Losing the Google Earth desktop app and getting an image generator in Google Earth does not look like a good trade.
Remote
Henri Sivonen
@hsivonen@mastodon.social
mastodon
4.7.0-beta.1
Making Firefox load about:blank correctly
685
Followers
253
Following
44
Posts
Joined April 04, 2017
Web site:
Twitter:
Posts
The UTF-8 to UTF-16 and UTF-16 to UTF-8 conversions in the simdutf library use large lookup tables.
Mere throughput benchmarks don’t measure how the perf of other stuff is affected by (at least parts of) the tables ending up in L1 cache and evicting something else.
I fail to find a blog post characterizing the performance impact in an application context, e.g. in Chromium or WebKit. Does such a blog post exist?
Two things where Rust chooses principle over practicality with SIMD and that annoy me right now:
1. Calling a function annotated with a target_feature from a function not so annotated requires unsafe even if the target_feature is statically enabled. (E.g. sse2 on x86_64.)
2. is_x86_feature_detected! is in std rather than core despite using an instruction and not a syscall. (There is even https://docs.rs/core_detect/ .)
What’s the deal with notion that American AI data centers are noisy very noisy due to cooling?
I’ve walked past Telia’s Helsinki data center in summer time, and it doesn’t make noise, smell, or emit visible fumes. It’s the size of a city block and there’s a regular sidewalk right in front.
Just better design and/or regulation or fundamentally different hardware inside?
(It’s likely more CDN servers than GPUs, but both require some level of cooling.)
TIL:
1) Floating-point to integer cast can be UB in C++.
2) The convener of the C++ committee dismissed this a “benign” UB not worth defending against in the Guidelines Support Library.
3) The UB can cause LLVM to delete a bound check
https://github.com/microsoft/GSL/issues/786#issuecomment-5127325234
Feels weird to write code to support Firefox on ARMv7 Android. I don’t even know what kind of CPUs users run it on in practice: actual ARMv7 CPUs or on ARMv8 CPUs with 32-bit software stack like folks running 32-bit Windows on x86_64 CPUs.
I don’t have ARMv7 hardware anymore. I guess I will have to find an old 32-bit Linux distro image that boots on Raspberry Pi 3 to see if my code runs.
There’s been a lot of “WTF Europe doesn’t have AC” lately, but Europeans have seen and used AC.
Ezra Klein’s guest suggested that Americans would choose inductions stoves instead of gas stoves if they had experienced them. Can it be true that Americans who use gas stoves haven’t seen/used an induction one?
I’m aware that the U.S. having made a bad voltage decision has effects that surprise Europeans, but it looked to me like gas stoves are also a thing in South Korea despite voltage.
Corporations still occasionally react to press reporting.
https://www.theverge.com/tech/970489/lg-mcafee-ads-windows-microsoft-crackdown
@paperlesspaper@social.tchncs.de Do you have a firmware mode that turns off the radios (to have no remote attack surface) and allows images to be loaded via USB?
RE: https://mastodon.social/@andrewrk/116889478874166045
Made me look up Thiel Fellowship on Wikipedia: https://en.wikipedia.org/wiki/Thiel_Fellowship
Quoting
My Thoughts on the Bun Rust Rewrite
https://andrewkelley.me/post/my-thoughts-bun-rust-rewrite.html
Open quoted post
RE: https://mastodon.social/@LukaszOlejnik/116799318435434871
Makes one wonder how much of Open AI eating all RAM, storage, GPUs, and energy is about essential requirements of what’s being computed and how much of all this is about a culture of moving fast and using resources without bound.
@atpfm@mastodon.social Regarding Neoing a display: Similar to what @siracusa@mastodon.social said on @gruber@mastodon.social’s podcast about how other people didn’t see that Macs had the right-sized pixels at the turn of the 1980s and 1990s, today the need for a site like https://retinadisplays.com/ shows that other people aren’t properly appreciating 218 ppi displays. One might assume that one could buy a 3840 × 2160, 218 ppi display for less money than the non-XDR 5K Studio Display (1st or 2nd gen), but that’s not an available product.
The RAM shortage is caused by purchases or expressions of intent to purchase between American buyers and American and South Korean sellers. Would the U.S. government have intervened if the buyers / expressers of intent to buy were in China instead of being in the U.S.?
What’s going to happen first due to the situation with LLMs and security bug finding: Microsoft issues a patch to Windows 10 even for computers not enrolled into ESU to fix something really bad or a major LTS Linux distro declares kernel patch backporting bankruptcy and rolls the kernel forward instead of backporting?
Replying to
@sayrer@mastodon.social
@sayrer@mastodon.social Yes. Somehow other parents seem more OK with paying for the console versions than for the phone versions of that one, too.
I’m annoyed that so many parents are too stingy to pay for phone games for kids (even if they do occasionally buy Nintendo Switch games), so network
multiplayer games that friends play are free-to-play games that are designed for addiction and in-app purchases. Even if kids have the patience not use real money in game, they still get exposed to the design elements whose purpose is get less patient adults to pay.
