elevation

> My local model never says no

In case a future user wants to know what a 2026 model would refuse to do, I needed to rotate dozens of passwords last night both on the server and on the clients. When it was time to verify that the rotated credentials worked, I asked for a script that would rate limit the credential checks. Claude/opus5 (opus!!) refused and stopped in its tracks.

In another instance, Claude was making great headway bringing a legacy Windows app up in WINE until it’s saw “auth” somewhere and shut down. In the shutdown state, Claude asked me to reword the prompt to see if I could get it to act on less dangerous instructions. But when I reworded my request, narrowed the scope to be clearly unthreatening, or even redirected the model, it’s still rejected me. I suspect Anthropic uses the less suspicious rephrasing as training material to increase their rejection rate.

> then blocking the number & reporting spam

I think it's also helpful to be prompt if you'd like to help others; A campaign will use e.g. twilio numbers leased for a matter of hour, then release it. If you wait too long to report spam, you damage the number's reputation without actually punishing the hyperactive spammer.

I love their shared hosting; I have a $100/year account with dozens of little low traffic apps in their own subdomain/user isolation. They maintain the OS, I maintain the app, I can pull code with git and even compile a python interpreter if I need.

I love that I have infinite/unmetered email accounts. In practice I run 3-4 accounts on 2-4 domains, but they don't nickel and dime you on it, I've literally setup 1200 forwarders in the past. They have a good sending reputation.

What other provider does this as well?

Also, you can’t generate a bitstream for a hello world design without getting 10^5 warnings about why the fit for your part could be suboptimal. The signal to noise is awful.

Also, not supporting new VHDL2008 for years and years, and lagging on newer updates.

Another Vivado bugaboo: terrible support for source control.

My current flow is to use the ‘write_project_tcl’ command to export a tcl script that would rebuild the project from a single command. Tracking this in git along with your RTL and constraints should be enough. But the file is jam packed with hard coded paths that have to be carefully removed, or else the source can’t be built on another machine. I wrote a custom tool to post process “setup.tcl” but it is brittle because with every new release, Vivado tampers with the output format.

Xilinx ships IBERT cores so you can test high speed lanes between devices. When you bake them into a bitstream and configure an FPGA, you can read/clear the status of the cores over JTAG via the UI or a TCL script.

Using these cores in particular have revealed a bunch of issues with the Vivado suite:

Inconsistent naming conventions: In a Vivado block diagram, you must figure an IBERT core to use a transceiver by bank number, e.g, Quad 127, Quad 224. But when you get per-lane test results they reference transceivers as X0Y1, X0Y23. The official “packaging and pinout” documentation will help you translate between these identifiers, but you shouldn’t need to: the Towing should use a consistent naming convention in both the design flow and the test flow.

Another issue: incomplete script Support. When you’re viewing the status of an IBERT core over JTAG, you can see a lot of meta data in the details panel, but not all of this information is available in the TCL objects provided to the script console. This means that certain checks cannot be scripted.

Bad UI architecture: all TCL commands run in the UI thread, so long running commands can lock you out of even unrelated actions for minutes at a time.

TCL was novel in the 90s, but it is haggard, and ill-suited to this line of work. Give me python!

> Lie to your colleagues with confidence and ease

https://xkcd.com/1138/

> containers are just processes

Johnathan Blow's talk on the bronze age collapse pushed me to simplify my production stack. I wanted 'just processes', so I stopped using docker there. I'm happy with the result.

In recent years we have also witnessed the outcomes from DAs who refuse to prosecute -- having someone more hard nosed in office seems vastly preferable to losing the local Walgreens and still not having my burglaries prosecuted.

We like convictions because there's a hell of a lot of actual crime that is never punished. Just my circle of friends has suffered car break-ins, burglaries (no suspects), grand theft auto (never recovered the car), and devastatingly, a rape on school property. Most of these crimes weren't investigated, despite real damages, and the couple that were never saw a conviction.

> physical security system

> can be trivially MITMed

Crazy how poor security can be even from a purported security vendor.

> cannot afford to get on the property ladder

The American Midwest would like a word.

If you don't mind being a couple hours drive from anywhere Taylor Swift would play, you can find affordable property, a good community, and amazon prime service. Any town that lacks tech work opportunities will still have solid internet from Starlink to support remote work.

There are awesome opportunities if you look.

Thanks, I appreciate it!

> World Wide Web

Embrace, extend, extinguish

> it’s quite the evolutionary trait

I’m not sure about that. Evolution has two mechanisms: mutation to roll the dice for new traits, and natural selection against any traits that hinder survival up to the point of successful reproduction.

Because this ovarian trait only manifests well after reproductive function it cannot be explained by selection pressure; the remaining culprit would be happy mutation.

Yet while every post-reproductive trait is free to vary without selection, but this one appears to be unvaried across the entire class Mammalia. What force would preserve a non reproductively-advantageous trait so broadly?

