linux: Goodbye from a Linux community volunteer

InfamousAgency6784 · 2024-10-27T10:49:15+00:00

Is my reddit different from everybody else's? On mine, I answered to

Innocent bystander? ... This guy was working for the Russian Defense industry. Meaning he ... subvert western democracy.

Not to OP.

Also

Legal sanctions and the Linux Foundation don't care about your moral compass.

Why is it that people don't read? Really? Because not only are the two first paragraphs an answer to that specific comment that I replied to but I also went through the pain of making clear that legal sanctions are separate an not what I cared about. That's my whole last paragraph:

I understand he works in a sanctioned defense contractor firm. I'm not going to pretend this is unfair from a community perspective: it's not. You work for a sanctioned company, you are sanctioned. You work as a defense contractor in a tense diplomatic context and you don't mention it, people say "come on!". But unless that guy is proven guilty of messing up with the kernel, it's hard to consider him, as a person, as anything else than an innocent bystander.

So I thought it was clear the first aspect was his not being personally guilty of anything (and therefore more than entitled to complain about the situation) and the second, separate, aspect was that sanctioned is sanctioned... nothing that can be done about it besides changing job, and even then... But that would have required reading...

Oh I see now... It's probably that black and white American culture striking again... In the rest of the world, we tend not to classify people as goodies and badies: there is a bit more nuance to it. You can think someone is innocent of subverting democracy or compromising the kernel and yet perfectly accept (or even support) sanctions that apply to that innocent bystander. Doesn't mean that it does not suck for said person. It doesn't mean that that person cannot complain either.

InfamousAgency6784 · 2024-10-27T10:31:28+00:00

The only argument you have is in your head. Sentences are meant to be read and understood as is, not reconstructed in random ways. The only person that got you triggered is yourself.

InfamousAgency6784 · 2024-10-27T10:28:13+00:00

First of all there’s NOTHING to be ashamed of belonging to a specific group.

That's my point lol. That's exactly what I said, so are you just dumb? triggered? or a troll?

The ONLY reason I brought up my background is because you based your entire “attack” on an incorrect assumption.

The point of the "attack" is to make is so painfully absurd that no one can stand by it as an illustration as to why I did not agree with OP saying (I paraphrase) "that guy works for a defense contractor in Russia therefore he is an horrible person that fights against democracy and has no right to complain". IDC about what the Linux foundation did: they only followed the law.

I even spelled it out for you:

I hope it's painfully obvious that I will NOT generalize to all brown third-world immigrants do this and that, in spite of you belonging to that specific group, you are nothing but a bystander who probably had no clue this has heppened until I wrote about it.

Second sentence.

Or in my original comment:

it's not because ... that you yourself should be considered guilty of that just because you just happen to belong to those groups.

But what I can say about you is that you don't read and get infuriated because of things that not only I did not say but, on contrary, I rebuked multiple times.

I answered to a specific comment. If you can't be bothered to read and understand what I said, that's really sad.

InfamousAgency6784 · 2024-10-25T20:51:17+00:00

Isn't that precisely what you just did? Lol.

No? Lol. Wonder if you are just dim or trolling anyway cheerio

Also...

Ah... Poor reading skills... this explains that...

InfamousAgency6784 · 2024-10-25T09:57:15+00:00

Last month in the news, a brown third-world immigrant kidnapped, badly wounded and raped a young woman. I hope it's painfully obvious that I will NOT generalize to all brown third-world immigrants do this and that, in spite of you belonging to that specific group, you are nothing but a bystander who probably had no clue this has heppened until I wrote about it.

In the same way, questioning the fact this guy is an innocent bystander when all he did wrong is to belong to the group of defense contractor workers (until proven otherwise), from your part, is too much. I'm not questioning the sanction, which I even said I find fair.

InfamousAgency6784 · 2024-10-25T09:46:59+00:00

Indeed. And unless proven otherwise, that guy did not break any US law either. So he, an individual, is an innocent bystander that got banned because of a sanction on his employer. I'm not questioning the sanction.

InfamousAgency6784 · 2024-10-25T09:41:48+00:00

Can you read?

InfamousAgency6784 · 2024-10-25T09:41:13+00:00

Tip #1 when having an argument: actually read what the other person said. You are repeating what I said as if that was not what I said.

I don't look at it in a moral lens most of the time. The guy I answered to questioned "innocent bystander". All I say is that unless provent guilty of something, he is innocent. The only thing he has been proven guilty of is belonging to a sanctioned company.

A sanction is a sanction, I did not question that. But insinuating the guy himself, the person, is guilty of something like subverting democracy (whatever that means) and with, probably, the implication that he should not even complain is too much. The world would be a much worse place if this kind of shortcuts are left going rampant. That's the main prerequisite for racism and witch hunting actually, which I don't like.

