CyberFrog

https://social.glitched.systems/@froge

Your friendly neighborhood tech frog, here to explore society and complex systems together. My personal views are obscure and will probably be grating to most people, but we don't have to agree to be friends!

Will often discuss things like distributed systems, programming, society, and computer security. Politics WILL come up sometimes. Video games are cool too :blobowo:

I do serious research in between memes I swear, follow for fun computer adventures, and help build a better society together!!

Public Key

npub1h6y7d9evl7yl836lzvcwsz0mf9hd8gm4k7p97yuw4c9nm4qm535snglzm0

NIP-05 Address

froge_at_social.glitched.systems@momostr.pink

Profile Code

nprofile1qqstaz0xjuk0lz0nca03xv8gp8a5jmkn5d6m0qjlzw82uzea6sd6g6gpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dspk6lge

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1h6y7d9evl7yl836lzvcwsz0mf9hd8gm4k7p97yuw4c9nm4qm535snglzm0

Show more details

Last Notes

2026-03-26 19:05:50 UTC

- reply

the ones which are blocked and unblocked change regularly, IPs that broke yesterday sometimes work the next day, and the pool of addresses I can use without paying more money is somewhat limited

2026-03-26 13:51:56 UTC

every day I open the internet and spend 15-20 minutes cycling IP addresses in order to hit a winning combination that allows me to access all three (3) centralized services I regularly use to communicate with people, without one of them arbitrarily blocking me based on made up bullshit metrics

2026-03-10 00:55:42 UTC

- reply

you're not gonna believe this but I don't need a clandestine lab anymore, just a shitty but clean lab, apparently some insane company in Australia will just sell these pre-built units to me lol
https://corticallabs.com/cl1

2026-03-10 00:38:19 UTC

hey fedi, how much would it cost me to create a vat grown clone of my own brain neurons in a dish, and wire it up to a computer in my garage so I can force it to play doom?
surely this is like only a $50,000 endevour right?

2026-03-07 01:54:14 UTC

- reply

I'm going to fucking SCREAM
the backend synchronized and the second payment was detected, which resulted in automatic finalization and automated return of the original payment
it took 15+ minutes for the UI to reflect the fact that I paid them and it fucked up my provider's payment system by rejecting the FIRST payment instead of the second duplicate
I fucking hate computers fedi, I fucking hate banks, I hate computers, and I ESPECIALLY hate anyone connecting computers to banks

2026-03-07 01:48:18 UTC

Just paid for something online, twice, it took my money twice and the service still thinks I've not paid anything
holy fuck I hate banking systems, I cannot express to you in words how much I hate them, everything about their existence is a fucking mistake

2026-03-06 06:07:36 UTC

holy shit, samy called, he wants his based 2005 javascript attack back
#note158v…zjjk

2026-03-06 04:17:48 UTC

- reply

ahahahahahahahahahaha
> During our initial disclosure, the Wi-Fi Alliance privately created security recommendations to mitigate our attacks. In these recommendations, they claim that Brainpool curves are safe to use, at least if products securely implement Dragonfly's quadratic residue test (i.e. it must be implemented without side-channel leaks). However, we found that using Brainpool curves introduces a second class of side-channel leaks in the Dragonfly handshake of WPA3.
fucking ahahahaha
holy shit I can't believe my intuition about the curves was right, and the mitigation was just immediately a worse curve in every way

2026-03-06 03:18:45 UTC

Arc Raiders was logging a bunch of sensitive discord user data to disk in plaintext lol
https://timothymeadows.com/arc-raiders-discord-sdk-data-exposure/

2026-03-06 03:15:42 UTC

- reply

oh.. cool... nice
https://wpa3.mathyvanhoef.com/

2026-03-06 03:13:59 UTC

anyone out there have good information about the security and weaknesses of the SAE (Simultaneous Authentication of Equals) protocol used in WPA3 and a few other places?
specifically it appears to be built to allow authenticated key exchange, how easy is it to compromise authenticity? the allowed curves are also strange here

2026-03-03 03:50:28 UTC

"oh their malware C&C is operating in the amazon datacenter? just blow up the datacenter lol"
unchecked military use of civilian infrastructure and its consequences

2026-03-02 06:30:38 UTC

- reply

I did see the verification, it's interesting but my critique of AI is less about the actual code at any given snapshot in time, and more about the way it's produced, the lack of oversight developers give it, and the fact that this leads to many bugs and errors being added over time.
A lot of the reason I'd probably avoid these projects is that I'm not sure if they will create regressions tomorrow, or next week, due to some massive set of AI changes with poor review, who's to say they won't just break the TLA+ tests? I have much less confidence in the developer's ability to push stable and reliable changes, and this is a pretty big red flag when their programs are supposed to handle my financial future...

2026-02-27 19:19:32 UTC

fedi there is so much full force sloperating happening in open source accounting software...
no, NO look at me fedi, I know it's boring but you need to look at the accounting software, it's bad ok, it's really fucking bad out there, and I don't think your financial situation should depend on whatever logic an LLM spat into a bunch of accounting software without review
beancount developer fantasizing about running "5-8 agents" on the beancount codebase and babysitting them instead of writing code
https://groups.google.com/g/beancount/c/cz8Xwnb7BLE/m/LSA3rTfMAgAJ
ledger accepting LLM code and talking about vibe coded ports to Rust (as an experiment, at least, but lol)
https://github.com/ledger/ledger/discussions/2474
rustledger (seems almost entirely vibe coded)
https://github.com/rustledger/rustledger
paper by the american accounting association on "Applying Large Language Models in Accounting"
https://publications.aaahq.org/jeta/article-abstract/21/2/133/12800/Applying-Large-Language-Models-in-Accounting-A

2026-02-17 08:06:25 UTC

- reply

do they accept amazon gift cards? that'd be hilarious

2026-02-13 16:38:37 UTC

- reply

holy shit this is a standard part of git??? why do they leave all the cool parts buried in weird obscure doc pages 😭

2026-02-13 08:59:07 UTC

Imagine not having this feature on your git forge already
> Gives maintainers the option to limit pull request creation to collaborators or disable pull requests entirely.

2026-02-11 14:18:31 UTC

- reply

I'm no fan of the braxman technology, but out of curiosity, do you have some info on the supposed intentional backdoors? that would be extremely interesting to know about

2026-02-10 09:00:48 UTC

- reply

I think sequential queries are also much better on time series DBs, and the query commit times are a lot faster (which is more than just WAL flushing)
theoretically if you can make like sqlite go fast enough you can abuse it as a time series DB but at larger scales it starts to slow down, I think most production system are just chasing scale

2026-02-06 06:18:30 UTC

- reply

me watching two Rust libraries interact over the simulated C FFI calling convention because that's the only way they were exported even though they're both actually Rust code
this is a real thing happening in several major production projects in several different ways and some people just aren't ready to accept that lol

2026-01-30 08:47:18 UTC

- reply

I think this is generally why the advice is that you shouldn't actually have auto-updates turned on, by default the auto-update systems only apply security patches even if you enable them usually too

2025-12-18 19:46:56 UTC

fedi I've been programming for 15 hours straight, my code is linear but the output is nondeterministic, type abstraction has lost all meaning
send help, for I have sinned, and this is my purgatory

2025-11-23 03:02:42 UTC

- reply

I'd like to see open street maps go back to contributor only updates, because I'm very certain it's going to suck way worse than incorporating the state maps, pretty sure they started doing that because it was *actually* much higher quality data tbh
I do think they should offer a version that separately labels the state maps so you can choose to ignore them, but also, I'm very sure the state data will be if high enough quality that everyone will still prefer downloading it anyway tbh

2025-11-23 02:50:23 UTC

- reply

maps are constantly changing, even the government supplied state maps will have like 1,000+ changes a month, sometimes a street disappears and comes back, usually this is a better experience than an outdated maps with streets that don't even exist
ghost streets exist in OSM too and it's way more annoying for me than just having updated maps tbh

2025-09-01 06:58:44 UTC

IACR out here taking shots at the non-js users
https://iacr.org/tinfoil.html
https://s3.eu-central-003.backblazeb2.com/glitched-social/social/3fe7a08a-4699-484a-a9aa-c08bef16934d.png

2025-08-30 01:59:25 UTC

- reply

this, 100% this, it's bullshit and shouldn't be tolerated for end users

2025-08-22 01:32:26 UTC

- reply

imagine deploying this in a world where several alternatives do a better job for free lol

2025-08-22 01:32:01 UTC

- reply

wow, what a piece of shit tbh

2025-08-21 13:09:10 UTC

- reply

> so if you're poor? Get fucked. That's basically it.
this describes almost all technology I see in the modern world with some built in "market" or "profit incentive", you cannot implement these things without massively tipping your user base towards rich people with disposable income, especially during the early growth phase
this is not technology for the people, this is not technology for the benefit of society, this is technology that works for the rich

2025-08-21 12:15:17 UTC

- reply

2025-08-17 12:10:30 UTC

- reply

the policy for development at linux is to fix anything that you break when making changes... unless what you break is out of tree... so having this out of tree just imposes a lot of annoying problems on distribution and packaging systems, and having bcachefs be removed from the kernel over what is effectively a minor argument about patch timings is just bad and stupid tbh
linux desperately needs a serious replacement or competitor to btrfs, and having it in-tree helps support migration over to it as a reliable default for linux users at some point in the future, which I think would be a good thing generally

2025-08-17 12:02:19 UTC

- reply

yeah, I guess it also depends on what you care about and consider "significant"
protesting can change funding or fix some types of social issues, but very rarely will it change systemic problems caused by broken power structures tbh

2025-08-17 11:49:48 UTC

- reply

I fear that even this is becoming impossible lately, which honestly is a truly despicable feat
not even in ethereal form on a data network can our people move and exist freely... it's quite sad, and genuinely difficult to get to this point in society

2025-08-17 10:29:29 UTC

- reply

I feel this way most days tbh
today I walked past several cars which I know for a fact recorded footage from 5 different angles of my body and face, and uploaded it to some private company to analyze and identify me, which will later be sold to some government department one day for barely justified reasons
that was between walking through a local mall with no less than 15 different CCTV cameras and spending my last few dollars at a store that tracks my purchases through systems owned by a single global corporation, to maximize their income against my interests
sometimes I just want to live in a society where I can walk down the street without being automatically profiled and squeezed for money, or have a genuine conversation with a friend that isn't recorded and ruthlessly analyzed to benefit somebody who doesn't even know me
sometimes I just want to go into the woods and live in a cabin where the world will finally, at last, just leave me the fuck alone and let me live my life with like minded people tbh

2025-08-17 10:08:25 UTC

- reply

legal peaceful protest does little to a state or system of management imposing laws against their people which are immoral and unjust tbh
nothing significant in life has ever been achieved through entirely peaceful means, it just... isn't something that works long term... because sometimes you have to actually anger the people in power for things to improve, and doing that necessarily involves more than passive peaceful resistance to inhuman and terrible conditions

2025-07-31 08:03:08 UTC

- reply

yes, so much this... I understand requiring MFA for certain special actions even after being logged into an existing session, but if your system has to ask *multiple times in a row* you're doing something very wrong (especially if these interactions are routine)
annoying users this way only frustrates them into being insecure in new and increasingly fucked up ways tbh

2025-07-29 23:29:19 UTC

- reply

yeah I have to fight my inner computer user when people do this too because... god wtf literally why the fuck would you do that it's so awful omg
but then I calm down and just hope society doesn't collapse from everyone doing this repeatedly, and sometimes it's ok lol

2025-07-29 23:23:31 UTC

- reply

this reminds me of the time I saw a head teacher at a trade school open an MS excel document and, I swear to god, based on muscle memory checked the warning box and clicked "run embedded scripts" faster than I could finish reading the popup
I'm extremely certain that when they get hacked due to this the person responsible will say "it just opened and ran without any warnings, I had no idea!"

2025-07-23 01:07:52 UTC

- reply

damn, perhaps possible, but maybe not fun lol

2025-07-23 01:04:13 UTC

- reply

but how much is it in drumsticks only? 🤔

2025-07-21 22:29:52 UTC

- reply

well yes, but that is like... every security exploit ever, the issue is that reverse proxy and HTTP server implementations are buggy and non-conformant, which results in genuinely serious security issues
sending extremely broken and malformed content to reveal a bug is standard, and if the implementation fails in ways that expose users to attacks, that is perfectly valid and important to disclose and fix
the same thing is true of inputting malformed content into a binary and having a memory corruption exploit happen, just because you're not following spec doesn't mean the code should break

2025-07-21 00:59:26 UTC

- reply

to be fair the portswigger researchers are well known for pulling off complex attacks (this is related to HTTP server desync attacks)
also I'm 99% sure they're negotiating patches for the impacted software before this talk, it's not like them to just full disclosure bugs like this... but yeah the flashy websites are still annoying lol

2025-07-20 16:58:48 UTC

- reply

this, it's not even a competition, graphene wins in basically any metric you could imagine almost without effort, just because the practices of /e/OS are laughable

2025-07-20 04:45:36 UTC

> Meanwhile, many companies investing heavily in AI are not finding any clear return on investment, the Autonomy Institute claims. Of those 500 firms, 57 (11 percent) have explicitly cautioned that they may never recoup their spending on AI, or actually realize the expected benefits.
lol, lmao even
#note1clp…exx3

2025-07-19 17:35:05 UTC

- reply

this website recently took down their server, about 10 minutes ago, and the DNS record has been removed from their domain
seems they noticed and quickly burned the entire project, but I can confirm they cloned about 3.9k accounts at the time of checking (about 10 minutes ago)

2025-07-17 16:32:35 UTC

just found out the largest domain+email provider in Australia (ventraIP) is storing their customer IMAP passwords in plaintext.... what even the fuck?
apparently iiNet is also doing this for their ISP customers... is this shit just normal? am I going insane? this is MILLIONS of people using services where their email password can be viewed by literally anyone at the company with access to the support systems, in plaintext format... wtf

2025-07-11 09:59:11 UTC

- reply

"just work bone crushing manual labor until we find a way to replace that too"
yeah thanks bro lol

2025-07-09 07:32:58 UTC

- reply

surely they just jammed a single sentence into AI to generate this report.... I wish bug bounty didn't encourage people with the lowest possible skill level to spam 10,000 issues until one of them happens to stick for money *sigh*
genuine question, would you say you get mostly useful reports on the curl bug bounty program, or are majority just noise that gets closed with no impact? a quick look at the "hacktivity" page shows a depressing stream of nonsense at first glance

2025-07-09 07:17:58 UTC

- reply

I remember reading about this story when it first broke, a huge part of the issue is that the UK legal regime maintained until very recently that "computer systems could not make mistakes" as a matter of legitimate legal authority
it was absolutely insane and every time someone claimed the computer system was wrong the court automatically sided with the computer system against the employee
truly they've never looked at software in the real world before, and it literally killed people as a result

2025-07-01 06:32:07 UTC

- reply

hey, just a heads up, your new bot filtering software is breaking firefox with noscript enabled for some reason
this seems to be because of the 301 redirects which attempt to set a `deflect_session` cookie, which firefox + noscript strips on page reload as far as I can tell, causing an infinite reload loop
I fixed it by pre-allowing your website in noscript before the page even loads, but I'm guessing this is new because it hasn't really happened to me before on your site

2025-06-29 01:38:39 UTC

I swear to fucking god if another government website blocks access to their services based on shotty geolocation detection of an IP address assignment I'm going to lose it
say it with me now:
IP ADDRESSES ARE NOT TIED TO PHYSICAL LOCATIONS
this shit is a *CRIME* and I am fucking sick of legitimate citizens being blocked from their OWN GOVERNMENT SERVICES because the absolute dickheads running these systems decided to block random IP assignments based on nothing except 3rd party geolocation databases, instead of funding actual security controls for their garbage systems
fuck you, I'm 🤏 this fucking close to taking entire departments to court over this.

2025-06-27 15:30:52 UTC

I'm gonna be real with y'all I am extremely alarmed by the fact that politically sensitive services such as palestinian news organization Quds News Network just loads a shitload of google javascript into the browser on their page, including requests to accounts.google.com, meaning most likely everyone who visits them gets identified via their google account automatically if logged in
this is like, extremely bad.... if you ever build websites for organizations like this, never ever do that, ever.
https://s3.eu-central-003.backblazeb2.com/glitched-social/social/fd4669ff-eff7-4e26-896f-8c9b51ca363e.png

2025-06-26 07:16:19 UTC

- reply

ready to be shared with law enforcement? I have awful news for you, Ring regularly signs deals to automatically share this crap with cops already, they've been doing that for years, thousands of police stations have unlimited warrantless access to ring video footage because Bezos thought it was cool already
https://www.eff.org/deeplinks/2019/08/five-concerns-about-amazon-rings-deals-police

2025-06-23 17:05:40 UTC

- reply

funny you should mention that, a few years ago I experimented with smuggling malware inside of the DICOM format, it bypassed every available anti-virus online when I stashed a KNOWN bad sample of ransomware inside the document as a binary polygot

2025-06-23 12:31:43 UTC

- reply

I don't really consider hospitals to ever be correctly air-gapped because in reality there are like 6,000 endpoints literally a single hop away from the "air gapped" devices with full internet access, and hacking the firmware of something like an insulin or drug pump is laughably easy because they simply ignored computer security for 30 years, you can still buffer overflow to RCE on those things without any issues
@npub1fdr…lvhs wrote about this in 2014/15 and from the new research I've seen very little has improved since then
https://boingboing.net/2014/04/27/hacking-the-hospital-medical.html

2025-06-23 12:07:00 UTC

- reply

once saw a dentist chair running outdated windows 7 (yes, after EOL) with an anti-virus security alert popup which was ignored, and a horribly outdated Java version installed that was begging for updates
this person was doing minor surgery with that machine daily, I had no choice but to let them use a probably malware'd device on my face, or leave and pray the next guy isn't as stupid
nothing about this is fun

2025-06-23 12:05:23 UTC

- reply

I actively refuse to look at the security of the healthcare systems which keep me alive because literally EVERY time I have checked it scares me deeply

2025-06-22 13:54:02 UTC

- reply

can confirm LoRa radios and meshtastic is very cool, definitely your thing if you haven't looked at it before
I once saw those devices transmit data at passable speeds from over 150km away on a free-to-use radio band, very nice stuff

2025-06-04 00:32:05 UTC

- reply

the most hilarious part is that I think we already have this, it's called pending payments on the card, I think online purchases can even request that payment type and it works and everything, they're just not used very often for whatever reason (probably that it takes 3-8 days for a payment on the business side because real banking is slow as fuck)

2025-06-04 00:16:16 UTC

huh, just heard a bank advertising rotating CVC codes for online purchases with their card, and this combined with the cards that technically offer 2 valid CVC codes has me wandering about the rate limiting and other security controls on card verification systems 🤔

2025-05-31 22:34:43 UTC

- reply

me spamming the reply button with "yes Derek, I discussed it, we need to do <x> I think actually" like it's an NPC dialogue and I'm waiting for the story to start (it will still take 5 more emails)

2025-05-22 04:54:07 UTC

- reply

the USA likely won't do anything except kill the person responsible, either through the death sentence or otherwise
however this comes only a day after IDF soldiers shot at a delegation of 25 diplomats in the occupied West Bank, this shooting in the USA is likely to be a retaliatory action taken by an independent citizen as a result of world governments not representing the values of their people in regards to Israeli actions, including in the USA
The news hasn't reported a motive yet, it's either American turbo racism (which is entirely possible), or what I think is more likely is that it's probably a reaction to the recent aggression on display by the IDF toward world leaders, and the current lack of any real reaction from many governments in response

2025-05-22 04:13:26 UTC

uhoh.... this can't end well
#note1wvp…qwj4

2025-05-22 04:12:41 UTC

- reply

I have enough self awareness to know I shouldn't be fucking with things like that at least lol

2025-05-13 09:17:50 UTC

yooo federated forgejo is becoming real, this is great news
#note1hct…nkun

2025-04-02 05:56:47 UTC

- reply

the reports from industry leaders have LONG echo'd that cybersecurity is not an "entry level" field and there will never actually be "entry level" jobs in that market, because the skills required are not taught by businesses and employees won't be useful without years of experience anyway
I heard almost 5 years ago that entry level jobs don't exist in the cybersecurity market and literally nothing has changed since then, and this is probably a good thing

2025-03-12 09:51:00 UTC

Undocumented backdoor commands were found in the popular Espressif ESP32 microcontroller bluetooth stack
> In total, they found 29 undocumented commands, collectively characterized as a "backdoor," that could be used for memory manipulation (read/write RAM and Flash), MAC address spoofing (device impersonation), and LMP/LLCP packet injection.
https://www.bleepingcomputer.com/news/security/undocumented-commands-found-in-bluetooth-chip-used-by-a-billion-devices/

2025-03-07 04:29:42 UTC

- reply

it's mostly a side effect of UNIX treating everything as files, in linux a "file descriptor" is opened for tons of shit that really has nothing to do with the filesystem, for example a network socket or UNIX socket consumes a file descriptor as defined by ulimits, and yeah so does an mmap'd file
It's less about not sanitizing things in linux, and more like by limiting the number of open files you prevent weird race condition/threading attacks like this
https://binarygecko.com/race-conditions-in-linux-kernel-perf-events/
this attack needs to open thousands of new FDs (which in this case are actually just a reference to a struct, not a real file) in order to trigger a race condition around an actually mmap'd file, so if your hard limits were quite low there is a better chance this fails to execute
> The struct perf_event is returned to the user mode process as a file descriptor.
this second link also explains a simple kernel module race condition, where the example code requires multiple threads to loop opening files until a bug is triggered that duplicates one of the FDs, so again limiting the open files can sometimes help stop this, since these type of exploits are common in real world attacks
https://santaclz.github.io/2024/01/29/Linux-Kernel-Exploitation-exploiting-race-condition-and-UAF.html#race-to-get-double-file-descriptor

2025-03-07 03:24:27 UTC

- reply

it's mostly about exploit mitigation, a huge amount of race conditions and threading exploits rely on opening millions of files and hoping that probability lets them trigger a bug eventually (cache related exploits also do this)
so basically by limiting the number of concurrent open files you slow down those attacks so much that they stop working usually, which is why most distros have a pretty small soft limit, and a larger but not actually unlimited hard limit
besides that it also sometimes stops buggy code from crashing everything lol

2025-03-07 03:14:35 UTC

- reply

yeah, the weird thing is that my distro hasn't changed and the soft/hard limits are still set to very low defaults for security reasons, because the only time I go over the limit is large compiles
but actually I can't find the documentation note about increasing the file limits anymore, so maybe they fixed this in the build process for me instead of requiring a file limit increase from users tbh

2025-03-07 02:43:53 UTC

- reply

I've been using this OS professionally for over a decade and to be real I have no idea why this happened, my best guess is that the system was under less load and the compiler managed to get enough open files to complete without breaking, but that's just a wild guess, compiling firefox should have saturated the file limit still

2025-03-07 02:41:54 UTC

- reply

chat somehow 1024 FDs actually allowed the project to compile correctly, despite this failing every single other time I tried, and the documentation explicitly warning you to increase this limit or the compile will fail
and yet it worked... this is an even BIGGER linux moment than I thought, wow

2025-03-07 02:31:15 UTC

Oh no, I compiled firefox with `mold` linker and forgot to increase my open file limit above 1024 FDs.... welp guess I gotta restart that now
classic linux moment :^)

2025-01-28 10:31:02 UTC

- reply

did you see that github's copilot will refuse to autocomplete ANY code which has the word "gender" in it? also several other banned keywords lol
supposedly there are over 1,000 words which it will detect and refuse to operate on...
https://github.com/orgs/community/discussions/72603

2025-01-27 08:23:10 UTC

- reply

catch me hacking this algorithm and releasing information to the public to trick the system into believing everyone is impoverished, algorithmically driving Microsoft's profits into the dirt, and allowing thousands to buy items at a relative discount.
I promise me and those like me have infinitely more time and energy to fuck this up than the corporations have to fix it, I'll make it my lifelong side project to lose them vast amounts of money with the same technology they built to exploit people lol

2025-01-27 01:12:47 UTC

- reply

damn that's kinda rough, the show is really old so I don't imagine many people seed it, but I'm like 99% sure it would be on usenet somewhere... issue with usenet is that you have to pay for it :/

2025-01-27 00:14:18 UTC

- reply

apparently there are a *lot* of versions of the series, but they all float around on nyaa somewhere

2025-01-27 00:12:20 UTC

- reply

that show was fire, don't worry I gotchu fam
https://nyaa.si/view/1923190

2025-01-27 00:01:16 UTC

The loops.video instance has been submitted to #FediBlock with the reason being outlined below. I can't say I disagree, the terms of service presents a serious problem for user content rights, and this should be addressed before federation of loops.
Otherwise for the safety of your users I would highly suggest that instance admins defederate loops immediately once it comes online (assuming the TOS is not changed first)
https://bajsicki.com/blog/loops-video-terms/

2025-01-26 23:43:14 UTC

- reply

I have said this for many months, but it is worth repeating:
Based on a lot of current state of the art research, AI models could probably be 10x smaller and trained with 10x less data than they are today. I genuinely believe we have enough data to just never collect anything new, and train AI on that for the next decade easily.
Also Deepseek in particular was trained on 100% "synthetic" datasets, which are increasingly becoming common (and are usually generated by other AI models). This means no human/user data was even put into the model for training, it was all generated by other systems and completely made up to fit some desired statistical patterns
Before someone asks, no model collapse doesn't matter in the real world, for reasons seemingly nobody can understand (please send me research if you do) training models on other model output, with the correct statistical approach, doesn't cause any problems.
Merging the resulting model with other models also doesn't cause any problems really. Your guess for why this works is as good as mine, currently I think the variations in model output and differences in training data (thus embeddings) are enough to prevent model collapse. I tried finding research papers about this, and didn't see much analysis on why it works, just that it does work in practice.
I think the single most impressive thing about Deepseek, aside from being trained on synthetic datasets, is that it's actually produced by China which is currently under extremely strict US sanctions and has no access to top of the line computing hardware for training, unlike OpenAI and other US companies do.
Even while literally being sanctioned they still produced a better model, and this isn't the first time it has happened either lol
also here is some info about model collapse due to synthetic data not mattering in practice, for anyone who is interested:
https://www.theregister.com/2024/05/09/ai_model_collapse/

2025-01-25 21:22:27 UTC

- reply

I used to write a lot of C, I read K&R like 3 times, and used to regularly consult the man pages every time I did anything.
I once had a 50 line piece of code doing a super basic XOR operation over some bytes, which was technically vulnerable to a memory corruption bug even though I had used best practices as much as possible.
It took me and literally three other experienced C programmers, and a straight block of three hours of arguing over the definition of two words in a man page, before concluding that yes it was probably buggy.
I just stopped writing C after this, I'm convinced shitty C is the only thing that exists.

2025-01-25 17:59:10 UTC

- reply

wow, even I learned something new from this, namely that #Apple #AirDrop is using a completely broken and flawed security system which is essentially broadcasting your name, email address, and phone number to the world all the time 🤯
https://arstechnica.com/security/2024/01/hackers-can-id-unique-apple-airdrop-users-chinese-authorities-claim-to-do-just-that/

2025-01-24 15:50:45 UTC

- reply

very very true, I am not impressed by their response, but I understand why Graphene maintains an official community there regardless

2025-01-24 15:46:52 UTC

- reply

I've also spoken to several Graphene contributors about the Matrix rooms, previously more than one of them was bricked due to state resolution bugs that Matrix insists are/were fixed, it's not exactly ideal for a big support community lol

2025-01-24 09:26:10 UTC

- reply

#shametesla did nothing wrong!

2025-01-16 07:49:06 UTC

- reply

they regulate usage of the internet, they don't actually manage or run it right now (for the most part), I just don't think national governments that don't even manage or control the internet should be regulating how people use it
most of the world doesn't have net neutrality, and the USA repealed it recently (again), so packet shaping and blocking/censorship happens constantly online according to whatever your government just doesn't like that day, in the USA internet providers will check for insecure connections and inject extra advertising into websites just to rake money out of you (and this is technically legal), in other places entire protocols like torrents are blocked
The people responsible for running the internet should be working on regulating and managing more of it without intervention and demands from random governments, like US states that want to block porn, or Egyptian and Chinese governments trying to block news websites, letting some national government which only represents a fraction of the people online control how shared resources are used and accessed by everyone else is just shitty in general
This isn't even such a new idea, the people who built these systems understood the issues it could create, that's actually why the governments don't manage who can buy and run a website online, that'd be terrible lol

2025-01-16 07:08:10 UTC

- reply

no, I just care about improving the world and don't like the way governments manage the internet for their own interests smh

2025-01-12 02:48:35 UTC

- reply

internal politics and people management are almost as important as the technical skills in most, if not all roles tbh

2025-01-08 09:58:28 UTC

- reply

I genuinely can't view this because reddit is a garbage platform not built for humans anymore, and they block my browser and network, and block people without an account in a lot of cases now, but I'm sure whatever this was it's damning lmao

2025-01-08 06:59:45 UTC

- reply

Very VERY much agree with all of this, Gargron and his control over the mastodon server codebase itself creates these problems sometimes (as do the other popular implementations and their devs), rejecting social discovery because they personally don't like it is absolutely no way to run a community project used by millions of people
Definitely think social discovery and search should just be implemented, ignore those people honestly, their concerns have been considered and discussed and I personally believe they are probably way overblown compared to the benefits of actually improving the software, network, and discoverability of the fediverse in general, especially for new users.
This isn't to say that it's not important to consider the negative aspects of any change on the fediverse, it's absolutely critical to consider the impact of these things, but the reality is that we're just not implementing features because a small handful of people don't want them... not because it would be a huge issue for the fediverse itself tbh
As you said, I absolutely agree that there are some fair points against implementing this, but we need to face reality here and realize that the harmful actors don't care and have discoverability anyway, and everyone else suffers shitty UX without it.

2025-01-08 06:08:13 UTC

- reply

not entirely surprising, considering the fediverse is a public network, and most servers don't have a robots.txt or similar which prevents scraping tbh
I mean if they're pulling data from reddit and every other popular website, better believe their scrapers found the fediverse too

2024-11-23 09:55:47 UTC

I feel like the internet should be an independent national organization, independently regulated with its own rule of law and governance systems, letting national governments which are tied to specific populations and land areas control such an important shared global resource is misguided and morally/ethically wrong tbh

2024-11-20 17:11:16 UTC

- reply

the Irish DPC being basically useless on GDPR enforcement is a hot button issue in Europe right now, from what I understand the rest of the EU is essentially applying legal pressure and threatening penalties for non-enforcement so hopefully the Irish DPC gets much better in future

2024-11-20 16:38:52 UTC

- reply

if I had to guess I'd assume it corresponds to defender team/department increases and funding increases
I find the Mozilla data very interesting, it seems they're consistently ahead of attackers despite producing a browser, which is more-or-less hit with 0day exploits and many other unknown bugs regularly?
I suppose it depends on the measurement methodology, since I guess if they patch those issues within mere hours of being told it counts as extremely good remediation? or maybe it's just a measurement of the "mozilla org" and their security rather than security of their products

2024-10-17 19:04:21 UTC

- reply

is... is this real? I mean even just the branding here is awful from a PR perspective, wtf are they even doing... incredible

2024-10-16 06:42:13 UTC

- reply

what company operators this scraper? where does the data go? how do you know it's actually related to AI and not some random bot?

2024-10-09 04:09:27 UTC

- reply

I think in pretty much every modern system UEFI is considered a security boundary, that's why vendors care about things like secure boot, particularly for virtual machine hosts or other high security applications the UEFI and boot chain security get really important
super interesting exploit though, I'd definitely say it was either some UEFI bug or maybe a hypervisor bug that caused UEFI issues, especially because they mention bypassing the "secure kernel" which requires working UEFI security to establish at boot time

2024-08-31 07:20:40 UTC

- reply

the way the old blocking `/dev/random` call worked, and the OLD linux kernel random number generator, yes it could go down LOL
also at very early boot if you need CPRNG material you'd sometimes have to wait for entropy to increase first, especially on routers or servers with no external inputs, but the MODERN linux kernel has a better system which avoids this afaik

2024-08-31 07:18:13 UTC

- reply

in short this is why an entropy graph is useless, thanks for coming to my TED talk :^)

2024-08-31 07:17:53 UTC

- reply

entropy doesn't "go bad", it will always reach a max buffer size after boot and initialization, and the entropy will probably stay full after that forever without being depleted even when doing crypto operations
if it "goes down" it sort of also doesn't matter at all, you should definitely read the justification for Linux changing the `/dev/urandom` function to a varient of CPRNG with ChaCha20, Bernstein himself makes VERY good points about how entropy can't be deplete in practice when doing crypto anyway, along with an attack that occurs when constant re-seeding happens :)
https://en.wikipedia.org/wiki/Dev/random#Critique_of_entropy_injection