Meleagris

Members of the Senate committee reviewing C-22:

Marty Deacon (Ontario) Committee chair 613-943-3429 Tony Ince (Nova Scotia) Deputy chair 343-991-5540 Andrew Cardozo (Ontario) Committee member 613-996-9545 Katherine Hay (Ontario) Committee member 343-991-5536 Rebecca Patterson (Ontario) Committee member 613-995-2185 Hassan Yussuff (Ontario) Committee member 613-944-1108 Kim Pate (Ontario) Committee member 613-995-9220 John M. McNair (New Brunswick) Committee member 613-995-5060 Victor Boudreau (New Brunswick) Committee member 613-947-4110 Judy A. White (Newfoundland and Labrador) Committee member 613-996-2433

This is a cool article to come across, having just finished Becky Chambers’s new book, “As You Wake, Break the Shell”.

I think the advantage is making the honeypot goal-directed.

High-interaction honeypots are about extracting as much information from the attacker as possible.

Instead of just observing, you could give the model intelligence objectives and have it dynamically steer interactions to achieve them.

Deliberately leading an attacker down paths that reveal their capabilities, tradecraft, or infrastructure.

You can do this today…but it requires effort to develop the scenarios. With this, it’s just a disposable goal.

This is more useful than you’d think. Consider using something like this to drive a high-interaction honeypot.

I’ll be interested to see how this compares to Nvidia’s Nemotron 3 Diarization model for diarization. For my use-cases real-time diarization is still not where I’d like it to be, but nemotron was definitely a step above the previous attempts.

Edit: apparently it’s not open unlike the previous, so not useful for local. Sigh.

Ok. But why would anyone buy a third level domain when they could have bought the second level? It’s a strange thing.

Were the third level domains cheaper?

Me personally, it wouldn’t even occur to me to register a third level directly, because why bother when you can have the second level and do whatever you want with it.

Super strange.

Holy smokes!!! It has just occurred to me that anyone who can type on a keyboard knows how to play an instrument. Your keyboard is the instrument.

With solo mode, I asked ChatGPT to translate the songs to keyboard notes, and I was just typing the notes as if I was doing a typing test, and I was playing songs. lol the easiest "sight-reading" I've ever done.

Is this the every persons instrument?

Here is Happy Birthday in solo mode:

E E T E I U E E T E P I E E B X I U T C C X I P I

Crazy unlock!

INB4 "OSS Rewrite"

Sure frontier models can continuously scan projects for vulnerabilities, but projects written in memory-unsafe languages (i.e. C) require an endless cycle of discovery, triage, and remediation as new features are built.

Just wait a couple more years, I am betting that it will be economically preferable to migrate software onto memory-safe languages and more verifiable architectures rather than repeatedly auditing systems built on fragile code.

If they truly wanted to do good, an "OSS Rewrite" service is a natural logical successor to vulnerability scanning. Instead of spinning wheels and burning tokens finding bugs in unsafe code, it would probably make more sense for AI to help move projects onto platforms where entire classes of vulnerabilities are just eliminated.

Totally agree with this article. With AI, I think now is the perfect time to consider where Unikernels might fit into your architecture, and how you can leverage them to minimize your attack surface.

I’ve started looking at them myself, and have been comparing them to mature VMMs like Firecracker, and asking myself where each piece of my stack might be best run.

Virtual machines and containers are no longer an effective isolation mechanism when AI is involved. VM breakouts are becoming trivial. So everyone should be considering how to bake better security into the their runtimes.

I’m surprised people don’t get refusals running this, or are they running it with cyber-enabled models like daybreak?

In my experience, even just hinting at reverse engineering to models from Anthropic or OpenAI leaves them extremely sensitive to refusals. After all, the same techniques used here can be used to find exploits.

Or are people using it with local models?

Curious.

I’m actually more interested in hair removal. There should be better methods than what we have now.

If I’m going bald, then I’d love to shortcut the process.

Shaving is awful no matter where it is on your body. It takes time, it’s irritating and you never look fresh for more than a day.

I wasn't expecting to get hit by AI generated slop on Standford's website. At least mark the article as being produced by AI.

> “What they found was striking: … These differences essentially locked each progenitor cell into its respective fate, like travelers on parallel tracks that never cross.”

The dramatic colon, the obligatory closing metaphor, makes me ill.

So I did test this, and it doesn't work because the quantized layers need torch._int_mm, which PyTorch's MPS backend doesn't implement. It just throws NotImplementedError.

I've been using MiniMax H3 on my M5 Pro 64GB MacBook Pro through ComfyUI. It works extremely well.

I had to modify the default ComfyUI workflows to use a GGUF quant (city96's ComfyUI-GGUF custom node, UnetLoaderGGUF in place of the stock loader) [0].

I use the model labeled Q5_K_M. There is Q8_0 available as well, which is 34GB and fits fine in 64GB unified memory if you keep resolution modest.

The main issue is speed, a ~9-second 480x864 clip at 20 steps takes me a bit over an hour. So this will be cool to try for the speed up alone.

There's a lot of great information and workflows available to follow on the r/StableDiffusion subreddit.

[0] https://huggingface.co/Abiray/MiniMax-H3-GGUF/tree/main/unet

Anyone who is bothered by mosquitos should look into how to build a “bucket of doom”.

Basically you deliberately create the best mosquito breeding habitat in your yard (stagnant water), then spike it with a a bacterial larvicide to kill the larvae at the source.

Since mosquitoes don’t travel long distances, you end up creating a small mosquito free zone around your trap where they were never able to breed. It’s extremely effective

I don’t believe for a second that they lack the engineering talent.

It’s just another example of a company demonstrating shamelessness in the pursuit of growth, in an industry where consequences do not exist.

From the outside, it looks like OpenAI got exactly the kind of event they could market the hell out of to demonstrate the capability of the model.

But the event itself only seems possible because they failed to properly monitor and isolate the environment in the first place. To me, it looks like their job is to market the model, not take security seriously.

The model is obviously impressive, but we already knew that. I personally don’t like how the containment failure becomes part of the mythology of how capable the model is, rather than an environment engineering failure.

At the end of the day, it’s not like Hugging Face is critical infrastructure. But there need to be real consequences for stuff like this so that OpenAI is incentivized to mature as an organization and take security more seriously.

At this point, this incident is just security porn and entertainment for developers

I was just working on backing up my mac yesterday. I talked to Fable about replacing Carbon Copy Cloner with a custom script.

One of the things I realized is that backups are about as “critical” a function as you can get in personal computing. I ultimately decided to stick with Carbon Copy Cloner because, in this case, it just made sense to use something battle-tested.

I’m happy the developer of SuperDuper got the chance to build the version he wanted to build. But from the outside, reading the blog on mobile, it’s hard to ignore that the website is broken and appears to have been generated with an LLM.

The fact that AI was used to create the website isn’t a problem in itself. It’s the lack of attention to detail in shipping the website broken. It makes me wonder about the state of the application itself.

In the case of SuperDuper 4. The application could be extremely well tested. But as a potential customer, I have no way of knowing that, and the presentation doesn’t inspire the confidence I’d want before handing it my backups.

Cases like this are where I really appreciate open source projects. Having the ability to look at the source directly gives me confidence. In this case, all I have to go off is a broken LLM generated website.

I do use git branches, but they solve isolation, which isn't my pain point with git.

When I'm using agents to code, I don't want to have to stop what I'm doing and commit known-good state to the repo every few minutes.

jj just snapshots everything automatically, so I know I've captured that state, and I can look back and curate it all after the fact.

It's like the shift from manually saving Word documents to autosave, but instead of forcing it with git, I can use JJ which has been intentionally designed for that workflow.

In .claude/settings.json you can trigger shell commands on events like SessionStart, Stop, PreCompact, and PostToolUse [1].

I have all of them run `jj status`, because jj snapshots the working copy every time it's invoked.

You can have Claude write the hooks, but mine is:

`[[ -d .jj ]] && jj status >/dev/null 2>&1; exit 0`

[1] https://code.claude.com/docs/en/agent-sdk/hooks

I recently switched to Jujutsu (jj) and it made me realize that “what comes after Git” might already exist.

It turns out the snapshot model is a perfect fit for AI-assisted development. I can iterate freely without thinking about commits or worrying about saving known-good versions.

You can just mess around and make it presentable later, which Git never really let you do nicely.

Plus there’s essentially zero learning curve, since all the models know how to use JJ really well.

For those interested in doing this themselves, there’s some great existing software to create EPUB3 files with the audiobook aligned with text.

https://storyteller-platform.gitlab.io/storyteller/

https://codeberg.org/richwaters/StoryAlign

Out of curiosity. Where does the metadata for the books come from?

+1 for Storyteller. It is beyond fantastic to have my progress seamlessly synced between my ebooks and audiobooks.

I’m paying for BookFusion, to have synced cross-platform reading. It’s expensive, but seems to be one of the few cross-platform synced readers that supports the EPUB Media Overlays from Storyteller.

Have you experienced ghosting with your Boox tablet? I’d like to get one, but I know that ghosting would bother me.

Perhaps there’s a B2C offering to be made here. An SMS proxy, forwarding 2FA codes to people without SMS.

It would require a lot of trust.

Similar and related discussions on this post:

https://news.ycombinator.com/item?id=43976359

This past weekend I was struggling to teach my 97-year old neighbor how to login to his RBC Bank account. It was an 11 step process!!! The state of technology in the Canadian banking system is abysmal.

Combine that with our cell providers, and it's a real problem. There's some cell providers like Public Mobile where you can't even opt into roaming. So SMS 2FA is never an option. [1]

[1] https://productioncommunity.publicmobile.ca/t5/Get-Support/T...

We should really define a new term for such work.

Perhaps "Risk Compliance Security" or "Security Compliance Engineering"

Where "Security Compliance Engineering" is the practice of designing, implementing, and maintaining security controls that satisfy regulatory frameworks, contractual obligations, and insurance requirements. Its primary objective is not to prevent cyberattacks, but to ensure that organizations can demonstrate due diligence, minimize liability, and maintain audit readiness in the event of a security incident.

Key goals:

- Pass external audits and internal reviews - Align with standards like ISO 27001, SOC 2, or NIST

- Mitigate organizational risk through documentation and attestation

- Enable business continuity via legal defensibility and insurability

In contrast…

Cybersecurity is focused on actively detecting, preventing, and responding to cyber threats. It’s concerned with protecting systems and data, not accountability sinks.