m3047

+1 but I didn't see pack / unpack...

Scrapie (a sheep and goat prion) contaminates soil where sheep graze (and shit) and can persist for years in the soil.

> Because insects are part of a natural diet for chickens.

It's actually a welfare issue for chickens. They have feathers, and they molt. Just like hair, feathers need methionine. Methionine is very hard to get solely from plant sources. If they don't get enough methionine they eat each other's feathers, not just the discarded feathers (which left on their own they do normally).

The dead elephant in the freezer in the room is low / no code solutions, which don't require a cloud. Is it really easier for the illiterate masses (can't unsee all of the horrible graphics with fumble mumble legends) to accurately, consistently, coherently type out their thoughts than it is for them to gesture? Hey guys, ummmm guys do you use a web interface to manage your CI / CD pipeline? Have you ever had to verbally guide somebody through a sequence of gestures? Have you ever had to extract an ACCURATE description of their gestures during an interaction you're investigating from some rando?

I use pointy-clicky software for visualizing relationships and correlations. I use draggy droppy software for building complex data workflows (including ML elements). I use desktop publishing software rather than LaTEX. I suffer industrial interfaces for (most of) my own software (where I am the chief customer) because it's easy for me to sling simple server-side UIs, but there are standalone servers out there which make creating apps (with RFID, QR, accellerometer support) just like, yes JUST like, desktop publishing (especially as you get closer to industrial control applications); one of my faves has a widget which is a "choose your own adventure" dashboard widget so that the users can create a dashboard customized just for them, yes, Inception (granted, that widget does need some configuration which requires a keyboard).

Granted, behind every one of those slick interfaces is a drippy gob of data. I have to create a CSV in the correct format for the visualizer, or surrender to their integrated "partner solutions"; or for a different visualizer I have to create some network services which it consumes for "enrichment". My data workflow tool has generic python "actions" so you can create custom tasks (it presents the data to your scripts using pandas). On very rare occasions I have a need to hack on DTP docs to format obscene amounts of repetitive data; but a lot of the time it's back to making a CSV and putting that in a spreadsheet / database which the software can then utilize for quaintly-named "mail merge". The UI software which I refer to integrates with SQL databases and authorization / access management engines, somebody still needs to set those up; and I stumbled across it in the first place because somebody needed a little (surprisingly little) help connecting to an obscure HTTP resource.

To short circuit a bunch of off track commentary: LLMs are not speaking english to other LLMs to design new LLMs AFAIK. I have never seen a debate or article about whether it is better for LLMs to utilize english or russian for this task. I just don't like the menu that is offered on this ship Titanic, and I'm uncomfortable with the majority of the passengers being incarcerated belowdecks; I'll book different passage, thanks.

"everything's too dark": it could be temporizing or parallel construction, but my understanding is that "everything's too dark" originates from trying to optimize the color map to show off some detail that we obviously don't care about.

I can read that "submission and deference" at the casino as conflict avoidance, the arresting officer says to his peers at the station that he "kind of believes" the suspect. He also states at some point that he can't cite (and I infer then release) the suspect because he is not certain who he is, and therefore has to arrest him as a "John Doe" so that his identity can be established. The fact (?) that the suspect now has a police record for this possible farce won't be settled until after the facts are determined in a court of law.

This video demonstrates that when it comes down to it the blunt end of law enforcement is oftentimes a shit show of "seems to work for me" and that goes for facial recognition, shot spotter, contraband dogs, drug & DNA tests, you name it.

Upvoted because I think it's an important topic, but this take causes me to question the motive for the article... which ironically is my big concern with using LLMs to write stuff generally (the unconscious censoring / proctoring of voice and viewpoint):

  That means that if an officer is caught lying on the stand – as shown by a
  contradiction between their courtroom testimony and their earlier police
  report – they could point to the contradictory parts of their report and say,
  “the AI wrote that.”

IANAL but if they signed off on it then presumably they own it. Same as if it was Microsoft Dog, an intern, whatever. If they said "the AI shat it" then I'd ask "what parts did you find unacceptable and edit?" and then expect we'd get the juicy stuff hallucinations or "I don't recall". Did they write this, or are they testifying to the veracity of hearsay?

From what I've seen reports written by / for lawyers / jurists / judges already "pull" to a voice and viewpoint; I'll leave it there.

Good summary IMO.

> You can drop arbitrary logs to stay within ingestion rate.

Another way I've heard this framed in a production environments ingesting a firehose is: you can drop individual logging events because there will always be more.

I agree with this statement: "Instead of logging what your code is doing, log what happened to this request." but the impression I can't shake is that this person lacks experience, or more likely has a lot of experience doing the same thing over and over.

"Bug parts" (as in "acceptable number of bug parts per candy bar") logging should include the precursors of processing metrics. I think what he calls "wide events" I call bug parts logging in order to emphasize that it also may include signals pertaining to which code paths were taken, how many times, and how long it took.

