Yeah, still, I wouldn’t claim “as no human would end up falling into that”, given that it may not be that unlikely to find at least one human who displays similar writing the more humans you involve.

No, it is actually statistically impossible for a human to replicate this on sufficiently long runs of text.

This is not about replicating writing like a model. This is basically about guessing which words to pick from the list of suitable words based on a rule that you don’t know (because the key is secret).

To reduce this to the simplest possible example, imagine you are writing a “text” from just two letters: “a” and “b”. Let’s say for convenience that the text is supposed to be random. So the text would look something like “ababaaabbababbbabababaabbbabaababbaaabbabaabbaaaaabaaabbbaabaabababbabbbbbbbbabbabaabbbbbbbaabbabaab”

(generated with '''.join(random.choice(['a', 'b']) for i in range(0, 50)))

The watermarking works as follows: the model owner holds a key, and then uses that key to influence the random choices between “a” and “b” somehow, in a context-dependent way. The actual algorithm is quite complicated, but for simplicity let’s just say we have a secret pattern which biases the random choice towards it. In order to see the exaggerated results, let’s say the secret key is “aaaabbbb” (of course this is a bad secret key, once again just an example), and that the bias is strong (let’s say 80%). So this would mean that the first four letters in our text are more likely to be “a”, the next four letters are more likely to be “b”, then the next four letters are more likely to be “a”, and so on.

Then the text would look something like “aaaabaabaabaabbbabaaaabbaaaababbbaaaabbbabaabbbbaaabaabbaaaaabbbabababbaaaaabbbbaaabbbbbaaaaababaaba”.

(generated with ''.join(random.choice(['a', 'b'] + ([key[i % len(key)]] * 3)) for i in range(0, 100)))

You can see visually that the secret key has affected the text. Of course in this example even if you didn’t know the secret key you could probably figure it out, in reality the algorithm is way more complicated than that, relying on cryptography, so you wouldn’t be able to know the secret key or see that the string has been biased at all.

If the text is long enough, and you know the secret key, you can guarantee that the text was generated with it. In our examples, the letters in the text match our key 77% of the time. The probability of an actual random algorithm generating a text like that is already very low, despite the base entropy being only 100 bits. If my math is correct, for our example the p-value is 2.7 * 10⁻⁸, or about 0.00000027%. I would bet a hungy that the text was generated by our watermarking algorithm, with odds like these!

Of course we did exaggerate the bias and our base algorithm was random. In reality the bias is smaller, the algorithm for determining the likelihoods of possible next tokens is very complicated (it’s the LLM itself), and the algorithm for determining which token to bias is also way more complicated (involving cryptography and real secret keys). That said, hopefully it should help you understand why, for sufficiently long texts, this fingerprinting is just not possible to be replicated by humans.

Why would firefox drop UBO support?

If it was unusually selfish to care about how you were honored after you die, then nobody would be buying grave monuments or fancy urns.

I wouldn’t say unusually, but yes, people are known to be selfish and immature sometimes. Especially when faced with something scary and unavoidable, like death, and backed by culture and tradition.

I imagine it makes them feel like their child doesn’t love them as much as they thought they did.

People receive and express love in different ways. Not understanding and engaging with that is immature. Trying to manipulate another person into doing something uncomfortable after your death for no material reason at all is selfish.

Sometimes we bear little burdens for the people we love, and that’s totally normal, in my opinion.

Maybe the father can bear the little burden of not doing anything and not being materially affected in any way, then.

The reasons to visit a funeral are:

1. If it helps you process your own grief
2. If you can/want to help others process their grief

If, when your father dies, you feel overpowered with emotions, you should consider going, because a ritualized, socialized process like this can really help you process the sadness in a healthier way. If you care about your mother or other relatives and think your attendance will help them process the loss, you should go. Don’t let your annoying aunts ruin your mental health or relationships with people you care about.

If neither of those applies, you are fully justified in skipping the event.

As for what to tell your father: I would say a white lie is justified in this particular case, whatever you decide to do in the end. He will not know whether or not your attend. Yes, this is treating him like a child; however, by manipulating you to attend an event which definitionally will not affect his life in any way, he is already being childish. Unfortunately this is how some people are, it doesn’t mean you can’t love or respect them in other aspects.

On the other hand, it is immature and even selfish to care about the details of your own funeral. Your funeral is specifically an event for people who loved you, to process their grief. You will definitionally not be around to care about any of it, let your loved ones process their grief however they want.

I hope you’re trolling, but in case you’re not let me walk you through a series of arguments that should hopefully convince you that allowing homeschooling without a good reason (mostly medical) is a bad idea.

