Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Maybe you shouldn't install new software for a bit

xeiaso.net

Post reply on HN
Print view View original

411–420 of 497 posts

Re: Maybe you shouldn't install new software for a bit

#411

Post by larodi »

jangxx wrote: post #204
larodi wrote: post #173

Earlier quoted context omitted.

You are avoiding intentionally to say ‘thanks to LLMs’ or is implicit? As all these recent mega bugs surface with lots of fuzzing and agentic bashing, right ?

Thank you for reminding us all that you AI bros are still the most obnoxious people there are.

Indeed, yet another proof, there's the part of HN crowd which is passive aggressive, dismissive, and dishonest in the very scientific possible sense. Won't make my day harder than it is, but is a very weak signal.

If I'm to be offended by a single thing in your post that is calling me (names) - is AI Bro. This was undeserved, and cannot be farther from the truth. Not to miss the fact your comment is entirely off topic, and perhaps you see AI bros everywhere now.

Re: Maybe you shouldn't install new software for a bit

#412

Post by CJefferson »

c7b wrote: post #179
weregiraffe wrote: post #168

Earlier quoted context omitted.

But you can't expect the language std to supply you with every package under the sun.

I don't have an answer what the alternative is going to look like. But smarter people than me may find something. C/C++ are doing fine without package managers. Go at least has a more capable standard library than Rust. But I'm not sure if Go's import github approach is the answer. One idea I've been entertaining is to not allow transitive imports in packages. It would probably lead to far fewer and more capable pack…

I think what we really need is better sandboxes languages. I’d be much happier if my compression algorithm only had an input stream and an output stream. Maybe my gui library shouldn’t have network access or filesystem access. It just draws what I give it, gives me back what users press. You could still make evil software in this world of course.

Re: Maybe you shouldn't install new software for a bit

#413

Post by kibwen »

uecker wrote: post #262
c7b wrote: post #179

Earlier quoted context omitted.

I don't have an answer what the alternative is going to look like. But smarter people than me may find something. C/C++ are doing fine without package managers. Go at least has a more capable standard library than Rust. But I'm not sure if Go's import github approach is the answer. One idea I've been entertaining is to not allow transitive imports in packages. It would probably lead to far fewer and more capable pack…

The solution exists, and those are curated package repositories as we have in Linux distributions. In C I can simply install a -dev package and use some library which sees some quality control and security updates from the distribution. The problem is that the UNIX shell model got very successful and is now also used on other platforms with poor package management, so all the language-level packaging system were crea…

> But those did not learn from the lessons of Linux distributions. Cargo is particularly bad.

I recall a decade ago listening to native app developers lamenting how web pages were inferior to native apps and gnashing their teeth at why browsers wouldn't learn the lessons of native apps. It was, and remains, a shocking display of self-unawareness to fail to understand why web pages, despite doing many things worse than native apps, managed to do blow native apps out of the water when it comes to doing the things that actually matter to users. This is how it feels listening to the above comment; you have failed to reflect on why both programming language authors and programming language users were pushed to using language-specific package managers in the first place, and you have failed to put forth any improvements to OS-level package managers that would allow them to address those underlying flaws.

Re: Maybe you shouldn't install new software for a bit

#414

Post by uecker »

marcus_holmes wrote: post #348
uecker wrote: post #257

Earlier quoted context omitted.

The problem is that they get away too easily with bugs in their products they ship to customers. If this would come with some penalties, there would be some incentive to invest in security and this would probably often flow back to upstream projects.

Seriously? You think that curl gets away with bugs shipping to prod? And that's the major problem? I don't agree with any of that.

I was not talking about curl, but the downstream products such as cars. And I am sure curl would appreciate support from car vendors, this was the point wasn't it?

Re: Maybe you shouldn't install new software for a bit

#415

Post by c7b »

CJefferson wrote: post #412
c7b wrote: post #179

Earlier quoted context omitted.

I don't have an answer what the alternative is going to look like. But smarter people than me may find something. C/C++ are doing fine without package managers. Go at least has a more capable standard library than Rust. But I'm not sure if Go's import github approach is the answer. One idea I've been entertaining is to not allow transitive imports in packages. It would probably lead to far fewer and more capable pack…

I think what we really need is better sandboxes languages. I’d be much happier if my compression algorithm only had an input stream and an output stream. Maybe my gui library shouldn’t have network access or filesystem access. It just draws what I give it, gives me back what users press. You could still make evil software in this world of course.

Sounds like functional programming could help with that?

Re: Maybe you shouldn't install new software for a bit

#417

Post by tclancy »

teiferer wrote: post #165
tclancy wrote: post #65

Earlier quoted context omitted.

So, to play Pandora, what if the net effect of uncovering all these unknown attack vectors is it actually empties the holsters of every national intelligence service around the world? Just an idea I have been playing with. Say it basically cleans up everything and everyone looking for exploits has to start from scratch except “scratch” is now a place where any useful piece of software has been fuzz tested, property t…

What we are seeing so far come out of the AI agent era is reduced not increased code quality. The few advances are by far negated by all the slop that's thrown around and that's unlikely to change. > any useful piece of software has been fuzz tested, property tested and formally verified. That would require effort. Human effort and extra token cost. Not going to happen, people want to rather move fast an break things…

>What we are seeing so far come out of the AI agent era is reduced not increased code quality.

I am not disagreeing in the main, but I wonder about the net effect. Again, this is total speculation on my part. If I vibe-slop a half dozen apps this week (and I might, just you watch), the overall raw code quality in the universe got worse. But if in the space of the same time, two major security holes got patched (assume there was no net amount of code changed), didn't things actually get better?

Re: Maybe you shouldn't install new software for a bit

#418

Post by himata4113 »

BobbyTables2 wrote: post #95
himata4113 wrote: post #44

Earlier quoted context omitted.

this, this is something I don't understand there are a billion ways to gain root once you control the user that regulary uses sudo. this is only scary for rootless containers as it skips an isolation layer, but we've started shipping distroless containers which are not vulnerable to this due to the fact that they lack priviledge escalation commands such as su or sudo. never trust software to begin with, sandbox every…

I doubt your “distroless” container is any safer for this vulnerability . Infecting sudo just makes for a quick demo. If your container has different processes at different user ids, the exploit would still be effective. It would likely also be able to “modify” read only files mapped from the host.

distroless rootless containers don't have the syscalls enabled to do anything reasonable with this exploit

Re: Maybe you shouldn't install new software for a bit

#419

Post by junto »

Reminds me of the old adage “I don’t need to outrun the bear. I just need to outrun you.”

Once everyone takes the stance of waiting 2 weeks, we are all back to the same situation.

I don’t like the suggestion to “wait for others to be the unfortunate victims, so that I can benefit from their misfortune”.

Surely there’s a better way.

Post reply on HN