Logging is not metrics is not auditing. In particular processing can continue if logging (temporarily) fails but not if auditing has failed. I prefer the terminology "observables" to "logging" and "evaluatives" to "metrics".

In mature SCADA systems there is the well-worn notion of a "historian". Read up on it.

A fluid level sensor on CANbus sending events 10x a second isn't telling me whether or not I have enough fuel to get to my destination (a significant question); however, that granularity might be helpful for diagnosing a stuck sensor (or bad connection). It would be impossibly fatiguing and hopelessly distracting to try to answer the significan question from this firehose of low-information events. Even a de-noised fuel gauge doesn't directly diagnose my desired evaluative (will I get there or not?).

Does my fuel gauge need to also serve as the debugging interface for the sensor? No, it does not. Likewise, send metrics / evaluatives to the cloud not logging / observables; when something goes sideways the real work is getting off your ass and taking a look. Take the time to think about what that looks like: maybe that's the best takeaway.

The keys aren't in the backups you still have?

IOW: who owns the backups owns the data... until proven otherwise. My default presumption from space is that 1) there are document management policies and 2) document management policies apply.

Whatever was in those emails wasn't important enough for them to unencrypt them in a durable fashion, or put the keys in a safe with the gold bars.

We call this the "scream test" in BOFH land.

I'm sorry for your loss, but this sounds like an antipattern. Hundreds of emails between co-workers and it was all contemporaneously related to work in progress or cat pictures of your own cats, didn't contain PII or proprietary information of your employer or unaware third parties? And you want it back? From far enough away (that I might as well be in orbit) this seems preferable to an unencrypted drive ending up in somebody's hands for "refurbishment" (cough printers with hard drives).

No one is innocent. I refuse to use LE and operate my own CA instead, and as a consequence of scareware browser warnings I publish http: links instead of https: (if anyone cares, you know to add the "s" don't you?). I run my own mailserver which opportunistically encrypts, and at least when it gets to me it's on hardware which I own and somebody needs a search warrant to access.. as opposed to y'all and your gmail accounts. I do have a PGP key, but I don't include it on the first email with every new correspondent because too many times it's been flagged as a "virus" or "malicious".

Clearly we live in a world only barely removed from crystals and ouija boards.

As they say in physics: color and charm may change, but up and down are forever.

Ummm... Google, Amazon, eBay, and PayPal... Facebook, Airbnb, Uber, and the offspring of Y Combinator... doesn't look like a particularly virtuous trajectory to me.

One of the more interesting ways of detecting rail damage, and subsidence in general, is optically detecting noise / distortion in fiber optic cables. An applied case of observables which are the basis for an evaluative (the "signal") being utilized originally to diagnose possible maintenance issues and then going "hey there, wait a sec, there's a different evaluative we can produce from this exhaust and sell".

https://fibersense.com/

http://www.focus-sensors.com/

  Location: Tacoma, WA, USA
  Remote: Sure, that's an option.
  Willing to relocate: No, but willing to drive around the greater Pacific Northwest.
  Technologies: Python, Redis, C, DNS, Ignition SCADA / HMI, SQL, Bash, Linux, TCP/UDP,
                old school ML & numerical methods, threat hunting, electronics, handy
                with a wrench, dangerous with acetylene.
  Résumé/CV: https://github.com/m3047 https://www.linkedin.com/in/fred-morris-03b6952/
  Email: m3047-wantstobehired-t5b@m3047.net

Let's have a conversation, I like working with people. Not looking for the same old thing, have had a business license since 1984; prior to 2000 about a third of my work was firm bid (why did that go out of fashion?). Technologist and problem solver. Cloud skeptic, but I use what works. I prefer contracts to promises. W2 / contract: it depends, let's choose the correct vehicle for the scenario, and risk has a lot to do with it. Part time, seasonal, campaign... it's all good.

Some great links to thinky things, if you like those.

It's been over 20 years, but I used to build batch processing pipelines using SMTP (not Outlook). Biggest "choose your own adventure" aspect is accounting / auditing (making sure you didn't lose batches). I still joke about it as an option; although if somebody took me up on it I'd write up at least a semi-serious proposal.

In the middle are Mule, Rabbit, Kafka, ZMQ.

At the other end is UDP multicast, and I still use that for VM hosts or where I can trust the switch.

Not intended as an endorsement, but Access / FileMaker / 4D were all great solutions for low-contention, low-user count low / no code CRUD apps.

DNS is utilized for many things besides looking up web sites (and consequently ads on web sites). DNS was used for many things etcd was invented to solve, and still is by many. Adblocking is kidstuff; the bearded, motorcycle riding, gun-shooting, jumping out of airplanes and hanging off of rocks jackals use a "DNS firewall" (just posted this the other day): https://www.dnsrpz.info/ and Dnstap for application-level DNS logging.

