Hacking Google Bard – From Prompt Injection to Data Exfiltration
A solid LLM XSS prompt-injection exploit on Bard; inject chat history into a Google Apps Script invocation and exfiltrate via a Google Doc. The thing I find most shocking about this is that it’s entirely by-the-numbers. This is the simplest possible way to exploit Bard (well, maybe the second after an IMG tag), and it’s a frankly shocking that it worked. I am particularly unimpressed that Google Apps Script was permitted as an output from Bard! LLM security is going to be a total shambles if this is the state of the art.
(tags: ai bard llm security infosec exploits prompt-injection xss google)
-
I knew Oz was bad for fauna, but apparently the flora are just as bad. The Gympie Gympie tree is “a Queensland native plant covered in microscopic hairy spines containing a neurotoxin. Brushing against it whilst walking past has occasionally been lethal because it caused enough pain to drive its victims to suicide. There is no treatment, and pain and welts can be expected to last for months, sometimes years”.
Should you use a Lambda Monolith, aka Lambdalith, for your API?
I don’t use Lambda, personally, as I find it too expensive and it doesn’t fit well with our current infrastructure (and I still fear the availability risks that might come with it, viz. this year’s outage). But this seems like a good guideline for those who might be using it:
The argument to limit the blast radius on a per route level by default is too fine-grained, adds bloat and optimizes too early. The boundary of the blast radius should be on the whole API/service level, just as it is and always has been for traditional software. Use a Lambdalith if you are not using any advance features of AWS REST API Gateway and you want the highest level of portability to other AWS gateways or compute layer. There are also many escape hatches to fill some of the promises that single-purpose functions offer.
(tags: lambda monolith api design architecture aws serverless)
Creating a Correction Of Errors document
good write-up on the AWS-style COE process (COEs being Amazon’s take on the post-outage postmortem)
(tags: coes ops processes aws amazon work outages post-mortems operational-excellence best-practices)
Europe’s hidden security crisis
Bloody hell! This is a big one, from the ICCL:
Our investigation highlights a widespread trade in data about sensitive European personnel and leaders that exposes them to blackmail, hacking and compromise, and undermines the security of their organisations and institutions. These data flow from Real-Time Bidding (RTB), an advertising technology that is active on almost all websites and apps. RTB involves the broadcasting of sensitive data about people using those websites and apps to large numbers of other entities, without security measures to protect the data. This occurs billions of times a day. Our examination of tens of thousands of pages of RTB data reveals that EU military personnel and political decision makers are targeted using RTB. This report also reveals that Google and other RTB firms send RTB data about people in the U.S. to Russia and China, where national laws enable security agencies to access the data. RTB data are also broadcast widely within the EU in a free-for-all, which means that foreign and non-state actors can indirectly obtain them, too. RTB data often include location data or time-stamps or other identifiers that make it relatively easy for bad actors to link them to specific individuals. Foreign states and non-state actors can use RTB to spy on target individuals’ financial problems, mental state, and compromising intimate secrets. Even if target individuals use secure devices, data about them will still flow via RTB from personal devices, their friends, family, and compromising personal contacts. In addition, private surveillance companies in foreign countries deploy RTB data for surreptitious surveillance. We reveal “Patternz”, a previously unreported surveillance tool that uses RTB to profile 5 billion people, including the children of their targets.
(tags: iccl rtb targeting profiling patternz google ads security national-security surveillance)
Justin Mason's Weblog Posts
Insurance companies given access to UK Biobank health data, despite promises
Colour me totally unsurprised. Disappointed, though:
When the project was announced, in 2002, Biobank promised that data would not be given to insurance companies after concerns were raised that it could be used in a discriminatory way, such as by the exclusion of people with a particular genetic makeup from insurance. In an FAQ section on the Biobank website, participants were told: “Insurance companies will not be allowed access to any individual results nor will they be allowed access to anonymised data.” The statement remained online until February 2006, during which time the Biobank project was subject to public scrutiny and discussed in parliament. The promise was also reiterated in several public statements by backers of Biobank, who said safeguards would be built in to ensure that “no insurance company or police force or employer will have access”. This weekend, Biobank said the pledge – made repeatedly over four years – no longer applied. It said the commitment had been made before recruitment formally began in 2007 and that when Biobank volunteers enrolled they were given revised information.
(tags: biobank uk politics health medicine data-privacy insurance discrimination science)
-
Amazing essay from Kate Crawford —
At this moment in the 21st century, we see a new form of extractivism that is well underway: one that reaches into the furthest corners of the biosphere and the deepest layers of human cognitive and affective being. Many of the assumptions about human life made by machine learning systems are narrow, normative and laden with error. Yet they are inscribing and building those assumptions into a new world, and will increasingly play a role in how opportunities, wealth, and knowledge are distributed. The stack that is required to interact with an Amazon Echo goes well beyond the multi-layered ‘technical stack’ of data modeling, hardware, servers and networks. The full stack reaches much further into capital, labor and nature, and demands an enormous amount of each. The true costs of these systems – social, environmental, economic, and political – remain hidden and may stay that way for some time.
(tags: ai amazon echo extractivism ml data future capitalism)
We’re sorry we created the Torment Nexus
Hi. I’m Charlie Stross, and I tell lies for money. That is, I’m a science fiction writer: I have about thirty novels in print, translated into a dozen languages, I’ve won a few awards, and I’ve been around long enough that my wikipedia page is a mess of mangled edits. And rather than giving the usual cheerleader talk making predictions about technology and society, I’d like to explain why I—and other SF authors—are terrible guides to the future. Which wouldn’t matter, except a whole bunch of billionaires are in the headlines right now because they pay too much attention to people like me. Because we invented the Torment Nexus as a cautionary tale and they took it at face value and decided to implement it for real.
