IMHO those are both lipstick on a pig solutions. Ultimately all this stuff is just a variation of "make releases harder to publish", which isn't going to do anything but train people to evade them. Notably, neither would have prevented the xz-utils backdoor from reaching package distribution, which remains the gold standard for sophisticated upstream compromise.
The bug here isn't that we need to better authenticate already-trusted upstreams for packages, it's that the upstreams cannot be trusted as the sole source for security at all. Upstreams are a bunch of hackers[1] who aren't really interested in, nor will ever be good at, solid release engineering practices.
But some people are! The solution in the Linux world (and the one that saved us from xz-utils) is that there is a second level of human beings responsible for reviewing, auditing, packaging, and customizing those hacker-generated upstreams for the benefit of their users. These people have different eyes, different consumer requirements and different quality metrics. And they catch bugs and malfesance that the upstreams aren't prepared to do.
NPM (and cargo/PyPI et. al.) continues to think it can short circuit this requirement for human labor. It can't.
[1] In NPM's particular ecosystem, a bunch of web jockeys used to extremely fast release processes, loose compatibility requirements, and extreme reliance on reuse. This really explains why we see this with node packages more than Python or Rust: older and more conservative programmers just don't have as many rakes to step on.
> The solution in the Linux world ... is that there is a second level of human beings...
AKA "unpaid labor". I don't think that's a good solution, either. Certainly it's only by pure luck that no malefactors have infiltrated the ad hoc, anonymous social proof communities that Linux depends on, and I don't think other systems should emulate it.
The real solution (for Linux too) is a paid package curation service. Or really, a small handful of them competing on price, speed, reliability.
> ... a second level of human beings responsible for reviewing, auditing, packaging, and customizing those hacker-generated upstreams for the benefit of their users.
> The real solution (for Linux too) is a paid package curation service. Or really, a small handful of them competing on price, speed, reliability.
That was also what I was thinking aloud a moment ago. And there would be a business opportunity, too. Perhaps not like RHEL et al. full-blown stuff per se, but say smaller scale guarantees with different pricing; web, AI, scientific computing, and whatnot. At the pace things are progressing, I'd guess you might even get desktop etc. users on board (for nominal pricing).
> Certainly it's only by pure luck that no malefactors have infiltrated the [pinko commie Linux hippy commune]
Yeah... no. Sorry, that's a wild misunderstanding of the economics of the Linux ecosystem, modern libertarian thought and the employment status of people with write access to the packaging layers.
But there is a second level of people reviewing packages on npm. They're the ones that report issues like the github issue this HN thread is linked to, and they very frequently get malicious npm packages taken down within a day of publishing. The big issue is just that not everyone is using a cooldown to avoid packages less than a day old and so people who install new packages at unlucky times don't get the benefit of that layer of review.
> Notably, neither would have prevented the xz-utils backdoor from reaching package distribution, which remains the gold standard for sophisticated upstream compromise.
Mandating that the final binary is compiled without having any access to any test file though would have prevented the xz-utils backdoor as it was conceived though.
A proper packaging setup would first verify that all the tests are passing and happen in an isolated environment. And that isolated environment either returns which tests failed or gives the green light.
When the greenlight is given (that all tests are passing), another environment should first delete all files related to tests and then build (in a bit-for-bit reproducible way btw and we're basically here already so that's good) the final binary / package.
If you prepare your final package in an environment that has access to test files, there are simply way too many ways obfuscated binary data can be hidden in test cases / test files.
I'm not saying the NSA (sorry, Jia Tan) wouldn't have tried something else but I think we should really move to build/packaging that discards non essential data/files before compiling.
P.S: note that as a side-effect of reproducible builds... If we have reproducible builds and if we add, later on, a builder/packager that discards tests files and ends up with a final package that's not bit-for-bit identical to the package created while having access to the test files during the build, we've just detected a backdoor hidden inside test files (like the XZ utils one). As a really mindboggling food for thoughts: if we were to recompile all the Debian binary packages that are already reproducible today (95% of them), but while discarding all tests files before the build, we may catch other backdoors.
