I think that’s distinct from what the user is trying to do. They are trying to play audio and video on the machine that’s running the ssh server, by outputting video over HDMI from the graphics card and sound over the 3.5 mm jack. There’s no X forwarding to the ssh client going on.

Aha, ok, so it’s using pipewire when logged in locally, and it can’t find it when using it remotely.

Can you try logging in via ssh again and checking if there’s a /run/user/$UID/pipewire-0 (or other pipewire-<NUMBER> sockets)?

If there isn’t, that means your pipewire service isn’t running, you can try starting it with systemctl --user start pipewire wireplumber. You may need a loginctl enable-linger $USER and a re-login for that to work. You can also do systemctl --user enable pipewire wireplumber so that it auto-starts them whenever you log in, if that’s not already the case.

If/once that socket is there, you may need to export XDG_RUNTIME_DIR=/run/user/$uid so that mpv can find the socket. You should probably do that in your .profile so it’s set automatically.

Can you show the output for when you’re running it while physically logged in, particularly the AO: output?

Yeah, I actually screwed that up a bit, the average is closer to 7.6 $/gal, and 8.9 $/gal for diesel.

Hopefully this means more trains and bike lanes, rather than switching to EVs.

EU average is about 6.5 $/gal. And I think that’s still way too fucking cheap for the amount of harm it does to the planet

The main outcome from this is that it forces the companies to not out-source the development/maintenance/support to AI. If they do, they are literally no different from just self-hosting this and asking your own LLM for help, which is going to be cheaper.

As usual, automation actually reduces the rate of profit in the long run.

This is probably the most realistic goal of the movement.

But in all seriousness, they’re still unmaintaible slop

They are definitely more user-friendly and community-maintainable than the closed-source originals.

Originals are either binaries you can’t modify, or completely black-box inaccessible software someone else runs which you only interact with.

Having some source code which does almost the same thing, even if it’s buggy, is much better than having nothing at all.

Of course AI has its own issues and the resulting software is pretty bad. It is a great starting point to be improved tho.

Nah, security is one front where a browser is actually slightly better than simply running natively

That said you can always just bwrap whatever you’re running for a similar level of isolation.

People out there reinventing native software from first principles

Nah, he’s just a capitalist highlighting the contradictions. Capitalism doesn’t mean “you get to own stuff”, on the contrary it means that property is increasingly concentrated in the hands of the few because of exponential accumulation.

In other words, he is right that centralizing computation is more efficient in the physical sense. But under capitalism it’s also a means to further take away control from the working class and rent-seek us to hell.

Even though framework is questionable as a company, I really like their quip of “Seize the means of computation”. I know it’s just a way to sell more hardware but this news got me thinking about other ways to interpret it.

Operator overloading is awesome in a functional language. Haskell allows for a lot of creative stuff with operators, but since they can’t have side effects, must conform to predictable types, and have specific requirements they are somewhat understandable. Idris is also very ergonomic when it comes to operators.

C++ allowing a library to override the + operator with system("rm -rf /") is a lot less awesome.

With the rate of CVEs coming up, feels like I’ll have to switch to nixpkgs staging and just compile everything myself gentoo-style for my server.

I also write less and less code for my job nowadays, increasingly just sketching out the architecture and most important/unique code paths, letting the LLM fill in the boring details, and cleaning up the idiotic things it hallucinates sometimes.

However,

Nobody in my team writes code anymore. Things that would have taken days are now done in minutes. We are all just considering design and architecture. We are changing our processes since they are not fit for the new way of doing things. Scrum? What’s even the point anymore? We can work through a sprint-backlog that would’ve taken two weeks in two days now. We do reviews 90% of the time. When we request changes they come back in minutes.

That… kinda sounds good? I mean, we have extracted the boring repetitive boilerplate and can focus on actually getting things done. LLMs can expand your thoughts into code that you would have written much faster than you can. You still know how to write that code (well, you should anyway) so I don’t see much of an issue there.

If you liked doing the parts that are no longer necessary, there’s plenty of FOSS software you can contribute to, or just start your own pet project! In those situations there is no financial incentive to replace your typing skills with a token predictor, you can write everything by yourself, and it helps keep your skills fresh in order to not miss hallucinations or bugs.

LLMs come with a lot of ethical issues but they can also be an awesome tool to make your job more interesting. It just depends on what you like doing and from which perspective you look at it.

Good thing she wasn’t a GTK girl

all i can say is that i need to log into outlook to log into teams, because logging into teams directly is broken, but the cross site cookie work…

Thankfully I don’t even have an MS account, but I do implore you to check out the cookies and see for yourself that they will have a specific list of domains they are valid for.

Open the browser developer menu on an Outlook tab (F12), navigate to “Storage” → “Cookies” (may be named slightly differently in different browsers), and look at the “Domain” column in the table.

and reading stuff like adFection really doesn’t instill confidence in opening random websites.

The problem there is website operators selling their adspace to a literal israeli spyware company, which meant injecting adversarial javascript into their own pages. It was not a case of “user opening a random link”, rather it was the website operator themselves forwarding the user malicious JS from the “ad company”. As a user there’s generally nothing you can do to prevent this kind of attack where the website itself was compromised; besides, without another vulnerability/attack vector the impact will be limited to the website in question.

No, you generally should not be worried about that.

Generally the worst thing that a website can get from you just opening a URL is (1) whether or not you’re logged in to google/facebook/etc, (2) your advertisement profile/who you are, (3) roughly where you are. All those are privacy issues, not a security issue, hence not very related to the “cybersecurity course”, and only the first one is tangentially related to being logged in.

You should of course use various anti-tracking measures, e.g. an adblocker, “resist fingerprinting” in Librewolf, user agent faker, a good VPN, etc. That will reduce the exposure to all 3 issues above, but once again those are not security problems.

You should also never download random bullshit to your computer. Having an actual file on disk outside the browser sandbox could indeed be an issue. You could simply forget where it came from and decide to execute it one day, or there could be some bug in some app on your OS which could trigger a code execution exploit.

However, if your browser shares authentication details with random websites like what you are describing, you should stop using it immediately.

Cookies are specifically separated out per-domain. Your browser will not give a random website access to your auth cookies/localstorage for other websites. There are some awful companies which do set cross-website cookies (e.g. facebook, google, and other adware), but (1) those cookies are not auth credentials and are used mostly for fingerprinting and ad targeting, (2) should be filtered out by your browser’s tracking protection (hence “if your browser is set up correctly”).

Realistically there is still be a way for the website to fingerprint you enough to know who you are even without cookies, so the most adversarial outcome from clicking a link is that the attacker can know that you clicked that link, along with your general location (from geoIP) and some device info.

iirc that’s how the linux tech tips channel got into trouble.

Nah, that was pretty much an .exe sent out by a fake sponsor, which was downloaded and executed. It then stole all browser data (including google auth cookies). Opening a link ≠ running an unsandboxed exe.

There’s usually nothing wrong with just clicking a link (if your browser is set up correctly). The problem begins if you actually enter any sort of information in a random website or something.

“a little worrisome” is understating it by a lot