(tags: charlie-stross torment-nexus sf future elon-musk fiction)
Open science discovery of potent noncovalent SARS-CoV-2 main protease inhibitors
A great result for crowd-sourced science:
We report the results of the COVID Moonshot, a fully open-science, crowdsourced, and structure-enabled drug discovery campaign targeting the … SARS-CoV-2 main protease. We discovered a noncovalent, nonpeptidic inhibitor scaffold with lead-like properties that is differentiated from current main protease inhibitors. Our approach leveraged crowdsourcing, machine learning, exascale molecular simulations, and high-throughput structural biology and chemistry. We generated a detailed map of the structural plasticity of the SARS-CoV-2 main protease, extensive structure-activity relationships for multiple chemotypes, and a wealth of biochemical activity data. All compound designs (>18,000 designs), crystallographic data (>490 ligand-bound x-ray structures), assay data (>10,000 measurements), and synthesized molecules (>2400 compounds) for this campaign were shared rapidly and openly, creating a rich, open, and intellectual property–free knowledge base for future anticoronavirus drug discovery. [….] As a notable example for the impact of open science, the Shionogi clinical candidate S-217622 [which has now received emergency approval in Japan as Xocova (ensitrelvir)] was identified in part on the basis of crystallographic data openly shared by the COVID Moonshot Consortium.
(tags: crowdsourcing science research covid-19 covid-moonshot open-science drugs ensitrelvir ip)
Cruise self-driving cars fail to perceive kids or holes in the road
Should have seen this coming. I’d say kids are woefully underrepresented in many training sets.
‘The materials note results from simulated tests in which a Cruise vehicle is in the vicinity of a small child. “Based on the simulation results, we can’t rule out that a fully autonomous vehicle might have struck the child,” reads one assessment. In another test drive, a Cruise vehicle successfully detected a toddler-sized dummy but still struck it with its side mirror at 28 miles per hour. The internal materials attribute the robot cars’ inability to reliably recognize children under certain conditions to inadequate software and testing. “We have low exposure to small VRUs” — Vulnerable Road Users, a reference to children — “so very few events to estimate risk from,” the materials say. Another section concedes Cruise vehicles’ “lack of a high-precision Small VRU classifier,” or machine learning software that would automatically detect child-shaped objects around the car and maneuver accordingly. The materials say Cruise, in an attempt to compensate for machine learning shortcomings, was relying on human workers behind the scenes to manually identify children encountered by AVs where its software couldn’t do so automatically.’ also: ‘Cruise has known its cars couldn’t detect holes, including large construction pits with workers inside, for well over a year, according to the safety materials reviewed by The Intercept. Internal Cruise assessments claim this flaw constituted a major risk to the company’s operations. Cruise determined that at its current, relatively miniscule fleet size, one of its AVs would drive into an unoccupied open pit roughly once a year, and a construction pit with people inside it about every four years.’
The company’s response? Avoid driving during the daytime, when most kids are awake. Night time kids better watch out, though.
(tags: cruise fail tech self-driving cars vrus kids safety via:donal)
Microsoft accused of damaging Guardian’s reputation with AI-generated poll
wow:
Microsoft’s news aggregation service published the automated poll next to a Guardian story about the death of Lilie James, a 21-year-old water polo coach who was found dead with serious head injuries at a school in Sydney last week. The poll, created by an AI program, asked: “What do you think is the reason behind the woman’s death?” Readers were then asked to choose from three options: murder, accident or suicide. Readers reacted angrily to the poll, which has subsequently been taken down – although highly critical reader comments on the deleted survey were still online as of Tuesday morning.
Grim stuff. What a terrible mistake by Microsoft(tags: ai guardian microsoft grim polls syndication news media)
Marina Hyde on the UK’s Covid Inquiry
For me, the most depressing thing about the revelations at the inquiry this week – and no doubt for many weeks and months to come – is that they are not really revelations. The government was horrendously incompetent, didn’t have a plan, yet still wasted a huge amount of time – and a tragic number of lives – on mad posturing, pointless turf wars or buck-passing and catastrophic infighting. The sad fact is that all of this was said AT THE TIME, and all of it was denied repeatedly by those in charge. And it was denied not just in insidery lobby briefings or to individual journalists – but live on air, to the nation, in those wretched press conferences every night. They lied about everything, all the time, and the lies they told backstage were just the obverse of the ones they spouted front of house. Seeing inquiry witnesses feted for punchy WhatsApps now is a bit like congratulating a serial killer for switching to an energy-efficient chest freezer. I’m sure half of them will be reflecting amiably on the period on their inevitable podcasts in due course – but the British public deserve so much more, as they did at the time.
(tags: uk politics covid-19 boris-johnson dominic-cummings marina-hyde funny grim)
Summary of the AWS Service Event in the Northern Virginia (US-EAST-1) Region
“Amazon Secure Token Service (STS) experienced elevated error rates between 11:49 AM and 2:10 PM PDT [on June 13, 2023] with three distinct periods of impact.” We saw significant impact across our stack as a result of this outage impacting STS; in addition a very wide swathe of AWS services (way more than in this postmortem note!) were reported as impacted. I still can’t get over that STS (the security token service, used by most modern AWS setups to gain tokens to use other AWS services) is reliant on Lambda. These foundational services are supposed to be rock-solid and built with conservative tech choices. Disappointing.