> Mandating that the final binary is compiled without having any access to any test file
It would, but I'm not seeing that as a suggestion? That was a very clever side channel for hiding the build-time payload. It wasn't remotely the "root cause" of the exploit, which was that a malicious actor got write access to the release process of trusted software. I mean, if you can do that, you can surely find other clever ways to hide your junk.
To wit: you're not wrong, you're just stuck on minutiae. By all means make the case, but at best you're proposing a small constant factor optimization.
While true, tarring Arch here is a little unfair. AUR isn't enabled by default. It can't even be used via the same package front end, and in fact the "official" usage model requires that you clone the source yourself.
Indeed, AUR is bad as a software distribution mechanism (really it's best understood as a proving ground for baby packages before they get real maintainers and distro blessing), but it's less bad than NPM which puts the malware in the trusted/default/automated path.
Depends on who 'you' are. I have one package I installed from the AUR and it's from a corporation that just repackages their builds. The problem is always who vets the packages. I trust the Arch team and I trust that one corporation. Also to use the AUR it's a different command, so I can't get surprised by an AUR package. It's not a pacman -Syu is going to pull in a new unknown to me AUR package.
That sounds like an opinion baked in 2013 and never revisited. A modern chromebook with Crostini can run basically any Linux desktop stack you want. Like, what exactly are the tasks you need from a "computer that you could use like a normal computer" that you aren't getting today?
As a data point: I'm 100% converted personally. A Chromebook is what goes into my backpack and the device I use for all my general day-to-day UI clickery, and it's a better fit for my needs than Windows (not nearly as bad as it used to be but still sort of a PITA to make work as a Linux-focused dev environment) or Linux (not nearly as much of a PITA for a connected consumer network device but still has the occasional wart trying to get something weird to run).
Crostini is a mixed bag; e.g. IIRC something in their stack breaks ptrace. I prefer to wipe and install a normal Linux distro. But, when it works it works, and I do use one Chromebook with Crostini.
ptrace works fine on crostini. The guest kernel has Yama enabled, which restricts it to root for boring security reasons. You can do your debugging at a root shell or turn the setting (yama/ptrace_scope) off via sysctl.
> A modern chromebook with Crostini can run basically any Linux desktop stack you want. Like, what exactly are the tasks you need from a "computer that you could use like a normal computer" that you aren't getting today?
Well... yeah. Likewise your post is clearly about your needs, which are different. But that's not what you said, you said it "wasn't a computer" and you couldn't use it "like a normal computer". Which is obviously wrong. But I guess "normal computer" means "windows" to you, which (especially given the forum you posted on!) is a little surprising.
So what you wrote (but apparently not meant) seemed mistaken to me, thus the correction. But if you want windows then just buy windows. Your market is well served.
> Normal computer means a choice of OS to run on it without having to hack it to do that job.
That's too high a standard. When we consider MacOS along with Windows and Linux, there are basically no computers that let you freely choose between all three without hacks.
And even just considering Windows and Linux, a big chunk of the laptop market only supports Windows properly.
A laptop that runs any normal desktop OS is a normal computer.
You're losing me. Your first reply says "A computer that meets my needs must provide a choice of OSes", your second says "A computer that meets my needs must run one specific OS". To be blunt: your reasoning here is simply bunk and I don't understand it.
If you must use windows, then you must use windows and you don't have a choice. None of that has anything to do with the nonsense about Chromebooks not being "real computers" or whatever, that's just the rationalization you've decided on. Obviously they are real computers.
That works great until you inevitably need to launch some streaming service that doesn't work on Linux Chrome or whatever. The needs of "general consumer junk we all deal with" are real. I spent decades on the "I don't actually need that stuff" hamster wheel too, and... yeah, it sucks and I'm too old for that.
A Chromebook is a first class consumer device backed by a Big Threatening Tech Giant that works on all sites everywhere because no one wants to piss off Google. And it's still Linux and runs great. I'll take it.
I was too, and then AI came out, and now Codex just makes my Linux work how I want it, no needing to fiddle with .config/gconf whatever crap. I just tell it to fix my two finger scrolling on my trackpad, and it does it.
