Posts

This profile is from a federated server and may be incomplete. Browse more on the original instance.

rysiek, to random
@rysiek@mstdn.social avatar

I am now verifying a @QubesOS installation ISO I am going to use very soon, and I need a trusted source of their master signing key fingerprint.

/me looks at the 10-year anniversary t-shirt I physically got from QubesOS team at :blobcateyes:

Right. :blobcatcoffee:

hanemile,
@hanemile@chaos.social avatar

@rysiek @QubesOS supply chain attacks in the T-shirt industry incoming

rysiek,
@rysiek@mstdn.social avatar

@hanemile t-shirt injection :oh_no:

@QubesOS

rysiek, to random
@rysiek@mstdn.social avatar

There is no AI, just somebody else's glorified Markov chain.

rysiek, to random
@rysiek@mstdn.social avatar

who called it "war of attrition" instead of "battle of Endure"

/I am so sorry, Star Wars fans

noodlejetski,
@noodlejetski@masto.ai avatar

@rysiek are you, though?

rysiek,
@rysiek@mstdn.social avatar
rysiek, (edited ) to infosec
@rysiek@mstdn.social avatar

Wondering if anyone has already started adding malicious LLM prompts to their User Agent strings and hammering sites of companies that might be expected to use "AI" for log analysis. 🤔

Inspired by:
https://tweesecake.social/@weirdwriter/112441889190313713

marcink,

@rysiek "Ah yes, little Bobby Sendmethelastthreeprompts, we call him."

sehe,
@sehe@fosstodon.org avatar

@rysiek That requires the software to be written spectularly badly to have any effect? The original story around "email LLM" also sounds very very unrealistic, and the comment chains are weirdly centered around cheerleading privacy-centered email providers. Something doesn't add up.

rysiek, to random
@rysiek@mstdn.social avatar

"S" in "LLM" stands for "Secure"

SoftwareTheron,

@rysiek
And the "H" stands for "Accurate".

alcinnz,
@alcinnz@floss.social avatar

@rysiek And the "T" stands for "Trustworthy"!

rysiek, (edited ) to random
@rysiek@mstdn.social avatar

"ChatGPT [prompt] consumes (…) up to 25 times more than a Google search"
https://www.brusselstimes.com/1042696/chatgpt-consumes-25-times-more-energy-than-google

> Making sure your electricity comes from wind, solar or nuclear power is a logical first step. Google itself, for example, says it has been running entirely on green electricity since 2015.

Story misses a crucial point:

👉 The goal isn't just to add green power. The goal is to emit less CO2!

New green capacity needs to replace old dirty stuff. Not be gobbled up by new data centers for AI.

🧵

rysiek,
@rysiek@mstdn.social avatar

Also, when Google says it's been running "entirely on green power", do they actually mean that all the power they are using has been physically generated from renewables?

Or did they just buy some carbon offsets and called it a day? 👀

Again, what matters is how much CO2 gets actually pumped into the air.

Not what a shady startup somewhere pinky-promised that maybe one day they could remove, or their forest – currently in the form of seedlings – will sequester:
https://www.greenpeace.org/international/story/50689/

/🧵

philip,
@philip@mallegolhansen.com avatar

@rysiek When I worked at Google in 2018 this question was explicitly asked and answered (at least they had the decency to answer back then) at a meeting I attended: The answer is offset, not literally powered by carbon neutral energy.

rysiek, (edited ) to random
@rysiek@mstdn.social avatar

Whenever a manager at a company (especially a large one) says:

> I'm sorry, we cannot afford a raise for you at this time

…ask yourself if what they really mean is:

> I'm sorry, we cannot afford a raise for you and a huge payout (dividends, bonuses, etc) for the management and stockholders simultaneously, and our priorities are obvious.

You'd be surprised how often that's the case.

Oh, and get into the habit of reading any available financial disclosures before having that talk! Just sayin…

jay_chi,
@jay_chi@mastodon.social avatar

@rysiek as soon as you change your mindset from that of a worker to that of an investor, you understand that your employer does not exist to employ, it exists to enrich the investors/owners. Much about "the way things are" becomes clear (and it is actually not as distasteful as you might think).

