Using password login renders this vulnerability useless.

This isn't the case, though I can see how the article could lead you to believe that.

It's directly based on password rather than key input. The entire vulnerability is that typing a password longer than 256 characters automatically defaults to crypt() outputting the * character instead of a normal password hash, which is coincidentally the same default character used as the "hash" (not actually a value you could get from a normal hash, intended to be impossible to get from any normal password for that reason) for the built-in daemon account.

When the Ars Technica article says "Second, the target system account must be configured to be passwordless", what they mean is the default daemon account, which has a hash set to * by default, and thus wouldn't normally be accessible via any hashed password... unless you happen to find out that the system chooses to not make a hash, and just send * if you type more than 256 characters.

Look at https://sshhole.com/ if you want the details.

Plus, if not officially released and confirmed to be accurate via the normal legal processes, it's very hard for any journalists to report on the new findings without being sued for defamation by those accused claiming it was "doctored" or "fake".

It isn't really a specific font, just something AI models made to generate images have picked up on. Things that were immediately attention grabbing and bold probably got more positive scoring and reinforcement during training, so they learned to use larger more dramatic styles (this is also why you often see sort of electric or fiery glows, sparks, dramatic lighting, etc) but that doesn't really work to help a business stand out when all of them now look like that.

I'm also not sure if everyone knows this yet, but most AI image generators nowadays are split into two parts. It used to be that you'd need a prompt like poster, graphic, promotional, large text, dramatic, brushstroke font, on sign, city background, club background, microphone, This Font is the New Comic Sans bold text, high quality, but since most people do this shit through something like ChatGPT, and might just say "make me a poster that says 'This Font is the New Comic Sans'", in the background, an LLM takes that prompt and makes a more extended prompt for the image generator.

This is where a lot of this type of thing probably takes place. For example, I prompted an AI model with Convert this prompt: "Make me a poster for my nightclub" into a Stable Diffusion prompt for a poster, and it gave me: nightclub event poster, bold neon typography, vibrant magenta and electric blue lighting, silhouetted dancers in motion, smoke and laser beams, glowing geometric shapes, dark moody background, high contrast, synthwave aesthetic, centered composition, space reserved for event title and date, ultra detailed, sharp focus, professional graphic design, 8k (emphasis added by me)

Nightclub posters do sometimes have these elements, but a lot of them actually use clean typography, little to no neon inside the typography, it just made up synthwave as a relevant aesthetic to the club it knows nothing about, and simultaneously wants a dark and moody background... with something that has high contrast, neon lights, lasers, and lighting everywhere.

Both image generators and LLMs optimize for things that are bold and for excessive additions like you saw in the prompt earlier, which leads to the super sloppy, over the top, crowded designs you see on most AI posters.

I still don’t think it’s useful to look at total spend to each “party” vs the spread of spend from each source and what they are targeting.

Party represents what they are targeting, because party lines are how much of our legislation is defined. For example, low taxes on wealth is associated more with Republicans, and less restriction on abortion rights is associated with Democrats. Even if they may sometimes mix across party lines, they tend to have extremely strong correlations between party and policy, so donating to a given party is effectively donating for the policies they tend to represent.

The largest donors donate vastly more to Republicans than they do to democrats.

If you want individual policy, it lines up.

Big-tech PACs donated 2-to-1 toward Republicans and Republican-aligned ad and influence campaigns in favor of data center construction: https://www.industrialinfo.com/news/article/money-votes-and-data-centers-will-political-spending-overcome-rising-public-opposition-to-data-cente--359789

Billionaires have outspent on ads to fight a one-time billionaire's tax in California 250-to-1 https://www.commondreams.org/news/wealth-tax-opponents-spending

Law enforcement PACs spend lots of money on Democrats... https://readsludge.com/2020/06/24/law-enforcement-pacs-give-millions-to-the-politicians-who-set-their-budgets/ ...and Democrats shift to being more pro-police. https://truthout.org/articles/in-2024-platform-democrats-lurch-right-on-policing-and-immigration/

Again, it's not that these issues don't sometimes mix across party lines, the police spending is a good example of that, but generally speaking when a party receives donations, it's because the donors believe they are supporting that party's political positions.

