• 0 Posts
  • 12 Comments
Joined 2 years ago
cake
Cake day: June 10th, 2024

help-circle

  • PC allows you to (mostly) own your games once you buy them, at least the offline functionality. Sure it’s legally still just a “license to play the game” but technically you can back up your Steam library, move it to a new PC, whatever. Steam can’t really “take the game back” from you (again, at least the offline functionality).

    Meanwhile on console if Sony decides to remove some game from their store, well, that’s it. IIRC it will even become unplayable on your console if you have it downloaded.

    Same difference as buying & downloading MP3/FLAC files vs subscribing to a streaming service.







  • balsoft@lemmy.mltoLinux@lemmy.mlIs multi user nix safe?
    link
    fedilink
    arrow-up
    1
    ·
    edit-2
    5 days ago

    Assuming you’re talking about Nix the package manager,

    Nothing is actually “installed as root”, except for stuff that the root user installs themselves. The Nix Store (where all the “derivations”/packages are stored) can be thought of more as a cache, just because a package is there doesn’t mean it’s used anywhere. Users don’t get to choose the cache “key” (i.e. the directory name in /nix/store) either - it is determined by all the build instructions and dependencies needed to build the package, and Nix doesn’t (well, at the very least shouldn’t) give users any control about the package build process after it starts.

    When users install something, Nix fetches or builds that package into /nix/store - which doesn’t affect other users in any way - and then just symlinks that particular package into some user-owned directory in their $PATH (e.g. $HOME/.local/share/nix/profiles/default or so), which also doesn’t affect root or other users in any way.

    So, basically, if some user installs malware only they are affected - the fact that it’s also in the shared /nix/store is irrelevant since there’s nothing in other user’s profiles or $PATH or whatever that references it in any way.

    The most likely vulnerability is something like this:

    1. The attacker guesses the nix store path of some package that root will use in the future (e.g. glibc from a more up-to-date Nixpkgs version compared to what root currently uses) - note that users can’t replace a derivation that’s already in the store, so they need to guess a future derivation path
    2. The attacker forces Nix to build that package from source instead of fetching from a trusted substituter
    3. The attacker finds a way to breach Nix’s sandbox during the build and inject their own backdoor into the resulting package ← this is the difficult part, there are currently no such known sandbox holes
    4. The attacker then waits until root starts using that package in the store, at which point the backdoor becomes actively ran as root.

    I must add that this is theoretical and I don’t think has ever happened in practice on a multi-user system.

    Sorry, I’m pretty bad at explaining stuff, hopefully it makes some sense :)




  • But also the problem is that they cheat.

    Using AI is easy, as you note. You don’t need to go to college to learn to do that.

    College can give you many useful skills, mostly related to gathering and processing information, and applying it to solve various issues. If you just copy-paste every question into AI and then copy-paste the answer back, you will learn absolutely nothing.

    LLMs hallucinate and there’s nothing we can do to stop them. No amount of QA will fix that fundamental issue of “the LLM is somewhat likely to confidently produce incorrect information”, if you need the answer to be correct you have to do the research yourself, maybe based on the sources the LLM provided, not just sanity-check the output. This is a very useful skill to have for many jobs involving thinking or finding stuff out.

    And even if we fix the hallucinations at some point by switching to a different tech (LOL), I do think it’s useful for people to keep some mental skills. Otherwise we will end up with a stupidity and/or dementia epidemics, similar to cars causing an obesity epidemic.


  • After some finaggling I managed to compile it (here’s the nix file I used to get the dependencies). It’s looking basic but actually promising! Here are some screenshots (sorry for potato quality, it’s the only one Lemmy allows me to upload at for some reason):

    The search seems quite nice, it seems to search by names but also allows to search for (some?) OSM tags, e.g. amenity:drinking_water shows up water fountains around you. I’m actually annoyed that other apps don’t allow you to do so this easily.

    The navigation also seems to work-ish, which is surprising for such a young app. The only remaining things before it’s really useful is downloadable maps and offline routing.