robertlagrant

The Ultimate Guide to Fine-Tuning LLMs from Basics to Breakthroughs: An Exhaustive Review of Technologies, Research, Best Practices, Applied Research Challenges and Opportunities (Version 1.0)

> While common JWT libraries have now mostly got their stuff together, this has not always been the case. There were plenty of libraries accepting the "none" algorithm [1] or allowing attackers to forge tokens by using a public key as a shared secret [2]. This is the direct result of the complexity criticized in the linked blog post.

I'm a bit surprised at this. These are extremely simple to solve - the first time I ever did a JWT-reading implementation I specified the right defaults, which are very simple, even for a mid-level backend person I would say, and they haven't needed changing in 8 years or whatever it's been. It really isn't very complex.

I don't know why you're surprised; you didn't specify you meant historically.

Microsoft have not maintained a monopoly on search, mobile, or maps, and they seem to mostly maintain their large market segments based on familiarity, not hype.

How are you sandboxing your Pi coding harness? Directly only mounting certain folders, using capabilities to kill the network and not giving it all your shell env vars, that sort of thing? Or do you use a tool?

I prefer KDE (on Ubuntu, because I tried it and it's good enough) - it's got more stuff built into the OS in terms of settings. I tended to find that Gnome needs you to install more things to expose configuration settings, whereas KDE's configuration UI is pretty good.

I agree that integrity can be done by secure boot, but HTTPS does mean that someone can't intercept your request and serve you valid, signed, older software that has a known security flaw in it.

I'm not an expert in database hints, but the syntax looks very readable and composable. That's great thing to have got right.

Most people have laptops now, in my experience of large corporations.

Hm - I think I follow. But say I push a commit on a branch, then realise I messed up the commit message, so I --amend and push. I know that git push will fail, but if I git push -f then it won't detect that someone else pushed to the same branch in between - it'll just silently wipe their push.

Using --force-with-lease means the git push -f will succeed if no-one's pushed in between, and fail otherwise.

Oh dear. That is tricky. It must be a rare enough combination that it looks like automation.

Well, that was terrible searching by me! Thanks. @dang could you update it please?

All force-with-lease does it stop you from clobbering rather than you having to realise somehow that you did that. It seems like a no-brainer. What's the problem with it?

(I couldn't find this announced on the Proton website - apologies if there was a page, Proton!)

I haven't ever noticed Cloudflare having any issues on Firefox, so presumably that implies any unilateral actions in web standards have been worked around by CF to provide the service to Firefox as well.

> and if you're lucky Firefox

I haven't had any problems with Firefox so far. Why do you say this?

I was reading things[0] about sugar a lot earlier than that - maybe 2007? And it made a lot of sense back then.

[0] https://nosdiet.com

Thank you! I will have to give it a try.

> As if megacorps somehow don't have inefficiencies

No one is saying megacorps don't have inefficiencies.

I have a Reolink but haven't got to Home Assistant yet. I'm happy switching to that, but for less technical (though still digital savvy) spouses - how would you say the switch would be for them?

No, many of them fold, and even those that don't close departments and make redundancies. Companies can only grow if they're serving their customers with value, or if someone believes that they will do in future and puts money in for a bit to get them started.

If they get things wrong by overspending or overinvesting in the wrong thing, they don't have a wellspring of tax money to keep drawing from. They have to offer enough value to not only supply the good and make a profit, but also pay taxes on that profit.

> you simply stated but haven't explained why bloat is inevitable in the government except to say there is no market pressure applied in government. Whereas the parent is literally talking about employing people using market rates, an example based on market pressure.

The market pressure I'm referring to isn't on salaries, it's on departments. If a department gets the same budget next year because it managed to spend it all this year - a universal truth in UK public sector then departments only ever grow.

I agree, but also a civil servant has incredible pension opportunities, and defined benefit as well, and is hard to remove if they turn out to be bad. A contractor is a fixed cost, and individuals can be rejected with far less ceremony and cost.

If the civil service could shape its workforce with individualised salaries and quicker removal due to low performance I suspect it'd be a different story. I agree that consultancies and contractors are not cheap, but they are not the root cause.

Ah great! Best of luck. They're a nice bunch.

Well, it was surprising at the time. I agree that the public should care about this, and I'm glad the specifics of Palantir are helping bring the issue to light, but it was still very odd. I think non-technical leaders are seduced by words like "platform" and "low code" (at the time), as it makes it seems technical issues seem trivial, and converts them into vendor management tasks, which they know how to do.

That part was referring to the air-quotes here:

> but at least you won't have "inefficient civil service bloat" to have to manage.

The problem is that the civil service is inefficient and will bloat, because the only pressure on it to not is the individual good practice of leaders. There's no competitive/market pressure on it to naturally cap spending based on value.

I agree that GDS is a good thing, and I interviewed with them a few years ago and was impressed, but there is always the risk of bloat. I wish this could be fixed. I have some ideas about a similar concept in the NHS that would require the government hiring well-paid software engineers.

I was part of a UK company that did sovereign data work on NHS data. They would give NHS trusts equity in the company in return for the data, and the data wouldn't leave the company; only results of paid research studies. The idea was to lower the increasing cost of pharma studies through early data-driven work.

The company bid for this contract, and lost to Palantir. I still can't believe that a company trying to do this in exactly the right way lost to a US intelligence company.

Hi Ben - how are you positioning yourself vs LocAI? I had a few chats with them and they have a fairly similar pitch.

This is my instinct too. I've had the pleasure of using DataDog and the pain of negotiating with their salespeople!