cecilkorik

@cecilkorik@piefed.ca

• ⁨Comment⁩ on ⁨Update all your stuff, NOW - again.⁩ ⁨⁨5⁩ ⁨days⁩ ago⁩:

  I think there is some confusion and potential for misinformation here. SSH in key-only mode (common configuration) protects you from this problem, because it never accepts or even attempts any passwords at all, regardless of length. SSH in password-allowed mode with at least one user who might be a key-only USER by merit of having a password hash of “*” (not a valid password hash) is a prerequisite for this. That is a very different and very common thing, as most systems come with at least one key-only user by default. But gaining access to that user with an incorrect, invalid password still requires having passwords enabled at all.

  To be clear: Password access enabled is a prerequisite, and by extension, password access disabled (key-only) prevents this.

  The website you linked clearly defines that all of these conditions must be true for you to be vulnerable, and as far as I can tell, it is exactly correct:

  is your sshd running on musl? (alpine, openwrt, buildroot, yocto)
  is it not using pam? alpine’s openssh-server doesn’t by default, or maybe you set UsePAM no
  are password logins still on? they are by default
  is there an account with just * as its password? key-only users, ldap users, root on alpine
  and some other account with a real password?

  then that * account takes any password between 257 and 1024 characters

  The * account which they suggest potentially being “key only” is the prerequisite you are talking about, but having SSH itself key-only (which is best practice anyway) prevents the attack entirely.

• ⁨Comment⁩ on ⁨British fintech Revolut slashes "AI" coding costs 10x by cutting out Claude and going self-hosted⁩ ⁨⁨6⁩ ⁨days⁩ ago⁩:

  Open weight models cannot do this, they do not have any funding. If you demand this, you are just demanding that there will never be any open models, that proprietary AI models controlled by massive trillion dollar corporations will be the only models available, and frankly the cure is worse than the disease.

  It’s also impractical, like closing the gate after the horses have already gone. Open-weight, unethically trained models are already out there. They are not going away. You cannot put the genie back in the bottle. They will never earn any money, so they will never be able to compensate for the training that was done to create them, unless you consider the fact that they exist, and they are open to anybody, as at least some measure of compensation.

  It’s not enough compensation, but it is something. The training was certainly unethical, but so is an economic system that requires intellectual property to be transactional. Why fix one unethical thing while keeping and reinforcing another?

  The only sensible and reasonable way to resolve the issue in the long term is for significant government support and patronage of the arts and content creators (and ideally all people) to be established. People who do this for a living are providing valuable service to all of humanity and that deserves to be recognized not by transactional, metered capitalism that defines each piece of art or content in terms of its raw economic value (a system easily and frequently corrupted anyway if you look at the prevalence of theft, forgery, fraud and money-laundering in the high art world), but by guaranteeing a comfortable and dignified life that allows creative people to freely create the art or other works they love and feel passionate about without worrying that they’re going to starve to death or be forced into a dead-end job if they’re not economically successful.

• ⁨Comment⁩ on ⁨⁩ ⁨⁨3⁩ ⁨weeks⁩ ago⁩:

  I build a Linux system with multiple NICs. It’s heavyweight for a router, and probably not very efficient, but it does the job very well and I love it. I’m using foomuuri to manage the NFTables and NAT and it was very easy (although it’s a very obscure piece of software and the documentation and community isn’t excessively comprehensive, you might have better luck with something more common but it works nicely for me). It can pull in all the adblocking lists and all that fun stuff. I find it pretty intuitive to configure, at least compared to the horrors of most networking/routing configuration nonsense.

  For DHCP I tried using the ISC’s new “kea” in the hopes it would be modern and clean alternative to the venerable old isc-dhcp-server but it turned out to be a horrible mistake. They made some awful, insane, unjustifiable design decisions in that software. It gets confused about IP addresses already being claimed (by the exact same host/MAC) address because some arbitrary value changed in how it identifies itself, and then does absurd things with static leases, it just randomly decides to give it a dynamic lease instead, and then will fixate on that dynamic lease and never let it have the static lease back, I fought with it for months, it kept breaking my network for absolutely no reason and it was a nightmare.

