top 50 comments

sorted by: hot top controversial new old
[–] 95 points 6 months ago (3 children)

Hold on ....

Are you saying all software hosted on github is infected with copilot? Or am I misreading the situation?

  • source
  • hideshow 6 child comments
  • [–] 182 points 6 months ago* (33 children)

    Your confusion is understandable since MS has called like 4 different products “Copilot”. This refers to the coding assistant built into GitHub for everything from CI/CD to coding itself.

    All code uploaded to GitHub is subject to being scraped by Copilot to both train and provide inference context to its model(s).

    Basically having your code in GitHub is implicit consent to have your code fed to MSs LLMs.

  • source
  • parent
  • hideshow 34 child comments
  • [–] 61 points 6 months ago* (1 child)

    All code uploaded to GitHub is subject to being scraped

    No kidding: That was literally my very first thought back in the days when I learned that M$ has taken over GitHub.

    (Copilot did not exist then)

  • source
  • parent
  • hideshow 2 child comments
  • load more comments (32 replies)
  • [+] 71 points 6 months ago* (last edited 4 months ago)
    [–] 64 points 6 months ago (7 children)
    load more comments (7 replies)
    [+] 41 points 6 months ago (1 child)
    load more comments (1 reply)
    [–] 24 points 6 months ago

    More distros need to follow. No FOSS should have any relationship to Microsoft or their products.

  • source
  • [–] 22 points 6 months ago

    Did this few months ago. Everyone should do the same.

  • source
  • [–] 7 points 6 months ago* (1 child)

    The because of training claim is wrong.

    Quoting the Gentoo post:

    Mostly because of the continuous attempts to force Copilot usage for our repositories,

    It seems to be about GitHub pushing copilot usage, not them training on data. Moving away doesn't prevent training anyway. And I'm sure someone will host a mirror on hitting if they don't.

  • source
  • hideshow 1 child comment
  • load more comments (1 reply)
    [–] 7 points 6 months ago
    [–] 7 points 6 months ago (3 children)

    Gentoo is still around‽ But Arch exists and eMachines was discontinued like 10 years ago!

  • source
  • hideshow 6 child comments
  • [–] 24 points 6 months ago (1 child)

    I know this is probably sarcastic but honestly Gentoo's great if you don't trust binaries by default. Nothing is an absolute guarantee against compromise, but it's an awful lot harder to compromise a source code repository or a compiler without anyone noticing (especially if you stick to stable versions) than it is to compromise a particular binary of some random software package. I trust most package maintainers, but they're typically overworked volunteers and not all of them are going to have flawless security or be universally trustworthy.

    I like building my own binaries from source code whenever possible.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 9 points 6 months ago (4 children)

    Genuine question from a longtime Linux user who never tried Gentoo - doesn't updating take forever? I used a source build of firefox for a bit and the build took forever, not to mention the kernel itself

  • source
  • parent
  • hideshow 7 child comments
  • [–] 8 points 6 months ago

    Gentoo does not have always the latest builds, not by default.

    Updates depend on your amount of packages, hardware, and willingness to utilize that hardware for compiling.

    I don't use DE, just dwm+dmenu, so my biggest packages are Firefox and LibreOffice, which can take 3+ hours with dependencies. KDE or Gnome would most likely add more.

    But you can put number of cores for compiling into config. If you have your PC on most of the day, you can set it to 1 or 2 and you most likely won't even know about it.

    Or, if you have 16 core CPU, let 14 do the compiling and you can browse the web with the remaining two.

    This all assumes you have enough RAM as well. It's not as bad, but you should have at least 32GB.

    The distro is smooth, way more than anything I've ever tried, and I'm not switching from it.

  • source
  • parent
  • [–] 5 points 6 months ago* (1 child)

    Depends on your system specs, but.... yes, generally speaking. There is a reason most people and most distros use binaries. Even Gentoo can use binaries for some stuff.

    Are you going to suffer significant damage if your updates take forever though? What's the hurry? The number of times I have literally needed the absolute latest version of something installed right now are pretty damn minimal. The major exception is widespread, exploited zero-day remote-access vulnerabilities, but those are rare, and especially rare are ones that affect the exact versions and configurations of software that I am currently using and cannot reasonably just opt to "stop" using. Even so, there are usually other ways to block the network traffic, disable the offending part of the configuration, or otherwise mitigate the risk. Besides, there's nothing stopping you from literally just downloading a patched binary if that's what you need at that moment.

    Patience is a virtue, and it's generally good for you. You don't have to be addicted to constant updates, but you do need to be thoughtful and understand how to build defense-in-depth.

  • source
  • parent
  • hideshow 2 child comments
  • load more comments (1 reply)
  • [–] 14 points 6 months ago (1 child)

    Gentoo is more linux than anyhing. It is literally a penguin. What does Arch have?

  • source
  • parent
  • hideshow 2 child comments
  • load more comments
    view more: next ›