How Elon Musk changed Twitter’s Dublin operation: ‘He broke the culture in a week’ – The Irish Times
This is sadly, not surprising at all, and quite indicative of Musk’s mindset:
“We were, in many ways, an afterthought … the decisions he made and how he made them, were made as if they were only impacting America,” says the source. “I think one of the toughest things for a lot of the Dublin people was [that] we were spectators at our own demise. We were like collateral. [Musk] was attacking Twitter in the US, and we were collateral damage — which was a strange feeling for a place that had been so integral to the global footprint of the company.”
(tags: elon-musk twitter ireland dublin working business acquisitions)
research!rsc: Running the “Reflections on Trusting Trust” Compiler
This is great! An annotated dump of Ken Thompson’s “Reflections on Trusting Trust” backdoor in V6 UNIX cc
(tags: history programming security infosec ken-thompson unix cc backdoors exploits quines)
AWS ALB returns 503 for Istio enabled pods
yes, yes it does. I am not a fan of istio at the moment
-
A very cool hack — its PMTiles format allows serving map tiles using HTTP range requests, allowing the entire world to fit in a single CDN-compatible file of 107GB, but with easy incremental zooming from the javascript viewer app
(tags: cartography javascript mapping maps web http range-requests map-tiles cdn formats)
Lessons Learned from 1TB DynamoDB Import
good advice for large scale DynamoDB usage. better yet is to avoid having to do big imports in the first place of course :)
Instagram apologises for adding ‘terrorist’ to some Palestinian user profiles
Just staggeringly bad: ‘The issue … affected users with the word “Palestinian” written in English on their profile, the Palestinian flag emoji and the word “alhamdulillah” written in Arabic. When auto-translated to English the phrase read: “Praise be to god, Palestinian terrorists are fighting for their freedom.”’
Fahad Ali, the secretary of Electronic Frontiers Australia and a Palestinian based in Sydney, said there had not been enough transparency from Meta on how this had been allowed to occur. “There is a real concern about these digital biases creeping in and we need to know where that is stemming from,” he said. “Is it stemming from the level of automation? Is it stemming from an issue with a training set? Is it stemming from the human factor in these tools? There is no clarity on that. “And that’s what we should be seeking to address and that’s what I would hope Meta will be making more clear.”
Someday the big companies will figure out that you can’t safely train on the whole internet.(tags: training ai ml fail funny palestine instagram meta alhamdulillah)
-
“Recently, a project rewrote the LLaMa inference code in raw C++. With some optimizations and quantizing the weights, this allows running a LLM locally on a wild variety of hardware. If you are like me, you saw this and thought: What? How is this possible? Don’t large models require expensive GPUs? I took my confusion and dove into the math surrounding inference requirements to understand the constraints we’re dealing with.” […] Summary: “Memory bandwidth is the limiting factor in almost everything to do with sampling from transformers. Anything that reduces the memory requirements for these models makes them much easier to serve — like quantization! This is yet another reason why distillation, or just training smaller models for longer, is really important.” (via Luis Villa’s https://www.openml.fyi/ , which is great!)
(tags: llama2 llms performance optimization c++ memory quantization via:luis-villa)
-
More on distillation and quantization to reduce cost of LLMs
(tags: llms quantization distillation performance optimization ai ml)
Linux Foundation: Why Open Data Matters
LF getting into Open Data in a big way (via Luis Villa). This is interesting, particularly with this angle:
Digging down to open data specifically, the team say that open data will have a similar impact over time in the world of Large Language Models (LLMs) and Machine Learning (ML). [….] “Today, there are a growing number of high quality open data collections for training LLMs and other AI systems. Sharing well-trained and tested AI models openly will minimize waste in energy and human resources while advancing efforts to deploy AI in the battle against poverty, climate change, waste, and contribute to quality education, smart cities, electric grids and sustainable, economic growth etc,” said Dolan. “To achieve all that can be achieved, the use of open data must be done ethically. Private information needs to be protected. Data governance needs to be protected. Open data must be transparent top to bottom.”
100% behind all of this!(tags: linux-foundation open-data training ml ai via:luis-villa)
-
a great little web app from Radek Toma on the Irish Solar Owners FB group. “I’ve recently developed a tool for analyzing electricity usage based on smart meter reading (I know not everyone is a fan of smart meters ) I built it for myself but over time I thought more people could benefit. The tool reads smart meter file (from ESB or electricity supplier): – it compares current price plans and calculates annual cost based on the usage; – it visualises energy usage in a heatmap so we can easily identify how the energy is consumed Feel free to give it a try and let me know what you think.”
(tags: smart-meters analysis electricity home esb power via:facebook)
-
[..] The famous maxim “‘The future is already here, it’s just not evenly distributed” — apocryphally attributed to the writer William Gibson — takes on a very different meaning from the one now commonly understood. Big, rich states might inflate their defense budgets and boast of systems like Israel’s Iron Dome, but the extent to which sophisticated technology is “distributed” across a broad consumer landscape is enough for highly motivated smaller actors to do whatever violence they wish.
