NegativeK

I don't know if that's a thing here in the states, but I'll keep it in mind! It probably wouldn't be hard to advertise via the local (different) hackerspace.

But I'll probably have to get through my backlog of current tasks and projects before I wanted to take on other peoples'. And I may have literally set up a wiki to track those projects...

It was climbing, but that one I've fully walked away from.

I've slowly pushed away the classic attention manipulating applications -- basically anything that will find new content to keep you engaged. Tiktok feels like the maximalist example, but other similar apps, social media text feeds, and parts of Youtube (though, I've so aggressively tuned Youtube that it has a very limited content base to show me.)

TV isn't for TV's sake; it's for relaxing a little with someone I care about.

I can read longer form news articles and not need to stay abreast of what's happening daily.

I've found that I'll eventually grow bored and annoyed with things meant to steal attention, at which point I'll excise them from my life. It just might take an unfortunate while to get there.

I've taken somewhat of a parallel path.

I set foot in a shop for the first time at a hackerspace 11 or 12 years ago and eventually feel deep into machining. I spent huge swaths of my days there, and when I wasn't, I was reading about machining. Books, because there were few Youtubers doing it and the forums are thin. It's not a popular hobby and a lot of the professionals and hobbyists aren't computer savvy.

I focused on it to the detriment of other things. Friends commented last year on how absorbed I became and how much I was absorbing. Puttering around on a computer fell away, since it wasn't that relevant to the hobby. It wasn't necessary to use the aging laptop in my free time; I could read PDFs on my phone or old, used books.

But you're not looking at your phone often, because your hands are dirty. Or busy. Or there's a significant safety concern from lapsed attention. Or when doing related types of metal working, weld spatter might land on a face up phone and take chunks out of the glass. Or maybe a steel chip scratches the screen.

Eventually I drifted away from machining for another hobby, but I've come back to it now that I have space in my garage -- this time with more balance. I'm not out until after midnight on work nights. Instead, I'm up before dawn, working with my hands for an hour or two before work. After work, I spend time on learning things somewhat relevant to my career. On the weekends, I'll spend a few hours each day.

The machining isn't ever useful. I made a nylon washer on my lathe once for a dog harness -- I think that's the only item I've made that's not for the hobby itself. But it's tangible. The projects are incredibly slow, and no undo button means a small mistake can result in hours work thrown in the recycling. I spent maybe eight hours over the past four days making a tiny brass rod (as well as other, failed versions) to repair an older clockwork mechanism. A used replacement would've been relatively cheap on Ebay, but that's never the point.

One of the secondary awful things about AI is that I have to hear news sources I like listening to complain about it constantly.

This AI hype is frustrating, but it's also frustrating that it dominates conversations with valid points that are identical to the last five times it was talked about.

When they were first released, there was a fleet/commercial only model that was stripped down and roughly $40k. _That_ was the model that I expected to succeed. Presumably the same type of truck my employer bought from dealerships 20 years ago, with the sterile interior.

But that doesn't address any of your other points, and I can't imagine a business owner that has very little incentive to change how they're buying vehicles to even care about the Lightning if they aren't seeing their friends or themselves in the modern minivan that's called a truck today, just electrified.

> I'd need to build twice the nodes.

Why twice the nodes? The manager is optional -- but do you need multiples?

Also, when I looked into clusters (that I haven't implemented,) I did see qdevices. It's a way to have a cheap and weak third node just to break ties.

They're not the only ones to claim that absurdity.

https://opensource.google/documentation/reference/using/agpl...

> People are capable, and should be helped to make decisions based on all available information.

To relay a quote, with the source not being very important: "I'm not going to waste a dime on cybersecurity when my officers need bullets and armor." People can be intelligent and capable and have minimal (if you're lucky) bandwidth or tolerance for cybersecurity advice. It's not the crisis they see every day. The advice given to unwilling listeners has to be focused and prioritized.

And... Password leaks and therefore rotations aren't an issue if people are using a strong main password for their manager. Then a leak doesn't transfer to another account and the manager will loudly tell them when a password is found in breach data -- which lines up with NIST's modern advice of avoiding password complexity and rotation, since they've found it to lead to minimal (at best) gained security.

