@cley_faye@lemmy.world
member since 21 Jun 2023 01:40
comments
- on Smart devices can testify against you: How home robot data is being used in court in c/technology@lemmy.world · 2d ago
-
on Sam Altman says OpenAI will not go public this year as AI fears grow in c/technology@lemmy.world · 15 Sep 2026
the next generation “AGI” resulting from all the new datacenters will repay the trillions invested.
Too bad we don’t have the slightest clue on how to do that, except that it won’t work with LLM alone.
-
on Sam Altman says OpenAI will not go public this year as AI fears grow in c/technology@lemmy.world · 15 Sep 2026
From a technical point of view? It’s just software. If you give a software with semi-random outputs access to control external tools, it will do semi-random stuff and could cause harm. And since the people that loves these little runner also likes to run hundreds of them concurrently, with the ability to spawn more, they can cause harm real fast with no oversight.
If you don’t give them uncontrolled access to anything though? Not much harm in that. But it’s harder to sell the “this is the future of everything” if you put pesky things like checks and limited capabilities for the sake of safety.
So, nothing unique to AI, except the scale of it.
-
on LG Denies Its TVs Are Spying on You (Unless You Opted In) in c/technology@lemmy.world · 14 Sep 2026
Especially if said denials comes after evidence that they’re doing it in the first place. I wonder what was their train of thoughts here.
-
on German police read Signal, Telegram, WhatsApp messages without breaking encryption in c/technology@lemmy.world · 12 Sep 2026
Intercepting a verification code with signal does not allow reading messages.
-
on German police read Signal, Telegram, WhatsApp messages without breaking encryption in c/technology@lemmy.world · 12 Sep 2026
Because sometimes, people are not online 24/7 and messages still need to reach them when possible.
-
on German police read Signal, Telegram, WhatsApp messages without breaking encryption in c/technology@lemmy.world · 12 Sep 2026
Except they had to get the keys, at least for Signal, as described in the article. Only you can allow a new device. If you get a notification for a new device and you go “sure, let me flash that code for you”, you’re giving the key. And a moron.
Can’t say about the other services.
-
on “This is the AI men actually use”: Meta ads pushed apps nudifying real teens in c/technology@lemmy.world · 8 Sep 2026
When what passes for the leader of the “free world” is a spearhead for pedophilia it’s kind of a bit late to be safe talking about “normalizing” stuff.
-
on “This is the AI men actually use”: Meta ads pushed apps nudifying real teens in c/technology@lemmy.world · 8 Sep 2026
Better pull the plug on that bell, because “it’s here to stay”, some people says proudly.
-
on 1Password wades into a right-wing mess after funding a Linux project in c/technology@lemmy.world · 3 Sep 2026
What kind of distro does that?
One that does not care at all about having maintaining a sane and open ecosystem. Where there’s money to make, they will prey down quickly. Now that people are somewhat convinced that Linux based systems can work and actually attract the general public, a whole new market is ripe for reaping.
-
on 1Password wades into a right-wing mess after funding a Linux project in c/technology@lemmy.world · 3 Sep 2026
Except for the very last part (I hope…), it’s the case of most “funky crazy distro” out there.
-
on 1Password wades into a right-wing mess after funding a Linux project in c/technology@lemmy.world · 3 Sep 2026
You think if the developer bails out, the software will magically disappear from everywhere, leaving you with no way of recovery whatsoever?
Let’s say they decide to pull the plug. Everything you have that’s already running will keep running. Code can be forked (in fact with keepass, it already happened). Data can be exported after the fact. Other software can actually open keepass database file.
You really don’t see the difference between this and “the server stopped sending you your own data, oops”?
-
on Microsoft's latest AI rebrand beats its own history of terrible rebrands, renaming Microsoft 365 Roadmap to "AI at Work" in c/technology@lemmy.world · 28 Aug 2026
They own A LOT of gaming companies
They’ve started killing/selling them though.
-
on Chinese memory can now match the speed and latency configs of the RAM in our gaming PCs in c/technology@lemmy.world · 21 Aug 2026
There’s also the issue of things not necessarily having to be the MOST profitable thing ever. Memory manufacturers decided to go to the highest bider because money. I suspect Chinese company will be quite happy to just flood the market with cheaply priced (relatively speaking) products and just get everyone’s money.
-
on scripts? in c/linuxmemes@lemmy.world · 17 Aug 2026
JavaScript in the browser have no “sandbox” to evade. It does not have the ability to run outside of it’s virtual machine, at all. It’s completely different from a native executable, that actually have the ability to make system calls, that would evade a container/chroot/whatever.
Also, running a crypto miner in a browser tab (or even as a service worker) is probably more costly to put in place than it will ever bring back. It’s just not efficient enough.
-
on scripts? in c/linuxmemes@lemmy.world · 15 Aug 2026
Bugs exists. But JavaScript running in the browser have, theoretically, little access to anything. Definitely no FS access without user interactions, can’t access most of the system services, and the few that are accessible are through restricted API with permissions/confirmations.