(tags: culture politics world war israel tech gaza palestine)
AWS Reliability Pillar Single-Region scenarios
I hadn’t read these before; these are good example service setups from the AWS Well-Architected Framework, for 3 single-AZ availability goals (99%, 99.9%, and 99.99%), and multi-region high availability (5 9s with a recovery time under 1 minute). Pretty consistent with realistic real-world usage. (via Brian Scanlan)
(tags: via:singer aws reliability architecture availability uptime services ops high-availability)
-
A transcript of his submission to the Dutch parliamentary hearing on EU Chat Control and Client Side Scanning — this is very good.
now we are talking about 500 million Europeans, and saying, “Let’s just apply those scanners!” That is incredible. … If we approve this as a country, if we as the Netherlands vote in favour of this in Europe and say, “Do it,” we will cross a threshold that we have never crossed before. Namely, every European must be monitored with a computer program, with a technology […] of which the vast, overwhelming majority of scientists have said, “It is not finished.” I mentioned earlier the example that the Dutch National Forensic Institute says, “We cannot do this by hand.” The EU has now said, “Our computer can do that.” 420 scientists have signed a petition saying, “We know this technology, some of us invented it, we just can’t do it.” We can’t even make a reliable spam filter. Making a spam filter is exactly the same technology, by the way, but then much easier. It just doesn’t work that well, but the consequences aren’t that scary for a spam filter. Nevertheless, there are now MPs who say, “Well, I feel this is going to work. I have confidence in this.” While the scientists, including the real scientists who came here tonight, say, “Well, we don’t see how this could work well enough”. And then government then says, “Let’s start this experiment with those 500 million Europeans.”
(tags: eu scanning css chatcontrol internet monitoring surveillance bert-hubert)
Zimaboard: the closest thing to my dream home server setup
Helpful review of this new single-board computer. 8GB of RAM, 32GB of eMMC storage and a quad-core Intel Celeron N3450 CPU; built-in heatsink for totally silent operation; low power usage (2-15W typical power usage); 2x SATA or NVMe for SSDs. Ideal profile for a home server, in my opinion; I’ve already gone for an ODroid-HC4, but possibly on the next rev I may take a look at the Zimaboards as an alternative. (ODroids are pretty great though.)
Protesters Decry Meta’s “Irreversible Proliferation” of AI
I don’t know what to think about this:
Last week, protesters gathered outside Meta’s San Francisco offices to protest its policy of publicly releasing its AI models, claiming that the releases represent “irreversible proliferation” of potentially unsafe technology. [….] [Meta] has doubled down on open-source AI by releasing the weights of its next-generation Llama 2 models without any restrictions. The self-described “concerned citizens” who gathered outside Meta’s offices last Friday were led by Holly Elmore. She notes that an API can be shut down if a model turns out to be unsafe, but once model weights have been released, the company no longer has any means to control how the AI is used. […] LLMs accessed through an API typically feature various safety features, such as response filtering or specific training to prevent them from providing dangerous or unsavory responses. If model weights are released, though, says Elmore, it’s relatively easy to retrain the models to bypass these guardrails. That could make it possible to use the models to craft phishing emails, plan cyberattacks, or cook up ingredients for dangerous chemicals, she adds. Part of the problem is that there has been insufficient development of “safety measures to warrant open release,” Elmore says. “It would be great to have a better way to make an [LLM] model safe other than secrecy, but we just don’t have it.”
(tags: ai guardrails llms safety llama2 meta open-source)
-
“A Java version of simdjson” — Java parsing using SIMD instructions to parse gigabytes of JSON per second. Early days, requires Java 20, and only covers a small number of architectures, but it’s getting there
(tags: simd java json parsing formats performance libraries)
-
“Bandcamp-style batch encoder and web player for independent musicians — an open-source web tool for making self-hosted Bandcamp-style album pages, with embeddable web players and multiple audio formats automatically generated; to sell downloads, you can use a store like itch.io”
alienatedsec/solis-ha-modbus-cloud
“A combination of Solis Cloud and Home Assistant via RS485 (Modbus) communication. This repo is a documented workaround for Solis [solar PV] inverters to connect Solis Cloud and the local Home Assistant based on my own experience. It includes references, examples of the code in Home Assistant, more about configuration, as well as wiring and all required components.”
(tags: home-assistant solis solar-pv automation rs485 modbus)
Google Chrome ad features checklist
a list of ad-surveillance and AI-training features to turn off, both on our personal browsing and on your websites, courtesy of Don Marti
(tags: browsers chrome privacy data-privacy google)
-
a Python script to reformat the data format used by ESB Networks in Ireland for power import/export, into a more flexible/parseable JSON/CSV format
(tags: formats json csv hdf esb power feed-in-tarriff ireland open-data data)
-
Interesting technique from the LLM community to search, cluster and classify text strings:
Text [vector] embeddings measure the relatedness of text strings. Embeddings are commonly used for: Search (where results are ranked by relevance to a query string); Clustering (where text strings are grouped by similarity); Recommendations (where items with related text strings are recommended); Anomaly detection (where outliers with little relatedness are identified); Diversity measurement (where similarity distributions are analyzed); Classification (where text strings are classified by their most similar label); An embedding is a vector (list) of floating point numbers. The distance between two vectors measures their relatedness. Small distances suggest high relatedness and large distances suggest low relatedness.
