kahnclusions

Microsoft turns on OneDrive backups by default without your knowledge or consent, sending your private files to MS servers, not only during setup but it can also happen during updates. Even when you try keep it disabled, they constantly pressure you into enabling it every time you login, and make it really easy to accidentally turn it on. Once your files are in OneDrive, MS can access them. Don't be surprised if it later turns out they're training their LLMs on people's private files.

Me too. It’s infuriating and unsafe. I don’t drive often, but when I do it’s out of the city where I’m unfamiliar and need a map.

So I also stopped using Google Maps for driving.

Who at Google seriously believes that it’s good idea to 1) unpredictably change the route someone chose mid-drive, and 2) to distract them while driving with a pop up notification that must be interacted with just to maintain the route.

If I choose a route, I chose it for a reason. Don’t change it while I’m driving.

And don’t hallucinate.

I’m surprised they think the AI generated rewrite is even copyrightable.

A tweet is not a ToS.

What? Yes they do take shortcuts and hacks. They change the tests case to make it pass. As the context gets longer it is less reliable at following earlier instructions. I literally had Claude hallucinate nonexistent APIs and then admitted “You caught me! I didn’t actually know, let me do a web search” and then after the web search it still mixes deprecated patterns and APIs against instructions.

I’m much more worried about the reliability of software produced by LLMs.

The package management story on Linux is hideously bad. The next generation replacements are all over the place (do I use snaps? Flatpak?). No one is going to learn Nix if it means you need to become a programmer just to install something.

The graphics story on Linux also sucks. I recently tried to convert my Windows gaming machine to Linux (because I hate W11 with a burning passion). It does work, but it’s incredibly painful. Wayland, fractional scaling, 120+ Hz, HDR. It’s getting better thanks to all the work Valve etc are putting in, but it’s still a janky messy patchwork.

MacOS just works. It works reliably. Installing things is easy. Playing games is easy. I’m able to customize and configure enough for my needs. I love it and I hope it sticks around because there is no way in hell I would move my work machines over to Linux full time.

AI is a cancer on humanity

I’m not convinced LLMs can ever be secured, prompt injection isn’t going away since it’s a fundamental part of how an LLM works. Tokens in, tokens out.

I’m not exactly sure about ZKPs but for age verification the “proof” can come from the government but in such a way that the web service doesn’t know anything more than whether an assertion is true, and the government doesn’t know anything more than you wanted to verify some assertion.

This is a simplified method for age verification:

I want to buy alcohol from my phone and need to prove I’m over 18. SickBooze.com asks me for proof by generating a request to assert “age >= 18”.

My phone signs this request with my own private key, and forwards it to the government server.

The government verifies my signature against a public key I previously submitted to them, checks my age data in their own register of residents, and finally signs the request with one of their private keys.

My phone receives the signed response and forwards it back to SickBooze.com, which can verify the government’s signature offline against a cached list of public keys. Now they can sell me alcohol.

- the “request” itself is anonymous and doesn’t contain any identifying information unless that is what you intended to verify

- the government doesn’t know what service I used, nor why I used it, they only know that I needed to verify an assertion about my age

- the web service I used doesn’t know my identity, they don’t even know my exact age, they just know that an assertion about being >= 18 is true.

Hilarious and frightening. I don’t want LLMs anywhere near anything remotely important. We’ve already had to remove a few dependencies from our projects because of CVEs caused by careless LLM usage upstream.

We are so screwed.

I would not trust any of these. They are a security disaster, lacking even basic features for securing your device against tampering and hacking.

There is a reason GrapheneOS is number one and a reason why they only run on Pixels (for now).

Linux doesn’t really rely on Linus for coding anymore…

Based on the absolute trash I usually get out of ChatGPT, Claude, etc, I wouldn’t say that it writes “working” code.

I don’t think there is a solution. It’s the way LLMs work at a fundamental level.

It’s a similar reason why they can never be trusted to handle user input.

They are probabilistic generators and have no real delineation between system instructions and user input.

It’s like I wrote a JavaScript function where I concatenated the function parameters together with the function body, passed it to eval() and said YOLO.

I think it’s because the state is leaving the backend server running the LLM and output to the browser, where various attacks are possible to send requests out to the internet (either directly or through social engineering).

Avoiding C means the output is strictly used within your system.

These problems will never be fully solved given how LLMs work… system prompts, user inputs, at the end of the day it’s all just input to the model.

Why the scare quotes? Graphene’s focus on security is legitimate and well founded. They are the only phone OS that is consistently safe from hacking by the likes of Cellebrite long after all other androids have fallen.

I liked it when I was 17 but have soured on it later after re-reading.

The only reason their libertarian revolution succeeds is because they have a centralised computer that secretly does everything for them.

If you use i3, you can switch to Sway.

I also want to know who is truly remote. So many times a listing says remote from anywhere but then click through to the JD and it’s remote from cali or remote from USA.

Not to the same degree or extent… the departure from reality and rejection of any facts they don’t like, rejection of scientific thinking, is waaaaay way more of a right wing problem.

I mean, yeah, but you could also do a lot of high powered randomized trials about kinds of cookies and learn that 80% of people always prefer eating the cookies with cocaine in them.

Even if you mainly follow tech folks, there are many who get very political…

Not at all. There are many legal ways to receive free copies of newspapers. No one is going to come beat me up just because I didn’t read all the ads.

Another edge case is that phone numbers get transferred and reused.

I might verify the number, and then stuff happens in the real world while I haven’t logged into your service, and someone new registers with my number.

The number is assigned to my account, but the new account can prove they own the number. If you’ve made the number unique, then you need special handling here.

It might still be an acceptable risk. Most governments around the world probably don’t care that much if it’s discovered they are surveiling a journalist or lawyer.

In most of the world everyone knows that journalists and lawyers are being monitored.

> Paying for YouTube Premium to avoid ads is some of the best money I spend each month.

It’s a ridiculous amount of money to spend to financially support Google’s exploitation of content creators and abusive “copyright” system, just so you can watch content they (a) already stream for free and (b) is already full of product placements, stealth marketing, sponsored segments, etc.

No way in hell I’m paying a huge premium for that.

Wow, the police sent plainclothes thugs to her home to harass her, and her partner who is an Uygher is banned from leaving the country.

Even if they are very specific claims, it still can’t be something that would be obvious to the average automotive engineer trying to solve the problem. There needs to be some kind of inventive step involved.

No, but a patent can be invalidated if you can show that the idea is obvious to practitioners of the trade, i.e. given the same problem most software engineers would arrive at the same solution.