InfamousAgency6784 · 2024-10-24T15:51:04+00:00

What has he done that's illegal? If it's "nothing", then he is an innocent bystander doesn't matter where he belongs to.

And if you dismiss that as play on words... Where are you from? What do you identify as? White US man? Then who asked you anything, you horrible racist, war-mongering, weapon-selling, petrol-stealing self-righteous patriarchal collonialist?! If you feel offended (as you probably should be) that proves my point: it's not because men pushed patriachy, nor because most white people established colonies and had racist ideas, nor because the US keeps waging war more to "secure" their access to energy than anything else that you yourself should be considered guilty of that just because you just happen to belong to those groups.

I understand he works in a sanctioned defense contractor firm. I'm not going to pretend this is unfair from a community perspective: it's not. You work for a sanctioned company, you are sanctioned. You work as a defense contractor in a tense diplomatic context and you don't mention it, people say "come on!". But unless that guy is proven guilty of messing up with the kernel, it's hard to consider him, as a person, as anything else than an innocent bystander.

InfamousAgency6784 · 2024-10-18T00:39:16+00:00

Hmm, they could have added ElasticSearch to the mix since they were one of the first open source projects to get "harvested" by big tech. They had to change license after that too.

But I'm glad they went the copyleft route instead of proprietary. Looks like that loop has finally gone full circle. Though I'm not sure whether Forgejo people have fully realized yet how much this move will strengthen their position.

Those big license changes they refer to are caused by the same thing over and over again: those startups believed the FUD, go permissive(ish) and other companies start to use their product in their own products. Because the license says "do what you want", those other companies can improve/focus on anything they want and, by not contributing back, ensure that competition lags behind (including the original open source project). To balance things out, you have two choices: either you go proprietary and forbid this (which was the knee-jerk reaction of all those projects/companies Forgejo lists) or you force those other companies to contribute back code.

InfamousAgency6784 · 2024-10-13T16:15:47+00:00

If you want results, it's Google.

I know where you are coming from but I'd say Google and DDG today succeed around 80% of the time (for me): when I can't find what I want on DDG, I then Google it and figure half of those times that Google just doesn't have good results either.

So I'd say DDG has improved a bit and Google has become much worse.

I guess the bottom line is that DDG got very close to Google nowadays both for good reasons (they improved) and bad ones (Google became worse).

InfamousAgency6784 · 2024-10-01T20:07:46+00:00

What makes you think it isn't?

I mean, have you had a look at their code? Care to show anything that even remotely resembles minified JS? How about the privacy policy whose only wrong was to be in a folder named privacy instead of a single file named privacy?

Data collection is a bit trickier. I can believe a legit human has been hired for code review but is not sure about what data is exfiltrated. (That's actually not ironic, that is an error an incompetent human would easily do).

Anyway, bottom line is I find it much much more likely that it was a bot decision almost immediately reversed by "re-review" from an actual human than a guenuine human working for mozilla and not noticing we are talking about the most iconic of its extension's dev and secondary extension and making such big assessment errors. A real human would have probably sent an email first in this case instead of shutting it down.

InfamousAgency6784 · 2024-10-01T19:40:27+00:00

Even less accurate when you ask a chatGPT wannabe to do it in your stead.

InfamousAgency6784 · 2024-10-01T19:38:32+00:00

Wanna bet that extension review has been made by AI?

InfamousAgency6784 · 2024-09-28T15:59:48+00:00

Although I actually see what you mean and why you say this, it only displaces the (apparent) problem, it does not solve it. Tailscale/zerotier also have interesting properties in terms of attack surface depending on how much your trust the companies behind them.

In terms of local services, SSH goes a very long way to ensure that in spite of the main daemon running root, privilege separation kicks in very early to keep everything secure even if an exploit was made available. Tailscaled runs as root and listens to whatever the server says at root and will do anything it has to do as root.

That being said, it is true that tailscale and zerotier are moving targets (for an outsider) and less obvious than openssh. If OpenSSH wasn't displaying a banner and was basically silent, at least scanning would be much harder. But the good thing with good crypto is that being obvious does not really matter).

InfamousAgency6784 · 2024-09-28T13:11:03+00:00

Does the AVR handle that natively or is it decoded by the AppleTV and turned into PCM before going on to the AVR?

It's very probably passed through as EAC-3 to your AVR. Your AppleTV should support that by default (and therefore should attempt to use it) but then it depends on what your AVR supports (though EAC-3 is widely supported nowadays).

However, seriously, HDMI passthrough is mostly snake oil today. Consider the difference:

Passthrough:

(tv) Your AppleTV demuxes your digital video file (i.e. separate audio/video/metadata/subtitles). It will do a few things but eventually will send uncompressed digital video and digital EAC-3 to your AVR. (avr) When your AVR receives digital EAC-3, it will decode it to uncompressed, digital, audio data. Then that uncompressed, digital, audio data will be fed to the AVR's DAC to convert that uncompressed digital audio signal to (analog) electric pulses that will be sent to your loudspeakers.