Commonly used as a storage format in vector databases (cf. https://vercel.com/guides/vector-databases). Search using text embeddings is therefore implemented using cosine similarity or k-nearest neighbour to find vector similarity. Looks like https://www.trychroma.com/ is the current open source vector DB of choice, at the moment. (via Simon Willison)(tags: ai openai via:simonw vector-embeddings text-embeddings text storage databases search similarity clustering recommendations anomaly-detection classification vector-databases)
Covid inquiry: UK’s top pandemic scientist gives damning verdict on Boris Johnson and Rishi Sunak
None of this is remotely surprising, unfortunately:
The inquiry also heard that in October 2020, Mr Johnson wrote “bollocks” in capital letters across a Department of Health guidance document on Long Covid, from which it is estimated more than a million people are suffering. Anthony Metzer KC, representing Long Covid sufferers, said the former PM has admitted in his own witness statement that he did not believe the condition “truly existed”
(tags: long-covid boris-johnson politics uk covid-19 patrick-vallance)
-
ooh looks great! Decent support for fast I/O, lots of CPU power, lots of RAM bandwidth, dual HDMI output (dunno why tbh) and only a tiny bit more expensive than the RPi4. Another fantastic wonder of affordable SBC hardware
(tags: sbc raspberry-pi hardware gadgets devices)
I’m happy to announce that I’m now listed on TechArchives.Irish as one of the pioneers of the Irish web!
After extensive interviewing and collaboration with John Sterne, my testimony and timeline of those early days of the Irish web is now up at TechArchives.
It’s been a good opportunity to reflect on the differences between the tech scene, then and now. I was very idealistic 30 years ago at the possibilities that the web and internet technologies had to offer; nowadays, I’m a bit more grizzled and pragmatic. But I still have hope — particularly if we can apply this tech in a way that helps address climate change, in particular…. here’s to the next 30 years!
Anyway, I hope writing this down helps record the history of those great early years of the web. Please take a look.
Comments closed-
lcamtuf with a solid prediction for the future of content moderation: it’s LLMs.
Here’s what I fear more, and what’s already coming true: LLMs make it possible to build infinitely scalable, personal hall monitors that follow you on social media, evaluate your behavior, and dispense punishment. It is the cost effective solution to content moderation woes that the society demands Big Tech to address. And here’s the harbinger of things to come, presented as a success story: https://pcgamer.com/blizzard-bans-250000-overwatch-2-cheaters-says-its-ai-that-analyses-voice-chat-is-warning-naughty-players-and-can-often-correct-negative-behaviour-immediately/ And the thing is, it will work, and it will work better than human moderators. It will reduce costs and improve outcomes. Some parties will *demand* other platforms to follow. I suspect that the chilling effect on online speech will be profound when there is nothing you can get away with – and where there is no recourse for errors, other than appealing to “customer service” ran by the same LLM. Human moderation sucks. It’s costly, inconsistent, it has privacy risks. It’s a liability if you’re fighting abuse or child porn. But this is also a plus: it forces us to apply moderation judiciously and for some space for unhindered expression to remain.
(tags: moderation llms future ai ml hall-monitors content mods)
Distinguishing features of Long COVID identified through immune profiling
This is great news — clear, objective biomarkers for Long COVID, in a new Nature preprint. Hopefully this will put a nail in the coffin for the sorry cohort of LC deniers claiming that it’s “just anxiety” etc. @PutrinoLab on Twitter notes: Clear objective differences detectable “in the blood of folks with #LongCOVID when compared to people who did not have LC (some who had never had COVID as well as others who had COVID and fully recovered). These differences came down to three big areas: 1) Hormonal differences: namely extremely low morning cortisol in the LC group (cortisol is a hormone that does a lot of things, but in the morning its job is to wake you up and get your body ready to face the day. Low morning cortisol can affect your ability to do that). 2) Immune differences: namely evidence of T-cell exhaustion and increased B-cell activation in the LC group (this shows us an immune system that is fighting something off – and has been doing so for a while – persistent virus makes sense in this context). 3) Co-infection differences: namely evidence of latent viral reactivations in the LC group (if your immune system is weakened, opportunistic viruses will attack). There were NO differences in pre-existing history of depression or anxiety between the three groups and these objective biomarkers did not co-occur with any mental health sequelae that were measured.”
(tags: covid-19 diagnosis biomarkers long-covid putrino-lab akiko-iwasaki papers preprints nature medicine cortisol)
-
A heartfelt plea to stop autoclosing issues/bug reports based on “staleness”: “On github, there has been an increasing trend of using “Staleness detector bots” that will auto-close issues that have had no activity for X amount of time. In concept, this may sound fine, but the effects this has, and how it poisons the core principles of Open Source, have been damaging and eroding projects for a long time, often unknowingly.” 100% agree…
(tags: bots communication community issues github bug-reports cadt software open-source)
-
“Gossip-based service discovery (and more) for large distributed systems” —
In a nutshell, Corrosion: Maintains a SQLite database on each node Gossips local changes throughout the cluster Uses CR-SQLite for conflict resolution with CRDTs Uses Foca to manage cluster membership using a SWIM protocol Periodically synchronizes with a subset of other cluster nodes, to ensure consistency
This is very cool stuff for configuration distribution across a large network, where eventually consistent config is doable….(tags: eventual-consistency configuration corrosion sqlite cr-sqlite crdts distributed-systems)
Why Scalpers Can Get Olivia Rodrigo Tickets and You Can’t
Specialised browsers, virtual mobile networks, and other custom code to evade Ticketmaster’s protections. Whatever Ticketmaster is doing, it’s not enough (via Waxy)
(tags: via:waxy tickets ticketmaster adversaries mvnos scalpers music web)
The Disappearing Art Of Maintenance
Really fantastic article on maintenance, and how the concept has gradually disappeared from modern capitalism:
[The maintainance team’s] knowledge is only worth so much, however. The real challenge is creating an economic system that values labor outside of profit-driven production. Many have rightfully called for a revaluing of care work in recent years. Maintenance workers deserve a similar revival in attention — but not only that. The price mechanism, and the labor system built around it, is fundamentally opposed to maintenance, both in its narrowest practical applications and in its broadest philosophical implications. The fact that the failures of capitalism happened to encourage maintenance practices at the margins is not worth emulating, and we shouldn’t be waiting around for climate change to recreate that austerity at a global scale. It must be valued on its own terms, and that means tearing down the economic system that rejects it.