Is there a Linux distro that is set up for running x86 Windows games inside UTM with Virgl on Apple Silicon Macs such that the game is emulated but most of Wine internals and Mesa run as aarch64 code?
I remember a colleague replying to a question about C++ exceptions not being allowed in Firefox by saying that humans can’t write exception-safe C++.
Looking at recent soundness bugs both in the Rust standard library and elsewhere in the crate ecosystem, it appears that humans can’t write unwind-safe unsafe Rust, either.
(Rust panics abort in Firefox.)
I’m a bit annoyed when folks use 🦀 to refer to reckless use of LLM agents. 🦀 is for Rust. 🦞is the OpenClaw emoji.
Reminder that Mozilla has been bundling multiple memory-safety bugs under one CVE number for, *checks notes*, a couple of decades. https://www.mozilla.org/en-US/security/advisories/mfsa2006-68/
Replying to
@zai@mas.to
Replying to
@freddy@social.security.plumbing
@freddy Project Zero reports don’t have a slop reputation, though, and there are takes that see Project Zero reports as hostile demands to do work benefiting Google. (Hence my point about Google’s ffmpeg use likely already being better sandboxed than VLC.)
I keep seeing bad takes that express hostility towards security bug finding whether by Project Zero or by LLMs.
It’s as if folks with these takes are ignoring two basic things:
1) Google and Anthropic didn’t put the bugs in your code. The known risks of memory-unsafe programming languages are hitting the fan.
2) Attacks that exploit memory-unsafety hurt _users_.
(Take an ffmpeg vulnerability: Chances are that YouTube’s back end is already isolated but VLC users could have a very bad time.)
Replying to
@harald@mementomori.social
@harald @suihkulokki @saaste Reunoilta leikataan siivu pois ja jäljelle jäävä suurennetaan. Tämä älyttömyys tunnetaan nimellä “overscan on HDMI”, vaikka termi “overscan” tulee kuvaputkista. Kun tarpeeksi penkoo valikoita, tästä misfeaturesta voi päästä ohi nimeämällä HDMI-tulon PC:ksi. Sellainenkin Samsung on tullut vastaan, että PC-valinta poisti reunojen leikkauksen vain, jos lähteestä tuli 60 kuvaa sekunnissa, mutta 50 kuvalla sekunnissa reunojen leikkaus meni takaisin päälle.
Replying to
@hsivonen@mastodon.social
@suihkulokki @saaste Ja olen täysin samaa mieltä, että pitkälliseen selvitykseen pitää kuulua misfeatureiden selvitys. Tähän mennessä selvittämäni perusteella en missään tapauksessa ostaisi Samsungin TV:tä jo sillä perusteella, että liian moni Samsung-sukupolvi on leikannut HDMI:stä pikseleitä pois. Viimeksi, kun ostin TV:n 2009, menin kauppaan läppärin ja HDMI-kaapelin kanssa katsomaan, että löytyi TV, joka ei tee HDMI:lle jäynää.
Replying to
@suihkulokki@society.oftrolls.com
@suihkulokki @saaste Päästätkö sen nettiin, vai teitkö vertailun alunperin siitä lähtökohdasta, ettei TV:tä päästetä nettiin? (Minun olettamani on, että seuraavan TV:n pitää olla sellainen, että HDMI toimii ilman nettiinkinuamisviestejä, vaikkei laite ole netissä. TV:lle ei ikinä anneta wifin salasanaa ja siihen päivitettän ekan vuoden aikana firmis kerran Ethernetin tai USB:n kautta, jotta saa kuvanlaatubugikorjaukset.)
Replying to
@Larko@mas.to
@Larko @saaste Minulla on vuoden 2009 TV, jossa on jo Ethernet-portti, mutta se ei koskaan ole ollut netissä. Suunnitelmani on, että seuraava on LG, ja silloin tällöin tsekkailen kauhuissani, suostuvatko LG:n TV:t edelleen toimimaan HDMI-näyttöinä ilman nettiinpääsykinuamista, jos sellaista ei päästä nettiin. Tai milloin niihin pannaan sisäänrakennettu kännykkäverkon radio, jolloin käyttäjä ei enää pysty estämään TV:n nettiin menoa.
Replying to
@freddy@social.security.plumbing
@freddy @gabrielesvelto Also, it looks to me that fuzzing requires more human setup of what part of code to fuzz and how to deal with stuff like checksums whereas reportedly LLMs can deal with less specific harnesses and figure out how to fill in checksums.
Replying to
@hsivonen@mastodon.social
Or folks go LOL at security incidents or code quality at an LLM company. Irrelevant to whether their model can find security bugs. The way this works is that you have a non-LLM oracle like ASAN. If the model found a way to trigger the oracle, then it’s not really productive to argue that it didn’t.
Why even post this considering the predictable hate? Because denial about the situation does not make users safer from attacks.
