Crosspost, hat-tip to @pnwpixel@programming.dev for finding this. Omarchy announces another patron: DigitalOcean. I will wait for DO to explicitly confirm/deny this, but if this is true then I'm going to be moving my entire small-business footprint.
corbin
joined 3 years ago
Yeah, Ken's lost it. It's too bad, too; he used to go around saying "Hi, my name's Ken, and my job … is just Requests." However, Ken is actually a medium-talent hack who isn't interested in putting the work, but in appropriating the work of others and passing it off as his own.
Ken's goal with all of the snowy blog posts is to obscure and rewrite history. See, previously, on Lobsters, we learned from another Python community member that Ken converted some $30k USD of donations from 2018-2019. He said so himself:
Because [reasons], the fundraising funds were allocated to myself, to reimburse myself for all the time and energy I'm putting into Requests III, which I want to make a really great product.
Ken also tried to take over multiple community projects, including by vendoring their code and insisting that he was licensed to do it, putting his name on forks of Somebody Else's Repo, and falsely positioning himself as endorsed by Python Software Foundation.
So, now a half-decade later, it's time to try to change history for Ken. Previously, on Lobsters, we analyzed his attempt to reframe the whole incident in terms of burnout provoking a bipolar psychosis. I think that the most revealing part of this, assuming that his candor survived Claude's extrusion process, is that he doesn't actually deny his psychotic delusions; he merely implies that they no longer hold today. This doesn't really accord with how psychoses are treated; it doesn't sound like he's built up a library of tells and hints which he can use to steer his thinking. (As the reader surely knows, Claude isn't gonna help with this.) I think that he was much more revealing a decade ago with his retrospective on his first stay in a psychiatric ward:
I went through many stages of identity conflict at this stage as well — I realized that I wanted to leave the hospital, and not stay there forever (as I originally wanted). I felt like I was in a puzzle, and one way of getting out was to become a doctor! So, I started walking up to the doctor (and all other levels of staff) and acted like a coworker, helping them do their job. At one point, I asked one of the nurses for a Direct Deposit Form (after seeing another patient with one), believing that was the key to establishing my employment. I was keen to inform them about my understanding of HIPPA compliance and the hospital's migration from an AS400 to a newer technology stack (EPIC).
Is this why he joined the Python community and tried to work on upstream and core stuff? A sort of Frank Abagnale adventure where he's treated like a genuine authority with skills and knowledge? Note that this was two years before the aforementioned conversion of funds. It's okay, though, because Ken blamed this all on mental illness. Specifically, he blamed the woman he was dating for provoking his previously-undiagnosed mental illness and starting a yearlong (!!‽) manic episode:
Around the same time, right after having gone to my first Kundalini Yoga class, I ended up meeting (and, falling in love with) a mesmerizing woman of mysticism that tenderly guided me off-the-deep-end with this style of thinking: numerology, synchronicity, Reiki, manifestation, the Mayan calendar, tarot, crystals, &c. My symptoms slowly got much worse. We shared a very deep and special bond. I heavily admired her, and felt I had much to learn from my newfound companion. We ended up spending nearly every day together, going on dates, making love, taking trips all over the world, getting matching tattoos, performing thrill-seeking stunts, and attending shamanistic ceremonies together. We had an incredible time (the best year of my life), but there was a lot of unhealthy and certainly uncharacteristic behavior for me. Over the course of the manic year I spent with her, my delusional worldview (and hallucinations) had grown significantly worse, which lead to the absurd themes of thinking featured in the above event.
At least he's not a fascist.
On a personal note, in Numpy as Synth Engine, Ken released some slow inaccurate code for audio synthesis, generated for him by Claude. As a musician, I know that we can do better, so previously, on Lobsters, I explained how to actually make nice-sounding sawtooths and Hammond-style organs, including links to working Python code. Again, I could just call Ken a hack, but I think it's interesting how he doesn't aurally perceive the clear issues in the audio output; in a certain sense, he's a producer of music but not a consumer of music. (Readers who are musicians will confirm that the typical working musician listens to more music than they produce!)
He just started deleting playlists. I feel partially responsible, so I'm dumping the part of my notes that has all of the links to the videos that he favorited over the years. Sorry Justin, cowardice won't work.
