4 karma · joined October 22, 2022
As someone else pointed out above - this is going to be a surprising century for y'all promurica folks. Or for the the posterity, at least. Won't even be China to be blamed. Might not even be a state. Not seeing where this train is headed (and not just with the AI) - this is the biggest issue with the overall comprehension of the larger picture. But opening your eyes and learning to make sense of the world around isn't something you can learn by being lectured on HN, unfortunately.
It's a soothing feeling to have, though - this belief you're on the "good guys" team. Comfy. Also helps when you're arguing, doesn't it? OR when your passport allows you to travel to more places. Very nice indeed, but not a single a thought is usually given as to why, say, the latter, is the case. "Ignorance is our only ammunition".
DISCLAIMER: I DO NOT hate America. It's given this world a lot of good things and personally affected my life through art, books, movies, music, language and other things. I used to visit, but I think I could've never enjoyed living there. I used to think it's the American movies that perpetrate lies about how life really is, but then when you see it, you realize the lies is anywhere but in the movies (even the bad ones). Lies not by the people... Just lies. Fake. Vanity. Madness. And the only true thing I found in America was my one and only love. For which I'm forever grateful.
NixOS is also a subjective take on packaging, heavily luring people into a functional programming world, where one set of problems is merely replaced by another set of problems. I tried NixOS, so no, thank you. There are better ways to isolate packages and have multiple versions of libraries. The simplest of which that come to mind are things like Flatpak and containers. There's almost 0 usecase for NixOS - it merely replaces one set of problems with another. And forces you to learn something, that does not justify the time it'd take to learn it. I feel like people who built it just wanted to be smart, not create things that are seemingly simple and beautiful (which is what true artists strive for, I think). I learned Vim in two weeks. I gave NixOS the same time and it was almost a waste of it. Not a complete waste, however, because, I recall, I discovered an extremely useful, but unrelated thing (zfs), but I don't remember how come it worked out this way.
Today I had to use Node.js and grunt (first time I hear about it) which installed npm packages and "compiled" it all into the Chromium extension I needed. The extension's actually good, but it itself uses Angular and ton of other packages, 50 or 70 maybe. What in the actual...?
On the backend side... Why do you need a framework? Learn yourself some CGI, write small programs. Sure, use libraries, but also maybe try a compiled language, so it runs faster, isn't as simple to hack if someone breaks in. Besides, Cloudflare and the likes of them (also hated by me and many) protects from most attacks anyway (and that would be one single positive aspect of the existence of these captcha racket-companies). So you won't need to learn much at first. You don't want spam? Maybe ask your users to pay first. Then it's much harder to perform a DDoS if most of your website is behind a paywall. Nothing is free. Everyone complained about how Bitcoin mining is bad for the environment etc... yea yeah. Next time don't use React and Ruby On Rails for your Blog with two and a half articles in it.
P.S. My sincere recommendation for anyone: find and listen to Jonathan Blow's interviews and talks (not the twitch streams - they're too long and boring). This man understands many important things, not the least of which is that game devs, somehow, manage to waste less resources while people are playing their pretty demanding games, less than certain websites do. Or that Twitter's engineers being let go is because you don't need that many engineers to build a micro-blogging platform that hasn't even changed all that much over the years. It appears to me there's a lot of scamming going on in the startup/VC industry. You get a $2mil check and hire expensive devs - also pay yourself nicely, of course - to build something I can probably build in 3 months for $15k and it'd be better. I had founded and financed a company myself. And even when we finally got external funding (not much) we never paid ourselves as founders, not the once. VCs in the US don't care (not their money and the inflation forces them to just stuff it into whatever comes their way) and founders are happy to be sort of "working for themselves". No wonder the success rate is low.
I know how to run them from a container or even a VM and use X client-server architecture to isolate them - that's how it should be. To set it up, though, requires time and careful considerations and knowledge of many things. I may have most of the knowledge, but not the time. And then again, a malicious vendor has many different ways to fool the system, yet as a user one only has to make a single mistake to allow them to do what they intended to do -- as opposed to preventing it.
So the larger problem isn't signatures. It's the loopholes and vulnerabilities, introduced intentionally or by negligence, that have the potential to compromise an OS. Almost all software should be isolated from the filesystem or any other information that would allow it to uniquely identify your machine (like why the hell does Google Chrome need to know my webcam model and possibly its serial number, which fonts are installed, my GPU and CPU models and a ton of other things?). By the same token, all software shall have no network access UNLESS it's enabled explicitly and one should also be able to block browsers or any other software (including your operating system) from sending telemetry -- by blocking all possible ip-addresses & domain names that aren't associated with the same websites you visit or when some other software truly requires such access. And, frankly, I wish I didn't have to spend hours and days setting up firewalls and closing up all those holes. It isn't because I have things to hide. It's because it's simply wrong. If you need a shallow reason why, I'll give you one: I pay for electricity and for my internet access. No software vendor, open-source or not, for good reasons or not so good reasons, shall have the right to send a network request and, thus, send or receive data from the network without my explicit permission. That has to be the default.
Update: and if they're allowed to send telemetry (again, by users themselves and explicitly) users should have the key to inspect the encrypted data that's being sent before it is sent. My machine, my rules. The irony is that the non-free, proprietary operating systems abuse privacy rights even more than the open-source ones, while I'd actually pay for the opposite happily if someone would design a system that is provably non-malicious, has the properties described above and doesn't require a lot of time and effort to achieve the desired things related to privacy and security.