m3047

I have a steep pitch (1:1) roof, and I'm building ladders so I can get on top of it for cleaning, etc. I actually did this a decade ago out of wood, but it apparently hadn't been inspected / seasoned / treated correctly (by the people who produced the lumber) and after a couple of years the thing started growing mushrooms so I had to tear it all out. Just re-roofed a month ago. Building it this time out of mild steel. Cutting, drilling, bending, welding... oh my! Plus there's the risky business of assembling it in place on aforesaid slope.

If I don't have a consulting gig where risk is taken seriously, I can always work on my house or my motorcycles. :-p

I've been consulting since 1984, and before there was a notion of "open source" I (and others) had a notion of "tools of the trade" that we wrote into contracts. These had to be finished enough in a conceptual and artifactual sense sufficiently so as to be distinguishable from what was delivered to the customer as the customer's property. How public these tools would be was negotiable. There wasn't necessarily support, but there was often an expectation that bug fixes or functional enhancements would be shared with prior recipients / licensees.

So that's kind of my grounded understanding of "finished": that something is "finished" given the context it operates in. Meets some contractual specifications.

I give away the core components of an (mildly SIEM-like) observability platform on GitHub. I publish demo clients, but I don't publish the actual clients which I utilize in production. I will give them to you if you make friends, demonstrate that you can steer the core components, and demonstrate that you're capable of providing useful, cogent feedback.

This is a support issue. I don't have the time, patience, or interest to provide support theater. I'm not that interested in the clients, per se; I'm more interested in what they accomplish for me. Let me put it plainly: I'm interested in what they do for you if you pay me money to be interested, or I find your particular application of personal interest. I don't want to hear that the clients are crap because they don't solve your personal problem pretzel. I don't want to hear that the client doesn't work when the server components aren't set up properly.

I'm pretty comfortable with stuff being finished for a given context. That functionality in that context is a kind of oasis or petri dish, and if stuff manages to transplant to a different context or different inhabitants come to the oasis then I'm generally interested in looking at that and reexamining "finished"; and that's why I put it out there, in public.

There was a time when email clients running scripts in emails from randos on the internet was "a game-changing opportunity for automation". Here we are again.

There was a time when people thought letting their children use the internet as a babysitter was healthier than parking them in front of the television... guess that turned out another way.

In other circles they call this "functional overlay": where people who suffer an injury (mental or physical) and alter their behavior such that the altered behavior persists after the injury heals.

After many years of "4096 ought to be enough for anybody", the default max UDP size in BIND 9 was reduced to 1232. Frags are bad; jumbos are good, but frags are bad!

A DNS message cannot exceed 64K, but multiple messages can be transmitted over TCP. That's the way AXFR (zone transfer) is done: one question, multiple responses.

https://github.com/m3047/rear_view_rpz/blob/b17cf943ccd7498d...

If the internet is in fact "the largest social media platform", then anonymity absolutely has to go as my public-facing telemetry server [0] based on DNS as a transport, and not rooted to the ICANN DNS tree, gets 1000+ abusive requests for every legitimate one. I'm supposed to return REFUSED to each and every one [1] of them (not drop them) and I'm not supposed to publish the IP addresses involved. Granted they could be spoofed, but the only way we'll ever know is to go ahead and publish so that a global picture can be developed and the owners of the addresses can tell us that they're being spoofed.

[0] One of the pieces of telemetry is the addresses abusing the server.

[1] I, and many other operators violate this stability requirement and drop traffic. [2]

[2] There are no internet police. If there were then BCP 38 would be enforced and this particular problem would largely go away.

A lot of them are just moneymaking machines, they don't really want community engagement. This is demonstrated in their approaches to community organizing / engagement. I directly witnessed this as a boardmember of an organization ostensibly representing over 100,000 voters:

1) The "90%-ers" view of the suggestion that they identify and court their supporters from (for them) the "40%-er" constituencies because they would be able to sway other 40%-ers due to the "liking" "weapon of influence" (Cialdini): this was mostly treated like a suggestion that they lick dog vomit.