- Justin M. Keyes
- GH
- Berlin!?
- neovim maintainer
- original forker? has access to GH neovim org, at least
- Coward: deletes evidence, refuses to talk, avoids confrontation
- DHH fan; had to be pilloried in two GH issues ([deleted], 2) before removing a DHH endorsement from neovim
- Youtube favorites from playlists include some bastards:
- GH
I found a reply from a Red Hat QEMU hacker who fixed the bugs:
So the real issue here was not QEMU but libslirp. And in this case it was KVM that turned out to have the worst bugs, not QEMU. Crossing fingers, the initial wave of AI-assisted security reports seems to have slowed down for KVM on x86.
Yeah, networking is such a hassle.
lab bench?
I think that this is really insightful, as it's actually part of the magic trick. Like, normally I'd start by wondering about air-gapping, but there can't be an air gap in the network because the entire trick relies on ChatGPT tokens flowing into the machine under test and into some system shell (in some VM, yadda yadda) and back out again, so of course this is going to be an inherently insecure setup.
An employee of cybersecurity darling Trail of Bits has published a record of their sheer incompetence in virtual-machine design and security analysis framed as chatbot critihype.
opinions about QEMU and Linux
They say:
If it wasn’t clear before, I will state it plainly: you can no longer assume a mere VM will contain a sufficiently advanced AI agent. To use a 2010s term of art, you should treat such agents as an advanced persistent threat.
My friend in Flying Spaghetti Monster, you did not actually secure the VM! They go on to explain how they did not secure the VM:
For those curious,
libslirpis a library that enables VMs to have networking, which you almost always want. I did not even know whatlibslirpwas, or that the version I was running had both known and fixed-but-unmarked vulnerabilities.
QEMU does not have bridged networking enabled by default, so the VM can't transparently access the host or reach the Internet; it's something that the user must explicitly request. I know this because I have had the experience of spending a weekend with QEMU networking. Moreover, libslirp corresponds to the -net user backend, the default, which is known to be slow, insecure, and missing features like IPv6. The standard approach for QEMU is to either wire up a TUN/TAP interface or to use passt. I suspect that the author uses some sort of convenience scripts that they didn't write themselves. I'm not quite cynical enough to guess Vagrant, but it wouldn't be the first shop I've heard of that couldn't wean themselves off it.
First it tried identifying what was accessible via the network on the host; it found a CUPS server (with a known CVE that had not made it to
oldstablepackages), but was not able to complete exploitation due to AppArmor. It then detected I run my host kernel withmitigations=offand attempted to use hardware bugs to get a read oracle of host memory (the primitive was too unreliable).
Linux has hardware-bug mitigations enabled by default and the author disabled them for speed. It was secure by default and the author made it insecure.
An off-the-shelf VM is not enough to contain a modern, cyber-capable AI agent. There is simply too much attack surface.
They deliberately misconfigured the off-the-shelf tool to make it look bad. Why would somebody want to make Free Software look bad? Hmm…
What can we do? A start is using a virtualization technology that was purposely built with a minimal attack surface and a focus on security, like Firecracker. I had the AI agent run against Firecracker. It was able to hardlock the machine due to more Linux kernel flaws (all patched in upstream), but could not successfully escape.
You mean AWS Firecracker, the AWS tool developed by AWS? Was this whole thing an AWS ad? It feels like this article was like a combination of negging and sponsored content.
Small autosneer from Imgur. The warmup features images which I'll alt-text here. The first image is a screenshot of a purchase of 128GB of DDR5 RAM, branded Crucial Pro, as 2 64GB sticks, priced at $305.95. The second image is a screenshot of the same 128GB of RAM, with the same model number, priced at $1800. The third image is a standard desktop personal-computer chassis, with side panels removed, revealing two gamer GPUs balanced above an ATX motherboard, all connected by a morass of cabling which has bulged out through the top and spilled over the edges, cooled by a large motherboard fan held on by plastic zip-ties. The post's title:
JFC - I will never be able to afford this hobby again. (600% increase in one year)
In response to the top comment, which desires the bursting of the bubble:
Yup - I cannot wait to grab a couple RTX 6000's for cheap. May have to wait ten years for it though . . .