1. People are terrible at creating strong passwords. People will NOT create hundreds of strong passwords.

2. People will not use complex solutions unless actively and rigidly enforced.

3. At best, we can hope that they can create one really good passphrase. That's combined with MFA.

There are people that are exceptions to those, but they're vanishingly small percentage of the population. And unfortunately, there are a way, way more people that think they have something better but are deluding themselves -- like bad card counters that casinos are happy to have at the blackjack table or non-experts rolling their own crypto.

While you and I would love it if password managers would rotate creds, we're not yet at the point where people will use password managers. They're still using CompanynameFall2025!. Next month, they'll dutifully rotate their password to CompanynameWinter2025! because their work policy is still stuck on shitty standards.

> This kind of advice is well-intentioned but misleading. It consumes the limited time people have to protect themselves and diverts attention from actions that truly reduce the likelihood and impact of real compromises.

When you've got 15 seconds to _maybe_ get someone to change their behavior for the better, you need to discard everything that's not essential and stay very very far away from "yes, but" in your explanations.

I've had to inform leadership that stability is a feature, just like anything else, and that you can't just expect it to happen without giving it time.

One leader kind of listened. Sort of. I'm pretty sure I was lucky.

Top commenter's "AFAYK" acronym is covering that.

The type that claims they're going to achieve zero known and unknown bugs is also going to be the type to get mad at people for finding bugs.

I both 100% agree with you and also don't think our opinion matters.

The general consumer isn't going to hear "the manufacturer hasn't upstreamed stable drivers to the kernel" and suddenly stop blaming Linux if the hardware works in Windows.

Now you can pretend you're an enterprise IT environment with arbitrary and ridiculous purchasing constraints!

But for real, that sucks. The alternatives -- much older, used RAM -- may not be very attractive, depending on what you're doing.

It's a vulnerability via pathing, not a worry that the shebang script could be malicious.

Someone may have dropped a malicious executable somewhere in the user's path that the shebang calls. The someone shouldn't be able to do that, but "shouldn't" isn't enough for security.

Or maybe the relatively pathed executable has unexpected interactions with the shebanged script, compared to what the script author expected.

Etc.

I obviously can't speak for you, but there's not a freaking chance I'd trust my life to the servers I run.

To go maybe too literal: when I'm working on machines that could physically eat me, I don't trust myself with just one off switch -- I want redundancy. And since computers are horrible piles of ridiculous complexity, the closest I can get (and not really get close) is trusting some of the top minds to overthink the crap out of it in a way that I can't do with the systems I manage.

But again, YMMV.

Anubis has been around for almost a year now, but it's also not particularly relevant to the content of the email thread.

The problem isn't that AI slop is doing something new. Phishing, blogspam, time wasting PRs, website scraping, etc have all existed before.

The problem is that AI makes all of that far, far easier.

Even using tooling to filter articles doesn't scale as slop grows to be a larger and larger percentage of content, and it means I'm going to have to consider prompt injections and running arbitrary code. All of this is a race to the bottom of suck.

PR.

And pushing forward the idea that "responsible disclosure" doesn't mean the software creator can just sit on a bug for as long as they want and act superior and indignant when the researcher gives up and publishes anyway because the creator is dragging their ass.

AGPL, with no CLA that lets the owners relicense. Then we'll see if the using corporation fully believes in open source.

There's a reason Google turned into year 2000 Microsoft "it's viral!" re. the AGPL. They're less able to ignore the intent of the license and lock away their changes.

Vulnerabilities should be publicly disclosed. Both closed and open source software are scrutinized by the good and the bad people; sitting on vulnerabilities isn't good.

Consumers of closed source software have a pretty reasonable expectation that the creator will fix it in a timely manner. They paid money, and the (generally) the creator shouldn't put the customer in a nasty place because of errors.

Consumers of open source software should have zero expectation that someone else will fix security issues. Individuals should understand this; it's part of the deal for us using software for free. Organizations that are making money off of the work of others should have the opposite of an expectation that any vulns are fixed. If they have or should have any concern about vulnerabilities in open source software, then they need to contribute to fixing the issue somehow. Could be submitting patches, paying a contractor or vendor to submit patches, paying a maintainer to submit patches, or contributing in some other way that betters the project. The contribution they pick needs to work well with the volunteers, because some of the ones I listed would absolutely be rejected by some projects -- but not by others.