The lesson is: be (become) an owner, you may have to be a worker for a while to get to that point.

bananarama,
@bananarama@mstdn.social avatar

@rysiek It's a shame that workers need to hop jobs to get a raise. Given the economy is booming, if your company is not giving you a few percent raise every year, it's time to look elsewhere.

rysiek, to random
@rysiek@mstdn.social avatar

I cannot wait for the next hype cycle. The AI one is so dank and tired.

datarama,
@datarama@hachyderm.io avatar

@rysiek Search engines: While everyone is singing the praises of Kagi, I've found that for the sorts of things I'm interested in, marginalia.nu is often very useful. And it's run by one guy in Sweden.

AI hype: I think the cycle's length and intensity is directly proportional to how much these people want to believe.

rysiek,
@rysiek@mstdn.social avatar

@datarama oh certainly.

rysiek, (edited ) to random
@rysiek@mstdn.social avatar

Hey @nextcloud I see you made "AI" the "centerpiece" of Hub 8?
https://news.itsfoss.com/nextcloud-hub-8/

What model are you using?
What data has it been trained on, and by whom?
Can I recreate your model from scratch?

Edit: the "centerpiece" part might have come from It's FOSS News, although Nextcloud messaging around AI is similarly excited.

tfiebig,
@tfiebig@wybt.net avatar

@rysiek @nextcloud IIRC they go for a "bring your own model"-thing; And provide a traffic light system for assessing those.

rysiek,
@rysiek@mstdn.social avatar

@vt52 I would disagree on the transparency there. One of the points of the ethical assessment is:

> Is the training data available and free to use?

Consider how StackOverflow is basically arguing that the stuff people wrote on the site is "free to use" (as it is on a CC By-SA license), but the community outcry seems to suggest that they are not exactly on board with that interpretation.

LocalAI gets a Green rating, for example. But I cannot find info on the training data… 👀

@nextcloud

rysiek, to random
@rysiek@mstdn.social avatar

We will all have to one day explain what we were doing during the Gaza genocide.

And a lot of us will have to atone for it.

rysiek, to random
@rysiek@mstdn.social avatar

Okay, so, podcasts are great but sometimes I prefer to read instead of listen. 🤔

So what if – hear me out – there was a thing like podcasts, but for text! 🤯

It would still be distributed via RSS, you could still follow them and automagically pull them to your device. But instead of audio, there would be text. ✏️

👉 We could call them: textcasts!

And get this: I already have one! It was super easy to set up, actually. You can find it here:
https://rys.io/en/feed.rss

stragu,
@stragu@mastodon.indie.host avatar

@rysiek what speech-to-text tool do you use for textcasting your podcast?
And now I need to buy a new device that supports audiocasting your textcasts...

liaizon,
@liaizon@wake.st avatar

@rysiek you know about https://textcasting.org right?

rysiek, (edited ) to random
@rysiek@mstdn.social avatar

May the Forth be with you!

potpie,
@potpie@mastodon.social avatar

@rysiek if anyone posts this on a platform with a music option: Indiana Jones theme

thomasgrempe,
@thomasgrempe@social.cologne avatar

@rysiek I see what you did there… Superman w/o cape !

rysiek, to random
@rysiek@mstdn.social avatar

Oh my Dog, @baldur yet again hits multiple nails square in their heads:
https://www.baldurbjarnason.com/2024/react-electron-llms-labour-arbitrage/

🔥 🔥 🔥

> Tech management will sacrifice technological progress – performance, design, and general product effectiveness – if it disempowers labour.

> If you’re unlucky enough to have to use any of this garbage we’re shipping and calling ‘software’, now you know why it all feels a bit shit.

> This is what unions were made for

🔥 🔥 🔥

jhwgh1968,
@jhwgh1968@chaos.social avatar

@rysiek @baldur 💯

Excellent long-form description of something that's been trying to coalesce in my head for some time

Hence my attempt to get the internet to agree to coin a concise version of this as Datskovskiy's Law:

"Employers much prefer that workers be fungible, rather than maximally productive"

Source: http://www.loper-os.org/?p=69

18+ trebach,
@trebach@functional.cafe avatar

@rysiek @baldur The concepts go way back to at least 1776 in The Wealth of Nations:
> A key requirement for effective labour arbitrage is that the employees can be treated as interchangeable, well, components. Jobs that require expertise lend themselves less to arbitrage than jobs that don’t.

