craftkiller

I self-host my own code forge (a gitea instance) and I've mirrored a couple of large repositories on it. The traffic from AI crawlers was bringing my entire server to its knees. As soon as I put the large repos behind a login, my server's CPU usage dropped to ~5%. I don't doubt for a second that github is under a torrential downpour of AI crawler traffic. Those locusts destroy everything they touch.

> Now I wonder who invented [...] sugar (used to make cake)?

If you're talking about the refined product, then India. If you're talking about the plant, then New Guinea and Taiwan.

https://en.wikipedia.org/wiki/History_of_sugar

You worded that as if you speak for Microsoft, but your account is 2 days old and this is your first comment, which makes me suspect you are a karma-farming bot.

> I have never seen a company use AMD

Meta is using AMD: https://www.amd.com/en/newsroom/press-releases/2026-2-24-amd...

And OpenAI: https://www.amd.com/en/newsroom/press-releases/2025-10-6-amd...

I actually do, and I still notice it every time. Some asshole across the street rides a motorcycle and every day he revs his motorcycle which sets off the alarm of some other asshole's van.

I've noticed that the various tools report different amounts of free memory. I appreciate finally having an explanation for why.

Many of them, yes. It's up to the individual publisher whether they want to release their game DRM-free on steam. https://www.pcgamingwiki.com/wiki/The_big_list_of_DRM-free_g...

If you want to guarantee that you can backup your PC games and run them without a client, then there is always https://www.gog.com/

> Another underappreciated feature about NixOS is, that you can create a VM out of a NixOS config to locally test a server update/deployment.

And similarly, you can generate a bootable ISO of your NixOS config. It's really nice for both testing things out and also as a recovery mechanism. Rather than booting some generic ISO, connecting to the internet, installing whatever recovery tools and filesystem drivers I need, and then doing the recovery, I can boot an ISO that is identical to my main system, with all my favorite recovery tools pre-installed.

One suggestion for improving the cache's posture: Give each dedicated builder machine a TPM. On each builder, generate a TPM-backed signing key. Only use those TPM-backed keys for signing packages that end up in the cache. That way we'd ensure that signed packages _must_ have been built on the dedicated build machines (due to the TPM) rather than potentially uploaded from a compromised developer machine using a compromised signing key.

It seems the current situation is there is a single signing key that has been in use since 2015 which implies that key is not tied to specific hardware and therefore could be leaked/exfiltrated/copied: https://github.com/NixOS/rfcs/pull/149/files#diff-ac4cc42774...

> And then recruiter spam is COMPLETELY gone.

Oddly enough, in the past year recruiter spam has ticked up significantly for me. It was completely gone for a while, but it's back in full force.

NYC taxis drive an average of 180 miles per shift[0] so they'd need to triple the range or have some sort of system where they can swap their depleted taxi for a freshly-charged one mid-shift.

[0] https://en.wikipedia.org/wiki/Taxis_of_New_York_City

Oh absolutely, I'm with you there. LED strips are so unnecessary. I'd much rather the money go towards something functional.

I did some math, supposedly the complete install of the latest Call of Duty game is a 200GB download[0]. At 1gbps we're talking 26 minutes of downloading. At 2.5gbps we're talking 10 minutes of downloading. I'm honestly surprised game downloads have become so massive but are those 16 extra minutes really going to change anything?

Personally, I'm rarely "surprised" by a need to play a specific game that I don't already have downloaded/installed so I can just tell Steam to download the game in advance. But if I were to be in such a surprise scenario, we're talking the difference between popping on one youtube video while I wait or popping on two youtube videos while I wait. In both scenarios, I am waiting for a small but not insignificant amount of time... now if we could get 10gbps that'd be a game changer. I wouldn't even context switch for a 2.6 minute wait.

[0] https://gameboost.com/blog/call-of-duty-bo7-download-size

Nope, I hadn't heard of that. Neat. I see two problems though:

1. I can see this being effective against larger landlord that will have many units available every year, ensuring that adequate testing can be performed. But on smaller landlords with only a few units, it seems like it'd be hard to test. (for example, you get rejected from an apartment. The landlord rents it out to someone else. You file a FHIP complaint, but the landlord no longer has any units available so they cannot test.)

2. It seems like this is largely driven by complaints? If I was rejected from an apartment, I'm not sure how I'm supposed to glean whether or not it was based on race.

Are we sure that law is working as intended? Or are employers simply not admitting to factoring race into the decision? It is next to impossible to prove a candidate was rejected on the basis of race, especially when you can legally reject someone for not being a "culture fit" on the team.

I'd also argue the stakes are higher when leasing, so landlords will be less likely to take a chance on a race they don't like. Most jobs in the US are at-will employment so you can be fired at any time for almost any reason, but evicting a tenant can be a long process.

What alternative solution to housing-related racism would you suggest?

> You should be able to select freely who you want to have live in your house

We already tried that. It turns out that people are racist, so now we need laws to protect against that. It sucks for all the decent non-racist folks but the alternative of not having those protections was far worse.