  Back to trusty old isc-dhcp-server for me. And of course bind for DNS, I’m a bit old-school but it’s very comfortable.

  dnsmasq might be a lighter-weight and easier alternative you could consider, I think it does DHCP as well, convenient.

  And of course, being a full Linux server means you can put all kinds of other stuff on it too. Stuff that needs to be both publicly visible and privately visible on the LAN seems like an obvious fit, but in fact it’s probably the worst place to put those services, because you run into issues with NAT hairpinning and other nonsense. For services that are strictly intended for the private LAN/VPN, or services that are strictly public facing, it can handle those just fine by restricting them to a specific interface. But you should avoid stuff that needs to listen on both sides of the connection, it can be done, but it’s tricky and annoying and not ideal.

  If you need both internal and external access, port-forwarding from the outside through the NAT to another dedicated internal host is a much better solution if possible, it’s still a bit tricky (you may have to override the DNS for that domain internally to use the private IP instead of the public one) but it’s quite reliable and functional once you have it set up.

  None of this is really for the faint of heart, it’ll likely require a fair bit of trial and error and physical access to the machine to resolve issues. But it’s a fun project and I think the end result is worth it.

• ⁨Comment⁩ on ⁨Meta used AI to tag workers who took leave to be laid off, lawsuit claims⁩ ⁨⁨3⁩ ⁨months⁩ ago⁩:

  Hiring people who know how to do that is expensive. Hiring incompetent executives who know how to ask an AI is more expensive (but it benefits said executives, so they prefer this option).

• ⁨Comment⁩ on ⁨[deleted]⁩ ⁨⁨3⁩ ⁨months⁩ ago⁩:

  No, they can’t. And the “biggest name” in PC gaming doesn’t mean they’re the biggest actual company in PC gaming, much less the biggest company in computing as a whole. They’re not even in the same league as datacenter operators and builders anymore. Nobody is. Maybe they should be. I think they deserve to be. But they aren’t. I too, wish the entire economy still made sense. But it’s not Valve’s fault that it doesn’t. They are not the ones causing this to be a reality, but it is still the reality whether it makes sense or not and whether we agree with it or not.

• ⁨Comment⁩ on ⁨[deleted]⁩ ⁨⁨3⁩ ⁨months⁩ ago⁩:

  It’s very likely a prerequisite, unfortunately.

• ⁨Comment⁩ on ⁨[deleted]⁩ ⁨⁨3⁩ ⁨months⁩ ago⁩:

  Yes, we need the Torment Nexus as quickly as possible. Imagine how horrible it would be if we were not the first ones to have a Torment Nexus!

• ⁨Comment⁩ on ⁨From the factorio school of business.⁩ ⁨⁨5⁩ ⁨months⁩ ago⁩:

  That’s totally fair, and that’s why bots like these exist I guess. For what it’s worth, I wouldn’t have seen this if the bot hadn’t reposted it, so, everything is working as intended, great success!

• ⁨Comment⁩ on ⁨From the factorio school of business.⁩ ⁨⁨5⁩ ⁨months⁩ ago⁩:

  the tl;dr (or perhaps: too ideological; don’t care) is yes they are reposting bots, doing what they do because they feel like lemmy.ml is a shit community run by bad people (they’re maybe not completely wrong) and their purpose is to copy all useful content off lemmy.ml communities into other communities because they would like to see a world where everyone can defederate lemmy.ml and nothing of value is lost.

  And you posted to Gaming@lemmy.ml so they reposted your comment here.

• ⁨Comment⁩ on ⁨Oops - someone nearly caused a fire with the Steam Controller Puck⁩ ⁨⁨5⁩ ⁨months⁩ ago⁩:

  This is a very solved problem I have no idea why the Steam controller would have an issue with it other than laziness or oversight. Don’t supply voltage and current on exposed pins until you’ve validated that thing you’re expecting to deliver voltage and current to is actually there and correctly connected. This is the whole reason the third pin usually even exists, for data/sense purposes. Add a fourth pin if you have to. It’s not rocket science.

• ⁨Comment⁩ on ⁨Lasagna dreams, spaghetti reality⁩ ⁨⁨5⁩ ⁨months⁩ ago⁩:

  It would be interesting to compare what games on Steam have the highest mean, median and p90 playtime.