It doesn't take secret meetings; the industrial players are subject to regulatory costs that a small local farmer isn't. When "big egg" had to slaughter millions of layers because of a birdflu outbreak, then sell a limited amount of eggs while they waited for new chicks to mature, your local farmer's birds kept laying without an interruption in production or a sudden repeat of the startup costs.

> requiring a human to [...] hand write the pr

> they still have an ai do it all for them

What recourse do you have when employees do not perform the work you're paying them for?

I couldn't find a link, but there's a Bizzaro strip that shows a sculptor putting the finishing touches on his latest work: an elderly mannequin made of peanut butter and bird seed, dressed and seated in a wheel chair. The artist smiles as he imagines the reaction he'll get when he wheels the sculpture through a park full of pigeons.

> Unless a startup fab decides to build its own EDA stack and open-source it as a way to attract customers

An excellent insight -- good tooling could be a differentiator for a US fab looking to compete on something besides price.

I wonder if an Alphabet or an Elon Musk would be willing to buy one of these and open source their software tooling. Same for Xilinx.

Open source tools could grow the market by letting many more creators afford to make designs, effectively commoditizing the manufacturers complement.

It deputizes private institutions to violate Americans’ 5th amendment rights with no evidence, warrant, or right to face our accuser.

When bootstrapping self hosted infrastructure, you cannot rely on the presence of the services which you have not yet set up. So while your normal devops scripts can count on an OpenBao instance, your bootstrap scripts need something smaller and self contained.

Keepassxc has been perfect for this. A clean UI allows humans to navigate if needed, and keepassxc.cli provides enough surface to let a script generate a .env file as part of a bootstrap or disaster recovery process.

> You can't authenticate a person using their (public) fingerprint information.

Yes, but it's a signal! There's a cost to spoof it. A scammer could cheaply start a VM that clones your font profile, but at what cost could they replicate your CPU SKU and GPU combination to provide identical webGL timings?

Other signals include the ability of your employee to show their face on a video call, to sound like themselves on a voice call, the ability contact you from their home IP, to receive official mail at their listed address, to produce a second 2FA token you'd previously registered (but not activated) or repeat a code word you'd exchanged. Any of these things can be spoofed, bypassed, copied, or burgled, but each one imposes some cost on the attacker.

The question is how to surface this information in a way that equips help desk staff and doesn't deceive them into authorizing unnecessary risks.

> Do you have any advice for aspiring bug-bounty hunters?

We're probably at the end of the era of these kinds of big payouts. AI tools will drive the going rates to approximately the costs of the tokens. Bounties exist to make it nominally more economical for researchers to report exploits than it is to resell them.

How could this information be surfaced in a reasonable way in administration software?

Say I have a remote employee who is only able to access your internal systems via his yubikey. His fingerprint is "Genuine Antelope".

Next week, he accidentally damages his yubikey. He has another one in the drawer, but I need to authorized him. I create a new session for him on the provisioning portal (so he can enroll the new key) but now his fingerprint is "Interesting Elephant". What do I do with this information?

It might be better to log the exact forensics and show the administrator the differences, e.g, "User has a new font called "my_handwriting.ttf" since a week ago", or "appears to be a totally different processor, and the new system has Russian fonts installed".

There was a time when I would have bought one, or recommend that a family member buy one, but I've had the same ubiquiti APs for years and I'm happy. If you sell reliable hardware, it will take you many years to see repeat business.

If you start this business, bootstrap -- don't go into debt. If you have 100 units on your shelf, you'll sell them eventually. If you have a large loan, you'll have the bank breathing down your neck -- not worth it for the margins you're after.

At small scale you can economize on shipping by finding a small business that does a lot of receiving and intercepting their cartons and packing material. You can tell if the business's cartons are right for you by glancing at their corrugated cardboard dumpster, but if you ask, they may be happy to give you a load of boxes that they did not already break down.

Sell on eBay/Amazon, but also list your items directly on a website you control where you can bypass their fees. Perhaps the price is the same, but your site can be more profitable. Amazon may de-list you for offering a direct price that's lower than you list for on their site -- but you may be able to bypass this with a coupon code.

If you get good at shipping reflashed OpenWRT routers you will probably not be netting six figures. But by developing the skills of effective marketing and fulfillment, you may find a complementary product that is even more profitable at a similar volume to a similar customer base. The business you build selling routers can make another business idea take off even more quickly.

I was encouraged by a story I heard from NPR about a Hasidic community turning out the vote and using official powers to take private a school building that had been underfunded under municipal control. It was genuinely impressive how much they changed their local community.

I understand how this would be infuriating to other locals. But it shows the power of community organization. They don’t win because America is systemically pro Hasidic, they simply turned out the vote (after years of non-participation.). This is an encouragement to be active in your own community. If you don’t, someone else may do it for you.

This works in other areas of life. A courtesy charge creates a better environment by giving participants skin in the game and filtering out actors who wouldn’t mind abusing you but wont pay to do so.

This will drive rent up, punishing people who lack the credit to purchase.

Unsupported doesn’t mean out of use. Certain institutional customers cling to EL7 so we have apps that maintain python 3.5 compatibility.