Society must take care and protect the vulnerable people in it. Children are pretty much the most vulnerable group. Therefore, society must take extra care to protect its children.

The best way to ensure someone’s safety is to regularly check on them. Thus society must regularly check on every child. This is the most important purpose of a school. This, combined with the fact that the majority of child abuse happens at home, would already be enough to ban homeschooling without a good reason.

In order to continue functioning well, society must consist mostly of socialized people tolerant to each other. Children are the future of any society. Thus society must make sure that children are socialized and tolerant to others. The best way to socialize children is to place them in a group of other people, and the best way to teach children tolerance is to make that group include different ethnicities, cultures, belief systems, and sexualities. This is the second most important purpose of a school.

In order to develop, society needs educated people; and, educated people tend to be better off in their lives. Childhood is the easiest time to teach basic concepts of science and life in general. Thus, society must make sure it educates children. This is the third most important purpose of a school.

Of course, if a parent is not a child abuser and puts in a lot of work, they could substitute school with other ways to ensure their child’s safety, socialization, tolerance and education. But it is a lot of work for which most people just don’t have the resources, and unfortunately there are a lot of child abusers out there (not necessarily sexual or even physical, but definitely psychological).

If you allow arbitrarily “pulling” children from school, you will just statistically end up with a lot of bigoted uneducated people with child abuse trauma. Which is exactly what’s happening in the US.

To answer your question directly: I don’t know better than any particular individual parent, but I know there a lot of parents out there which should not be allowed to homeschool. Probably including this lady.

The fact that a parent can just “pull” a kid from school with no good reason is just insane. It’s such fertile ground for all manners of child abuse.

Yes, fair.

Computers could make cars a lot more reliable and moddable. It’s proprietary/locked-down software and hardware that’s the problem.

I would hope that the Switch falls under “Tablets”. Because that’s exactly what it is.

Video consoles are either desktop computers with proprietary parts, or tablets with proprietary parts. There is nothing especially difficult to repair in them compared to the rest of their categories.

Well, in that case remember to force everyone to use the same Nixpkgs version (otherwise you’ll still end up with a lot of duplicated packages), and run nix-store --optimise; nix-collect-garbage -d regularly (ideally via cron or something).

I’d like to note that the 4 points are not separate issues, they are all requirements in order for an attacker to get access.

I’m not too worried about hash squatting, I guess there’s no way around it, but other ways of managing packages have way worse flaws than that.

“hash squatting” is not really an issue on its own. Unless an attacker can breach the sandbox, given the same derivation hash, the resulting derivation output would be the same regardless of which user requested the build.

I do want my users to be able to build packages. In most cases I imagine we’ll use pre built packages, but often packages available are not optimized for certain architectures.

Actually, Nix without the ability to build derivations would just be useless. In Nix, everything is a derivation, even if you just want to have multiple packages installed into your user profile at once, behind the scenes it’s a derivation which simply combines binaries from multiple other derivations, which will not be available in the remote cache and needs to be “built” (in the most trivial sense possible) locally.

How does the nix sandbox work? Just so I know what I’m working with. Do you know where I can read about it?

You can think of the Nix sandbox as a kind of lightweight container, into which Nix mounts all the dependencies needed to build the derivation (including source code and such), and then runs the builder command. On Linux it is using User Namespaces (and a few other sandboxing tools), in a similar way to what Docker does (in fact there is some work to use runc as a sandbox backend but it’s not usable yet). I don’t know if it’s described in a lot of detail anywhere, but a brief description is available in the manual.

Does root actively run installed packages at any point? If that is the case I’d be a bit wary to use nix for this purpose.

Once again, just random packages in Nix Store are not “installed” in any real sense. In order for any user (incl. root) to install/run something, they have to be the one explicitly doing it, e.g. via nix profile install or nix shell. That also means that if you’re not using NixOS, you can actually just not do anything as a root user and then no code from /nix/store will be executed with root privileges at all.

To reiterate, unless your threat model involves sophisticated attackers^[1], users installing packages with Nix is as secure as them just building code from source manually, or dropping binaries into their own $HOME/.local/bin. One user installing a package into their profile does not affect other users or root in any way.

From what I can tell from your other replies, you are setting up a common build server with your coworkers. In that case I’d say it’s 100% fine, both workplaces where I’ve been doing Nix work had a server like this, there were never any issues with privilege escalation or malware spreading between users.