• ⁨Comment⁩ on ⁨It's not you, would-be Subnautica 2 fish murderers, it's our creature encounters not feeling "fair, readable, and engaging" enough, say Unknown Worlds⁩ ⁨⁨5⁩ ⁨months⁩ ago⁩:

  There’s plenty of reasonable middle ground between “constantly evading relentlessly aggressive predators that ignore most attempts at distraction and cannot be damaged, discouraged, dodged or escaped or in a reasonable timeframe or with any measure of permanence” and “I want to kill every one of them until I become master of all the ocean” they just need to find it.

  As a player I don’t want wholesale murder either. I won’t necessarily mind if that’s an option, but I don’t think that should be the focus. I just want more tools to deal with the situations that evolve, I don’t want hammerheads camping my base and attacking my docked tadpoles with impunity, because once they fixate on it, they will never leave and there is no way to make them go away. I don’t think having to move my base whenever one gets attracted is a reasonable ask. Perhaps it’s even realistic and fits the game lore, but it’s not fun. And fun needs to be the point. We need something to discourage and defend ourselves somehow, it doesn’t have to be lethal or even harmful, it could even be friendly. Maybe the hammerheads love to eat a particular plant and if we grow it somewhere other than our base for long enough, they’ll be attracted to wander over there and go eat it and maybe if they eat enough of it even fall asleep for awhile. There are so many possible options and I hope the devs actually understand that there is plenty of middle-ground to explore that are both non-violent and player-friendly. It doesn’t have to be a chore of burning consumables and hypervigilance from risk of death to keep it engaging. People watch fish tanks for a reason. We want to see behaviors that make sense and be able to have some limited, mild influence on those behaviors both over the short and long terms, without necessarily having absolute control.

• ⁨Comment⁩ on ⁨"Unofficial builds of Subnautica 2 are currently circulating online," Unknown Worlds confirm, just days before the ocean survival game's early access release⁩ ⁨⁨5⁩ ⁨months⁩ ago⁩:

  To be clear it’s not “release release” it’s early access release. If you want the actual release with the full story and everything implemented you’ll be waiting a lot more than a few days.

  That said people are still going to go nuts on the early access, I’m sure.

• ⁨Comment⁩ on ⁨Palantir posted a manifesto that reads like the ramblings of a comic book villain⁩ ⁨⁨6⁩ ⁨months⁩ ago⁩:

  Pursuing feudalism in a country that famously loathes kings is a bold move, let’s see if it works out for them. It might seem like it’s working out for them at the moment. I’m not sure how long that’s actually going to last though. I think they are standing on top of a volcano of public anger and they don’t seem concerned about how the ground keeps rumbling because they are wearing lava-proof suits. I think when they actually get submerged in lava they are going to find they have many other weaknesses and vulnerable spots they didn’t realize and in fact “the goggles do nothing!”

• ⁨Comment⁩ on ⁨"War is our reality": 4A reveal Metro 2039, a horror FPS inspired by Russia's invasion of Ukraine⁩ ⁨⁨6⁩ ⁨months⁩ ago⁩:

  Could’ve called it Metro 2026 to be honest but I guess that would be a bit too on-the-nose.

• ⁨Comment⁩ on ⁨GOG "won't be making absolute statements in either direction" about their future approach to AI use⁩ ⁨⁨8⁩ ⁨months⁩ ago⁩:

  I hate these filthy Neutrals, Kif. With enemies you know where they stand but with Neutrals, who knows? It sickens me.

• ⁨Comment⁩ on ⁨AMD say the Steam Machine is "on track" for an early 2026 release⁩ ⁨⁨8⁩ ⁨months⁩ ago⁩:

  It is definitely incredibly common, yes. Like I said, the laws are generally not effectively enforced, and they’re also intentionally limited. For some reason, we have decided it is totally acceptable to do that when you don’t have a recognized monopoly position, which Sony doesn’t in that market. It’s very particular, it’s very specific, and it’s very subjective, which is probably a huge part of why they aren’t effectively enforced. Also, companies know all the ways to get around the ways the laws are written if they really want to.