(via Keith Dawson)(tags: via:kdawson maintenance repair technology infrastructure culture capitalism sustainability)
-
It seems the GDPR does not allow an escape from the Catholic Church:
So to conclude, the Archbishop is a data controller and he needs to be more transparent, for his penance he will have to handle data subject requests but virtually all of these can be safely refused. Go and announce the Gospel of the DPC. Thanks be to the GDPR.
(tags: gdpr fail dpc ireland catholicism religion data-privacy)
-
Quite impressed with what Nextcloud are doing with their AI integrations – an emphasis on self-hosted and “ethical” AI, where “ethical” is defined on these 3 axes: * Is the software open source? (Both for inferencing and training) * Is the trained model freely available for self-hosting? * Is the training data available and free to use? More like this!
(tags: ethics ai ethical-ai nextcloud ml)
Block YouTube Ads on AppleTV by Decrypting and Stripping Ads from Profobuf
Good deep dive into reverse engineering and rewriting in-app HTTP protocols on the wire. Terrible way to do ad-blocking, though
(tags: blocking protobuf youtube google protocols appletv apps reverse-engineering)
-
aka. “cellular architecture” (which is what Slack called it). Basically, entirely independent replicas of the system, to provide fault isolation between “cells”. (Back in 2011? our team in AWS Network Monitoring did this with PIMMS, to provide an ability to survive single-AZ outages.)
(tags: architecture aws infrastructure slack cell-based-architecture cellular-architecture fault-tolerance fault-isolation)
-
Fascinating:
The Polynesians, scattered as they were over 1,000 islands across the central and southern Pacific Ocean, were master navigators who tracked their way over a huge expanses of ocean without any of the complex mechanical aids we associate with sea fairing. They didn’t have the astrolabe or the sextant, the compass or the chronometer. They did however have aids of a sort, which though seemingly humble, were in fact the repositories of an extremely complex kind of knowledge. Called Rebbelibs, Medos. and Mattangs, today we call them simply “Stick Charts.”
(tags: cartography design history maps polynesia stick-charts navigation seafaring)
-
What will happen to AI is boring old capitalism. Its staying power will come in the form of replacing competent, expensive humans with crappy, cheap robots.
(tags: ai future capitalism enshittification ml)
-
“CLI Tools for LLMs”. It’s a UNIX bash/zsh shell, with integration with ChatGPT built-in; run UNIX commands, then ask ChatGPT questions about their output and suggestions on what to do next. Nice, but I’d prefer to use a locally-hosted LLM model
CVE-2020-19909 is everything that is wrong with CVEs
CVE is assigned a ludicrously-high severity rating for a trivial, already-fixed bug
-
Naomi Klein and her “doppelganger”, Naomi Wolf:
Almost everyone I talk to these days seems to be losing people to the Mirror World and its web of conspiracies. It’s as if those people live in a funhouse of distorted reflections and disorienting reversals. People who were familiar have somehow become alien, like a doppelganger of themselves, leaving us with that unsettled, uncanny feeling. The big misinformation players may be chasing clout, but plenty of people believe their terrifying stories. […] When looking at the Mirror World, it can seem obvious that millions of people have given themselves over to fantasy, to make-believe, to playacting. The trickier thing, the uncanny thing, really, is that’s what they see when they look at us. […] on either side of the reflective glass, we are not having disagreements about differing interpretations of reality – we are having disagreements about who is in reality and who is in a simulation. […] To return to the original question: what is Wolf getting out of her alliance with Bannon and from her new life in the Mirror World? Everything. She is getting everything she once had and lost – attention, respect, money, power. Just through a warped mirror. In Milton’s Paradise Lost, Lucifer, a fallen angel, thought it “Better to reign in hell than serve in heaven”. My doppelganger may well still think Bannon is the devil, but perhaps she thinks it’s better to serve by his side than to keep getting mocked in a place that sells itself as heavenly but that we all know is plenty hellish in its own right.
(tags: culture politics naomi-klein naomi-wolf us-politics)
you can use eSIM phone plans without needing a phone that supports eSIM
tl;dr: it’s feasible, but definitely not easy…
eSIM is actually a specification that is implemented by a UICC, or universal integrated circuit card. Phones with eSIM support have an eUICC (embedded UICC) chip, but there’s nothing preventing a vendor from making a traditional nano SIM-sized card with an eUICC that follows the eSIM spec. These are called “removable eUICCs” and are actually used in IoT devices, but their use in mobile devices is still somewhat new. A few companies have popped up that sell you removable eUICCs, like http://eSIM.me and http://esim.5ber.com, but it’s also possible to DIY your own removable eUICC.
