I wish I had your confidence in "detecting" LLM sentences. All I can do for now is get a very vague "intuition" as to whether a sentence is LLM-generated. We know how intuitions are not always reliable.
From what I understood, it's the torrent link that downloads a compromised zip file rather then the authentic image:
"Torrent downloads over at https://xubuntu.org/download/ are serving a zip file with a suspicious exe and a tos.txt inside. The TOS starts with Copyright (c) 2026 Xubuntu.org which is sus, because it is 2025. I opened the .exe with file-roller and couldn't find any .torrent inside."
Ah. Those work by having a valid zip at the end (and extraction code in front), taking advantage of the zip format allowing for arbitrary data before the actual zip data (which in turn was intended to facilitate this sort of thing).
It hadn't occurred to me that the .exe in question would be a self-extracting archive (or malicious code that also involves self-extracting an archive as part of the malicious working).
File roller does use 7z internally, so no real surprise here.
But both implementations can be vulnerable to malicious exe files, so it's not a great idea to do this with a file you already suspect to be malicious.
On second thought, Qubes OS does not prevent such types of malicious downloads; it can also happen to Qubes images. Verify your downloads with checksums and cryptographic signatures [2].
On second thought, Qubes OS does not prevent such types of malicious downloads; it can also happen to Qubes images. Verify your downloads with checksums and cryptographic signatures [1].
We should really compare it to Windows here, since that's the target. But if we do compare it to a classic Linux dist like xubuntu as baseline:
Using Qubes would limit the blast radius for a scenario like this. In QubesOS, you would use disposable VMs (with no access to your crypto wallets or other user files) to download and flash an ISO. So even if this malware was targeting Linux, it wouldn't get zit and disappear when you finish flashing and shut down that VM (as long as there isn't an unpatched exploit breaking the VM isolation involved).
Of course, if the ISO is bad then this won't save you from compromise once you boot it. But that's not what happened here.
Yes indeed. Qubes has a good article on verifying distribution images not only with checksums but also with cryptographic signatures that verify the checksum files [1].
The idea (outlined in the QubesOS documentation) is to clone the git repo of their website, verify the PGP commit signatures, then render the website yourself. Then you can be reasonably sure the website is legitimate, modulo a DoS attack stopping you from receiving updates to the website code, I suppose.
Getting the correct PGP public key appears to be an exercise left to the reader, but if you are already running e.g. Fedora, you can view the packaged QubesOS distro keys distributed by your current OS, cross-reference that with a second source such as a PGP keyserver, and unless you're being Mossaded upon you're probably good if they match.
The title itself. Without reading the article, I can sense the "we are living in a stupid age" arrogant trope characteristic of the "winning" social classes.
That's an interesting assumption, thank you for clarifying.
I do know a few people who walk through the world with the "everyone else is an idiot" mindset. They're a total pain in the ass and neither of them are particularly successful or particularly happy, irrespective of their (very different) notional social class.
For my part, I look at a title like that and immediately think of the number of hours I've spent doomscrolling, trying to find value in cryptocurrencies, thinking about what impact AI has been having on education, trying to figure out where my life took its various difficult turns...
And I see it more as a criticism of the systems we've built (primarily big tech, but also the industrial complex in general) to create a world where the answer might be yes.
Yeah, was kinda hoping they's work with Fairphone to fix their shit security situation... Anyway, hopefully another ethical brand fingers crossed! Thanks for the link!
I don't understand the people trying to convince others that this tool is useless by saying "just do it this way, duh!". It is useful, even from a rapid glimpse at the website.
I'm at the point where I know exactly what comment that is because of the comment ID of 9224. Don't even need to mention rsync, Dropbox, or anything else.
> This method is not available on all devices and does not support sharing or collaboration.
The parent cites "hassle of creating the database" and does not mention sharing or collaborating. I showed that it doesn't get more hassle-free than this and doesn't even require connectivity (which might be a problem "on some devices" or "in some locations").
It was just one item in a list and they used "etc." which prob refers to all the other obvious upsides, like why you would use pgadmin/postico to write postgres queries instead of psql cli.
So to double down on that one detail as if it were a load bearing remark comes off as trying to win a point.
If `sqlite3 test.db` launched a rich UI with tabs and such, then maybe they'd be onto something, but it does not.
If the database is loaded from an external source (as shown in the examples), using the "Share Script" feature automatically attaches a link to the database. The link allows both the database and the script to be accessed and loaded.
Implicit assumptions: You know what a CLI is, you have one on your system, and how to install the sqlite3 binary somehow.
When I just started out with linux I was so frustrated with people just listing reams of commands, or files I needed to edit without stating I needed to look in /etc
How do I get this sqlite3 command to work on my Chromebook? When I type this in on my Windows machine it's not working either. Are there other steps I need to take first?
Thanks for your answer! That said, I know how to install SQLite and am well-familiar with it.
My point was that the parent's comment did not tell the full story. A student just trying to do the first baby steps with SQL won't know any of this. Yet with the website shown here, they can immediately focus on the actual SQL, no matter what devise they are on, as long as it has a functioning browser.
I had the same reaction, why not just use the command line interface?
From there, I guess the value this adds is:
1. There is a UI, i.e. it has some autocomplete of sql syntax and it shows tables in a ... tabular format.
2. As others have mentioned, there are sharing features. Yes you could share a .db file, but with this you can also send a link viewable in a browser, with specific queries, etc.
#1 reminds me of MS Access from back in the day. Those were sql dbs underneath, but they had some interfaces to show you how to build queries. It wasn't a bad way to dip your toes into the basics of sql.