  We still don’t really follow them even when the laws probably do apply though, it’s just vestigial at this point. We’re supposed to believe the antitrust laws were only meant for those old, bad monopolies like Standard Oil and Ma Bell. We don’t really have monopolies like that anymore, all our monopolies are the good kind of monopolies that don’t harm society, or they’re not monopolies at all, they’re coordinating oligopolies that constantly partner with and all own chunks of each other, which means they’re also perfectly fine and not any kind of bad monopoly at all.

  I didn’t write the laws, there are lots of things about them that I think could be vastly improved. But I do agree with their intent, and we shouldn’t forget what their intent is, just because our current financial and political environment is not interested in them.

• ⁨Comment⁩ on ⁨AMD say the Steam Machine is "on track" for an early 2026 release⁩ ⁨⁨8⁩ ⁨months⁩ ago⁩:

  I am not a lawyer, but as far as I know that’s actually incorrect, selling a product below cost is considered predatory dumping, as it means literally nobody can afford to compete with you on anything resembling a level playing field. How is any competitor supposed to release a competing product when Gabe is using his own financial resources for “eating the price spikes”. Unless you have your own financial resources or massive speculative investment, you cannot also “eat the price spikes” so your own products will have to be priced at realistic levels so that it is something that actually earns you some level of profit in order for your business to continue and grow, and thus those products will be far more expensive than Valve’s subsidized product, and thus, you probably won’t sell any unless you have some significant further advantage, which you shouldn’t need to have in order to simply compete with the market leader. That’s a clear barrier to entry, and is the definition of anti-competitive.

  Usually, this would be done to lock the subsidized buyers into a particular ecosystem, or even just to bundle that ecosystem by default (aka illegal bundling, like Microsoft did for years) from which additional profit can later be expected. In Valve’s case, this would be Steam, and it pretty clearly would profit them in the long run, and this strategy also keeping all competitors out by dumping hardware below cost, thus abusing their Steam distribution monopoly to fund a second monopoly on the Steam Machines market to maintain their first monopoly. That’s literally what antitrust laws were designed for. Just because we don’t really effectively enforce them anymore I feel like people have started losing sight of what they mean and what they are supposed to be for and I don’t think we should just normalize that this is how businesses are supposed to operate.

  And that’s why Valve probably won’t do that. (at least I suspect they won’t, based on my view of their history, I have no insider knowledge)

• ⁨Comment⁩ on ⁨Steam Machine price leak suggests it will cost as much as an iPhone⁩ ⁨⁨9⁩ ⁨months⁩ ago⁩:

  Whether it’s true or not, I’ve heard a lot of people complaining about the possibility of a price point like this and it really blows my mind how twisted people’s expectations are about these price points. Like people line up overnight for a chance to buy iPhones, the same as the one already in their pocket but with a new function in the camera app or something, and then you get something that is almost an entirely new class of product and far more capable for the same price at a time when we’re facing unprecedented shortages, and people are pissed off about it? Double standards much?

  I wish it was $200 too, but like, we don’t live in that world anymore. I’m sorry, but that world died from Covid and any medicine that could’ve cured it was lost in trade wars and its corpse was blown up in real wars. It’s not coming back.

• ⁨Comment⁩ on ⁨Why won’t Steam Machine support HDMI 2.1? Digging in on the display standard drama.⁩ ⁨⁨11⁩ ⁨months⁩ ago⁩:

  Yes. DP is the right choice for civilized people.

• ⁨Comment⁩ on ⁨"GullyCricketApp" based on a reduced cricket game + 2 Business Ideas+ 1 Network Diagnostic's Tool by SATYABRATA SARKAR⁩ ⁨⁨11⁩ ⁨months⁩ ago⁩:

  Ahahahaha it is $150, on sale. I think only Elon Musk would understand and enjoy this game. It is too much for me. True geniuses only.

• ⁨Comment⁩ on ⁨The Illuminator Advert - Game Boy Accessory⁩ ⁨⁨1⁩ ⁨year⁩ ago⁩:

  I had one of these. It was truly terrible, extremely limited, clunky, dim, with awful battery life, but sort of better than nothing. Barely. The days before white LED backlights were a really painful time for portable electronics.