• 1 Post
  • 16 Comments
Joined 2 years ago
cake
Cake day: February 10th, 2025

help-circle






  • If only there were some community of people who valued using free and open source software so we had options that were not dependent on the whims of companies. Then we could have software that we could depend on that isn’t dependent on the whims of corporations.

    Throwing out AI because there are AI companies who causing harm is like giving up on Operating Systems because of the plethora of bad acts made by Microsoft.

    I agree that everyone should avoid using OpenAI, Anthropic or any of the other companies which were created to spend trillions of dollars buying up all computer hardware on the planet while building fossil fueled datacenters.

    That isn’t the same as thinking that the actual machine learning technology itself is somehow inherently bad. There are many open weight models and FOSS projects that lets people use AI without contributing to the capitalist orgy that’s causing all of the secondary harms.

    People conflating AI technology and AI companies are failing to diagnose the issue that we’re facing.



  • I’m going to say there’s not a chance in hell that this gets forked. Much like the systemd age verification topic, the outrage is primarily from the chronically online and the bots who influence them. This isn’t a population of people who have the actual technical capabilities to do anything productive, that’s why they have such a large online presence.

    The outrage on social media is massively amplified by bots which is why these ‘movements’ never get passed the ‘spamming social media with outrage porn’ phase. It’s easy to fabricate and spin up 1000 social media bot accounts to post anti-AI content (ironically using LLMs to do so).

    It isn’t easy to fabricate and spin up 100 competent developers who are so rabidly anti-AI that they will attempt to start a major new project

    Don’t confuse comments and upvotes with reality. Social media metrics are easy to manipulate.


  • The one you want.

    Ignore the ignorant purity test of the outrage junkies. Half of the ‘people’ stirring shit on this topic are probably LLMs themselves.

    AI is a technology.

    The rampant investment into that technology by capital and the market manipulations and fraud are the dangerous thing to societal stability. It’s the trillions of dollars poured into the technology in an attempt to buy a monopoly which is generating all of the secondary effects that people are complaining about.

    People are, I’d argue intentionally, confusing the two things. The Western AI Industry is bad but it is a separate thing from machine learning technologies.

    Pretending that the entire technology is bad because a bunch of people with infinite wallets are destroying the economy and ecosystem in order to make profits is ignorant.

    Trying to paint every project, person or group that uses AI with the same brush as the people who are creating all of the negative effects is misdirecting anger away from the people making the decisions and blaming a technology.




  • What is the security hole in systemd?

    You haven’t answered this.

    systemd-tmpfiles exists to delete inactive files in /tmp. That’s not a security flaw, that’s system maintenance. It’s the documented purpose of systemd-tmpfiles and it performs exactly was documented.

    The security hole is in snap-confine which does not verify that its own directory is owned by root before mounting it AS ROOT. That’s the security hole.

    So, again, what is the security hole in systemd?

    If you don’t have an answer then just say so. Resorting to name calling and trying to frame this as if I’m the irrational one is absurd.


  • There is no systemd flaw here.

    snap-confine creates /tmp/.snap owned by root.

    systemd-tmpfiles can delete this directory because it also has root privileges. It will do so if the directory is inactive for, by default, 30 days. Files can be excluded from this by adding a .conf file to /etc/tmpfiles.d/, snap-confine does not do this.

    Because the files are not excluded they will be deleted. systemd-tmpfiles can do this because it is running as root.

    Once they are deleted a USER can recreate /tmp/.snap with malicious code.

    snap-confine never verifies that the directory is owned by root, and performs its security checks before its privileged file operations, creating a race window. Because snap-confine is setuid root, it then bind-mounts files from the attacker-controlled /tmp/.snap into the snap sandbox’s filesystem, allowing an attacker to execute arbitrary code as root.

    What is the systemd-tmpfiles flaw? It does exactly what it is supposed to do, and it provides a means to exclude directories from its process. snap doesn’t configure systemd to ignore the directories and it doesn’t perform appropriate checks on the directory’s ownership.