Holy shit, Microsoft. Whoever made this decision should be fired. Into the Sun.
https://lemmy.world/post/46435614
#infosec #facepalm #clowncar
Remote
Morgan
@kaidenshi@exquisite.social
mastodon 4.5.19-EXQ1.01+glitch#OpenBSD nerd, open source hardware and software fan, retrocomputing enthusiast, Haiku OS evangelist, tinkerer, filthy casual gamer, goofball. One day I'll start writing again. He/him. Proudly anti-fascist. Trans rights are human rights. No hate, only love!
Profile pic by @Jgbird@mas.to
Header image by Carlos Lopez Castillon (@magocarlosyo-19404921@pixabay.com)
0 Followers
0 Following
50 Posts
Joined May 08, 2024
home:
cats:
yes
favorite childhood computer:
the Apple //c
OS:
OpenBSD / Void Linux / Haiku
band:
The Birthday Massacre
color:
purple
NO:
AI
Playing:
Final Fantasy VI
I am slowly coming to understand that the reason some applications crash often on OpenBSD is not the fault of OpenBSD, but the fault of poorly written applications that have tons of vulnerabilities. OpenBSD is designed to be a secure operating system as one of its main goals, and trying to circumvent these safety guardrails by "optimizing OpenBSD for desktop use" -- i.e. tweaking sysctl.conf to the max -- defeats the purpose of having the guardrails in the first place.
If you want an OS where applications are free to roam full of holes and exploits without crashing, use Linux I guess. It will happily continue to allow those poorly written programs to run, giving the user a false sense of stability. Meanwhile, I'm starting to prefer safety and security over "desktop performance at all costs". If a program misbehaves it should die, and OpenBSD will kill it before I even know it misbehaved.
#OpenBSD #ProactiveSecurity
Nearly six weeks later, and the question of whether "AI" generated code in tmux -- not tool-assisted bug finding, not refactoring, actual LLM-generated slop with questionable license(1) -- that was consequently merged into OpenBSD base, is considered acceptable by the lead devs, remains unanswered. Despite Theo de Raadt's concrete stance against any code of questionable license origin polluting the project -- and the tmux merge was indeed questionable -- it seems this is being swept under the rug. This makes me extremely uncomfortable; it's like seeing a fox in the henhouse but the farmers are all looking the other way and no one can convince them to admit they can see it and root it out.
I really don't know what to do being just a user; I feel like even if I tried to chime in on the mailing list I would just be ignored like the others trying to raise the alarm. I hope, as they do, that this is being discussed internally, away from the public list, and that a positive outcome is near. Maybe they are waiting for the 7.9 release before setting anything in stone.
Or maybe the "AI" disease has infected one of the last pure operating system projects we have left and there's no going back.
https://marc.info/?l=openbsd-misc&m=177513420401322&w=2
(1) As in, it could have been lifted from any GPL'd or otherwise encumbered code and there's no way to know for sure since LLMs are perfect plagiarism machines
It always happens. I said I was switching to OpenBSD thanks to the nail in the coffin that is "AI" infecting the Linux kernel and systemd, the two anchors of nearly all Linux based OSes. Even though my distro of choice on the desktop, Void Linux, doesn't use systemd, it has no choice but to use the kernel as-is.
So woodwork squeaks and out come the freaks, telling me that OpenBSD is also tainted because tmux is now vibe-coded. Well, here's the thing. The OpenBSD kernel and core subsystem will never be vibe-coded. The project has a valiant history of kicking substandard code and implementations to the curb. Bluetooth used to be part of the base installation, but it was ripped out due to poor code quality and difficulty to maintain. OpenSSL was forked into LibreSSL to address the Heartbleed vulnerability and to improve and modernize the codebase. The overly complicated and insecure sudo utility was punted in favor of the simple, secure, and superior doas utility.
I am confident that the OpenBSD project will address the issue of "AI" infected code in tmux and take action.
And to everyone who tried to make me feel bad or conflicted about my decision, try harder next time. I'm cozy and content running OpenBSD, and if that bothers you, unfollow me or block me. I'm not here to make you happy.
RE: https://mastodon.gamedev.place/@dahnielson/117011397432280299
I laughed, my girlfriend laughed, my 3D printer laughed, I shot my 3D printer.
