[1] https://www.bbc.com/news/articles/c3rz1nd0egro

[2] https://quitgpt.org/

It doesn't matter how efficient your kernel or DE is if users expect to be able to load bloated websites in Chrome.

With their recent hostilities regarding age verification [1], there has been a lot of interest in alternatives.

The only problem is people are used to all the features discord provides, and alternatives [2] currently are nowhere near feature parity.

[1] https://discord.com/press-releases/discord-launches-teen-by-...

[2] https://www.teamspeak.com/

The biggest downside for me with Cursor was losing access to gated Microsoft extensions like Python and C#. Even when vibing there are times you will still need a debugger or intellisense.

I note in the comments lots of people saying they are moving back and this latest move looks like the final nail in the coffin for Cursor.

The issue is that code then extracting secrets and data from your organisation, ie. data exfil.

raw.githubusercontent.com can not be used to submit data to, it's read only, but github.com obviously can.

Note, if you really needed github.com access in your application or environment, then you need to use SSL interception (using squid or a firewall) and allow certain URLs and methods ie. GET requests only from your organisations path, to make it safe.

If they want to drill down to flaws that only affect a particular language, then they could add a regex for that as well/instead.

This needs to be done (as we've seen from these recent attacks) in your devenv, ci/cd and prod environments. Not one, or two, but all of these environments.

The easiest way is via using something like kubernetes network policies + a squid proxy to allow limited trusted domains through, and those domains must not be publicly controllable by attackers. ie. github.com is not safe to allow, but raw.githubusercontent.com would be as it doesn't allow data to be submitted to it.

Network firewalls that perform SSL interception and restrict DNS queries are an option also, though more complicated or expensive than the above.

This stops both DNS exfil and HTTP exfil. For your devenv, software like Little Snitch may protect your from these (I'm not 100% on DNS exfil here though). Otherwise run your devenv (ie vscode) as a web server, or containerised + vnc, a VM, etc, with the same restrictions.

Another silly (compression-based) idea I had was to:

- Index say google images, or something else with a large amount of URL -> data

- Find patterns in the indexed data that match patterns in your data, such that storing the URL and an offset into the data (or something more complex) would be smaller than the data chunk you are trying to compress

- Repeat for all chunks

- After you're done you can run it again and again. Infinite compression!

Yes the user has to download WAY more data that what they are trying to extract, and you'd need an insanely large index to be able to compress, but hey it was an idea.

After seeing how easily California bent OS developers (commerical and open source) to comply with their local laws, Canada decides they will go one further. They aren't happy with a simple date field that can be easily fudged. So they pass a law that requires all OS's to continually scan the biometrics of users using the OS. ie. Camera if it has one, fingerprint reader once an hour, voice analysis, etc.

They also refuse to allow computers to be sold in their country unless OS developers comply with their law.

Do you think you'll see such enthusiam to comply? Or will the line be drawn at some point?

If someone wants to introduce an age-verification-ca-module, fine, but not make it core. Yes I understand systemd is not the kernel, but its ubiquitous enough.

That just says to every country around the world; Windows, Mac, and even Linux is on board too, let's make it law also!

I dunno, I always expected Linux to be the last bastion of freedom and not to capitulate so easily.

If I saw that badge on someones github I would think it had something to do with lorem ipsum text generation, rather than anything to do with AI.

So if I'm locked out of my 365 sysadmin user by this, what then?

Hopefully disabling the hardened memory allocator, as suggested by the article, holds them off for a while..

[1] https://news.ycombinator.com/item?id=47156925

If you use AI to make repetitive tasks less repetitive, and clean up any LLM-ness afterwards, would they notice or care?

I find blanket bans inhibitive, and reeks of fear of change, rather than a real substantive stance.