hasn’t worked for 5 years and isn’t actually related to what you were Googling at all, but now you’ve viewed 3 advert videos, scrolled through 10 sponsored ads and closed 2 popups. Here’s the next article on error -22.

Also, downloads were “here’s the link to it on our FTP server”, none of that guess which download button is the real one, waiting 30 seconds for the download to prepare and having to sign up for faster download speeds.

Max_P, 2 months ago

Easy: even if you vote for Bernie that’s still at best center-left. The US just really, really leans right overall: there’s center-right (democrats) and far-right (republicans) and that’s about it.

You guys are so afraid of socialism no party dares venture the true left.

Max_P, 2 months ago

So, they comply with the DMA… by only offering their own apps? Isn’t that the opposite of what the DMA is supposed to do?

Max_P, 2 months ago

At least it’s open-source: android.googlesource.com/…/DeviceLockController/

And that’d be why custom roms have it. It’s part of the base Android system.

Max_P, 2 months ago

I was able to start some of its private activities with ActivityLauncher as root. Most of them just crash immediately, but the help page is available. And yikes, they got them covered against a possible bypass, no developer tools or sideloading.

https://lemmy.max-p.me/pictrs/image/3d667fa7-fc8b-4991-9de0-22463253327d.png

https://lemmy.max-p.me/pictrs/image/30ab982a-dfeb-4ea8-8d4d-fc5f548b966a.png

https://lemmy.max-p.me/pictrs/image/ba7cb3e6-0a43-4ef7-9480-b36898b905b3.png

https://lemmy.max-p.me/pictrs/image/9864d0a4-d398-4658-9739-4a73489af791.png

Still disappointed this is shipped in LineageOS, but I suspect not for much longer with that publicity.

Max_P, 2 months ago (edited 2 months ago)

Just a friendly reminder that there’s accessibility problems with dark themes.

For me dark themes look like this because I have astigmatism:

White on black text with astigmatism

Black on white doesn’t have this issue because all the white around it does is slightly blur into the black text and makes it a little grey at worst.

Any dark theme for a longer period of time also causes the white text to burn in my retina for a couple minutes, and I just see lines when I look away, and also makes reading a long article difficult and painful.

Dark themes look so much better, but keep in mind some people have very good reasons to prefer light themes. There’s no need for dark theme elitism.

Max_P, 3 months ago

Valve just keeps on delivering the open-source goodness!

Max_P, 3 months ago

Throwing that kind of stuff at an LLM just doesn’t make sense.

People need to understand that LLMs are not smart, they’re just really fancy autocompletion. I hate that we call those “AI”, there’s no intelligence whatsoever in those still. It’s machine learning. All it knows is what humans said in its training dataset which is a lot of news, wikipedia and social media. And most of what’s available is world war and cold war data.

It’s not producing millitary strategies, it’s predicting what our world leaders are likely to say and do and what your newspapers would be saying in the provided scenario, most likely heavily based on world war and cold war rethoric. And that, it’s quite unfortunately pretty good at it since we seem hell bent on repeating history lately. But the model, it’s got zero clues what a military strategy is. All it knows is that a lot of people think nuking the enemy is an easy way towards peace.

Stop using LLMs wrong. They’re amazing but they’re not fucking magic

Max_P, 3 months ago

The votes are public. Kbin displays them right in the UI. Lemmy semi-hides it, but it’s never been designed to be private in any way.

Changing instance won’t do shit if that’s a concern to you. As an admin I can see them even if my instance isn’t involved with the post at all:

https://lemmy.max-p.me/pictrs/image/6bae7aa5-20a3-497e-9012-dc4c8a869eb4.png

Max_P, 4 months ago

The ads come from an ad network where there is very little visibility into what’s going to be displayed in your app. And bad people also keep managing to get their ads published even though the ad network doesn’t allow them

And it all ties into the whole targeted advertising, where they also make sure very few people get the bad ad, and tries to target people they think may be more susceptible to these kinds of tactics. Depending on the amount of interactivity allowed, the ad can even display two different things if it deems you too savvy to fall for it.

It’s basically unescapable unless you only use apps without ads, or pay for the ad-free versions.

The whole advertising industry is sketchy, more news at 10.

