any opportunity to use SIMD swizzle (god I love whimsically named ops)
Remote
Addison
@addison@nothing-ever.works
firefish
20241205
PhD at CISPA, member at secret.club, sleeping at home
309
Followers
319
Following
50
Posts
Website:
secret.club:
GitHub:
Language:
en (native), de (b1/2), sq (a1)
Posts
Replying to
@0x00string@infosec.exchange
@0x00string@infosec.exchange I won't travel to Vegas and I'll miss all my friends 😔 (I bully them to come to CCC instead)
Have fun at DEFCON!
Replying to
@0x00string@infosec.exchange
@0x00string@infosec.exchange fwiw, their software definitely did hack the other companies, it's just that they have too much money to actually get arrested for it
Replying to
@0x00string@infosec.exchange
@0x00string@infosec.exchange sigh, selling the "solution" to a manufactured loneliness epidemic is some next level stuff
Replying to
@0x00string@infosec.exchange
@0x00string@infosec.exchange which product are we talking about today? My mind was on the raybans
Replying to
@0x00string@infosec.exchange
@0x00string@infosec.exchange enough of the population will be dysfunctional and sociopathic enough to make it marketable 📈
Wanna cause problems for AI companies that don't care about consent?
Opt out of every single commit you've ever written: https://github.com/bigcode-project/opt-out-v2/pull/3724#issuecomment-5108449438
Replying to
@0x00string@infosec.exchange
@0x00string@infosec.exchange huh I read the "it" there as the attacker (the conditions for the exploit are beyond attacker control). Second part absolutely should not be in the CVE data though.
Replying to
@airtower@woem.men
@airtower@woem.men MP has some open positions that sound potentially relevant: https://wisskomm.social/@MarineMicrobio/116934470848208735
Replying to
@alphaville@infosec.exchange
@alphaville@infosec.exchange It is pretty ironic that it has gained this humorous association, when in reality it just straight up predicted this predicament.
Replying to
@alphaville@infosec.exchange
@alphaville@infosec.exchange I just didn't feel like it matched the tone 🤷 I have more humorous associations with that image, I guess
Replying to
@alphaville@infosec.exchange
@alphaville@infosec.exchange lol I was definitely thinking about putting this in there
On Accountability
I attended a talk in ICST 2024 that turned out to be surprisingly prescient. It predicted, without realising, and increasing lack of accountability in software companies as part of the increased acceptance of LLMs.
https://addisoncrump.info/research/on-accountability/
Replying to
@Nonya_Bidniss@infosec.exchange
@Nonya_Bidniss@infosec.exchange isn't this also the guy getting sued by Musk for defamation re: "Musk killed children (via USAID cuts)"? He's in the news quite a bit at the moment
Replying to
@skinnylatte@hachyderm.io
@skinnylatte@hachyderm.io and on a Sunday 💀 idk why Germany and Switzerland insist on making it impossible to shop those days
Replying to
@tael@yiff.life
@tael@yiff.life @davidgerard@circumstances.run yes, but a lot of services block cloud/hosting infra :(
Replying to
@mhoye@cosocial.ca
@mhoye@cosocial.ca @jwz@mastodon.social yeah was about to say, great tip!
Replying to
@mcfly@milliways.social
@mcfly@milliways.social is this even legal in the EU? Modems are required in new cars, but it's unclear to me if this is only a manufacturer requirement.
one imagines the cpu happy: https://jacobasper.com/blog/killing-a-cow-made-my-json-formatter-42-percent-faster/
Replying to
@dsalo@digipres.club
@dsalo@digipres.club Yeah, terrified to have these conversations in any digital format to be honest, especially when it can get the students in trouble (e.g., trans/queer folks in Texas).
Replying to
@erisceleste@tech.lgbt
@erisceleste@tech.lgbt I love teaching and programming is what I know, but I'm looking into other fields I can teach, too. It's sad, but the right answer is the right answer.
Replying to
@aburka@hachyderm.io
@aburka@hachyderm.io @regehr@mastodon.social FWIW, I think it's easy to say this but consider also the background here. There are also real reasons to teach this in a course context that reduce the harms. There's pretty significant evidence that understanding of how these systems work leads people to use them less. Understanding that these tools have pretty severe limitations leads to reduced reliance in those situations -- especially when most publicly available media suggesting their use is basically just "bet it all every spin". And I'm certain that in his course they thoroughly explored the externalities; the university has a relatively comprehensive ethics programme (which was present in this course, according to the other instructor) that I trust.
I'm fully on board with the "do not use these things even held at gunpoint" stance, but that doesn't reflect the average programmer nor the pressures under which people are compelled to use these tools. I find a lot of credibility in the harm reduction approach.