AI can't make the Mandalorian or The Last of Us play, though. This may have been fixed or worked around now, but for sure Disney+ and HBO were holdouts that refused to work on a Linux Chrome, Widevine be damned.
I mean, sure, I can torrent a copy or whatever. But there's a point at which you just don't want to deal with that nonsense. ChromeOS is Linux, in all the ways I care to measure. But it codes as "not Linux" to all the corporate overlords afraid of the nerds and hippies, and that has value too.
A local abliterated AI model with computer use could totally do the drudgery of "torrent a copy or whatever". AI deals with "that nonsense" now.
> ChromeOS is Linux, in all the ways I care to measure.
It's Linux the same way Android is technically Linux. You get this little box called Linux, and /proc isn't actually the "real" /proc because it's inside a VM. To each their own, but it's not (GNU) Linux enough for me.
Not sure why this is downvoted. This was an example from the same article.
And the answer is that the FBI wasn't involved. That was a threat the pilot made, which comes psychologically from the same place as terrorist bomb threats (and also "eat your vegetables or you'll die early" parenting). You want to control someone's behavior so you threaten maximalist retaliation.
> It can only mean that their Linux user base is growing, ie. more commercial operators are turning to Linux.
Well, more correctly that they think the commercial base has grown, and that there's revenue on the table by forcing their standard-edition-using commercial Linux users into contracts.
Maybe the thinking is that the Linux users are more sophisticated and able to self-support than windows shops, and so they're choosing not to buy support even though they could? Seems not implausible, though hard to measure even from within AMD.
Basically this seems like a "good beancounting but terrible marketing" decision out of product management. They're not being deliberately mean to their amateur users, they're just trying to squeeze out a few more dollars for their department's quarterly.
What is really interesting about Linux users is that they cost an enormous amount in support.
I think it was a dev of the reboot of Planetary Annihilation that said their Linux users / build made up a few percent of the sales but over 90 percent of all support tickets (!). Mind you that this was before Valve's Proton.
If those bugs are only present in the Linux port, then yeah, Linux users cost more to support. But if a significant amount of these bugs affect all platforms, then you could argue that a Linux user is much more valuable to them than a non-Linux user because they provide better feedback. Assuming they actually care about fixing their product.
yes, this. i don't know if it was the same game another another where the devs said that while linux users send the most bug reports they are also the most grateful about having a game that runs on linux, and all their reports genuinely helped make the game better for everyone. (wildly paraphrased from faint memory)
in other words, if you want your game tested and get good feedback for it, do release on linux. maybe even release on linux first. linux users will love you for it, and you get to release a more polished game for a wider audience on windows.
Personally, I think it's probably best to test with Proton as part of a game development cycle to reduce the overall complexity in terms of development (not that games aren't already exceedingly complex). That's just my take... especially if you want to take advantage of that extra 5% or so potential extra market share.
Part of the problem is that Linux isn't really one platform, it's 10 different ones of varying popularity (e.g. supporting Gnome on Debian with Wayland doesn't mean that KDE on Nix with X will work). And it costs somewhere in that 1-10x range to support it because of that.
Steam fixed this years ago. Many native games will default to the Steam Linux Runtime to ensure long-term compatibility and generally consolidated runtime expectations: https://github.com/ValveSoftware/steam-runtime
Compared to the dylib nightmare that Microsoft keeps shipping in Windows, native Steam/Linux is actually pretty consolidated.
When I worked at a Linux distro I worked with one device maker who told me in confidence that 90% of their revenue came from Linux-based shops and they only needed a one-person support team. They had a 20 person support team for the remaining 10% of revenue coming from Windows-based shops.
Where I work now the top 10 customers are Linux shops. They probably account for 80% of our revenue. The remaining hundreds of customers are more evenly split between Linux and Windows.
So I guess it depends very much on what industry you're in. For consumer games it might be Windows, but outside of financials and administrative realms and into the world of embedded it's a heckuva lot of Linux. Support costs tend to be lower, and you really only have to target Red Hat and Ubuntu.