Things built with asyncio and dnspython are close to my heart. ;-)

So, my impression from the doc (and a quick browse of the code) is that this is a tool for monitoring DNS caching / recursing resolver (RD) performance, not authoritative. If performance really matters to you, you should be running your own resolver(s). [0] Granted, you will quickly realize that some outfits running auth servers seem to understand that they're dependent on caching / recursing resolvers, and some are oblivious. Large public servers (recursing and auth) tend to "spread the pain" and so most people don't feel the bumps; but when they fall over they fall over large, and they bring some principles (and thereby create "vulnerabilities") at odds with what the DNS was architected for and throw the mitigation on the other operators, including operators who never accepted these self-anointed principles to begin with.

I have a hard time understanding how DNS is adding 300ms to every one of your API requests... unless DNS is both the API and transport, or you're using negative TTLs /s.

Good doc, by the way.

[0] Actual resolvers. Not forwarders.

Yoric, dropping some knowledge vis a vis the downstream regarding DNS:

* https://www.dnsrpz.info/

* https://github.com/m3047/rear_view_rpz

Upvoted not because the internet has ever been a safe haven, but for simply taking a moment to document the issue. But then again, I can't even give away a feed of what's bouncing off of my walls, drowning in my moat.

(An Alibaba /16? I block not just 3/8, but every AWS range I can find.)

I have noticed (with my intergenerational, perpetual flock) that different behaviors come and go. There seems to be a current one where if I feed them mixed scratch grains then when it's rainy they eat the corn and leave the wheat / barley to sprout before eating. I wish they wouldn't, it attracts rats!

DNS is in the same predicament. :-p

If you look at the pages which are hit and how many pages are hit by any one address in a given period of time it's pretty easy to identify features which are reliable proxies for e.g. exploit scanners, trawlers, agents. I publish a feed of what's being hit on my servers, contact me for details (you need to be able to make DNS queries to a particular server directed at a domain which is not reachable from ICANN's root).

...and people have to find special ways to set them. I didn't even know that pam_env existed until a recent security vulnerability announcement. It's never come to my attention before, I don't think I've ever seen it utilized. I've now made a runbook item to disable it. It's a shame that "configuration" includes undoing the fetishes and helpfulness [0][1] of others.

  pam-config -d --env

[0] Crowded elevator atrium. Multiple elevators running. Elevator wants to close, another one is coming (oh! I heard it "ding"!). Somebody is holding the elevator which wants to depart and trying to wave me in. Why doesn't somebody push them out?

[1] I'm at a stop sign. Some complete idiot is trying to turn left onto the street I'm leaving and waving me to turn left in front of them. Fuck no! I turn in front of you, somebody rearends you, you fly forward into me: my fault! You should be able to make this turn, if you can't go around the block! [2]

[2] I could go out of my way and turn right. Or I can just wait and see what happens.

Mindblowing. Took a walk. All I can say is that if business continues "as usual" and the economy and public services continue largely unaffected then either there were local copies of critical documents, or you can fire a lot of those workers; either one of those ways the "stress test" was a success.

> What gets them in trouble is the clever hacking, not a fundamental moral flaw.

I think you've got that backwards. Crims gonna crim. A clever hacker will evaluate ALL the risks, whereas a moral flaw blinds people to risks. Doesn't mean somebody can't have both attributes.

I quite literally stole an education, and there's a college transcript to prove it. I was a clever hacker, and I worked hard; I was aided and abetted by the college administration, inducted into the Masters candidate ghetto as an honorary member. When they made it a felony I quit that path, and following Hunter S. Thompson's advice [0] I went into business so that I could continue learning "on the job". (Nowadays they call it "OPT". Served today with a very thin glaze of sarcasm.)

During that tenure I met people who wrote theses for a living, who appreciated my industriousness and offered to admit me to their fold. I drank with foreigners ("muslims") who wanted information I might have or be able to obtain; I suggested that they get their home countries to forge documents and and then get admitted as students.

I've quit jobs after an appropriate "honeymoon period" when I still hadn't been furnished documentation demonstrating that we had customers' permission to be doing what we were doing. I've quit jobs when government compliance was considered a game rather than a minimum standard of performance. [1]

I pass government background checks just fine; no reason I shouldn't. I get the "dgaf" attitude, but I strongly suggest getting it in writing. Doing things off the books is a cancer; and it's contagious, like that 10,000 year old dog cancer which now moves from host to host.

[0] "When the going gets weird, the weird turn pro."

[1] If you need somebody who takes risk assessment seriously, we should talk.

Here's a company which produces biomarkers (which it can disperse as aerosols or via other means) which it can then detect in air or other samples: https://www.safetraces.com/

(I have no commercial connection with them.)