Assuming you’re talking about Nix the package manager,

Nothing is actually “installed as root”, except for stuff that the root user installs themselves. The Nix Store (where all the “derivations”/packages are stored) can be thought of more as a cache, just because a package is there doesn’t mean it’s used anywhere. Users don’t get to choose the cache “key” (i.e. the directory name in /nix/store) either - it is determined by all the build instructions and dependencies needed to build the package, and Nix doesn’t (well, at the very least shouldn’t) give users any control about the package build process after it starts.

When users install something, Nix fetches or builds that package into /nix/store - which doesn’t affect other users in any way - and then just symlinks that particular package into some user-owned directory in their $PATH (e.g. $HOME/.local/share/nix/profiles/default or so), which also doesn’t affect root or other users in any way.

So, basically, if some user installs malware only they are affected - the fact that it’s also in the shared /nix/store is irrelevant since there’s nothing in other user’s profiles or $PATH or whatever that references it in any way.

The most likely vulnerability is something like this:

1. The attacker guesses the nix store path of some package that root will use in the future (e.g. glibc from a more up-to-date Nixpkgs version compared to what root currently uses) - note that users can’t replace a derivation that’s already in the store, so they need to guess a future derivation path
2. The attacker forces Nix to build that package from source instead of fetching from a trusted substituter
3. The attacker finds a way to breach Nix’s sandbox during the build and inject their own backdoor into the resulting package ← this is the difficult part, there are currently no such known sandbox holes
4. The attacker then waits until root starts using that package in the store, at which point the backdoor becomes actively ran as root.

I must add that this is theoretical and I don’t think has ever happened in practice on a multi-user system.

Sorry, I’m pretty bad at explaining stuff, hopefully it makes some sense :)

In that case, what are they doing to college for?

But also the problem is that they cheat.

Using AI is easy, as you note. You don’t need to go to college to learn to do that.

College can give you many useful skills, mostly related to gathering and processing information, and applying it to solve various issues. If you just copy-paste every question into AI and then copy-paste the answer back, you will learn absolutely nothing.

LLMs hallucinate and there’s nothing we can do to stop them. No amount of QA will fix that fundamental issue of “the LLM is somewhat likely to confidently produce incorrect information”, if you need the answer to be correct you have to do the research yourself, maybe based on the sources the LLM provided, not just sanity-check the output. This is a very useful skill to have for many jobs involving thinking or finding stuff out.

And even if we fix the hallucinations at some point by switching to a different tech (LOL), I do think it’s useful for people to keep some mental skills. Otherwise we will end up with a stupidity and/or dementia epidemics, similar to cars causing an obesity epidemic.

Died as a war criminal fighting for pedophiles, remembered as a consoomer of capitalist glop. True american.

I’d like to add my perspective.

I’m not very anti-AI, I use a locally run model to help me write code (especially boring stuff).

For me it’s mostly about “is it worth the time to package this thing in Nixpkgs, add it to my config, and get used to how it works?”

And for vibecoded projects, even if they work now, the answer is “probably not”; more specifically it’s “let’s look if it’s alive in a year, if I’m still interested”.

As such, I really appreciate when people add a disclaimer so that I don’t have to go look at the code only to be disappointed - I also appreciated it back in the day when someone said “this is my first real project” or something, for similar reasons.

And secondly it’s a question of trust. If the author doesn’t disclose such basic things about the way the project has been developed, and in fact avoids answering when asked directly, what other potential problems could there be semi-hidden in the codebase?

At the risk of stating the obvious, I would like everyone to know that https://www.shellcheck.net/ exists. Unless you are a bash wizard: if your bash script doesn’t pass shellcheck, it is very likely to have bugs.

I think the key point with Linux is that at least no single corporation has enough control over it to dictate the direction of the project on its own. Sure, modern Linux is fairly corporate and somewhat beholden to capitalist interests in general, but there’s a lot of different actors pulling things in different directions, and the community (by that I mean non-corpo interests) still plays a role in decision making.

I didn’t vote to put Linux in AI servers, defense projects, Teslas

The definition of FLOSS mandates that software authors relinquish control over how and by whom their software is used, see for example the JSON licensing controversy. But I agree that we should rethink this somewhat libertarian approach and at least try to prevent our software being used for evil.

I didn’t choose to ban devs based on their nationalities

Yeah that one was a yikes. Especially given it wasn’t even prompted by any legal threats, it was just the Linux devs complying with an unjust law prematurely.

I’d be pretty wary of allowing MIT kernel modules.

Wait, is that a thing?? Unless you mean the out of tree modules, in which case the MIT ones are not the worst offenders (looking at you NVidia)