Yes, and I think a free-version user might produce more support requests than a commercial user for two reasons:
1) commercial/professional users might feel more entitled to support, but typically have a better understanding of linux and more versed in fixing stuff themselves.
-- and more importantly --
2) They probably have a dedicated setup where they can run the AMD-blessed distro
It was a coup, not an "operation". We provided assistance to a domestic takeover. The only Venezuelan forces acting in opposition were the ones who didn't get the orders to stand down in time.
Potato, potato. The administration said words about stuff it did and the reasons for it, and then there's the stuff that happenend for the reasons they happened.
It was about scratching an itch, not "spreading democracy".
Considering the US history of meddling south of the border, it was pretty low key. Fucked up, but low key.
The administration 100% did not say what happened, not correctly. The position of the Trump administration is that the US invaded and conquered the country and now runs it and is extracting its resources for our profit. None of that is remotely true. It's run by the same bureaucracy with a junta at the head of it that happens to be aligned with Trump geopolitically.
My only point was that the admin did whatever they did and, at least from the outside, appears to have been an "in and out" one-shot that worked in their favor.
And the only reason I mentioned that, is because invading a sovereign nation is a significant event and it would be safe to assume that they are emboldened by the success of their prior effort and think that Cuba may be a cookie-cutter repeat of that.
tl;dr -- Venezuela was easy peasy, so how hard can Cuba be?
The legality, morality, and value of this are separate matters (but I bet you can guess where I sand on them).
I mean, the wastewater issues can be real in some environments. It's not a completely insane idea and like all things can be reasonably discussed and mitigated. It's not like these things have the ecological impact of steel foundries or fruit orchards, but they're not parks either.
I do think the tech industry would be wise to do more outreach and less sneering, though. Freakouts about AI (which ultimately is what this is) aren't "rational" but they're eminently "reasonable". This isn't like electrification or aviation or the internet or whatnot (technologies that had clear, tangible benefits that everyone could see and understand), there is real discussion happening, by real experts, about essentially all non-physical labor being replaced!
And... what do regular folks get from that? Talking to robots doesn't look like a quality of life improvement!
Basically we in the upper stands here are having a "Let Them Eat Cake" moment, and we should stop. Things are getting ugly.
I don't see it that way at all, but then I'm a housing activist, and I've seen fiercer opposition to a 4-story apartment building than to some of these data centers. People just like opposing development. It's very satisfying!
When I see a protest over a golf course opening, I'll take data center water use concerns seriously.
The data centers the industry wants are all going to get built. People are being hypnotized by concentrated minority interests in specific spots in the country. The only big picture thing about it is the left-populist sideshow it's created.
That Gizmodo article says none of the things you characterize it as saying.
Except sorta - "Peter Freed, Meta’s former director of energy strategy, who spoke to Heatmap, expects only about 10% of the projects that are currently underway to ever be completed."
Perhaps that's why he's a "former director" but that doesn't really qualify as an "insider."
I do think it's a bit ridiculous though to not consider someone a tech insider who was a director for a decade at one of the biggest tech companies in history...
> The data centers the industry wants are all going to get built.
That seems very untrue - multiple areas have already banned data centers, and senators like Bernie Sanders have proposed stopping data centers nationwide. This is just the next phase of NIMBY-ism. Alternatively, source that the "data centers the industry wants are all going to get built"?
> I've seen fiercer opposition to a 4-story apartment building than to some of these data centers.
I'm guessing you're referring to rather cherry-picked data? I've seen data center opposition making even the national news, but I don't recall any '4-story apartment buildings' opposition doing so? And senators like Bernie Sanders are proposing halting data centers nationwide - are there any similar proposals to similarly outlaw such housing construction nationwide?
> People just like opposing development.…
When I see a protest over a golf course opening, I'll take data center water use concerns seriously.
Of course multiple areas have already banned data centers. So what? The United States is absolutely enormous. Data center buildout --- especially for AI training --- has a much easier problem than housing does. Housing needs to be built near centers of economic activity, which means that every marginal unit of housing is likely to be infill and has to pass muster with relatively dense neighborhoods of people who hate development. Data centers tend to be sited in underutilized industrial tracts. There are lots of those around the country.
