TacticalCoder
My milspec LG Gram with 24 GB of RAM: I know, I know, milspec means nothing etc. But...
A friend of mine literally stepped on it by mistake: no problem. There s an online video about someone throwing one down concrete stairs: keeps working just fine.
It s also lighter than any Mac laptop.
It s old now and may not have the fastest CPU but this laptop can and does take serious beating without breaking a sweat.
Amazing machine
But your comment says it several time: the valuable skill is being already a seasoned dev.
Then AI is superpower.
It's for the junior that things sucks big times.
I see it all around me: senior devs are empowered while juniors are not even hired anymore.
- compress backup
- encrypt backup
- add cryptographic checksum to encrypted backup file(s)
- pass the newly created backup to a container that only has access in read-only to the volume with the backup
- verify the cryptographic hash
- decrypt
- decompress
- verify everything that can be verified
- if all passes, whitelist the cryptographic hash for that backup as "known restorable backup"
I still, once in a while, take a backup at random and verify that it can be restored but basically already by verifying that the cryptographic checksum matches, I'm pretty confident it's gonna work.
Never failed.
A proper backup procedure can be so much more than simply: compress/encrypt.
A real cycle, before whitelisting the backup as "probably restorable", is way more involved than that.
"People shouldn't be allowed to bicycle for fun. Only utilitarian bicycles should be allowed. For there's too much energy spent manufacturing mountain bikes, tires, converting ski station into bike parks for the summer. That energy and money should instead be directed towards creating more RAM factories and more datacenters for the AI companies".
Where does such an "efficient" argument ends?
P.S: as a bonus question: does anyone know how to differentiate a paid shill from a sycophant?
They're not bad when you're in them but they're not amazing either. The thing is: they're incredibly good value compared to other brand new cars.
But the interior of a great many german cars (for example) is still qualitatively not just a bit but way above BYD.
And do we feel about running no firewall?
For example Linux works totally fine without running dhcpcd and without running avahi. But on many systems where people think they run "no service", these two shall have ports open on your network and happily listening.
Sure, it's typically "only" on your LAN: but how long before we see exploits affecting even private LANs?
Tighten your stuff up guys.
It's not the same thing as early NVidia / Amazon / Google IPO: these companies didn't IPO at a value immediately placing them in the top 10 (by companies market cap) and certainly didn't IPO at values representing 5% of the US GDP.
Can it x2? x3? x4? Maybe.
Can it x100 and represent five times the US GDP? I don't think so (I know, I know, the US GDP would grow too).
I know ANT ain't SPCX, but look at what happened so far to SPCX's valuation.
I really don't understand how could it be otherwise? They're planning to IP at a valuation representing 5% of the US GDP and, unlike NVidia, they are neither selling shovels in a goldrush nor a business with decades-old proven track of records.
Are people really going to buy ANT thinking it'll 10x to 50% of the US GDP?
Aren't there better stocks to YOLO on if you think you could maybe 10x? And if you want something safe instead of YOLO'ing, aren't there plenty of companies much safer and much more boring to invest in than something IPO'ing at 5% of the US GDP?
Isn't the entire Anthropic narrative based on infinite growth? How is infinite growth sustainable?
> Code quality has increased, test coverage increased.
And that's true for many old codebases!
> We've also recently set our compiler to treat warnings as errors, and to be as strict as possible.
Yeah. Everybody who said it was impossible, that no budget would ever be allowed to fix old bugs, that new features "to support the business" was the only thing that mattered and other nonsense like that have been proven wrong. Arguably they were kinda right but then LLMs happened and that's what proved them wrong.
I love to see what's happening: at very long last people are understanding that security is something to be taken seriously. They're understanding that "more code = more bugs".
> Our next project is to eliminate all 3rd party dependencies,
I love the spirit!
> and after that to rebuild our frontends completely using zero frameworks, not touching npm ever again after that.
I hope many more shall realize that now we can give the middle finger to a great many pathetically bad and totally unfixable (even with the help of LLMs) ecosystems.
At a moment where a sizeable part of the world is rising against the externalities of datacenters and the dangers of having two companies trying to do regulatory capture on AI in the US (and probably in the vassal EU too), using an episode of Star Trek to push the narrative that "Good men consider LLMs should have the same rights as humans" just makes me sick.
You guys are seriously unwell and totally falling for a narrative that's pushed on you.
Well you can use open-source / free software cryptography to encrypt and decrypt using a secret key which you do not need to remember and which is safely stored behind a secure element.
And there are quite a few people doing just that.
It's immensely more secure than trusting Lenovo or Microsoft or whatever company.
And you can have your secret on the secure element protected by biometric auth too (some do offer just that).