2) Community / consensus building: what issues should we focus on? This was done by dividing participants up by some feature and then having those subgroups come up with maybe half a dozen concerns each. (Something is supposed to happen here before the next step.) Then those concerns were listed on a board and the concern(s) which were reflected across the most subgroups were selected to focus on. The missing piece, which the organizers absolutely knew about: the caucus! What goes wrong without it is that concerns about pedestrian safety, speeding, children walking to school, people getting to bus stops, etc. all get listed differently by the subgroups and... awwww, too bad, you were the only group which cared about children walking to schools... but every group cares about saving the whales (no offense to the whales)! But no whales live here, so what are we to do?

I use a desktop system which has python as its scripting layer, and exposes data to python nodes using pandas.

(In case you're wondering, https://www.knime.com/)

Rust has unsafe, just like Java.

Words to the effect of "we live around people who act and feel like us":

Yeah, but maybe not for the reasons you think. I'm not sure the reasons are a priori discoverable, although they can be revealed by statistics. Or to put it another way "is it something in the water, or new car smell?" So something happens in groups which amplifies similarities.

The State of Washington collects voting results by precinct, and precinct sizes are typically in the hundreds of voters.

* http://athena.m3047.net/elections/36th-dist-colored.html

The distributions are not normal.

* http://athena.m3047.net/elections/dist-not-normal/distributi...

What got me started with this was King County making their canvass available in digital form. At the time I was feeling bored and like I needed some additional exercise, and publishing a quarterly zine and knocking on doors and delivering it to everyone in my precinct seemed like a natural thing to do; I had the thought that I might be able to see some effect, of some kind, in the canvass for my precinct (just a rather arbitrary notion, I like measuring things). As I kept doing this over a number of years it gained the attention of the established political order.

Anyway I started clustering the results because I had the software, and hammer... nail.

* http://athena.m3047.net/elections/perl/data-index.cgi?imagem...

One of Cialdini's "weapons of influence" is "liking", and again that may not mean exactly what you think it does. There was contemporaneous research going on about this. One of the notions was that you would be more likely to sway people who were "like" you. So where do you find these people? Well, maybe in precincts which vote similarly to yours. So this raises an issue for politicians: maybe they should identify people who are on their side in places where they are weak and prevail on those people to talk to their neighbors. Just a thought. But the reality was that trying to get for instance a "90%-er" to go to actively meet and court "40%-ers" was like asking them to lick dog vomit. On the other hand I used cluster correlations to identify an "like" precinct in another part of the City and took a walk; I was shocked at how similar it was in terms of physical features. I know, I know, confirmation bias.

* http://athena.m3047.net/elections/perl/cluster-correlate.cgi...

I suppose it does take a certain mindset to make knocking on stranger's doors a good time; and I don't know that that is a good idea everywhere. But I like talking to strangers, hearing their stories, and flipping each other shit. It's a skill which has served me well in my life.

I'd encourage the author to put a pointer to the repo in the actual doc. Maybe I should send a PR...

As an operator, I have questions about this; I also have very good metrics. I see a lot of what looks like what has traditionally been SYN reflection attacks. I have solid metrics and TTPs, which I'm willing to share TLP:RED and possibly discuss TLP:YELLOW.

I'd like to see some metrics which compare proven bot activity vs SYN reflection against the same infrastructure.

Cloudflare (it was news to me! why are CF assets actively reaching out to my infrastructure since I'm not a customer?) provides anonymization infrastructure to alleged VPN users. A data point. Doesn't mean they don't make an effort to screen abuse, but it's an open question (based on traffic to my site) how good that is. I'm also not convinced I should believe they don't use that traffic for their own purposes because "Simon says so".

I've contemplated patching Python's asyncio package so that the list of funcs isn't a weakref... but it's not that hard! This is way harder than it needs to be.

If the report is correct, then I think something else is being inferred / implied.