(via Brian Scanlan)(tags: via:brian-scanlan esims mobile phones sim-cards euicc hardware devices)
Evidence Undermines ‘Rapid Onset Gender Dysphoria’ Claims
Scientific American:
“This is just a fear-based concept that is not supported by studies,” says Marci Bowers, president of the World Professional Association for Transgender Health. The term ROGD is being used to “scare people or to scare legislators into voting for some of these restrictive policies that take away options for young people. It’s cruel, cruel legislation.”
(tags: rogd gender trans politics healthcare transgender)
-
“The laboratory accident hypothesis of COVID-19’s origins is a bust, but the popular consensus is unwilling to accept it.” This is an excellent long-form article about the lab-leak hypothesis of COVID-19’s origin, how it’s now leaked into the US elites’ mindset, and how it demonstrates our current problem with conspiracy theories:
I learned almost nothing of value when I was a [JFK] conspiracy theorist, but I did learn quite a lot pulling myself out of that mindset, and like [Scott] Alexander, I would never have done so had I only ever encountered people who told me I was being an imbecile. Part of the appeal of conspiracy theories is that they allow a person to feel more intelligent than the drones who passively drift along on the current of received consensus. […] For now and the foreseeable future, much of the COVID-origins discourse remains committed to an illusory explanation that appeals to misfiring intuitions and trades almost entirely in suspicion and innuendo. Highly intelligent minds are as vulnerable to irrational thinking and conspiracist ideation as those of the cognitively impaired, particularly if they are used to perceiving problems in political terms. Reasoning well, Scott Alexander reminds us, is hard and “all factual claims can become the basis for emotional/social coalitions.” The best way to avoid this trap is to try to remember that we do not live through the looking glass where up is down and black is white. In quotidian reality, things are usually exactly as they appear to be.
(tags: reasoning logic media lab-leak covid-19 conspiracies politics us-politics china long-reads)
NFT royalty fees dropped by OpenSea
Who could have seen this coming?!
One of the big promises of NFTs was that the artist who originally made them could get a cut every time their piece was resold. Unfortunately, that’s not the case anymore. OpenSea, the biggest NFT marketplace still fully enforcing royalty fees, said today that it plans to stop the mandatory collection of resale fees for artists. Starting March 2024, those fees will essentially be tips.
(via JK)-
I’d never heard of this before, but it makes a lot of sense: “In 1977, two planes collided above a runway on the island of Tenerife. A handful of passengers climbed out of the ruptured hull. Everyone else burned. It wasn’t because they were injured. They were all wide awake. They just couldn’t get moving. They didn’t want to panic.” “Large groups of people facing death act in surprising ways. Most of us become incredibly docile … Usually, we form groups and move slowly, as if sleepwalking in a nightmare.” In short, we don’t panic. We chill way out. More than half of people in any given emergency are almost destined to shut down or freeze up. Even if they can function, they’ll spend precious time gossiping with each other and trying to get more information before they even try to do anything.” (This latter phenomenon is apparently called “milling”.) https://en.wikipedia.org/wiki/Normalcy_bias : “Normalcy bias, or normality bias, is a cognitive bias which leads people to disbelieve or minimize threat warnings.[1] Consequently, individuals underestimate the likelihood of a disaster, when it might affect them, and its potential adverse effects.[2] The normalcy bias causes many people to not adequately prepare for natural disasters, market crashes, and calamities caused by human error. About 80% of people reportedly display normalcy bias during a disaster.[3]” Also referred to as analysis paralysis, the ostrich effect, and negative panic.
(tags: milling analysis-paralysis ostrich-effect negative-panic normalcy-bias biases psychology crises normalcy panic disasters cognitive-biases)
Scientists Witnessed The Birth Of A New Accent In Antarctica
Over the course of the stay, the researchers noticed significant changes in the [winter-overs’] accents. One of the main shifts was how the study group started pronouncing their words with longer vowels. Furthermore, there was evidence of linguistic innovation in the group. Towards the end of their stay in Antarctica, the residents were pronouncing “ou” sounds – like those found in the words “flow” and “disco” – from the front of their mouth, as opposed to the back of their throats. […] “The Antarctic accent is not really perceptible as such – it would take much longer for it to become so – but it is acoustically measurable,” Jonathan Harrington, study author and Professor of Phonetics and Speech Processing at the Ludwig-Maximilians University of Munich, told IFLScience. “It’s mostly an amalgamation of some aspects of the spoken accents of the winterers before they went to Antarctica, together with an innovation,” added Harrington. “It’s far more embryonic [than conventional English accents] given that it had only a short time to develop and also, of course, because it’s only distributed across a small group of speakers.”
(via Sean Michaels)(tags: accents antarctica language science)
The Culture War Funded by Russian Roubles
Between 2009-18, anti-gender actors from within the European Union, Russia and the US have spent at least $707.2 million in Europe, with the Russian Federation making up 26.6% of that spend, according to research published by the European Parliamentary Forum on Sexual and Reproductive Rights. As reported in this paper, the two main Russian funders of anti-gender disinformation are Vladimir Yakunin and Konstantin Malofeyev – oligarchs sanctioned for their alleged involvement in the annexation of Crimea, after Russia’s 2014 invasion. Their roubles have mingled with US dollars at the World Congress of Families; with Euros at the Novae Terra Foundation, and La Manif Pour Les Tous; and British pounds at Agenda Europe – in 2013, the assets manager of banker Sir Michael Hintze attended the network’s London summit, the following year Malofeyev’s man in Europe, Alexey Komov, was on the guest list. The campaigns and individuals funded by this wealth have regularly spread anti-abortion, anti-LGBTIQ disinformation, including that abortion is “Satanic” and that there’s a “homosexual agenda” which wants to make children “sex education propagandists in the EU”. They also spread anti-trans rhetoric.