I feel like what's obviously happening here is that people have a rooting interest against AI, and highly-publicized pushes against "AI data centers" in specific areas are simply sparking joy for people.
Is the argument that opposition to, and proposed bans of, data centers are only occurring on sites near dense population centers, as opposed to even covering incredibly low density sites? I'd say data center opposition goes beyond housing opposition as state-wide or even national bans have been proposed.
Many people similarly have a 'rooting interest' against public housing, public transit, even new housing in general in their area, and similarly celebrate when housing, transit, etc. get stopped. <shrug>
> I do think the tech industry would be wise to do more outreach and less sneering, though. Freakouts about AI (which ultimately is what this is) aren't "rational" but they're eminently "reasonable".
A lot of the "sneering" I see from everyone who isn't an investor or an executive is a consequence of resistance to outreach. It's very difficult to discuss subjects with people when many now interpret factual explanations as propaganda and reassurance as manipulation.
By the way, plenty of people feared electricity a great deal (and it wasn't exactly implemented safely when it was new). In the 90s, many people also thought the Internet was a temporary fad, a mere novelty that would fade in some years.
Maybe the issue is the "reassurance" is identical to propaganda and manipulation. It definitely doesn't help that the companies having to "reassure" people have aligned themselves with so many others that have been pushing propaganda to manipulate others for some time now. Nor does it help that many of the same companies that need to "reassure" people are also actively doing the opposite - see the billboards bragging about not hiring humans, or CEOs bragging about how AI will replace the majority of people and leave them destitute.
There's no reason for someone to trust any "reassurance" when there are so many signals indicating they shouldn't.
Reassurance is identical to propaganda and manipulation insofar as all attempt to convey beliefs. Reassurance, here, should be apparently different in that it conveys true information. In the history of mankind, it has never been easier to discern between true and false information.
If people want to throw up their hands and start believing whatever feels right, they are permitted to do so. Though they have a duty not to as citizens of a democracy, they have the right to actively pursue policies based on falsehoods. Let's not pretend it's a reasonable or respectable reaction to seeing billboards.
If somebody does want to give up on research and working out the truth, please actually give up and say you don't know. Stop coming to the city council meetings and plastering "millions of gallons" on even the social medias where that's surprising.
How can the average citizen who knows nothing about engineering/technology determine that their electric bill [as the result of a new datacenter in town] won't go up as truthful or falsehood?
Condescending responses like these are only reinforcing the original point. People don't want data centers because they don't want AI forced on them.
> Let's not pretend it's a reasonable or respectable reaction to seeing billboards.
Being angry after seeing and hearing your livelihood threatened by rich CEOs on a daily basis is a reasonable reaction. If you aren't willing or able to muster up a modicum of empathy to see that, that's concerning, and you won't ever really be able to grasp what's going on here and why AI is so despised. You've only served to make people (including myself) despise AI even more.
Being angry is not what is under discussion here. Abandoning the pursuit of truth is. Participating, either unthinkingly or with malice, in misinformation campaigns is not acceptable even if you're really mad. Start a 'AI will steal our jobs' campaign if you're angry about that- I don't think most AI critics believe that's true, but the ones you're talking about must. I don't even need empathy to be on board with that, I think my job has 5 years to expiration at best.
Just stop lying and defending liars while slandering the honest people who notice! I don't care how rich the ceos making you angry are, I don't care how pure the hatred in your heart is for this technology, none of that makes it okay! You don't get to demand my empathy while defacing the commons, sorry.
I think the marketing about not hiring humans is mostly what it is. There are also foreign entities actively spreading propaganda. But their claims are so wildly insane they get shot down pretty quickly. So it isn't just about messaging. It is about not being hated. If they hate you, the truth doesn't really matter.
> I do think the tech industry would be wise to do more outreach and less sneering, though.
The industry is actually doing real work on water issues in response to these complaints. Big tech companies are funding projects that will allow them to replenish more water than their datacenters consume. This isn’t actually that hard of a goal for them to meet, because as we know, the amount of water we’re talking about isn’t much on a national scale. Regardless, this will mean companies making some positive change in the communities where they build datacenters.
