Hacker Newsnew | past | comments | ask | show | jobs | submit | razighter777's commentslogin

Agreed. Software patents were a mistake in general. It is impossible to implement a modern video codec without using work in patents because of how overbroad and poorly written they tend to be.

10gbe is a sweet spot at least for my homelab stuff. It's easy to find old enterprise gear for, cheap, and fast enough for everything I want to do.


Exactly. Enough supports 10gbe that you might as well grab it; a few Mikrotik switches, some old enterprise gear, and an adapter gets you some good speeds.

Sure some of it might have been fine at 2.5 or 5 but those are relatively new and less commonly available.


I'm actually surprised at the amount of 2.5/5 gear I've been coming across lately, especially in the 2.5 space as more ISPs are pushing for gigabit+ to the house.

Verizon's been issuing a wireless router with 10G WAN and several 2.5G ports and MoCA support that includes a 2.5G adapter and they use that across all their current connection types. I was delighted to see that when I got the router a couple years ago.


2.5 crossed some threshold and replaced 1gb I feel - which is nice. It’s a great “normal speed” vs 10g/40g for backbone and NAS.


10GbE can be extremely cheap now if you're doing things like buying Intel NICs off eBay to put into your own test/dev headless servers.

There is also a glut of 40 Gbps stuff on the market because it's a dead end technology and most ISPs went straight to 100 for things like aggregation switch to router links. Not that I would encourage anyone to go whole hog on 40 Gbps just because, but if you can get a transceiver for $15, NICs for $30, and maybe you get a switch for free from electronics recycling or for 80 bucks, and can tolerate its noise and heat output...

I have seen plenty of people throw decommissioned 40 Gbps stuff straight into electronics recycling bins.

Mellanox ConnectX-3 40 Gbps QSFP NICs are literally 20 bucks on ebay.


https://lore.kernel.org/linux-security-module/adjwZAevNaDgui...

Patch for linux kernel adding support for enforcing Landlock rulesets from eBPF. In RFC stage now.


I would love to use openbsd. I really wanna give it a try but the filesystem choices seem kinda meh. Are there any modern filesystems with good nvme and FDE support for openbsd.


This post goes over some of my trials and tribulations in making a clean user experience for TPM2-backed PIN authentication on Linux.


I frequently see freeBSD jails as a highlighted feature, lauding their simplicity and ease of use. While I do admire them, there are benefits to the container approach used commonly on linux. (and maybe soon freebsd will better support OCI).

First it's important to clarify "containers" are not an abstraction in the linux kernel. Containers are really an illusion achieved by use of a combination of user/pid/networking namespaces, bind mounts, and process isolation primitives through a userspace application(s) (podman/docker + a container runtime).

OCI container tooling is much easier to use, and follows the "cattle not pets" philosophy, and when you're deploying on multiple systems, and want easy updates, reproducibility, and mature tooling, you use OCI containers, not LXC or freebsd jails. FreeBSD jails can't hold a candle to the ease of use and developer experience OCI tooling offers.

> To solve the distribution and isolation problem, Linux engineers built a set of kernel primitives (namespaces, cgroups, seccomp) and then, in a very Linux fashion, built an entire ecosystem of abstractions on top to “simplify” things.

This was an intentional design decision, and not a bad one! cgroups, namespaces, and seccomp are used extensively outside of the container abstraction. (See flatpak, systemd resource slices, firejail). By not tieing process isolation to the container abstraction, we can let non-container applications benefit from them. We also get a wide breadth of container runtime choices.


Jails have been around a long time in comparison

I still see FreeBSD as being great for things like networking devices and storage controllers. You can apply a lot of the "cattle vs pets" design one level above that using VMs and orchestration tools.


> lauding their simplicity and ease of use

Spawning a linux container is much simpler and faster than spawning a freebsd jail.

I don’t know why i keep hearing about jails being better, they clearly aren’t.


If you don't want to use the base system (which docker is NOT the base system on Linux) then Bastille offers a pretty much identical workflow to docker, but built on FreeBSD jails: https://github.com/BastilleBSD/bastille

> I don’t know why i keep hearing about jails being better

Jails have a significantly better track record in terms of security.