The risk of allowing JavaScript on a website is more tied to the site data, or tracking. Rogue browser extensions are way more dangerous.
It doesn’t mean every site needs JavaScript, but having this enabled by default is not that big of a security risk for the system. It can help with phishing, though, if you don’t know what site you’re viewing.
-
on Vulnerability giving attackers full control of Macs is under active exploitation in c/technology@lemmy.world · 15 Aug 2026
You can have IPv6 on your router, and an isolated network. It’s just not necessarily what’s done by default.
-
on The security co-processor in many CPUs is insecure in c/technology@lemmy.world · 13 Aug 2026
The issue is not usually with the seed (although being able to determine the seed used for a PRNG completely defeat its purpose). The biggest issue (aside from deterministic seed) is that not all (P)RNG are created equal. Some have seemingly infinitely long, non repeating sequences, that varies greatly for a minuscule change in the seed (the good ones). Some have relatively short, repeating sequences. Some are so badly implemented that actually seeing a few numbers of the sequence allows reverse-engineering their internal state, so you can get the next numbers for free afterward. If you don’t use a big function with an impossible to probe initial state (like any good cryptographic hash function), you could even go backward in the sequence, finding previously generated secrets.
There’s plenty of attack surface on bad implementation of a (P)RNG. And the hardware ones combines “nuh-uh, we won’t tell you the seed” with “nuh-uh, you’ll have to trust our implementation”. That’s why, as far as I know, hardware RNG is usually used as one of the source for the seed of a PRNG.
For example, although it was deemed a bug, some AMD processor, for a while, failed to generate actual randomness under some circumstances. That’s a problem if you only rely on them. That’s why dumping that in a tumbler of other sources is a good idea. (sorry for the reddit link: old.reddit.com/…/cpu_random_generator_seem_to_be_… )
The way you get your seed also matter. Time-based seed, if you have a vague idea of when it was acquired, is easy to check. Sure, there might be a window of a few hundred of thousands of milliseconds, but that’s nothing too hard to check if you’re sure this would yield you a secure key you really need. Multiplying the source, from sources that seemingly can’t be under the control of an attacker is important, but you have to be careful. An anecdote I was told at a conference was about using the system’s delay on read. Since reading happened at seemingly random (with a busy system), on a HDD, where the head have to actually move and the platters have to spin, it might be a good idea. When people moved to SSD, the reading delay became almost constant. Not such a good source now.
An example of failure on properly seeding your PRNG would be the random SSH keys generated by Debian (a long time ago). The random generation of keys moved from almost the full space of possibility to around 32.000 keys. That’s low enough that those keys are actually listed and banned from being used by some systems. More info about that here: hezmatt.org/…/how-i-tripped-over-the-debian-weak-…
If your PRNG is implemented correctly, with proper impossible (well, extremely hard) to reverse functions, and a really good seed that can’t be exfiltrated, periodically augmented (and not replaced!) with many source of seemingly out of control randomness, there’s little to do against that beyond just dumping memory beforehand and taking it out the hard way. Unfortunately, a lot of people think “outside the box” and wants to reimplement their own. Or rely on faulty hardware. Or rely on tampered hardware. And so on.
-
on In a universe of enshitification, Linux is one of the few things that consistently gets better. in c/linuxmemes@lemmy.world · 13 Aug 2026
Why are you obsessed with updates or specific distributions? It’s rarely, if ever an issue. Most package manager won’t break dependency; they’d rather not install an update anyway. And most system package manager are mature enough to not fail at this basic task, regardless of distro. There can be inconsistencies with flatpack sometimes, but that’s because they’re expected to sync with system versions of some libraries (especially graphic drivers), but that won’t happen unless you go out of your way to make it happen, and again, it’s not distro specific.
I’m talking about actual projects, adding actual bugs, that they find out are valid, and need fixed, in areas of their code that didn’t need a change to begin with. It’s a very real thing that seem to become more and more prevalent these days. And it has nothing to do with your distribution or your system updates.
-
on In a universe of enshitification, Linux is one of the few things that consistently gets better. in c/linuxmemes@lemmy.world · 12 Aug 2026
I don’t have problem with updates. I have problem with software bugs showing up uninvited, in places where there was no need for change. No distro hoping is gonna help that.
-
on In a universe of enshitification, Linux is one of the few things that consistently gets better. in c/linuxmemes@lemmy.world · 12 Aug 2026
Eh, you’d hope. I can’t definitively say why this happens for now, but I’m seeing a surprising amount of “little bugs and quirks” seeping through, more than it used to. And that makes me worried.
I recently paid extra to get an A/C with no connectivity. I can feel that. And the only incriminating thing one can get out of my fridge is the smudge of sticky stuff in the bottom drawer, not entire transcripts of the last two weeks -_-