And there are devices like that with a tiny attack surface that accept biometric (like your fingerprint) to unlock the secret.
To get the best of both world you trust the HSM with one thing: the secret, and that's it. And you use open-source software and protocols (like GPG and OpenSSH) with that secret.
My editor is configured to never show any character (except the one and proper newline) at less than the full-width of a regular character (in the monospace font I'm using ofc).
And if it's not a visible ASCII char, not only it's always shown at least at full-width, it's also shown as bold magenta on a black background. As the non visibe zero-width is empty, it shows as full-width on a black background.
Sticks out like a sore thumb.
How comes the very companies creating, supposedly, the best LLMs in the world have such blatant one-click security holes?
Something doesn't add up: sounds to me like coding ain't entirely solved yet after all...
https://www.schneier.com/crypto-gram/archives/2000/0715.html...
"Unicode is just too complex to eve be secure"
As to me I'm running my own DNS resolver (I use unbound) and everything goes through port 53 UDP (and AIUI technically 53 TCP should be allowed, but nothing will happen if you just block it), unencrypted. What then unbound does on the Internet, that's up to you: you can encrypt those requests...
The nice thing with everything being in the clear, is that you can null route / NX DOMAIN every single domain that uses Unicode (punnycode) characters and you can even do that at the firewall level, by inspecting UDP packets.
Of course you gotta be sure to really block DoH / DoT internally but it's all doable.
I set that up years ago and I've been running like that since then without any issue.
Just as entire countries's IP blocks do not exist in my world, domains using Unicode characters do not exist. And I really don't care about your feelings about it: I'm just explaining that technically it can be done to block them all and that the Internet keeps working just fine.
Unicode really is just too complex to ever be secure. And those who don't understand that are part of the problem.
On the plus side this requires collaboration both from the inside (on the airgap side) and the outside.
If you install a computer that's not running AI and it's airgapped, it won't suddenly start emitting radio waves out of nowhere.
We should not fall, once again, for the following logical fallacy: "Under exceptionally crazy circumstances it's possible to use RAM or the power line to exfiltrate data from a compliant airgapped computer, hence airgapping computers is pointless".
(reading TFA)
net/ipv4/af_inet.c
net/ipv4/tcp_ipv4.c
And moreover it's a security issue found by LLMs.
It's kinda a really bad time to be a C-loving, AI-hating, fanboi.
Do we at least entertain the idea that some rewrites of some things in safer languages could be a desirable goal? (not saying it's practical or not: just asking if C lovers are willing to reflect a bit on what's going on atm).
For the little story, back in the early beige PC days (think 386 and 486), quiet PC fans didn't exist. It was all super noisy, and typically at a fixed speed.
And, coming from the Commodore 64 and then Commodore Amiga that were silent machines, this was driving me crazy.
So 18 y/o me managed to source some proper fans out of Japan (Panaflo fans IIRC) and I went bug my neighbor, who was studying to become a chip engineer...
I came to my neighbor with an idea: "Why not lower the fan speed when the PC ain't too warm and then only speed it up when the PC gets too warm, you know, like a car's fan adapts to temperature?" (cars would do that: they'd start spinning a huge fan to cool down the water in the car's radiator, but only once the water would be too warm).
And so my neighbor drew a little electronical circuit and we bought "thermistors": I would "calibrate" them with boiling water in my mom's kitchen and then we'd install the circuit with the thermistor in the PC's PSU, with Panaflo fans.
So basically: back in the 386 and then 486 days, I already had quiet PCs. I'd "muffle" my HDD in an enclosure, opened on top (so that heat could dissipate, on which I'd put a 7V panaflo fan [I'd take the 12V and the 5V and create 7V]).
Once the PC world began to wake up and the likes of Be Quiet! and Noctua became a real thing, I was delighted. My current main rig has a Be Quiet! PSU and a Noctua fan for the CPU. I cannot thank such companies enough.
P.S: for what it's worth my neighbor later on moved to southern California and became an early Broadcom employee and he's been much more successful than me for he was the real smart cookie. We're still friends to this day.
I moved part of my wealth to a private bank, on an account requiring several signatures (from different persons) plus a vetting from the banker for every single outgoing transfer. Not only are several manual signatures required, in addition to that the banker must call me before authorizing any transfer, even if it's only, say, 1 000 EUR (now it's not a retail bank and that's kinda the whole point: transfers are rare and when one is done, no matter the amount, a shitload of verification do happen).
In addition to that, I told my banker that should anything out of the ordinary happen (say an order to suddenly wire 100 K to Dubai or Erithrea or something), then he should go out of his way to make me come in person to the bank to confirm the transfer.
You must train your banker: you must demo him voice impersonation on the phone. You have to make him become totally paranoid too.