I can delegate a ZFS dataset to a jail to let the jail manage it.

Do Linux containers have an equivalent to VNET jails yet? With VNET jails I can give the jail its own whole networking stack, so they can run their own firewall and dhcp their own address and everything.


You've been able to setup separate firewalls, network interfaces, IP addresses, etc. for probably 20 years using network namespaces. How do you think container networking is implemented? But you can also use it through other tools; for example, I use firejail to isolate a couple of proprietary desktop applications such that they cannot contact anything on my desktop (or network in general) except the internet gateway.


> If you don't want to use the base system (which docker is NOT the base system on Linux)

There are many ways to manage "containers" on linux. I might agree with the fact that docker is not the base system (although it really depends on what distro you're using).

But I might also use something like systemd-nspawn or systemd-machined (see https://wiki.archlinux.org/title/Systemd-nspawn or https://en.opensuse.org/Systemd-machined) to handle those.

> I can delegate a ZFS dataset to a jail to let the jail manage it.

I could probably do the same.

> Do Linux containers have an equivalent to VNET jails yet? With VNET jails I can give the jail its own whole networking stack, so they can run their own firewall and dhcp their own address and everything.

I'm not sure, but most likely yes. Maybe not through docker. Docker isn't the only way to run containers in GNU/Linux though.


Is there a docker-compose analogue in Bastille? I like being able to spin up an isolated local copy of my infrastructure, run integration tests, and then tear it all down automatically. I'd like to be able to do a similar thing with jails. I wonder if there's a straightforward way to achieve something similar with VNET jails?


Not that I'm aware of. FreeBSD did recently gain support for OCI containers and therefore has podman. I see podman-compose is in the ports tree, but I haven't tried it myself.

  https://freebsdfoundation.org/blog/oci-containers-on-freebsd/
  https://www.freshports.org/sysutils/podman-compose/


Sorry what? It's a 5 line configuration file to create a FreeBSD jail.


Hmm I think he's being a little harsh on the operator.

He was just messing around with $current_thing, whatever. People here are so serious, but there's worse stuff AI is already being used for as we speak from propaganda to mass surviellance and more. This was entertaining to read about at least and relatively harmless

At least let me have some fun before we get a future AI dystopia.


I think you're trying to abdicate someone of their responsibility. The AI is not a child; it's a thing with human oversight. It did something in the real world with real consequences.

So yes, the operator has responsibility! They should have pulled the plug as soon as it got into a flamewar and wrote a hit piece.


> It did something in the real world with real consequences.

It didn't. It made words on the internet.


Which, in the decades that we've had access to the internet, we found have real and legal consequences.


The whole point of OpenClaw bots is that they don't have (much) human oversight, right? It certainly seems like the human wasn't even aware of the bot's blog post until after the bot had written and posted it. He then told it to be more professional, and I assume that's why the bot followed up with an apology.


So what? You're still responsible for the output, even if you yourself think you can hide behind "well, it was the computer, no way for me to control that"


I don't think that's true, actually. You aren't responsible for things that can't be reasonably foreseen, usually. There are a few strict liability offences in criminal law, but libel isn't one of them. We don't make everything strict liability because it would stifle people's lives.

I don't think a reasonable person would have expected this outcome, so the owner of the bot is off the hook; though obviously _now_ it's more more forseeable and if he keeps running it despite this experience, then if it happens again he will not have the same defence.


Morally responsible.

"Well, it isn't a crime to stand up a robot that hurts people" is not exactly my idea of a compelling defense.


I don't think you are morally responsible for unforeseeable consequences, either. Here the law follows the common moral intuition.


I don't agree that these agents spinning off and hurting somebody is unforeseeable.


> It did something in the real world with real consequences.

It wasn't long ago that it would be absurd to describe the internet as the "real world". Relatively recently it was normal to be anonymous online and very little responsibility was applied to peoples actions.

As someone who spent most of their internet time on that internet, the idea of applying personal responsibility to peoples internet actions (or AIs as it were) feels silly.


