• 3 Posts
  • 379 Comments
Joined 2 years ago
cake
Cake day: June 6th, 2023

help-circle



  • So, I guess this means smart, ethical, and charismatic. I feel like this is one of those cases where I get to pick two one of those traits, and it has to be charismatic.

    That seems to accurately describe where we find ourselves. To quote Men in Black, “A person is smart, people are dumb.”

    I think we don’t get out of this situation by thinking real hard and convincing people to vote based on a theoretical future; people will only change their behaviour in the face of an actual failure. I’m not a historian, but I have to assume the appeal of fascism was alive and well in the US during the great depression. We just had the opportunity to learn from Germany and Italy’s mistakes before we went down the same road. Now WE are the example that will hopefully sway other countries’ democratic behaviors.

    Ex. the conservative party was heavily favored to win the Canadian election after Trudeau stepped down, but ever since Trump took office, the polls have completely reversed. Still unclear where it will land, but I think Canada’s voters are getting that much needed opportunity to learn from our failures.


  • I feel like this question is as useful as asking “when is it ok to downvote someone?” You can theorize about how a downvote should only be used when someone is not contributing to the discussion honestly, and how you should never downvote someone just because you disagree with them…but at the end of the day, people are gonna downvote others for whatever random reason they feel like.

    Similarly, is it useful to ask what a vote “means” in a democracy? Or is it a waste of time to try and apply reason to, or derive reason from, the behavior of a hivemind? Unlike individuals who can learn from hypothetical failures, I personally believe hiveminds (groups/societies/whatever word you’d like to use) can only learn from actual failures.

    The people could elect a perfect model citizen who will represent the people’s best interests, but if what’s best for the people in the long term comes with too much discomfort in the near term, the people will happily vote against their own interests.










  • I would go a step further and say that any time one of these MAC systems has to resort to user interaction to do its job, it’s a straight up failure case: the system simply didn’t have enough information to do its job, ended up doing no better than a blanket “block everything” config, and is asking the user to do 100% of the heavy lifting of determining what should happen.

    So, when I hear

    If someone is lazy or not knowledgeable enough to make the right decision…No automated system can protect [them].

    I hear: “every access control system is fundamentally broken”. Which is fine, maybe that’s true, there’s a reason social engineering is so useful. So then all these systems should prioritize streamlining that failure case as much as possible: Tell the user what is accessing what, when, how, and then make it trivial to temporarily (with well defined limits), permanently, (or even volatile-y using CoW/containerization/overlay fs) grant or deny access as quickly and easily as possible.

    Every other system you’re comparing SELinux, AFAIK, handles this case better, which is why users tend to prefer them.

    For the record, I’m not arguing that SELinux is bad at the actual access control part, I’m only answering why people don’t like using it, which is how it handles the failure case part. Now it’s been a while since I’ve used SELinux and I’ve never used setroubleshooter, but if you tell me it actually streamlines all of this to be smoother than every other tool, then I’ll install it tonight!


  • How do you know when you’re letting through a valid access, an unnecessary one that could be a vulnerability, and an actively malicious one?

    I don’t think anyone is saying throw out all access control, they’re just saying SELinux adds too much unproductive friction for everyday usage. You said it takes 15m to troubleshoot. But that’s not a one time thing, that’s 15m that scales with the amount of new programs and updates you’re running. And 90% of people aren’t even going to be able to tell they’re looking at a malicious access if they’re in the habit of always working around blocks that show up.



  • If you are familiar with the concept of an NP-complete problem, the weights are just one possible solution.

    The Traveling Salesman Problem is probably the easiest analogy to make. It’s as though we’re all trying to find the shortest path through a bunch of points (ex. towns), and when someone says “here is a path that I think is pretty good”, that is analogous to sharing network weighs for an AI. We can then all openly test that solution against other solutions and determine which is “best”.

    What they aren’t telling you is whether people traveling that path somehow benefits them (maybe they own all the gas stations on that path. Or maybe they’ve hired highway men to rob people on that path). And figuring out if that’s the case in a hyper-dimensional space is non-trivial.