• 3 Posts
  • 50 Comments
Joined 2 years ago
cake
Cake day: June 18th, 2023

help-circle


  • If I’m getting back to a game with gear treadmill, I can just clean uo my inventory and start the next exoansion with a clean slate.

    I have around 70% of the world cleared, several characters leveled to max, but I got through kike half of HoT and a bit of Path of Fire. I opened my full inventory that had a lot of random crafting stuff, consumables a a gew gear sets and I had no idea what’s anything for, or what am I even supposed to do next. Did a few quests then gave up in trying to sort it out, since it was just too overwhelming.

    I’ll probably give it a try again, love thw game.



  • Definitely, but the issue is that even the security companies that actually do the assesments also seem to be heavily transitioning towards AI.

    To be fair, in some cases, ML is actually really good (i.e in EDRs. Bypassing a ML-trained EDR is really annoying, since you can’t easily see what was it that triggered the detection, and that’s good), and that will carry most of the prevention and compensate for the vulnerable and buggy software. A good EDR and WAF can stop a lot. That is, assuming you can afford such an EDR, AV won’t do shit - but unless we get another Wannacry, no-one cares that a few dozen of people got hacked through random game/app, “it’s probably their fault for installing random crap anyway”.

    I’ve also already seen a lot of people either writing reports with, or building whole tools that run “agentic penetration tests”. So, instead of a Nessus scan, or an actual Red Teamer building a scenario themselves, you get a LLM to write and decide a random course of action, and they just trust the results.

    Most of the cybersecurity SaaS corporates didn’t care about the quality of the work before, just like the companies that are actually getting the services didn’t care (but had to check a checkbox). There’s not really an incentive for them to do so, worst case you get into a finger-pointing scenario (“We did have it pentested” -> “But our contract says that we can’t 100% find everything, and this wasn’t found because XYZ… Here’s a report with our methodology that we did everything right”), or the modern equivalent of “It was the AI’s fault”, maybe get a slap on the wrist, but I think that it will not get more important, but way, way more depressing than it already was three years ago.

    I’d estimate it will take around a decade of unusable software and dozens of extremely major security breaches before any of the large corporations (on any side) concedes that AI was really, really stupid idea. And at that time they’ll probably also realize that they can just get away with buggy vulnerable software and not care, since breaches will be pretty common place, and probably won’t affect larger companies with good (and expensive) frontline mitigation tools.


  • I have worked as a pentester and eventually a Red Team lead before leaving foe gamedev, and oh god this is so horrifiying to read.

    The state of the industry was alredy extremely depressing, which is why I left. Even without all of this AI craze, the fact that I was able to get from a junior to Red Team Lead, in a corporation with hundreds of employees, in a span of 4 years is already fucked up, solely because Red Teaming was starting to be a buzz word, and I had passion for the field and for Shadowrun while also being good at presentations that customers liked.

    When I got into the team, the “inhouse custom malware” was a web server with a script that pools it for commands to run with cmd.exe. It had a pretty involved custom obfuscation, but it took me lile two engagements and the guy responsible for it to leave before I even (during my own research) found out that WinAPI is a thing, and that you actually should run stuff from memory and why. And I was just a junior at the time, and this “revelation” got me eventually a unofficial RT Lead position, with 2 MDs per month for learning and internal development, rest had to be on engagements.

    And even then, we were able to do kind of OK in engagements, because the customers didn’t know and also didn’t care. I was always able to come up with “lessons learned”, and we always found out some glaring sec policy issues, even with limited tools, but the thing is - they still did not care. We reported something, and two years ago they still had the same bruteforcable kerberos tickets. It already felt like the industry is just a scam done for appearances, and if it’s now just AIs talking to the AIs then, well, I don’t think much would change.

    But it sucks. I love offensive security, it was really interresting few years of my carreer, but ot was so sad to do, if you wanted to do it well :(




  • For me, the issue isn’t as much that they are forcing the data collection (on some/free people, to be clear).

    I have issues with the way they are spending their development money, that I give them for the product. I don’t care about the AI hype slop, that apparently can’t even get good results (which they outright admit in the blogpost), instead of actually making the core features of the editor better. Everyone knows at this point it’s a hype bubble that will never be usable, and they are grasping at straws.

    I don’t want to pay 200$ a year only for them to add a dumb chatbot and data collection into my IDE, or make the code completion dumber and random instead of actually being deterministic. So I don’t, canceled my subscription and I’m sticking to the perpetual license while slowly switching to nvim. But I can still make fun of them about it. I have been recommending JetBrains products for most of my life, and they have disappointed me with the direction they are going, so I’ll make sure to un-recommend it.


  • The context is that they made a blogpost that’s written in, at least in my opinion, extremely pleading tone. They are basically crying that they can’t make a good AI with public data, and if you please could turn on their new AI data collection that would steal all your code. I’ve seen a few “we will use your data for AI” posts, and this was just unsettling, with the tone in which it was written.

    I can’t really say why, but I find this style of communication pretty unsettling. It does have exactly the same wibe as the picture in the post.

    So, if you pay for their IDEs, nothing changes, but you can opt-in into them using your data for AI training, and they are pleading you do. If you use the free version, it’s opt out and turned on by default.


  • I don’t think it’s misleading, or at leas the point was not to imply that they are forcing the data collection (which they are, for free users, but it is opt-out). The point is that they are actually downright emotionally manipulating in the blogpost. The blogpost in which they announce it, at least in my opinion, is written in exactly the same tone as the picture. They are basically crying that they can’t make a good AI without stealing your private data, pleading you to turn it on.

    I’ve seen a few similar posts of products announcing AI data collection, and this one was the most unsettling, hence the meme.


  • This was one of my biggest issues, but I did manage to succesfully switch to nvim few months ago, by installing ideavim into Rider, vscode-vim into vscode (so I can’t easily escape it when I get lazy), but most importantly - setting LazyVim as my default editor, which has been a lifesaver.

    It has a pretty good LazyExtras interface for easily installing a ton of plugins, almost for every language. You just open the LazyVim menu, select a language you want, and it installs LSPs, debuggers and whatnot you may need for it. It’s probably using the nvim-lspconfig mentioned in other comments, but it has been pretty seamless.

    But any other pre-made nvim config will work, this one is just more approachable than someone’s random plugin list.


  • That’s exactly what I did, switching from Rider. LazyVim helped with getting a usable setup (especially LSPs are pain to setup without it), https://www.vim-hero.com/ taught me the absolute basics of navigation, and then I simply installed IdeaVIM into Rider to force myself to use it, and switched my default editor to LazyVim.

    It has already been a few months, and I’m pretty used to it. I still fumble here and there, I still have to stop and think then doing more involved operations, but for the basic editing I wouldn’t go back.

    The most important observation I have is that it does not make me more efficient at editting text, the fumbles and mistakes usually offset any gains I have from the many navigation/jump/repeat keys, and reaching for the mouse would be quicker, but -

    It’s super fun. Learning new motions is satisfying, you can see progress, and by slowly adding a new motion, then trying to get it to your muscle memory is simply fun. And there’s always something to learn, a new motion to add or make more efficient. It’s basically gamified text editting, and if you like mastering things in the muscle memory sense, it’s awesome. I’d absolutely recommend everyone to make the switch, but not for “being a faster/more efficent at text editting” reason, because if you want that, learning every single IDE keybind will make you faster faster.

    Also, it’s surprisingly comfortable not having to reach for a mouse. It has only been a few months, and I’m getting slightly annoyed whenever a program doesn’t have a hotkey for proper navigation and I have to touch my mouse, hah.








  • My absolutely favorite take about art is the one from the edge of the 19->20th century, where they got obsessed about art having to be absolutely separated from reality, to be even worth considering, since that would only taint it, and just be perfect.

    So in that case, I have no issues with separating the art from the artist. Or, since they also tried to make art out of their lives (the whole dandy thing), which made basically professional posers, I also don’t mind separating morality/reality from the artists and viewing their life as art. For example, Motley Crue were extremely bad people to be around, but their lifestyle was portrayed well enough that it does sound kinda fun (as long as you don’t actually live like that in reality), so I don’t judge and kind of appreciate them trying.

    On the other hand, if someone is a dick as an artist without their behavior being refined enough to pass as an art/pose/dandyism, I make sure to not give them any money whatsoever, or promote their products, and just shittalk and laugh at them. Even if their actuall art is good, which I will probably enjoy, but will definitely not pay for.

    Is it a good take on the question that makes sense? Probably not, but it does work for me.


  • Is it a problem anymore with proton?

    Or rather – is testing the game on Linux via proton sufficient, or do you actually look for native Linux builds?

    I’m honestly interested as a dev who recently released my game I worked on free time, and I decide to go the route of single Windows build + proton, since it makes the build and release process a little bit easier, since I have a custom CI/CD pipeline and adding a Linux support into it would take some time.

    And as someone who has a Linux as a daily driver and game only on Linux, having the game run on it was important to me, but I honestly didn’t see a reason why go with a native build and the additional trouble it would cause with testing - because now I can just test one windows build on my Linux desktop through proton, and be fairly sure that it runs OK on both.