Good! I’m looking to ditch most search engines (with the possible exception of Searx) since they have become so inundated with so much junk links. Louis Rossmann mentioned in one of his videos that he pays $20/month for GPT-4 since it fetches better results. But I’ll look into this before I do so. Thanks for sharing this.
Love the sentiment, and I agree, but anti consumer surveillance tech is here to stay, sadly. Can’t tell you how many people in my life have Alexa, FireTV and random shit like that.
Kagi is the only search engine I use which has really good results and no junk links. …and you have to pay for it, of course. It’s a meta search engine but they use their own indexes for news results and Teclis, which indexes small commercial sites with fewer than 5 trackers. One of the cool features it added recently was an icon for identifying paywalled articles.
I’d like to recommend Mojeek, my default search engine, but it still has a way to go. If you’re just looking for an “answer engine” rather than a general search engine…I guess an LLM probably isn’t a bad place to start?
Thanks for mentioning us nonetheless! You can help out with that journey, if you want, by chucking some searches (either new ones or old ones you remember being not so great) into the Evaluation Page and voting.
I tested it a bit a few days ago, but I’ll see if I can give it a more rigorous go today. The ones I’ve found Mojeek to be weak in are bug strings that programs I’m working with spit out. Although I think I’ve had more luck in the past few months.
I’m using it daily but would be open to alternatives (markdown notes that can be synchronised locally between desktop and mobile) since their search (even after recently finding out that Ctrl-P is miles better) is just a desaster.
What I’d want is to do Ctrl-F anywhere to search everything, then get a list of results, click on an entry and get to the line in the note where the searched phrase is, having it highlighted.
Instead you have to click on “All notebooks” on the top left, search, which returns all the notes that have the phrase, click on one of them, search again and hope that it was the correct notebook or try the next one
Ctrl-P does what I want but it’s not highlighting the result which is just a minor inconvenience.
I use Qownnotes with syncthing syncing my notes folder to my phone. I use this notes app on mobile because it is the only one I could find that can access my sd card.
Yeah, tried that a few days ago and gave up on it after trying change the date format to something that wasn’t in their (horribly designed UX wise) options which basically mangled the whole thing. It sounds like a really cool system but I think I’ll wait a few years.
How do you know if it’s open source? Well if it’s called something like “huggingface” or “redpajama” there’s a very good chance it’s made by people who have no marketing department. So good odds it’s free.
ChatGPT is pretty crap branding too, for the record. They just somehow managed to mainstream it. All the LLMs after it try to have cooler names (Bard, Copilot, etc.) but the kludgy first name is still better known.
I’ve honestly been using Linux on and off for nearly 25 years, and daily the past 6 or so…and somehow just found out about this, and now my life is changed.
Either you’re trolling - in which case, sod off back to Reddit - or you have a woeful misunderstanding of how Linux user permissions work.
Please explain how someone might “simply change” someone else’s .bashrc without either already having access to that user account, or root access on the whole machine?
The idea is malware you installed would presumably run under your user account and have access. You could explicitly give it different UIDs or even containerize it to counteract that, but by default a process can access everything it’s UID can, which isn’t great. And even still to this day that’s how users execute a lot of processes.
Regarding Windows all I read is that this “admin permission dialog” is launched in some form of sandbox where no software can access it. Not sure about faking input devices though, and I am also not promoting Windows for Security
True, but that doesn’t necessarily matter if I can compromise the privileged app instead. I could replace it, modify it on disk, or really any number of things in order to get myself a hook into a privileged position.
Just injecting code in some function call which launches malware.exe would do the trick. Ofc signature checks and the like can help here - but those aren’t a given. There’s any number of ways you can elevate yourself on a system based off of user security if your threat model is malicious processes. Linux (and windows) will stop users from accessing each other’s crap by default, but not processes.
Or: supply chain attacks. Now your official app without any modifications is malicious.
If you containerize, the application (malware) will run under the user configured in the image, unless you override it, and in a separate mount namespace, unless you change that, which makes the “alias sudo” trick extremely unlikely.
Even running under a separate user anyway prevents almost fully the attack you mention, unless the separate user has root privileges or the DAC_OVERRIDE capability is assigned to the binary (assigning it requires CAP_SYS_ADMIN).
In short, the attack you mention is a common persistence and privilege escalation vector, which is relatively easy to detect (watch for changes to shell profiles), although preventing it requires some care. I just want to point out that in single-user machines (e.g. personal computers) escalating to root is anyway fairly unnecessary, given that all the juicy stuff (ssh keys, data, etc.) is anyway probably running under/owned by that user.
Yep! You can also get pretty far even without containers. At the end of the day containers are just sandboxing using namespaces, and systemd can expose that pretty trivially for services, and tools like bubble wrap / flatpak let you do it for desktop apps. In an ideal world every package would only use the namespaces it needs, and stuff like this would largely not be a concern.
Nearly all tools (with flatpak and portals progressing into better directions but probably never finished) have rw permissions everwhere.
The modern OS threat model is not other users, as private users mostly have single user systems. It is malware and software doing nasty things.
On Linux this always worked out somehow, but grabbing your sudo password is not hard, just alias sudo to a script reading your argument, reading your password, and piping the password to the real sudo. You dont even notice it but that script just got your sudo password.
It’s not about someone, it’s about something. A lot of us aren’t (only) using Linux as a server OS, but for desktop too, and desktop usage involves running much more different kinds of software that you simply just can’t afford to audit, and at times there are programs that you can’t choose to not use, because it’s not on you but on someone on whom you depend.
Then it’s not even only that. It’s not only random shit or a game you got that can edit your bashrc and such, but if let’s say there’s a critical vulnerability in a complex software you use, like a web browser, an attacker could make use of that to take over your account with the use of a bashrc alias.
I.e. how malware could easily catch your Sudo password without root access.
Peeps, bad news, Linux is damn insecure.
By simply placing an alias in your bashrc they could already grab your sudo password.
Another bad news, this Windows “okay” Button without any password is actually more secure.
In other words: a compromised system at the User level can easily compromised at the admin level if there are no additional checks/measures in place. Same for Windows. Just change the link to a Programm you commonly need the press OK to to you maleware. Profit.
The proper way to handle issues like these is process level permissions (i.e. capability systems), instead of user level. Linux CGroups, namespaces, etc. are already moving that way, and in effect that’s the way windows is trying to head too. (Windows has its own form of containerization called AppContainers, which UWP apps use. Windows also has its own capability system).
itsfoss.com
Active