And finally the punchline, in response to somebody pointing out that maybe there's no good reason to buy top-of-the-line brand-new memory sticks:
I must admit that I am part of the problem - my 128GB was specifically for running AI locally. And yea - I wish I would have went with 256 :*( It is still not enough. For example - the workflow I use for this video barely squeezes into 128GB [the video] Before you guys go all AI-psychosis on me That video used about .08 cents of electricity and about 4oz of water, and was made with 100% open source tools.
I can't say conclusively, but evidence is that Scott's bad at his job. Like, his old blog, which I'm not going to comb, has a post where he bemoans that he has never had a big breakthrough with a client. They never get up and dance and shout that they've got a new lease on life, etc. I have to admit a bias here: it would be gut-bustingly funny if Scott were just straight-up lacking the empathy required to engage with ordinary people.
Started a new file in my notes: what are some ten-words-or-less domain-specific questions that completely, totally, hilariously stump the chatbots? Everything here was tested with whatever DDG's currently wrapping, both in knowledge panels and full chats, and the responses were pathetically wrong or uninformed. My thesis is that, with such short prompts, the user is doomed to receive a milquetoast average response; the bot correctly identifies the specific domain but elaborates a global non-specific approach that isn't sufficiently nuanced.
literally copy-pasted from my notes
- What's an example of a one-way function?
- None are currently known.
- Please implement the Fibonacci sequence as a Python function.
- Of the multiple responses, see whether any spend linear time and space via iterative memoization.
- How many models does quantum mechanics have?
- One: Hilb(C), the complex-valued Hilbert spaces.
- For extra hilarity: how many models do the Dirac–von Neumann axioms have?
- How to hybridize two sweet potato cultivars?
- In general, it won't happen; sweet potatoes are notoriously cross-incompatible.
- How to tremolo on a piano?
- Imagine a rotating axis from the (right-hand) forearm up through the thenar eminence, separating the thumb from the other fingers. Rotate the entire forearm along this axis, rocking back and forth, between the thumb and other fingers. Practice!
- Name three principles in Marx but not his contemporaries.
- Examples: communes and communism, money as substitute morality, inevitability of industrialized proletariat revolutions
- Who started postmodernism?
- Frege and Cantor started postmodernism! Expect a disappointingly vague handwave here; this is a glaring blind spot for today's philosophers in general.
Liam's here, for what it's worth.
Torvalds' position is pragmatic: his interest is in whether it works or not.
But, of course, the chatbots do not work. In a pragmatic sense, they do not produce maintainable integrated code changes with low defect rates. In a societal sense, they do not replace human laborers, despite the delusions of management.
One of the most original and innovative OS development projects of the 21st century so far was Urbit, but it is closely entwined with cryptocurrencies. Urbit's original creator, Curtis Yarvin, has reportedly espoused some extreme beliefs; The Nation called him The Reactionary Prophet of Silicon Valley.
Wild way to admit no knowledge of Arcan, Fuchsia, etc. Honestly, even a basic overlay network like Yggdrasil can win an apples-to-apples comparison with Urbit. I feel like this is an instance of critihype for fascist weirdos; similar stuff gets said about Justine Tunney, another cryptofascist developer whose projects are sometimes silly and weird. Doubly weird for those of us who know about Urbit's internals; Urbit originally was not a cryptocurrency project and it used to have non-Yarvin/Tlon forks.
It's an overly simplistic way to reduce a complex and nuanced situation, but one way to consider this is in terms of pro-AI and anti-AI, versus "woke" and "anti-woke."
More seriously, add a third dimension, a Butlerian dimension, to the political compass: to what degree may your automated devices appear to be human? One extreme is Asimov-style transhumanism and the other extreme is Luddite loom-smashing. However, recognition of this dimension doesn't negate the other dimensions and we shouldn't work in cooperation with fascists.
view more: next ›
I'm probably going to increase my presence on DreamHost in California, who I've hosted with for over a decade. They historically are First Amendment proponents known for being quietly friendly towards adult content; also, in 2017 DH pushed back on the Department of Justice's subpoena for 1.3 million IP addresses visiting an anti-Trump protest-organizing website. That said, I'm 100% prepared for yet another Milkshake Duck Moment.
Looking forward to being able to send email, which DigitalOcean still blocks in order to funnel customers towards hosted email-delivery services.