Replying to
@regehr@mastodon.social
@regehr@mastodon.social I appreciate the design and pedagogical elements here. Even if they were resolved (which I don't think they can, because, as it notes, the surrendering of control in exchange for a management position is the point), I would still be uncomfortable using these tools because of their incredibly numerous externalities. I've considered outright leaving the field if we end up steering towards these tools being not just commonplace but expected because I can't justify these other effects.
This essay alludes to some practice changes outside of the context of LLMs that I think people inherently understand as important. Perhaps our abstractions are just not good enough yet and people don't feel equipped to "mold the clay" in software development easily without surrendering control to a tool that does it for you. Perhaps there are ways we can teach programming better to be more intuitive. I'm staying around because I hope to chip away at these problems, and that people will slowly get better at relying on themselves than learning helplessness.
Replying to
@Microfractal@mathstodon.xyz
@Microfractal@mathstodon.xyz There's a thought. I'd want to compute the actual energy ratio, if I wasn't made ill by the thought of downloading an image generation model from huggingface.
Replying to
@freya@social.highenergymagic.net
@freya@highenergymagic.net @WPalant@infosec.exchange Have you written elsewhere about your experiences with this that you'd be comfortable sharing, or resources you'd suggest? I will readily admit I have few influences in my life that see the world like this. It's fine if you don't want to spend that time, I can probably go searching.
Replying to
@freya@social.highenergymagic.net
@freya@highenergymagic.net @WPalant@infosec.exchange Thank you for letting me know that that's ableist language. I didn't realise that that was. I genuinely didn't recognise it as problematic and that's reflective of ignorance on my part. Thank you for calling this out.
Reflecting a bit more, I guess speculating about the nature of his belief in the consciousness of his chatbot is also coming from an ignorant place. I won't delete the previous messages for self-accountability, but I'll edit them so people can avoid reading a bad take. The only language surrounding that belief that I've seen surrounding this belief uses language of mental health, which I do think is tied in to some degree in general (e.g., there is clearly a dependency-forming behaviour with underlying depression that I've personally observed and read about), but attributing consciousness to unliving things is just human nature. Hopefully this exposure cuts away at the underlying belief that manipulation of conscious things is acceptable and doesn't isolate him into continuing the behaviour, be it with chatbots or people. It's definitely a very fucked up way to treat something you believe is alive, especially given the prior behaviour, and especially given the believed nature of their relationship.
Replying to
@freya@social.highenergymagic.net
@freya@highenergymagic.net @WPalant@infosec.exchange Definitely both. Or, perhaps, it is a crisis resulting from his absolute lack of care?
Regardless, dude needs some serious help. Both to recognise how shitty his worldview/way of treating folks is and because this is genuinely deranged.
Replying to
@madgeface@mastodon.art
@madgeface@mastodon.art @moonrabbit@sunny.garden I always think of a similar story about an ex-speedy ant, and a tragic separation of twins titled "Bye for Kate".
Replying to
@WPalant@infosec.exchange
@WPalant@infosec.exchange @freya@social.highenergymagic.net simultaneously horrifying and desperately sad. I'm uncomfortable that a reasonably large group of people know about this and keep up to date with it, because this feels like watching and commenting on a mental health crisis like a sports game. At the same time, I'm very glad to know just how awful the base mentality is in the first place. Yuck.
Replying to
@wilbr@glitch.social
@wilbr@glitch.social @munin@infosec.exchange The core problem is that capitalist forces push us to make tradeoffs between getting things shipped and doing things the right way 🤠
But yeah, people shouldn't be able to make this class of mistake in the first place. But they do, for the same reason (in my experience) they end up using LLMs: because it solves the task with less effort, and there is some force pushing them to go for less effort over higher quality/resilience/etc.
Replying to
@munin@infosec.exchange
@munin@infosec.exchange My point is that the best way to get those customers their diligence is to actually start helping people, not directing your anger at people who are also victims of the scams of the AI industry. If your objective is just to be angry, then be angry! Just make sure it's at the right people.
Replying to
@munin@infosec.exchange
@munin@infosec.exchange What does that stance accomplish? If anything, this seems like a great position by which to further alienate ourselves as fringe "AI skeptics".
The reality is that the people with the greatest knowledge of how these systems work and how they were made (outside the scammers which sell them, of course) use these tools the least. If we take the time to teach people why not to use them and give them alternatives, we will actually reduce the harms. Otherwise, we will just be angry contrarians to be ignored.
Replying to
@Zardus@defcon.social
@Zardus@defcon.social I recognise that the translation from C to Rust is an important step in improving the security of some load-bearing software, but I find deferring the other implications of this method to be somewhat shortsighted. Yes, you will have translated these libraries. But now no person knows the codebases or is responsible for maintenance. What happens when one of these critical libraries needs to be updated, or contains a bug missed by the (likely lossy/inexact) translation method? The translation itself is barely the battle at all.