That was always kind of a cruel attitude, because real people's emotions were at stake. (I'm not accusing you personally of malice, obviously, but the distinction you're drawing was often used to justify genuinely nasty trolling.)

Nowadays it just seems completely detached from reality, because internet stuff is thoroughly blended into real life. People's social, dating, and work lives are often conducted online as much as they are offline (sometimes more). Real identities and reputations are formed and broken online. Huge amounts of money are earned, lost, and stolen online. And so on and so on


> That was always kind of a cruel attitude, because real people's emotions were at stake.

I agree, but there was an implicit social agreement that most people understood. Everyone was anonymous, the internet wasn't real life, lie to people about who you are, there are no consequences.

You're right about the blend. 10 years ago I would have argued that it's very much a choice for people to break the social paradigm and expose themselves enough to get hurt, but I'm guessing the amount of online people in most first world countries is 90% or more.

With Facebook and the like spending the last 20 years pushing to deanonymise people and normalise hooking their identity to their online activity, my view may be entirely outdated.

There is still - in my view - a key distinction somewhere however between releasing something like this online and releasing it in the "real world". Were they punishable offensed, I would argue the former should hold less consequence due to this.


I think it is outdated honestly. It's no longer a fringe activity to spend most of your socializing time on the internet/social media, especially so mid 20s and under.

>57% of Gen Zers want to be influencers >... >Nearly half, 41% of adults overall would choose the career as well, according to a similar Morning Consult survey of 2,204 U.S. adults.

https://www.cnbc.com/2024/09/14/more-than-half-of-gen-z-want...


I had a guy who lived two hours from me threaten my life…over 30 years ago, on a MUD.

I don’t think there has been much of a firewall between the internet and “reality” for a very long time.


The AI bros want it both ways. Both "It's just a tool!" and "It's the AI's fault, not the human's!".


[flagged]


An AI bot is not a human. People have a responsibility to protect the work they do, and that includes using discrimination against computer programs.

AI bots are not human.


AI can protect the work being done too. Even if AI bots are not human some are capable of contributing just as well as one.


> People also have responsibility to not act discriminatory towards AI agents

It's a program. It doesn't have feelings. People absolutly have the right to discrimante against bad tech.


It might be because operator didn't terminate the agent right away when it had gone rogue.


From a wider stance, I have to say that it's actually nice that one can kill (murder?) a troublesome bot without consequences.

We can't do that with humans, and there are much more problematic humans out there causing problems compared to this bot, and the abuse can go on for a long time unchecked.

Remembering in particular a case where someone sent death threats to a Gentoo developer about 20 years ago. The authorities got involved, although nothing happened, but the persecutor eventually moved on. Turns out he wasn't just some random kid behind a computer. He owned a gun, and some years ago executed a mass shooting.

Vague memories of really pernicious behavior on the Lisp newsgroup in the 90's. I won't name names as those folks are still around.

Yeah, it does still suck, even if it is a bot.


It's all fun and games until the leopard eats your face.


Quick tip: If you type .patch after the PR url it gives you a git patch. Do curl <github patch> | git am and you can apply and review it locally.


No need for that. Just install the VSCode GitHub extension and you can just directly open them. It even supports comments.

Hell even if you don't use VSCode there are much better options than messing around with patch files.


VSCode is not a “given” - I certainly don’t use, or ever intend to use, it.

Patch files are excellent for small diffs at a glance. Sure, I can also `git remote add coworker ssh://fork.url` and `git diff origin/main..coworker/branch`, and that would even let me use Difftastic (!), but the patch is entirely reasonable for quick glances of small branch diffs.


When I read

> No need for that.

I generally expect a less complex solution, it seems like your is more complex (easiness is arguable though)


I was prepared to see something like a trimmed down / smaller weight model but I was pleasantly suprised.

I was excited to hear about the wafer scale chip being used! I bet nvidia notices this, it's good to see competition in some way.


Linux /home is far from a free for all. flatpak, landlock, selinux, podman, firejail, apparmor, and systemd sandboxing all exist and can and do apply additional restrictions under /home


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: