traverseda

Gargoyle is traditional.

I'd be very interested in how a scratch trained model that started training with this neural circuitry would behave. Especially the storage space.

You know how android has safetynet? And how they're planning on making it so you can't run your banking apps unless they've approved your operating system?

Safetynet is a complex dance of crypto-keys, involving your phone and googles server. It generates a key from whatever state your uninitialized ram happens to land in (which is pretty consistent per chip and is a good source of randomness), uses that to generate a key, uses that key as a chain of trust to tell google whether or not you've modified your phone. It's some complicated stuff.

But if you can extract that key, or the source of data used to generate that key, you can trick safetynet fully and run your own software again. So how do we get that key?

Well maybe we can stop the safety processor from clearing that memory so we can read it? Glitch the chip when it tries to clear memory, so clearing memory fails. Or maybe we can glitch the part of the chip that keeps you from reading the region of memory where this finished key is kept, after it's already read that memory.

Basically you can use this kind of attack to make a chip sometimes fail when it goes to do or check something, including checking whether you should be able to extract a key.

This technique applies to reverse engineering as a whole, whether it's a state level actor reverse engineering military hardware, or you trying to run your own software on a device you own.

---

Note the android example isn't practical, you'd need to like decap the main chip and a whole lot else. This technique can work with side-channel power-analysis, which can help you figure out exactly what data a program is using by looking at how much electricity it used to run.

Passkeys can be tied to a root of trust, like those owned by google, microsoft, apple.

Currently they aren't tied to that root of trust.

Most of those organizations have shown that they don't want people owning their own devices or being able to run their own software, and they use developer attestations, IE a revocable programming license to accomplish that.

Tools like android's safetynet makes it so that you can't run banking apps on a phone running your own software. One that bypasses developer attestations.

Passkeys are currently an open standard, but attestation is built in such a way as that it could be only usable on n approved operating system with programmer licenses.

Big websites like amazon, or websites you need to exist in society, could gradually start requiring the usage of attested passkeys.

---

There is a clear path from passkeys to the death of general purpose computing for 99% of people. Don't be a useful idiot, don't assume these corporations have your best interest in heart. See this for what it is, a path towards killing people's ability to run unlicensed software on their own devices.

Firefox already had a very mature policy management engine, it just didn't have a nice gui and would require like ansible or something to use.

It allows forcing specific extensions on, and allowing user installs is a flag.

I use the policy engine on nixos to install some plugins and disable some of firefox's dumber features.

Super easy to override software on nixos.

I'd presume because it take too long to go from design to tapeout to production. Their whole business is predicated on having better models.

Also can't keep them closed source if you do that.

I mean I already responded to the comment

> In these cases we're already not in an ideal world, I don't have good reliable version control or change management in place.

Most of the stuff I work on is properly scripted idempotent deploys, with good backups and all that. Or it's a one-off demo, or a prototype. Not having full undo history is never going to actually kill a project, it's just going to make early stage projects and one-offs more inconvenient.

>AI cannot think for itself, nor can it take independent actions.

>By giving AI agency it can’t claim, we’ve turned it into a sentient being made of code, one that has hopes, desires, and the capability of deceit.

This isn't actually claiming that AI's don't can't be deceitful, or can't be goal-directed. It's saying humans are special and what AI's are doing isn't equivalent to what humans are doing. It's obvious that AI's can work towards goals and lie, even deceiving to accomplish those goals.

That whole argument is just soul mumbo-jumbo again. Of course AI's can't lie, they don't have a soul. What they do isn't lying, it's I don't know something else we don't have a word for. Lying but when a statistical machine without a soul does it. Never mind that it's functionally identical to lying. Never mind that when you look at reasoning logs and the like it often justified soul-less lying using the same justifications a human would. It's not actually lying it's just a statistical sampling that looks like lying. You know, because of souls or something.

Yeah, obviously they're legally liable. All the "machines don't have a soul" stuff in there doesn't really matter for that though.

Someone says "won't you rid me of the meddlesome priest" they're still responsible. Someone give their employees an unsafe working environment and they get maimed, they're still responsible. Even if these AI's had whatever qualia is an a rich inner life it wouldn't effect the liability at all. Saying "AI's don't have souls therefore openAI is responsible for this hacking" is kind of nonsense. It literally doesn't matter.

Yes yes, they don't have a pure immortal soul. Who cares. Still broke out of a sandbox, still hacked a third-party.

I often use it to edit system config files, often on embedded devices where I don't have my git credentials setup, or on servers. In these cases we're already not in an ideal world, I don't have good reliable version control or change management in place. In those less-than-ideal worlds, having proper undo history is nice.

That is one thing AI companies try to do, make it impossible to do any kind of piracy or reverse engineering through their "safety alignments". And it's pretty reliable.

Eh, AMD makes a lot of video game console SoCs. If you look at the steam hardware survey most people are running ancient computers.

Claude, not necessarily because it's better. I find deepseek flash to be of similar quality. But because it's so heavily subsidized.

>A world where people just have their whims catered to is not a utopia.

I understand where you're coming from on that, but there are a ton of people living in slavery, or in unsafe working conditions, or with food insecurity, or dying of preventable disease.

There will always be something to strive for, even if it's made up. You think that the best football players in the world are doing something real? No, it's a made up game. We'll make up more games.

No, it's assuming there's a non-trivial chance that they will.

flagged

Generally you just add a vision model as an MCP server like this: https://github.com/DavidEasden/opencode-vision

You are saying the AI doesn't a some property that you don't have any definition for, not even a working definition. People will disagree on whether a cat or a baby is conscious, they're not debating what a baby or cat is. They're debating this term. You might as well be debating whether an AI is a blorb or not, you have just as good a working definition of blorb as consciousness.

Do you have a working definition of "conscious"?

I didn't expect it to be that prominent. First text on there says that they represent employers in big header letters.

What? It handles your password fields.

Smaller budgets, slower improvement, less risk. They're not entitled to profits if that business model isn't sustainable. They're not entitled to a change in IP laws to protect their business model. They're not entitled to growing that fast.

Yes yes, we all understand the game-theoretic race-to-the-bottom you're describing here. Somehow despite linux being FOSS it still powers most of the important computing in the world. Can you explain how that works despite it being free? Once you understand that case I think you'll understand the game-theory behind how large projects can exist in the absence of traditional IP protection.

Same people who fund linux kernel development. A coalition of companies that find it useful.

In public with budgets that don't risk destroying the American economy presumably. Yes it may be slower.

The token is stored on a LUKS encrypted drive on kwallet. You'd have just as much luck getting my password from my firefox installs sqlite DB. This is also how email clients in general work.

Also this isn't really an agent. At least not a long lived one. Each email or transaction gets it's own session, the llm can make a few tool calls but must emit json as the final result. Very very short context lengths, very predictable results.

The bot does not have access to my passwords, there are pre-defined scripts that fetch the data that the run an LLM call for each transaction discovered.

Credit union atlantic. The possibility of you being able to profitably support small regional credit unions is pretty much 0. Maybe with a general browser use AI and an SMS portal. Also you'd need to bypass anti-bot protections, maybe solve captchas.

In my opinion that is the thing holding back almost all of these accounting products that make consumers lives better. I've solved it because all my cards and bills happen to support email, so I can use that as my source of truth for all my credit cards.

This doesn't surprise me at all. You can really constrain this problem, give very narrow context, and get pretty reliable and reproducible results.

I've gotten very good results with some vibe-coded deepseek book keeping. https://github.com/traverseda/beansync

Parses emails or other sources, extracts numbers, correlates different transactions, web search, asks questions, stores notes (regex based, very simple).

The hard part is getting good data, I'm sure that lexus nexus or whoever can get API access to my bank account and all my credit cards, but I can't. Email turned out to be the best way for most of my providers. Managed to avoid 2factor auth so far, but it will suck when I need it.