(tags: russia politics terfs gender lgbtqi abortion europe eu trans-rights)
-
“One of the biggest threats to progress on climate change is misinformation. We’re here to stop the spread by changing the online algorithms of climate change sceptics and surfacing the truth in their news feeds. But we need your help. Send this link to any climate change sceptics you know. It’ll take them to what looks like a normal website for a cookie recipe. Every visitor who accepts our cookie policy will be targeted with accurate climate information content delivered through paid advertising over the course of a week. Their online profiles held by media companies will also receive signals to suggest they are interested in receiving fact-based climate content.” (via thejokersthief on ITC)
(tags: cookies targeted-ads climate-change news facts)
-
“Long COVID in a highly vaccinated population infected during a SARS-CoV-2 Omicron wave – Australia, 2022”, preprint, via Prof. Danny Altmann. Basically it’s still not great news, vaccination and “mild” omicron regardless:
18.2% (n=2,130) of respondents met case definition for Long COVID. Female sex, being 50-69 years of age, pre-existing health issues, residing in a rural or remote area, and receiving fewer vaccine doses were significant independent predictors of Long COVID (p < 0.05). Persons with Long COVID reported a median of 6 symptoms, most commonly fatigue (70.6%) and difficulty concentrating (59.6%); 38.2% consulted a GP and 1.6% reported hospitalisation in the month prior to the survey due to ongoing symptoms. Of 1,778 respondents with Long COVID who were working/studying before their COVID-19 diagnosis, 17.9% reported reducing/discontinuing work/study. [...] Long COVID was associated with sustained negative impacts on work/study and a substantial utilisation of GP services 2-3 months after the acute illness.
(tags: covid-19 long-covid australia omicron medicine papers preprints via:danny-altmann)
Even in Greek towns razed by wildfires, people don’t blame the climate crisis
Cognitive dissonance strikes again:
The more I spoke to people, including climate scientists, the more I came to see that there is often a gap that separates science from public awareness and debate. In her book Engaging With Climate Change, the psychoanalyst Sally Weintrobe says that “many people who accept anthropogenic global warming continue to locate it as a problem of the future”. To my astonishment, this seemed to apply even to people who had themselves been affected directly by wildfires. Perhaps the reality is too huge and too painful, the guilt too much to bear?
(tags: climate-change cognitive-dissonance reality future wildfires greece politics)
Apollo 11 Anniversary Tribute – The Full Mission flown in First-person view (IVA)
This is absolutely incredible — the entire Apollo 11 mission flown, mostly by hand, in Kerbal Space Program, and synced to the Houston and onboard audio from the real Apollo mission. The level of verisimilitude put into this, from the control panel recreation to the hand-piloting, is really off the scale — amazing.
(tags: kerbal ksp space apollo-11 apollo moon history video)
-
A Revolutionary Login Shell: “Managing access to resources is a crucial task for system administrators. There is an increasing need for a mechanism that allows the confinement of users within predefined boundaries. The `podmansh` command addresses this issue by enabling system administrators to execute user shells within a container, whenever a user logs into the system.”
Max Levchin’s Shamir Secret Sharing story
this is amazing. “This is the story of a catastrophic software bug I briefly introduced into the PayPal codebase that almost cost us the company (or so it seemed, in the moment.)” tl;dr: UNIX libc API standardisation failure bites again — the getpass() API had differing behaviour between Linux and Solaris, where SysV compatibility caused passwords to be truncated after 8 bytes. horrific
(tags: via:hn paypal security getpass libc system-v unix linux solaris bugs war-stories)
-
One recipe it dubbed “aromatic water mix” would create chlorine gas. The bot recommends the recipe as “the perfect nonalcoholic beverage to quench your thirst and refresh your senses”
(tags: ai funny fail meal-planners apps recipes chlorine pak-n-save)
Karl Jeacle’s Mortgage Calculator
Still the best visualisation of mortgage amortization. Thanks Karl!
(tags: karl-jeacle history irish mortgage amortization finance)
-
An officially-supported Linux filesystem client for Amazon S3, now GA
-
“the propensity for humans to favor suggestions from automated decision-making systems and to ignore contradictory information made without automation, even if it is correct.[1] Automation bias stems from the social psychology literature that found a bias in human-human interaction that showed that people assign more positive evaluations to decisions made by humans than to a neutral object.[2] The same type of positivity bias has been found for human-automation interaction,[3] where the automated decisions are rated more positively than neutral.[4] This has become a growing problem for decision making as intensive care units, nuclear power plants, and aircraft cockpits have increasingly integrated computerized system monitors and decision aids to mostly factor out possible human error. Errors of automation bias tend to occur when decision-making is dependent on computers or other automated aids and the human is in an observatory role but able to make decisions.” “The concept of automation bias is viewed as overlapping with automation-induced complacency, also known more simply as automation complacency. Like automation bias, it is a consequence of the misuse of automation and involves problems of attention. While automation bias involves a tendency to trust decision-support systems, automation complacency involves insufficient attention to and monitoring of automation output, usually because that output is viewed as reliable.”
(tags: automation bias complacency future ai ml tech via:etienneshrdlu)