If dnsmasq was only caching the ANSWER section, then the only thing which could be poisoned would be the qname. If cache poisoning for arbitrary domain names is being observed, then it would seem that information from the ADDITIONAL or AUTHORITY is being cached as well.

I can't think of a recursing resolver which discards / disallows non-hostname queries. The only case I've run into, ever, is the stub resolver in the Ignition SCADA platform (running Java on top of the Azul JVM).

(It's on my list to try loading the Python 2 version of dnspython and see if that works. Yeah, Ignition's internal scripting layer is running Jython, at version 2.)

Edit: that's not to say that some middlebox isn't dropping them in the name of "securitah".

I use Ooma VOIP service and you can forward calls to a different number (I use that occasionally). I don't use it but they also have an iOS / Android app which lets you make calls from your Ooma VOIP number. The FAQ says you can't call 911 with it, so that's smoke anyway.

https://support.ooma.com/home/ooma-app-faq/#can-i-make-emerg...

Kodak at one time was a powerhouse of applied chemistry, curating a huge library of chemical compounds. I know this because a particular early biotech company rented out the processes (in their own labs) they were developing so that Kodak could test some of these chemicals for particular forms of biological activity. That's how the biotech managed to have cash flow before they were allowed to let any material whatsoever out of the lab, let alone near humans.

(I also worked for Kodak for a brief time supporting a "dark line" where they packaged photosensitive products. A kick in the ass, great fun, very disciplined, and writing code which ran machinery in a black box!)

If you run Postfix yourself, here's something I wrote to scratch that itch: https://github.com/m3047/trualias

There's a question which was rhetorically asked by Yaser S. Abu-Mostafa: "How do we know if we're learning from data?" and his answer was: "We are learning from data if we can generalize from our training set to our problem set."

To me, it feels a lot like Deming's "what gets measured gets done" (with the quiet part "...oftentimes at the expense of everything else."). Of course, the quiet part is different in this case.

What is this "domain" of which you speak? Because LLMs are supposedly good for flying airplanes, mental health, snakebites, and mushroom poisoning.

I will die on the hill that the "best product" respects its customers, is safe, performs correctly, and is purchased not rented.

Under those constraints the "best product" largely does not win now.

He's talking about a fait accompli:

> But as countries defected and adopted mercantilist policies, the global system lacked sufficient authority to stop them.

It's not the future. It's now.

Am I the only person with vehicles to wrench, a house to work on, chickens in the yard... as well as open source projects? If I'm not getting paid, I still have plenty to do which feeds me to today or prepares me for tomorrow.

Cache la poudre.

In 2005 I used a bot motel with Markov Chain derived dummy content for this exact purpose.

Geoff Lewis has been sampling the product. Will this turn into a cultural thing amongst VCs? (Has it already?)

https://futurism.com/openai-investor-chatgpt-mental-health

Check out the CIA's free coursebook referenced above. It's got good stuff in it. (Your tax dollars at work.)

Human biological products (esp incl blood products) are a significant export product from the USA. Won't help Europe though because EU is one of the biggest importers.

I mentioned set and setting in a thread, and I guess the person didn't appreciate it (by the way, THREE 737 MAXes). What am I talking about when I say "set and setting"?

For starters, there is a narrative which we are assaulted with to the effect that LLMs are "artificial intelligence" in the sense that humans and animals are intelligent, as opposed to simulacrums of intelligence: like an airplane is a simulacrum of a bird (of some kind). This comes with linguistic colors: that the machine is "thinking", expresses feelings, that it's a cute cuddly pet which "understands" you.

This is the default "set and setting".

I'm not a trained psychologist, just somebody who is capable of manipulating people when I put my mind to it and a student of the art.

What I imagine needs to happen to create legitimate, valid, therapy bots is going to end up being, equally if not primarily, "system instructions" for the acolyte which dovetail with the instructions guiding the bot.

I kind of wonder why psych bots aren't regulated as medical devices, since ML diagnostic products certainly are.