lol They're already running at a significant loss. giving out more free stuff isnt going to help. What they really need to do is charge what it actually costs them. That will slow down the abuse a little.
That will also make it entirely unfeasible for anyone to use their services. The cost of the tokens you could burn on a $200 plan is in the neighborhood of $1200. They're getting users now and gambling on the cost of compute (or the difficulty of compute) dropping precipitously before they run out of cash.
Is the nixpkgs repo more "resilient" to these kind of attacks since an attacker would need the approval of a member with merge permission ?
Kinda, you'd have to go through the whole review process and also get your stuff to successfully be part of (at least) an unstable build.
What really worries me is that on Nix we have a strong habit of patching packages to work around problems caused by the fact that NixOS doesn't use FHS. So, in theory, someone could submit an obscure patch to systemd and get everyone affected by it, if it through the approval process.
I’m moving all my machines to NixOS. I’d done this before but ran into time constraints creating ports for convoluted binary software. With LLMs now as good as they are it’s quite possible this isn’t a problem anymore. I’ll be finding out.
I've had great results doing this, using flakes seem to make the results quite maintainable
lol They're already running at a significant loss. giving out more free stuff isnt going to help. What they really need to do is charge what it actually costs them. That will slow down the abuse a little.
That will also make it entirely unfeasible for anyone to use their services. The cost of the tokens you could burn on a $200 plan is in the neighborhood of $1200. They're getting users now and gambling on the cost of compute (or the difficulty of compute) dropping precipitously before they run out of cash.
absolutely agree.
I think what will happen is you'll get 3 or four "Tiers" of AI.
Tier 1: Big Corpo's, Govornments and soverign wealth institutions. Top of the line and dangerous AI, very likely to be abused and used to enrich the already powerful.
Tier 2: Enterprise level AI, Rich local Gov and rich individuals might have these. maybe also SAAS providors will tap into this. Functional but not really smart like Tier 1.
Tier 3: Community AI. Small business etc will use this. basically automated orchestration
Tier 4: Home AI.
I think this is where we're headed. and this is of course after the bubble pops and we get an economic crash because of the popping. (other events going on in the world and various economies and political scenes.)
Is the nixpkgs repo more "resilient" to these kind of attacks since an attacker would need the approval of a member with merge permission ?
Kinda, you'd have to go through the whole review process and also get your stuff to successfully be part of (at least) an unstable build. What really worries me is that on Nix we have a strong habit of patching packages to work around problems caused by the fact that NixOS doesn't use FHS. So, in theory, someone could submit an obscure patch to systemd and get everyone affected by it, if it through the approval proce…
I'm sure PRs to the systemd package will get scrutinized by an experienced packager.
Also Nixpkgs isn't really that special when it comes to patching. Making thousands of software all work coherently on a single system inevitably requires heavy amount of pop patching. Nixpkgs actually handles this better by having easier ways to make customizations.
personally im looking more into using freebsd, i was an openbsd user for years, and then i started arch, i liked it bc it was more bleeding edge, but over they years ive become less security aware bc its just too convienent, as i do more and more developing. currencly it takes almost 20 min to load thunar, and i dont know what update broke it, ya its my fault i know but i just dont have the time to vet everything, this wasnt an issue 6 mo ago. i want a more of a os thats professionals for professionals, i dont need the latest eyecandy, im fine using windowmaker. if i need to be limited imm deal with the limitations, im using cinnimon and when my wifi doesnt connect my desktop is broken and takes forever to load if i have to reboot, which is generally to thunar and frustration, i cannot use a later kernel and am stuck at a certain version bc video drivers arent compatible, i also cannot run vitrualbox bc something is wrong woth the kernel driver. does the community have any other options???
Assuming you're not pulling in software from outside of nixpkgs, Yes.
Why? AFAIK original source is never reviewed, only the change in nixpkgs. So if the original is compromised, the malware will make it to nixpkgs.
The scope of nixpkgs is nixpkgs. If every package's entire source code was being audited, then there is no such thing as a sustainable repository of software. There simply isn't enough people, or money for AI, to do it.
Why? AFAIK original source is never reviewed, only the change in nixpkgs. So if the original is compromised, the malware will make it to nixpkgs.
The scope of nixpkgs is nixpkgs. If every package's entire source code was being audited, then there is no such thing as a sustainable repository of software. There simply isn't enough people, or money for AI, to do it.
> or money for AI, to do it.
OpenAI and Anthropic both provide free credits for OSS.
Smaller models feasibly can review every commit IMO. Would not be cheap for sure, but also would probably be cheaper than a single fulltime employee.
The scope of nixpkgs is nixpkgs. If every package's entire source code was being audited, then there is no such thing as a sustainable repository of software. There simply isn't enough people, or money for AI, to do it.
> or money for AI, to do it. OpenAI and Anthropic both provide free credits for OSS. Smaller models feasibly can review every commit IMO. Would not be cheap for sure, but also would probably be cheaper than a single fulltime employee.
This would amount to auditing the vast majority of open source code found on the Internet. Not even OpenAI or Anthropic seem quite interested in doing that.