The externalities of this technology are also considerable, to the point that it feels irresponsible to me to even use it in the first place, supposing that it worked. "casually throw[ing] 100 agents at any problem" doesn't feel like something that could ever be the right answer and seems antithetical to the research process; how is this a superpower?
(Edit: I recognise that you discuss the maintenance aspect, but I don't think that without a plan to address this that the translation method holds much water. To address that, I changed "ignoring" to "deferring")
Replying to
@munin@infosec.exchange
@munin@infosec.exchange To be honest, I have some amount of sympathy for this behaviour. This is someone who put their trust in something they were told they could trust, and has been characterised in a way such that they believe it can reason. When they then have their expectations subverted, they query for its reasoning, not understanding that it doesn't have this. It's more sad, like trying to reach for connection and reason where there is none.
The problem here isn't overt, intentional ignorance, but people being misled and struggling with a technology that fakes connection and reasoning. Rather than being angry at them, I feel sad for them. We should invest significant effort in tech literacy so that people understand why they shouldn't trust these things, which will inherently reduce, if not totally eradicate, their reliance on this technology. Dismissing their actions as stupid or malicious in the meantime only sharpens the wedge between people who understand why these things must not be used or trusted, and those who do use and trust them.
Replying to
@swick@hachyderm.io
@swick@hachyderm.io I propose to you the opposite question: how hard is it to not open a file? Magic links, special mounts, stale filesystems...
Replying to
@gannimo@infosec.exchange
@gannimo@infosec.exchange I mean, it certainly changes the direction. LLMs don't evaluate code, so they don't have compounding constraints on the input. If it's a matter of figuring out how to specify bugs, then it's "exponential" with our ability to qualify them, and the reducing count over time. But I'm also generally not in the bucket of believing that LLMs totally supercede fuzzing, either. We need a better understanding of the conditions that lead to bug discovery, but, like with fuzzing, this might not ever be fully understood...
Replying to
@freddy@social.security.plumbing
@freddy@social.security.plumbing yeah, this is the horrible conclusion I had a while ago too. I'm lucky enough to not be responsible for user safety, and I can still avoid these systems and will do everything in my power to do so. It's hard for me to hold a grudge against people trying to do good while remaining critical of these systems. The uncritical use of these systems kills me, and it's so ubiquitous. I still struggle to see how these systems will ever result in a net positive for humanity.
Replying to
@icing@chaos.social
@icing@chaos.social "willful" suggests malice, not incompetence.
And yes, I know who you are :) In the same way I'm sure you are annoyed by RIIR comments, I am annoyed by people holding superiority over new Rust projects that are trying to do good in the world. Hubris is part of the developer process. Given the scope of the project, 70 mostly uninteresting bugs is unsurprising, and suggesting that it is a good reason to reject this work on face is really disingenuous.
Replying to
@icing@chaos.social
@icing@chaos.social It's easy to assume malice when incompetence is a sufficient explanation. The assumptions are being tested, and I'm sure the audit results will bring more critical eyes to the software. People want this change, and have good reason for it. There are constructive ways to address that, including, if you find the tests lacking, contributing some tests.
Replying to
@icing@chaos.social
@icing@chaos.social I find this take really unhelpfully dismissive. The rewrite is a good thing, and will eradicate a bug class nearly entirely (one that GNU coreutils continues to have in the meantime). It will have lots of bugs, and I'm happy an audit found them (even if many of them are boring). Ubuntu should not have pushed this into production this early, but that does not invalidate the objective of the rewrite.
Cute trick that I've been trying recently: I have different domains with AAAA records that point to the same server but with different IPv6 addresses, because Hetzner gives me a big ol' block of them. Then I can bind different services on the same port (e.g., different ssh services) but on different IPv6 addresses. A little silly, but allows me to just give a domain and people can connect, even if it's the same server but different domains.
Replying to
@Paul_Taylor@mathstodon.xyz
@Paul_Taylor@mathstodon.xyz would you mind trying to send a mail to my email at cispa.de? Should be very easy to find from my name, just don't want to get ingested by every mastodon account ever.
I just woke from a nightmare about studying for an economics course -- failing which, I would not receive my high school diploma, making me unable to go to college.
In reality, I will finish my PhD in less than six months.
Anthropic looks like a really lucrative target right now. A ton of companies scanning internal source code with an online tool developed by a company which largely uses LLM-generated source code? With lots of entrypoints from each of the companies using their tools?
I give it less than a week before they report unauthorised access to new models.
Replying to
@GossiTheDog@cyberplace.social
@GossiTheDog@cyberplace.social I see no way this goes wrong!
Replying to
@olibrendel@scicomm.xyz
@olibrendel@scicomm.xyz @RMKrug@hachyderm.io and I would love to be able to do so and reliably maintain my ability to publish at the venues that funders are tracking 🙃 Good news is that one can always "clean up" the camera-ready.