OpenBSD -current on my Dell Latitude 5480 is a complete success. Everything except Bluetooth is supported (and that is expected as Bluetooth itself isn't supported on OpenBSD). Battery life so far is much, much better than with Linux and Windows. I closed the lid without shutting down last night before bed, and 10 hours later it had lost only 2% battery in that state. In Linux it would drain about halfway, and in Windows about 10%. I've had it up and running for the past three hours and I'm at 72%, giving me a projected run time of nearly 12 hours. That's better than some MacBooks running macOS! It's certainly better than what the laptop is officially rated for under Windows.
It's fast and responsive, pretty much on par with my HP mini PC with a similar 6th gen Intel CPU running OpenBSD. LibreWolf is measurably faster and more stable than Firefox, thanks to @libreleah@mas.to and her LibreWolf port.
My plan for my main workstation is to install OpenBSD to the NVMe SSD for maximum performance, and relegate Void Linux to the SATA SSD which will be good enough for the few Steam and "Windows only" games I play which work fine in Void, as well as NoMachine which I use to access my workplace when I get the inevitable night/weekend calls for support.
Replying to
@jerry@infosec.exchange brother you read my mind. Changing out the hot end on one of our 3D printers only to find the entire wiring harness had slowly cooked itself. Rewiring the whole thing was not on my Monday morning agenda! And of course we need hundreds of a certain part printed this week before I go on vacation next week. 
Boosted by @kkarhan@jorts.horse
Replying to
@libreleah@mas.to @MaddieM4@raphus.social Success! Damn it feels good to run this browser on this OS. Thank you so much Leah!!
Replying to
@Grueproof@dice.camp One of my absolute favorite people in the world, author and blogger Carlie St. George.
https://mygeekblasphemy.com/
Replying to
@bluetea@ioc.exchange @mttaggart@infosec.exchange Unfortunately OpenBSD has already allowed LLM-assisted code into the project via tmux, and the core devs remain silent on questions about that incident.
Also, a recent mailing list discussion showed that at least two prominent devs were open to, and one seemingly eager for, LLM engines being allowed into ports. There was a little dissent from another dev but they are at least considering it.
It truly pains me to say it, but OpenBSD appears to have been compromised and is no longer a guaranteed safe haven.
Replying to
@bluetea@ioc.exchange @mttaggart@infosec.exchange Indeed, OpenBSD was my backup plan for when the inevitable Torvalds blessing of "AI" in the kernel came about.
Replying to
@cienmilojos yep. "You will be pwned by script kiddies and skilled adversaries alike, by design, and you will like it" ~ Microchud
Replying to
@thomholwerda I don't care if they make the greatest hardware in the world at half the price of their competitors (and they don't, either metric), I will never buy from them until they publicly and loudly kick the Nazis out of their tent, AND state unequivocally that they will not allow them back in.
Replying to
@thomholwerda@exquisite.social Absolutely! And I bookmarked it so it doesn't auto-delete.
Replying to
@Gina@fosstodon.org @btp@fosstodon.org @krisfreedain@fosstodon.org @joel@fosstodon.org @fosstodon@fosstodon.org
Hi from exquisite.social :flan_wave:
I just sold my Steam Deck. That's how fucking serious I am about dropping Linux based OSes and devices from my life. The enshittification of Linux and its ecosystem continues to get worse by the day and if I have to give up PC gaming to avoid it, so be it. I have retro consoles that take cartridges. I have tabletop games. I have a fucking bicycle I need to ride more instead of sitting on my ass staring at a screen.
Fuck "AI", everything it touches turns to shit.
Replying to
@jerry These guys are "brothers from another mother", my girlfriend got them about six months apart, ten years ago (long before we met) and they were raised together. They are truly brothers, they fight every now and then but they always look after each other.
Unfortunately they don't get along at all with my girl Sage; she's always preferred humans to other cats and they can sense that I guess.
I hope your evening is better than your day was, and that tomorrow is better still. 🫂
Replying to
@mirabilos@toot.mirbsd.org @thomholwerda@exquisite.social I've been following the issue on the mailing list since it popped up, and I've talked about it here previously. This particular post is prompted by weeks of waiting to see a definitive response from the project.