Max_P, 5 months ago

This is why I have respect for Valve. They’re willing to invest into changing the status quo instead of seeing it as not profitable immediately. They’re playing the long game, and they’ve put their version of Linux into millions of hands. They’ve built hardware for it, they’ve invested a ton into Wine/Proton, they’ve invested in open-source graphics drivers. They’re actively fixing up third party games to the point some of them run better on a their handheld than decent Windows PCs. And a good chunk of it is open-source and given away for free to everyone to use.

Meanwhile Sweeney is just there whining that Linux is too hard. They can’t even be bothered to try.

I would give money to Valve just so they keep going. I have no desire to buy an Epic game they’re not even willing to try to at least make it easier to run in Wine.

Max_P, 5 months ago

They can deny it however much. The right and anti-wokism is not the majority. Which therefore means unless special care is taken to train it on more right wing stuff, it will lean left out of the box.

But right wing rhetoric is also not logically consistent so training an AI on right extremism probably also won’t yield amazing results because it’ll pick up on the inconsistencies and be more likely to contradict itself.

Conservatives are going to self-own themselves pretty hard with AI. Even the machines see it, “woke” is fairly consistent and follows basic rules of human decency and respect.

Max_P, 5 months ago

C bindings and APIs generally work much better in Rust because the language works a lot more like C than it does C++.

Qt depends a lot on C++ class inheritance, and even does some preprocessing of C++ files to generate code in those classes. That’s obviously not possible when using Rust. And it looks like you need a fair bit of unsafe there and there to use it at all too.

Meanwhile, GTK being a C library, its integration with Rust is much more transparent and nice.

So if you’re making a GUI Rust app, you’re just kind of better off with GTK at the moment. It’s significantly easier and nicer.

Max_P, 6 months ago

They claim they didn’t ruin the Internet, but yet every single one I’ve worked with very aggressively keyword stuffed the shit out of the sites, even a blog with fake authors and carefully written junk top 10 blog posts to bring as much traffic as possible. I’ve even discovered they exploited Wordpress instances to stuff links to our site on it, when they weren’t just leaving junk comments with a link to the website.

They’re the very reasons so many sites have so many fucking useless tutorials and top 10s and whatnot. They go after search engines, and in that process, you gotta make your site appear to have loads of articles and content about a topic so it gets favored in search engines.

Max_P, 8 months ago

Eyes don’t really have a concept of FPS because we don’t have shutters in the first place. The brain is just continuously interpreting what we see. And it fills in a lot of gaps: for example, we technically have a large blind spot right in the middle of the retina, and that’s why we’re more sensitive to movement in our side vision.

Cats see just fine in the dark, our eyes are just not sensitive enough to low light to be all that useful for us, but we could, if the eyes provided that input. Evolution just made it so we favored speedy and sharp vision in daylight rather than night vision, in part because we quickly developed technology (fire) to keep our areas lit as needed.

Max_P, 9 months ago

Why is everyone outraged when Google/Microsoft/Yahoo and others have scraped the whole internet for two decades and are also massively profiting from that data?

Max_P, 9 months ago

I’ve switched to purely gesture navigation and never looked back. Wouldn’t surprise me if they’d remove 2 button too eventually.

Never understood 2 button navigation, it’s just a lot of wasted space for just 2 buttons. Gimme 3-4-5 buttons to do useful stuff if you’re gonna use the space.

Max_P, 9 months ago

They claim it’s to prevent bots, but we all know it’ll soon become standard in every WAF out there (Cloudflare, Akamai, etc) to just blanket block browsers failing attestation.

All you need to know what will happen is to root an Android phone. You’d expect Netflix and bank apps and other highly sensitive apps to stop working. Okay, I can accept that, it kind of make sense. But the more you use the phone the more you realize a ton of apps also refuse to work. Zoom complains and marks your session as insecure, the Speedtest app refuses to test your speed, even the fucking weather app won’t give you weather anymore. Jira/Confluence/Outlook/Teams also complain about it. It’s ridiculous.

Even if it’d trust Google to not misuse the feature and genuinely use it to reduce ad fraud, the problem is the rest of the developers and companies. Those, they absolutely cannot be trusted to not abuse the feature to block everyone. Security “consultants” will start mandating its use to pass security audits, government websites will absolute use it, and before you know it, half the web refuses to work unless you use Chrome, Edge or Safari.