I'm not going to say he's my buddy, but he knows I know my shit and we regularly talk for 20 minutes on the phone.
Any transfer to a new bank account: long discussion explaining what that account is and why I'm moving money there.
I've also got digital files (say administrative stuff, stuff from notaries, etc.), encrypted, that I myself cannot easily access. For to access them I must physically go to my safe at a bank first. And trying to impersonate me physically at the bank to steal my stuff means: "on your way out, you risk being locked in the secure airlock and then spend years behind bars".
> Makes me want to have like 5 separate computers:
I have a setup not totally unlike that. For example one phone with one additional app: the country's official "electronic ID" thinggy. And I don't browse from that phone.
I've got several computers and there's definitely my "trash computer", complete with bogus email accounts and crappy apps, etc.
> How else can you stay safe against a threat that exfiltrates your entire digital life in like 10 seconds?
The first thing is recognizing there's an issue if someone hacking your unique email then can steal everything you have. Many people stop there: they think, as in the XKCD, "it's game over anyway if someone gets my email, so I may as well not worry about it".
That is the mentality of losers.
You're already well ahead of the crowd by recognizing there's a problem and by thinking about solutions.
Many things can be done to lower the risk of a full compromise. I've got two physical LANs and the absolute most sensitive stuff (e.g. my banking apps) are done from a computer that does nothing but email + bank.
So it's not just a separate computer: separate computer on a separate physical LAN (not a VLAN). And there a tiny Pi doing the bridging between the two LANs. And of course it's got a serious firewall (a lost art, but it could make a comeback with the help of LLMs).
Something else that can help is stuff like Google Workspace and keeping the credentials for the admin account very secure and hardly ever logging into it. That way if "[email protected]" gets compromised, there's still "[email protected]" that can help get back control of [email protected].
> - one for development only
I've got a user account for dev only.
> - one for gaming only
A dedicated computer for gaming yes.
> - one for socials only
Besides HN, I don't need those.
It's a wild world out there.
The hacks won't stop coming and you're not anywhere near paranoid enough.
They don't really need to leave the EU: even though bureaucracy and the numbers of laws/rules/regulations is insane, the absolute dumbest thing the EU did is that common currency.
I don't know how some people here can believe that that 25 years old, ill-conceived, currency that the Euro is could replace the dollar. The second biggest economy of the Eurozone is France and France is doing really terribly badly. Zero growth, insane public deficit, it's car industry got destroyed by China, public debt through the roof and impossible to service...
And yet some ideologues here explain the euro is going to replace the dollar: facepalm.
He's saying what we all know: Anthropic has no moat, OpenAI has no moat (and btw how'd that work? "AnthrOpenAIpic has a moat but nobody else does"? So it's some kind of a dualmoatopoly?).
We all saw the benchs for Google's latest models: they're beating AnthrOpenAIpic on basically every single bench.
Some of us are working with chinese models and they're now 6 months behind anymore.
So he's saying: no moat, attempt at regulatory capture to block chinese open-weight models, it doesn't mean the whole market is going to crash hard (btw a big part of the market --and already before yesterday-- had already crashed quite hard, which you don't notice if you're only in indexes for a few companies have pulled everybody up).
To this sounds... Reasonable?
What is he saying that's controversial here? When you see Google's Argon 4, are you really convinced Anthropic has a moat and an IPO valuation at 5% of the entire US GDP that's justified and that there's a possibility it'll 10x to 50% of the GDP?
Does anyone here really think Anthropic can do the kind of multiplier on its IPO that we saw with Amazon, Meta, Google, etc.?
Is it really that controversial to say that, for an IPO, Anthropic is overvalued?
Here's my bet: in a year Micron (ticker MU) went 10x in value in a year. 24x in value since after the 2022 tech flash crash. My bet is that Anthropic (ticker ANT) won't 10x in a year. And won't 24x in 4 years.
That's precisely why something like signed distributions packages are way more secure than curl bash'ing.
But many simply don't understand that. We had plenty of forged Web certificates likely. And even without that, with curl bash'ing anything sensitive you have to cross fingers that the server ain't serving one in 10 000 request with a backdoored version.
With curl bash'ing everybody is trusting every single time that the server ain't compromised or intentionally malicious.
At this point I've lost any hope: people simply don't understand security.
And as long as we'll have people saying that curl bash'ing is just as safe as signed distros packages, we'll have daily posts about major security incidents.
Security is a mindset and most people simply don't have it.
It is a reality however. Just as humans were doing human sacrifices by torturing little kids for as long as possible before killing them.
We have to keep that in mind to shield ourselves from those explaining that "all cultures are equal", "it's all relative", "it depends on your point of view", "all humans are beautiful snowflakes", etc.
