The sad thing is that the families of teenagers which killed themselves after encouraged by their chatbot might not see a cent of compensation. I would feel better if they were paid from the personal possessions of the ex managers.

The whole “ai” industry is as uninsurable as nuclear power. Maybe that’s why they are so wild after software generation: Software is still in many cases exempt from liability, as long as it is not a Boeing 737 Max that your buggy code crashes.

Is it true that more experienced / knowledgeable / capable people, if at all, have more of an advantage from it, than juniors?

And on the other hand, it seems to me that these things are designed to take things out of our hands - “let me write that difficult email for you”, and so on…

deleted by creator

I do not want to cite Hickeys text because it is brilliantly written and grabbing some phrases would diminuish it. Go and read it.

The tl;dr of his argument is this: “Tools” are something that we fully and directly control and that enhances our abilities. Large Language Models are neither.

Passkeys big bonus is that they are far more phish-resistant than pretty much any other MFA out there.

So, what is actually the threat model? And does it justify to take away user’s control over keys?

anything PGP is highly questionable in 2026.

PGP has nuisance usability, but I do have control over my keys.

FAANG companies are not using “bait and switch”?

Do you have control how Google implements that, or a remedy if they suddenly include attestation?

Passkeys big bonus is that they are far more phish-resistant than pretty much any other MFA out there.

How do you recover if you lose a passkey? By a link in an email sent to you?

These things are not safer than the weakest link in your chain. And not easier to recover than the hardest link in your chain. With a bit bad luck, you get something that is easy to hack, and impossible to recover.

This is not a ringing endorsement of either passkeys or 1password, but bad releases do happen.

Can’t remember when a piece of paper I have in my purse failed to tell me an important password.

Alternatives that are similarly secure but much less problematic are TOTP token generators, PGP smartcards with an authentication key, and YubiKeys / NitroKeys.

:-D

Do yourself a favour. I am so glad I got rid of NVidia stuff.

If your stable release can’t handle proper updates over its stable content, then get a better stable distro.

It is not necessarily the distro. Apart from NVidia drivers breaking and breaking grub dual boot configurations, I had most problems with GNOME upgrades.

But the key question is: Is it better to have rare, bigger changes, or frequent, smaller changes? For desktop and development, my experience slightly favours the latter. For servers, I had no problems with the Debian model.

The fact that business people use language and words to diffuse bullshit does not mean that words have not a meaning. In contrary, language is important, and we should wrestle to express thoughts clearly. Rich Hickey is much better at that than the average person, e.g. see his youtube talk “Spec-ulation” on versioning and compatibility, or his thoughts on identity and state in programming.

Also it’s madness that systems like these are connected directly to the internet without read-only permissions implemented.

Water systems in the US are, too. And they have been hacked.

The whole field is evolving, there is the EU Cyber Resiliency Act and some provisions for critical infrastructure.

Search YouTube for “Michael Hastings Accident”.

Don’t worry. It is surely only a misbehaving LLM…

Perhaps the sweet spot is “stable rolling release” like SuSE Tumbleweed Slowroll or Void Linux?

In any case, I am using both Debian and Arch for 15 and 10 years and had a bit less problems with Arch on the Desktop than with Debian.

I believe the key point is perhaps backwards compatibilty, not freezing system parts; and rolling release systems seem to foster backward compatibility. To underline that: When did you worry the last time that a Linux kernel version bumb would break your system?

One distribution which stands out in its philosophy is Guix. It is entirely reproducible and stresses that anyone can built it from reviewable source code. This is so important that non-free firmwares are rejected (which gets them a lot of hate and negative astroturfing). That gives a lot of transparency and a solid base for trust.

Now, accepting vibecoded, unreviewable packages would make the whole buildable-from-source aspect moot, so I guess they are unlikely to accept slop packages.