I think the problem here is that you're addressing an entirely different question.

The question of if someone should report someone who raped them is entirely separate from the potential chance for false allegations.

If someone is raped, they should report it. If someone isn't raped but wants to make a false allegation, real cases of rape being reported won't change that person's decision to file a fake claim.

The entire point here is just "if you are raped, you should report it, even if that could ruin the rapist's life in some way, because they raped you, so they deserve consequences". It doesn't make a judgement call on how we can combat false allegations.

As if the ONLY thing your memory could be used for is running AI models.

Hey buddy, we need this shit to use our BROWSERS or to play GAMES. I have a GPU in my computer that can run most new AI models when quantized at a speed that would be perfectly reasonable for any home user that doesn't want it to literally replace every ounce of their thinking, and I bought that shit before ChatGPT was even a thing, because I wanted to play fucking video games.

I have a NAS with 16 gigs of RAM and a consumer-grade CPU that's a few generations old, and it can still run models with zero GPU or AI accelerator if you give it a little time.

Is it going to be perfectly tuned, and run at the highest possible speed if you design a datacenter just for AI models? Of course it is. But do most people on this planet need that or give a fuck about it? Absolutely not.

Seconded on Tuta. I'm currently pretty locked into the Proton ecosystem, but I have a Tuta account as well, and it's pretty usable if all you really care about is having an email that works. (haven't used their calendar yet, so I can't speak to it)

Definitely less feature-rich than Proton though. Worse spam filter, more basic UI, no auto-categorization of email by topic, etc.

To be clear for anyone who might not want to read the whole article but also doesn't want to rely solely on the headline:

This isn't some new surveillance system that was revealed, or even really unprecedented tactics. This was just a larger number of HSI agents assigned to tracking activists, infiltrating meetings and chats, etc than the number previously assigned to investigate suspected foreign influence on the "New Left" and anti-Vietnam War movement. (which had 42 officers at its peak, vs the Minnesota 15 case having 119)

Better than iPad kids. Not ideal obviously, but still far better.

iPads (and mobile devices/OS's generally) are designed to be as simplistic and easily understood as possible. They abstract away complexity, have to make menus less cluttered and make buttons larger to accommodate how people use them, and the lower power processors also mean less functionality than desktop-based systems.

If you grow up using less shit, you'll learn how to use less shit.

Maybe try Ente then?

Haven't used it before myself, but I've heard good things, and it does have a memories feature, and it seems at least based on the examples on their website that it might generate something more than just "today x years ago".

Unsure to what degree it works though, and unfortunately Ente is also a paid service (though it is privacy focused, and I believe it has a FOSS app too)

Seems like "Smart Memories" are on the roadmap for Immich though, so you might just have to wait a bit and can then switch once they're there:

There aren't really any other mature options out there for self hosted, or even just private Google Photos alternatives in my experience, so you're kinda just stuck with Immich for the most feature-complete replacement, and Ente for a more "just works" private but not self-hosted one. Everything else is basically just a glorified file browser, but maybe with some smart searching or better media codec support.

Both Tuta and Proton have iOS apps of their own.

I don't believe either can be used inside the native iPhone Mail app, since they use encryption schemes, which aren't standard in any commonly used spec for mail apps, so no regularly available mail app can act as a frontend for Proton/Tuta, because no regularly available mail app "speaks" their encryption. (though on PC, Proton does have a Bridge application that can essentially perform the job of a translator in that case, but again, only for PC clients)

One thing to note on this is that after a week, Google told me that my account might be compromised, severed the link between Gmail and my Proton account, and forced me to log back in to my Google account on my computer.

I reconnected to Proton and it did it again a couple weeks later. Not sure if it's fixed. (or working as intended)

Gmail Forwarding is the old feature that just forwards mail, and that seems to work fine without ever kicking you off, it's only Gmail Connection (which allows sending emails from your Proton mail and having them send from your Gmail address) that's done it for me so far.