Replying to
@hsivonen@mastodon.social
Then there’s the dismissal that, yes, LLMs now find security bugs, but the bugs could have been found by other methods. But evidently defenders hadn’t actually found them by other methods. (Unknown what attackers had already found.)
Or folks find it objectionable that the new capability has been made available to attackers and the proposed cure is to pay for access to the same LLM. But that does make the existence of the capability untrue.
Replying to
@hsivonen@mastodon.social
And, yes, the Anthropic Mythos post fits a previously-seen pattern of “AI” companies marketing by danger, but saying that it’s marketing does not refute what the models that are already generally offered can do.
And people act like their own conjecture is more informative than what people from multiple projects that deal with security bug reports say. See e.g. https://mastodon.social/@bagder/116363034479757682 .
I’m seeing a lot of denial and logical fallacies on Mastodon about LLM capability to find security bugs.
I get it that when folks have concluded that LLMs are harmful, they want to believe that LLMs fail at everything. But a list of correctly-identified bad things about LLMs does not logically imply that LLMs can’t find security bugs.
I don’t know what kind of message works and what does not, but I find it remarkable that endorsements by Vance, Netanyahu, and Le Pen are positioned as being in favor of getting folks to vote for Orbán. https://www.politico.eu/article/operation-save-viktor-orban-us-donald-trump-deploys-jd-vance-hungary/
Replying to
@niallor@mastodon.ie
@niallor As it happens, the new mechanism that is used to dealing with British Columbia in CLDR were introduced (among others) to deal with Dublin time.
Trying to figure out which movies are suitable for kids and annoyed how unreliable age ratings are to begin with and how little care companies put into carrying the ratings correctly. Currently looking at Apple listing a movie as prohibited to anyone under 18 in Finland, IMDb says the Finland age rating is 3, and the official database says 12.
Maybe France is right to just cover the entire Finnish rating range with “Tous publics”.
Regarding the most recent boost, the site says about itself: “House of Saud is the leading independent English-language publication dedicated to the Saudi royal family and the Kingdom of Saudi Arabia.” and “House of Saud is editorially independent. We have no financial relationship with the Saudi government, the royal family, or any Saudi government-linked entity.”
Shortly after learning about the British Columbia time zone change I asked folks from Ontario if BC is actually calling their new time zone “Pacific Time” or if it was a failure to edit out old stuff on Wikipedia.
Apparently BC really wants to call the new thing “Pacific Time”.
See https://lists.iana.org/hyperkitty/list/tz@iana.org/thread/IEZR4HYQXZTUMGRA7FEZJAKAOGFGOPIP/ for the software implications.
(In general, abolishing daylight-saving time by remaining on the old standard time is much easier on software than redefining the standard time.)
What a mess. I found an older CLDR bug: In the 1940s, London has been even at GMT+2 such that tzdb analyzes both GMT+1 and GMT+2 as daylight-saving time. Since CLDR in en-GB has a single daylight-saving time abbreviation for London, both GMT+1 and GMT+2 are formatted as “BST”.
It’s April 1st, so I’m checking stuff even more than usual, but this looks like it’s in actual legalese on the actual Microsoft Web site.
The most recent boost does not want to be quote-tooted, so here’s a separate link to llama.cpp’s AGENTS.md: https://github.com/ggml-org/llama.cpp/blob/master/AGENTS.md
Today in Web compat: Firefox and Safari are ahead of Chrome in ICU4C version and upsteam ICU4C changed the formatting of zero offset from GMT. This broke birthday date validation for a UK based site for birthdays before 1970 in Firefox and, on 26.x Apple OSs, in Safari, because the site performs a formatting-based check on the time zone of London on the date to be validated and the UK has changed time zone rules along the way.
TIL that with iOS set to fi-FI, in the Contacts app, adding a birthday when a contact does not already have one set always sets a Gregorian birthday. However, setting a second birthday defaults to a Hijri birthday with possibility to switch to Hebrew, Chinese, Korean, or Vietnamese. Now I have questions:
Which Hijri calendar variant is this? ICU4C has four variants.
What’s the Vietnamese calendar back end? ICU4C doesn’t have one. Does the Vietnamese calendar still have a maintenance authority?
Journalists who are impressed by how fast an LLM generates kLOCs clearly haven’t internalized this classic clip from the Triumph of Nerds of Steve Ballmer talking about IBM and kLOCs: https://www.youtube.com/watch?v=kHI7RTKhlz0
(Documentary from 30 years ago discussing time from around 40 years ago.)
Replying to
@mhoye@mastodon.social
@mhoye I was in a meeting of 5 or 6 people discussing the fingerprinting implications of browsers exposing system accessibility settings like “reduce transparency” to the Web. _Two_ of us discovered that we had “reduce transparency” turned on despite never having flipped the GUI switch. We had done a “defaults write” as advised on the Internet back when macOS was called Mac OS X and Apple made the menubar transclucent the first time. This had been migrated across multiple OS versions.