Just as a reminder: Israel killed 50 000 people in Gaza... In response to people killing 1200 civilians and bringing hundreds back to their country as hostages, while the entire country was acclaiming the murderers and celebrating their deeds (killing mostly young people who were dancing at a music festival, enjoying life).
In January of this year the iranian regime sent its islamist guards to kill 30 000 peaceful, unarmed, protestors and publicly hung athletes who spoke against the islamic regime.
This is the world we live in and this is what we're up against.
I'd rather see the truth than become soft.
One economist wrote, before the first Euro even circulated: "The euro will lead to too many public servants in France, too many industries in Germany, too many vacation houses in Spain [1], the default of Spain on its public debt and then the default of Greece on its public debt".
When Greece, not Spain, defaulted on its public debt, that same economist: "I was only wrong about the order of defaults of Greece and Spain".
The Euro, he predicted, would be one of the shortest lived currency in the history of currencies.
His name is Charles Gave and he's gotta be 80 y/o old now. Of course people are going to hate on him and spill all their hatred on him because he's neither a communism nor a socialist.
And then idiots are going to say that "euro is great because I can travel and pay in the same currency everywhere". As if they're own little convenience warranted the disaster that we're heading into because ideologues, not economists, decided to force a currency down the throat of most european citizens.
[1] btw there are many protests in Spain now because "costs of rents are too high" (yeah, no shit: there's a gigantic number of empty houses and apartment in Spain belonging to foreigners, who only come a few weeks per year).
I kept posting about it here over the years but at officially 57% of the GDP being public spending (and the actual percentage is bigger than that because a great many of the "private" companies that are monopolies are basically owned by state apparatchiks), France is already a planned economy.
And there's only one outcome for planned economies and its misery.
And when socialists succeed in establishing misery, they've guaranteed themselves an endless stream of voters. And they can only drive the country more into the ground. So more misery. So more socialism. So more planned economy.
France "offered" fiber optic to the entire country (at taxpayers' expense) and now that people have big Internet pipes, they're going to implement Bill Gates' old dream [1]: tax every single packet of information.
What's up with France is socialism. That's what up with France.
[1] in a leaked memo when the Internet began to take off, Bill Gates explained he wanted to tax every single network packet (for those who remember).
Any withdrawal should only ever be authorized from wallets protected by multisig and every withdrawal should go through several machines, running different implementations of the exchanges' verification part of the codebase, replaying the user's entire deposit/trading/withdrawal history and verifying if the withdrawal the user's asking matches his balance/history.
Devs working on "verification before withdrawal" on one of the stack should be forbidden from ever touching the other stack, and vice-versa.
This would prevent SNAFUs like this one for now at least two devs would need to be independently owned before such a heist could be pulled off.
I'm not saying hacks would be impossible. But the "I still $6 bn in 20 minutes" would be much harder to pull.
Another sensible thing to do would be to not have $6 bn on a warm wallet: I really don't think Binance really that much at all times available on warm wallets?
Nothing is 100% secure: but the "one dev gets its laptop owned, hence $6 bn disappear" is just madness and, as a whole (not speaking about crypto here), we can really do better here.
For a start we can do better than thinking: "Nothing can ever be 100% secure, so there's no way to do better than seeing $6 bn vaporize in thin air when a single dev's laptop gets pwned" (I'm know it's not what you're saying: you're asking what can be done better).
So many are going to think: "But if you do that, it still can be hacked because this and that". Which ain't the point: the point is to make hacks harder to pull off, not to make them impossible to pull off.
Yeah (not talking about crypto): yubikeys (or similar) are really sweet for that. I've use them for ssh / pushing / fetching from Git etc. I use them for 2FA to various services etc.
There are also similar devices where you enter a PIN and the PIN to register to a service the first time and then the PIN to auth are different. So you can't be tricked by mistake to register to a new service when you just want to auth (you could still be tricked to register to a service which ain't the one you think while registering, but never while auth'ing).
And yup I use that with AI all the time: my agents go inside a container or inside a VM (or both), and the damage it can do is very limited.
It's also possible to do passthrough of devices (GPU, USB, ...) to VMs: good stuff.
He got tried and jailed for a long time for fraud.
Mt. Gox was just incompetence, like Binance here. But then on the other hand Binance is making so much money that to them $3.5 billion to cover the losses is just a slap on the wrist.
I don't know about that. What I know is that dictators and criminals have existed since forever and the official estimates put the part of the worldwide GDP tied to criminal activities to between 3% and 5%, which is gigantic.
I don't think Bitcoin is to be blamed for that. If we're worried about dictators and criminals, a good question to ask would be: why do those exists at all? (and that's irrelevant to Bitcoin)