Replying to
@mhoye @mhcat So from what I gather, it's pretty much what I already knew: It's upstream Firefox with hardening and privacy focused changes, with community testing. It's not a funded effort, it's a community effort to improve security and privacy on the notoriously insecure and privacy-eroding Firefox. It makes sense that they rely on community testing and feedback as they are not a huge corporation with funding to do that themselves. I can't find fault with that; there are countless successful and useful projects out there in a similar position and if we faulted them all for lack of paid personnel we wouldn't have the open source ecosystem we all enjoy.
I get why someone would be cautious about a project like Librewolf; I was myself when I first heard of it but the fact is that it's simply a modified Firefox where all of the changes are positive and beneficial, if a bit heavy-handed in the name of security and privacy. I recently explored building it from source on OpenBSD and had the opportunity to compare changes in the source to upstream, and while I'm not a developer by trade I do have a little experience with coding and I never saw anything malicious or harmful. Then again, I am one person and it's a huge project.
Still, I'm put off by your statement "...librewolf is a misguided spite-fork...", that sounds deeply personal and emotional. I try not to let one person's negative interaction with another person or project color my viewpoint; if they have attacked you or otherwise acted negatively towards you I can understand your opinion, but I can't share it as that has not been my experience at all.
Replying to
@emenel Fucking hell. This is why we can't have nice things.
I will never, ever understand why a hardware company would partner with a proudly fascist fuckstick, but this is two of them (Framework being the other).
Replying to
@lproven@social.vivaldi.net Thanks, I'm aware, and when I'm SSH'd into a server I usually use screen since it's damn near universal.
This isn't about tmux itself though, it's about the silence on the part of the OpenBSD leadership on the move to slopcoding in a project they have in base. I feel it's a serious issue especially regarding copyright and licenses; there's no way to guarantee that the code used by the LLM in this commit is not from a GPL'd or otherwise problematic source.
Even putting my own misgivings about vibecoding and "AI" aside, the license issue alone should be enough to ask the tmux devs to revert this commit, or else drop the tmux project from base entirely in favor of something that isn't potentially polluting OpenBSD with code of questionable origin.
Replying to
@KF0UNK the difference is that other browsers only expose the one password you request at that moment and only for as long as it takes for you to log in to the service you need it for. Edge decrypts and stores all your passwords in plaintext in memory as soon as it launches and keeps them there until you close the browser. It’s a night and day difference.
Replying to
@mhoye @mhcat that’s a bit harsh, have you had a negative personal interaction with the Librewolf team? I’ve found that even with the toggles you mentioned, Firefox still sends data back to Mozilla constantly. It’s as if they don’t honor their own settings. With Librewolf I have yet to find any nefarious or secret behavior like that. I can’t speak to their test environment since I’m not a developer, but the fact that the entire reason for their existence is to secure and harden Firefox is why I use their browser.
I’m going to dig into your claims about their lack of security and testing because that kind of thing is deeply concerning.
Replying to
@libreleah@mas.to @MaddieM4@raphus.social That would be awesome and much appreciated! I still want to succeed at building it for my own personal achievement, but a pre-built package would be a boon to those of us who have been waiting years for a proper LibreWolf port. I feel like the intersection of OpenBSD enthusiasts and LibreWolf enthusiasts has to be wide and populous.
Replying to
@MaddieM4@raphus.social I have OpenBSD running on a few devices, but my main desktop is Void Linux. When I finally move it to OpenBSD I won't even bother with a dual boot, I'll just go all the way. And I'm close. Really, really close! Honestly just waiting on the LibreWolf port being worked on by @libreleah@mas.to to be accepted into ports and I'm there.
Boosted by @oxy@social.bsdlab.au
Replying to
So far so good on my main workstation, next to get a sysupgrade is my Dell Latitude laptop. @libreleah@mas.to 's Librewolf package that I compiled on the 7.9 snapshot just installs and runs perfectly fine on the 7.9 release. I'm in nerd nirvana right now.
Replying to
@davbucci@mastodon.sdf.org I use an Elmo digital projector that I picked up used for really cheap. It can output to several input types, HDMI, VGA, DisplayPort, MiraCast, and it has a microscope function that works extremely well for delicate soldering work. They are expensive new, but they pop up on eBay and other marketplaces from time to time. I don't know if they are regularly available in Europe though.