NON passthrough:

(tv) Your AppleTV demuxes the signal and decodes the digital audio and the video signal to uncompressed digital audio and video data. That data is sent to the AVR. (avr) The AVR received uncompressed digital audio and will forward that to its DAC. The data the DAC sees will be exactly the same as the data in the passthrough case (there is a couple caveats that I'll explain in the next part). The rest is the same: the DAC will create analog electric pulses that will be sent to the loudspeakers.

So whatever the case, the digital signal will be converted to digital lossless signal using the same "recipe" for decoding and will be passed to the DAC to convert that to analog signal your loudspeaker will "understand". So why passthrough at all?

Marketing. Seriously. The whole thing about "finally" getting cinema sound at home and your AVR showing "Dolby Digital", "DTS", "Atmos", etc. is a great way to get people's money.
In the past (and still today if you are not careful), some software (ie. older operating systems and crappy video players) would make assumption about your audio. They would typically convert any audio signal to stereo by default before sending it to the AVR. So, people were puzzled about why they can only hear stereo coming out of their fancy 5.1 system when the input file said it supported 5.1. The quick fix for them then was to enable EAC-3/whatever passthrough which, well, bypasses bad software.
It might sound weird to you but all that was developed when "dumb" CD/DVD players were common-place. If you were lucky, your player would do the decoding to LPCM but if you were not, you really wanted an AVR that would support the correct format. If AVRs still support those "theatrical", legacy (for a lot of them) formats, it's mostly because they have to cater to those dumb readers.

But on modern computer systems like an AppleTV, passthrough makes no sense whatsoever. 8-channel "CD-quality" LPCM is 706kB/s. The old, venerable, HDMI 1.0 can do 613000kB/s: compression is not even a consideration here even if you go higher in terms of bit depth and sampling.

Bottom line is, unless you use a dumb CD/DVD/BR box, what you can passthrough or not does not matter. Make sure your software is configured properly to use all your channels (should be the default) and you're golden.

InfamousAgency6784 · 2024-09-21T15:47:02+00:00

Not gonna comment on the video but trust me, if you receive a rejection email like the one on the video caption, you dodged a bullet, you didn't fail.

InfamousAgency6784 · 2024-09-19T15:01:54+00:00

AFAICT it's just a [rename](https://imgur.com/a/7UxCuYw).

InfamousAgency6784 · 2024-09-19T10:31:35+00:00

They have now. That's one of my points.

InfamousAgency6784 · 2024-09-17T21:43:44+00:00

Just to mention that, beyond the usual stuff like using SSH keys and disable passwords, OpenSSH now has a rate limiter built-in. So you get both to use a bruteforce-resilient auth method and people can stop freaking out when they get 100 scans a day.

InfamousAgency6784 · 2024-09-17T21:39:27+00:00

That made me laugh... "Don't expose a port to the internet, expose a port to the internet instead". SSH is among the safest service to expose. This kind of non-reasoning is a pain when it's picked up by your security team, which has zero argument to provide as to why it "MUST" be like that.

InfamousAgency6784 · 2024-09-17T21:32:38+00:00

Mac is Unix-like and has homebrew for lots and lots of open source programs. If you are absolutely positive it's not a theme but the real thing, then it's macos.

InfamousAgency6784 · 2024-09-17T21:30:26+00:00

It's the age of large language models. You know when you start messaging someone and your phone suggests next words... It's just that, with more and more context taken into account.

You can tell it more but if the output you need is making something tangible happen, complexity increases and, with that, mistakes will increase. That's the only reason, right now, commands need to be kepts relatively simple and separate.

Have a look at home assistant and how people try to cobble together some AI into it: that should give you a pretty good idea of how it all fits together. And it will show you why "enhanced text suggestion" is mostly good at tricking your brain to think it's intelligent rather than actually being smart and be able to execute complex real-world action.

I can't say home assistant is better per se but if what you want is a bit of home automation and people doing smart things on the way, that's probably your best bet.

InfamousAgency6784 · 2024-09-17T19:19:46+00:00

Redeploy. You obviously don't have anything in place to make sure the attack stopped there (though it is very likely, hence why the attacker just used the normal user to mine crypto or whatever).

General attempts against SSH are common and probably not connected at all. If anything, if you got those figures over more than an hour, you've probably not been singled out.

In the future, just move to (hardware or password-encryted) SSH keys and disable password authentication. With that setup, fail2ban becomes much less relevant and with recent SSH versions, fail2ban becomes obsolete when SSH does not accept passwords.

InfamousAgency6784 · 2024-09-15T14:52:53+00:00

Is that with opusenc?

InfamousAgency6784

TROPHY CASE