> Sf’s rent control also means tenants can’t leave

They have exactly as much freedom to leave as they would without rent control. They _choose_ to stay because rent control has made it advantageous to stay. The way you phrased it implies you're suggesting this is a bad thing for renters but that is strictly a positive. Without rent control they'd have zero affordable options, with rent control they have 1 affordable option. Woe to the inhabitants of rent controlled apartments with their golden handcuffs.

I was already building the vast majority of it from source because I enable CPU optimizations for the specific microarchitecture in the machine (nixpkgs.hostPlatform.gcc.arch and nixpkgs.hostPlatform.gcc.tune), so once I learned about the risk of supply chain attack on the nix cache, disabling it entirely was a pretty small change.

So far, I'd say the biggest negative (aside from the build times that I was already experiencing due to the optimizations) is that GNU savannah will temporarily IP ban you when you download too much from them. For example, building the grub that is used for the ISOs downloads like 70+ patches from GNU Savannah which frequently triggers the IP ban.

Resignation. As you've already pointed out, we're past the point where we could have stopped it. While I continue to try to keep my environmental footprint small, I recognize that the battle is lost.

The event that sealed it for me, was after decades of hearing about how we need to reduce our energy consumption to save our species, someone made an infinite energy pit that financially rewards people for throwing as much energy into the pit as possible. Bitcoin could not have come at a worse time. The modern LLM craze is not helping either but at least that isn't a literal infinite energy pit.

To quote the philosopher Robert Burnham:

  > You say the ocean's rising like I give a shit
  > You say the whole world's ending, honey, it already did
  > You're not gonna slow it, Heaven knows you tried
  > Got it? Good, now get inside

That's how I manage all of my virtual machines: building an ISO from a NixOS config and booting it as a virtual machine. I'm going to take some time to see what bits of this I can copy to slim down my ISOs.

One additional benefit: I build all my software from source (by disabling the nix cache) so stripping out these extra programs will not only slim down my ISOs but it will also reduce the build time.

Not at all. At this point, I don't see improvement in the future; I'm just hoping I'll be able to maintain my standard of living. We are hurtling towards an economic collapse, an unemployment crisis, and the risk of major war. I thought I was safely beyond conscription age, but the war in Ukraine has shown that when push comes to shove the max conscription age is mutable.

If you want to really save energy, then they've already made the ideal product: caffeine pills. It's all the wonderful drugs without any of the bullshit. You can have it at any temperature, with any drink or even without a drink at all. It doesn't get cold or give you coffee breath. They're ultra compact and don't require rituals or specialty restaurants. They're also incredibly cheap.

> It adds npm as a dependency, to a go build?

Programs often invoke other programs through the exec* family of syscalls. For example, git is written in C but it ships with perl dependencies. It is not unreasonable to assume pass-cli added a runtime dependency on a program written in javascript. Regardless, we're talking hundreds of AUR packages have been compromised, I'd be shocked if none of them were javascript-based programs. Perhaps pass-cli was simply a bad example for me to choose.

> It changes the contributor email?

I think this is the 2nd most sus change, but even so, I have changed email addresses over the years so it isn't completely unreasonable.

> in /tmp?!

And yes, this is the most sus change.

True, but looking at a compromised PKGBUILD[0], it looks like it is installing "atomic-lockfile" and "figures". I think 99% of people reading the PKGBUILD would assume those are legit dependencies needed by the program. It's not like it was running "npm install 1337hax0r". Which is why you need to read the source for both "atomic-lockfile" and "figures" (and literally everything else).

[0] https://aur.archlinux.org/cgit/aur.git/commit/?h=pass-cli&id...

As much as I hate to say it, the Qubes OS people were right. The solution is aggressively isolating apps into virtual machines. Anyone know how much my battery life is going to suffer if I bite the bullet and switch?

> The advantage to the AUR is just that you can reasonably review every PKGBUILD for what you're installing

Simply reviewing the PKGBUILD is not enough for the same reason reviewing a Makefile is not enough: You need to review the source code for _everything_ that is being downloaded and executed on your machine. For AUR packages, that means not just the PKGBUILD but the full source code for the program it is building and the full source code for any of its dependencies.

Hypothetical example: you wouldn't have caught the xzutils exploit by reading the PKGBUILD.

What did you learn when you checked the logs to see what was wrong?

I've seen claims that the wifi 6E spec mandated that 6ghz networks required WPA3, so you would need to have a separate WPA2 ssid for legacy devices which therefore couldn't include 6ghz. A lot of access points now support a single SSID with all 3 bands using both WPA2 and WPA3, but I don't know if that is due to a change in the spec or if access points are violating the spec by offering that.

> iPhones, iPads and MacBooks would not switch to another AP

About a decode ago when debugging networking issues in an office, we had the observation that Apple hardware holds onto access points for dear life. Everything else would roam fine, but Apple would stay connected to distant access points with awful signal as if Steve Jobs' life depended on it.