Mine is an older version of the TT-12G.
https://www.elmousa.com/document-cameras
Replying to
@PurpleJillybeans It's been over twenty years since I touched one, but from what I recall they were just about the worst performance you could get in a Pentium III clone at the time. I don't recall any hard numbers but I remember trying to get BeOS to run on one and it was a slideshow on the desktop. That could have been a lack of video drivers though.
Replying to
@redsad Poison Ivy is only a villain in the eyes of a billionaire with a flying mammal fetish.
Replying to
@randahl@mastodon.social It seems like they are trying to perform as many evil, illegal, and unconstitutional acts as they can before the midterms, because they know their number is up once Congress flips and they start getting investigated, deposed, fired, unseated, arrested, and jailed for their crimes against the nation and its people.
Replying to
@libreleah@mas.to @MaddieM4@raphus.social In other news, all dependencies satisfied on my current iteration, and the librewolf package officially started building at 20:08 local time. It's an HP mini pc with the i5-6600T so probably similar compile time to yours, if not a little slower. Fingers crossed!
Replying to
@libreleah@mas.to @MaddieM4@raphus.social Oh it's nothing wrong with your port, I just ran into issues building dependencies so I tried installing them as packages to both speed things up and avoid any compile issues, and that one package was being fiddly (the correct version from ports kept erroring out during compile, and (at the time I tried it the other day) the version in packages wasn't right).
Trying again right now with a fresh install of -current on my most powerful dedicated OpenBSD machine, hopefully this time it's all in place and it builds successfully.
Replying to
@libreleah@mas.to @MaddieM4@raphus.social May is great, happy birthday to me! I've been trying to get your port to compile on my secondary workstation here at the house but I'm still trying to figure out dependency stuff (I am in no way, shape, or form a developer). I think I've managed to tackle every dependency except icu-i18n. If I can't get it to build on my own I'll just use your -current port once it hits the tree since I tend to run -current anyway.
Replying to
@TechTangents@dialup.space What a nostalgia hit! This looks exactly like the AutoCAD setup in my drafting class in high school in the early 90s.
Replying to
@oleksandr @thomholwerda @libreleah regardless, it just works out of the box for me with no configuration necessary. Opening the lid immediately resumes with no delay, and there is virtually no drain when it's closed.
I'll take it.
Replying to
@libreleah @MaddieM4 Hell yes I'm about to chuck an SSD I found in my desk into my main workstation and start grinding away at it.
Replying to
@libreleah @MaddieM4 I backed up the package I built for safekeeping since it runs perfectly (actually a little faster than Firefox on the same machine). I tend to run -current so I'll just use your binary once it's merged.
Replying to
I know it's silly but I feel a bit of a personal connection with how many releases have happened on May 19th. It's like it was meant to be! 
Replying to
@tragivictoria@mastodon.com.pl I've never watched it despite being a fan of both the character and the actor. I really need to get around to it. I think I was in superhero burnout mode when it came out originally and just kinda forgot about it.
Replying to
@onepict@chaos.social I used Claws back when it was still Sylpheed-Claws on Slackware way back in the early 2000s, I loved it! These days my email provider's web client is good enough, but Claws is still relevant today. Just bear in mind it doesn't do HTML when composing messages, but honestly to me that's a feature, not a regression.
Replying to
@david_chisnall @KF0UNK I'm curious as to how Firefox does it (including forks). Do you have any insight into that? I'd assume it's similar to Chrome's approach but I really have no idea.
Replying to
@thomholwerda @oleksandr @libreleah my guess is that some OpenBSD developer has the same or a similar laptop and fixed the issue long ago. Every laptop is different and the only reason Apple has perfect sleep/wake on their hardware is because they develop the hardware and software together.
I’ve found this to be the case a lot with OpenBSD on specific devices; for example Joshua Stein submitted fixes for the Microsoft Surface Go tablets which made it easier to run OpenBSD on them.
Replying to
@libreleah @MaddieM4 Just under an hour on the main workstation. I think I'm ready to go all in on OpenBSD now. Thank you so much!
Replying to
re: grousing about AI/LLM offending me personally