The issue is that an org like Google, with its absolute mass of technical and financial resources, went looking for security vulnerabilities in open source software with the pretense of helping. But if Google (or whoever) doesn't finish the job, then they're being a piece of shit to volunteers. The rest of the job is reviewing the vulns by hand and figuring out patches that can be accepted with absolutely minimal friction.

To your point, the beginning of the expectation should be that vulns are disclosed, since otherwise we have known insecure software. The rest of the expectation is that you don't get to pretend to do a nice thing while _knowing_ that you're dumping more work on volunteers that you profit from.

In general, wasting the time of volunteers that you're benefiting from is rude.

Specifically, organizations profiting off of volunteer work and wasting their time makes them an extractive piece of shit.

Stop being a piece of shit, Google.

The US Supreme Court decided in 1886 [1] that it's the 14th amendment.

The general article on Wikipedia [2] has more info about it, and discusses the fact that corporate personhood is an abstraction that represents the rights of the individuals owning or running the company. "Statutes violating their prohibitions in dealing with corporations must necessarily infringe upon the rights of natural persons" and modern cases. That article also discusses how, from the 1920s to the 80s, general corporate personhood wasn't as broad as it is today. It also mentions, at the top, historical instances of the idea.

But to your point, no corporation in the US has full, equal rights to a natural person. It's an abstraction that the legal system does not apply blindly. You could change the phrase "corporate person" to something like "corporate legal entity with a set of rights that overlaps with natural persons" or demand a different approach to the rights of a corporation, but I don't think "you're using that word wrong" will hold much weight with legal professionals.

[1] https://en.wikipedia.org/wiki/Santa_Clara_County_v._Southern....

[2] https://en.wikipedia.org/wiki/Corporate_personhood#In_the_Un...

Ruff (I'm sure it's not unique) can yell at you for having a TODO without an associated link to a ticket, which I greatly appreciate.

So why didn't GDPR require Do Not Track to be honored? It was already there, to be expanded on if needed.

But I can't imagine copmanies would want that. They benefit from cookie dialogs fatigue, and for some reason people blame GDPR of all things for surveillance tech being annoying in how they ask for permission.

In most places I've lived, busses are for poor people. Because anyone else will pay whatever it takes to get a car and avoid something like a _three hour_ round trip for something 10 miles away. I'm not kidding; my work commute is 10 miles each way, in a city of way more than 1M, and it's 1.5 hours total for me to get to work on time.

I've lived in one place where they were great. Dense urban environments can do that, though. So nuh us busses can be great (the trains were even better), but it seems like the US has zero actual drive to make public transit not crap.

> How would one adapt to shifting demand, or new materials becoming available, or old materials going out of supply.

That's very unlikely. New materials would require the company requesting the part to reengineer it, recertify it, or at least retest it. But even still we're not coming up with materials that are a significant improvement in most fields. Aerospace, sure. It can be worth it to iterate and improve. Most things, a part that's worked for 50 years will keep working and will be happily profitable in maintenance mode. Those customers want reliability, not to test some improvement on a part that has negligible impact in the overall system.

And the common metals (gears are typically steel, maybe a yellow metal) are made in such large amounts that new materials are going to cost a heck of a lot more. So the customer is going to wreck their profit while the machine shop probably isn't going to have to change their process that much.

There definitely is innovation in machining. New processes are making tighter tolerances more achievable or material removal faster. But to the top commentor's point (who showed me how to use a benchtop lathe over a decade ago), the capital investment for a new machine plus the labor of duplicating all of your work plus the unknown maintenance costs, etc etc etc just don't make sense when Moore's law doesn't apply.

This article feels like an opinion piece with an axiom of perfection or nothing.

Are employees aware that they can't trust AI results uncritically, like the article mentions? See: the lawyers who have been disciplined by judges. Or doctors who aren't verifying all conversation transcriptions and medical notes generated by AI.

Does your organization have records retention or legal holds needs that employees must be aware of when using rando AI service?

Will employees be violating NDAs or other compliance requirements (HIPAA, etc) when they ask questions or submit data to an AI service?

For the LLM that has access to the company's documents, did the team rolling it out verify that all user access control restrictions remain in place when a user uses the LLM?

Is the AI service actually equivalent or better or even just good enough compared to the employees laid off or retasked?

This stuff isn't necessarily specific to AI and LLMs, but the hype train is moving so fast that people are having to relearn very hard lessons.

Using a OTP in your backup strategy adds way more complexity, failure modes, and costs with literally no improvement in your situation.