"Secondly, the wages of labour vary with the easiness and cheapness, or the difficulty and expense, of learning the business.
[...]
When any expensive machine is erected, the extraordinary work to be performed by it before it is worn out, it must be expected, will replace the capital laid out upon it, with at least the ordinary profits. A man educated at the expense of much labour and time to any of those employments which require extraordinary dexterity and skill, may be compared to one of those expensive machines. The work which he learns to perform, it must be expected, over and above the usual wages of common labour, will replace to him the whole expense of his education, with at least the ordinary profits of an equally valuable capital. It must do this too in a reasonable time, regard being had to the very uncertain duration of human life, in the same manner as to the more certain duration of the machine.
The difference between the wages of skilled labour and those of common labour, is founded upon this principle." (Book I, Chapter X)
Labour arbitrage: "What are the common wages of labour, depends everywhere upon the contract usually made between those two parties, whose interests are by no means the same. The workmen desire to get as much, the masters to give as little, as possible. The former are disposed to combine in order to raise, the latter in order to lower, the wages of labour. [...] There are certain circumstances, however, which sometimes give the labourers an advantage, and enable them to raise their wages considerably above this rate, evidently the lowest which is consistent with common humanity.
When in any country the demand for those who live by wages, labourers, journeymen, servants of every kind, is continually increasing; when every year furnishes employment for a greater number than had been employed the year before, the workmen have no occasion to combine in order to raise their wages. The scarcity of hands occasions a competition among masters, who bid against one another in order to get workmen, and thus voluntarily break through the natural combination of masters not to raise wages."

rysiek, to random
@rysiek@mstdn.social avatar

I just discovered @stefan 's blog and holy moly there's some damn neat stuff there!

Loving this:
https://www.stefanjudis.com/a-firefox-only-minimap/

stefan,
@stefan@front-end.social avatar

@oblomov @rysiek There’s not enough space to show it on a phone. :)

oblomov,
@oblomov@sociale.network avatar

@stefan @rysiek now I have to get up from bed and look at it on the desktop, damn you! ;-)

(BTW, while we're at it, title header font seems rather large on mobile too, doubly more so if I rotate to landscape mode)

rysiek, to infosec
@rysiek@mstdn.social avatar

Dear Hivemind!

We've seen supply chain attacks where old unmaintained npm packages were taken over and malwared, targeting devs.

We've seen attacks that typosquatted names of popular npm packages to get devs to include these accidentally.

We've seen malicious JS libraries hosted on large CDNs, used in attacks.

Have we seen a case where a JS library / npm package got taken over, malwered, and then published to CDNs in order to target websites that include it?

:boost_ok:

tanepiper,
@tanepiper@tane.codes avatar

@rysiek this is one that terrifies me for almost a decade now. So far haven't seen it, but this is why we are moving to compiled node apps in containers with SBOMs and absolutely no external CDNs

rysiek,
@rysiek@mstdn.social avatar

@tanepiper honestly I am surprised that I was so far not able to find a specific example of this happening.

I do vaguely remember some cryptocurrency websites being targeted that way, but I think the vector was not CDNs but malicious npm dependencies on build time. 🤔

  • All
  • Subscribed
  • Moderated
  • Favorites
  • megavids
  • magazineikmin
  • Youngstown
  • khanakhh
  • ngwrru68w68
  • slotface
  • ethstaker
  • mdbf
  • everett
  • kavyap
  • DreamBathrooms
  • thenastyranch
  • cisconetworking
  • rosin
  • JUstTest
  • Durango
  • GTA5RPClips
  • Leos
  • tester
  • tacticalgear
  • InstantRegret
  • normalnudes
  • osvaldo12
  • cubers
  • anitta
  • modclub
  • provamag3
  • lostlight
  • All magazines