Anyway, all of this is a distraction compared to the real problem of carbon emissions. It confuses me that environmentalists are getting sidetracked by the water use distraction here when more natural gas and coal plants are coming online.
>...the amount of water we’re talking about isn’t much on a national scale.
Water issues are always local issues. There is no national water distribution system or national aquifer.
>this will mean companies making some positive change in the communities where they build datacenters.
This will remain to be seen. So far, if it had worked out that way then there would be less vocal opposition to these data centers. Local perception seems to be that there will be nuisance to dangerous noise levels; heat islands which can cause local disruptions to weather events; closed-door agreements to build this infrastructure instead of open community involvement in the process; and other issues including concerns about excessive water usage especially in areas where there are already troubling water availability trends due to other forms of development.
>when more natural gas and coal plants are coming online.
Here in NTexas, the availability of and proximity to natural gas compression stations is key to data center siting from the ones that I have monitored. Plans seem to include construction of gas turbine generators to power the new data centers and these generators are sited on parcels very close to existing compressor stations and high-voltage power lines and small or medium local lakes.
If it's not rational it's not reasonable. The two words are more or less synonyms, unless you're using the word reasonable to mean something like "not uncommon".
AI does have clear tangible benefits everyone can see and understand! That's why ChatGPT has 800M+ actives! Those people aren't just experimenting anymore, they're getting real value. I myself ask models questions about all kinds of things many times per day, it's entirely replaced search engines for me. It's much more immediately useful than something like aviation which created a lot of noise and risk (objects falling out of the sky!) yet took many decades to become available at a price point ordinary people could afford.
That seems needlessly pedantic, even for HN. I genuinely thought the scare quotes were spelling out the distinction I was making, but for the record:
"Rational" is used in the sense of "derived from logic", or "correctly understood". "Reasonable" is used in the sense (this is very common in legal paradigms, for example) of "an understandable opinion", or "an idea likely to be held by a typical person".
> AI does have clear tangible benefits everyone can see and understand! That's why ChatGPT has 800M+ actives! Those people aren't just experimenting anymore, they're getting real value. I myself ask models questions about all kinds of things many times per day, it's entirely replaced search engines for me. It's much more immediately useful than something like aviation which created a lot of noise and risk (objects falling out of the sky!) yet took many decades to become available at a price point ordinary people could afford.
And you wonder why people are not taking you seriously?
That's misunderstanding the paper. The correlation here is with outcomes, not support. Republicans may very well be more "jaded" with the healthcare system. But that doesn't explain why they die early.
That's... not really a reasonable characterization of LA's urban growth patterns. To begin with, Hollywood quite clearly predates the aerospace buildout in the 40's and 50's. It was an oil production and refining hub before that, and an agricultural shipping center even before the dust bowl.
This particular neighborhood in Orange County certainly looks aerospacey, but I bet the Disney-centered service workers in Anaheim made up just as much of the population as the industrial folks.
Big cities are big for a bunch of reasons, basically. There are no simple answers at this scale.
The bug here isn't that we need to better authenticate already-trusted upstreams for packages, it's that the upstreams cannot be trusted as the sole source for security at all. Upstreams are a bunch of hackers[1] who aren't really interested in, nor will ever be good at, solid release engineering practices.
But some people are! The solution in the Linux world (and the one that saved us from xz-utils) is that there is a second level of human beings responsible for reviewing, auditing, packaging, and customizing those hacker-generated upstreams for the benefit of their users. These people have different eyes, different consumer requirements and different quality metrics. And they catch bugs and malfesance that the upstreams aren't prepared to do.
NPM (and cargo/PyPI et. al.) continues to think it can short circuit this requirement for human labor. It can't.
[1] In NPM's particular ecosystem, a bunch of web jockeys used to extremely fast release processes, loose compatibility requirements, and extreme reliance on reuse. This really explains why we see this with node packages more than Python or Rust: older and more conservative programmers just don't have as many rakes to step on.
reply