News for hackers. Stuff that matters.

grey-area

Re:Nvidia – open-source auto-ontology on Tuesday November 03, 2026 @08:44AM (#50351900)
Hmm, seems their ontology didn't fix this assuming they use it themselves.
Re:Let Me Ch... on Tuesday November 03, 2026 @06:34AM (#50350707)
The votes are keeping tally, seems pretty clear, but it's only internet points, feel free to disagree with me on this writing, I don't like it.
Re:Nvidia – open-source auto-ontology on Tuesday November 03, 2026 @06:16AM (#50350559)
I don't know enough about it, would welcome a more informed opinion on that, as a user it's the biggest issue with using them long-term IMO. Perhaps it is fixable somehow, and perhaps 'cannot do that' is a bit strong, what I meant was the current iteration of LLMs cannot do that.
Re:Nvidia – open-source auto-ontology on Tuesday November 03, 2026 @04:56AM (#50350023)
Depending on how you combine imperfect systems, you can lower or increase error rates.

Well, in principle yes one system can compensate for another, in practice, errors tend to compound and combine in interesting ways, not go away, particularly in systems like this which are unpredictable and generate slightly different responses each time without human intervention. They are not reliable in the way we're used to considering and don't work well without supervision from careful humans at present.

I don't think there really is a clear distinction between these things though.

Yes your second point is an interesting one - the divisions between these things are arbitrarily imposed on the world, but we do have these distinctions for a reason, even if they are not completely objective.

I do think this is a significant problem specific to LLMs though (that I at least see when using them) - we don't have a way to constrain them in what knowledge they consider. This can be a bonus (they are good at connecting faraway bits of maths in interesting ways), but it can be a significant problem when asking for a summary of a data - confabulations and data from outside the context easily leak into the output of the LLM. That is undesirable behaviour and we have no reliable way to constrain it.

I'm not sure that this particular effort is going to help because it doesn't change or constrain the behaviour of the actual machines and the behaviour is the problem, not the data they are fed.

Yes interesting point. I think the amount of dross does make some difference - it means google has to trawl through 10,000 dross websites instead of 1000 and attempt to sift them out from quality data (which is increasingly hard because they have the appearance of quality data, they are just incorrect or confabulated).

Perhaps the more important problem for google though is that people really like a query style interface AND response to a list of links. They don't even care if it's sometimes wrong (apparently). Google have added that, but it doesn't really fit with their current design.

The entire premise of google is now under threat.

Re:Postgres 19 is late, and it's AI's fault on Tuesday November 03, 2026 @03:47AM (#50349589)
There are definitely nuances, and yes of course the prompt must make some difference, but I'm not convinced it makes as big a difference as some think, particularly a long prompt or complex setup of harnesses etc surrounding the LLM model.

To me the order of importance would be:

1. The model - if you use a terrible model you'll get bad output

2. The codebase - this definitely forms the model for what claude outputs to some extent.

3. The human operator, what they accept and reject etc.

4. Things like prompts, skills, harnesses etc. The quality of the prompt.

So I think our positions are really just a different ordering of what is important rather than fundamentally opposed.

Re Claude being a mirror, if it is it's a particularly distorting mirror which often changes things in subtle ways and is determined to make people feel smart and addicted to its output - it has been trained to do so after all. I really don't think a mirror is the best analogy, because it's too independent and seductive to be a mirror.

Re:Let Me Ch... on Tuesday November 03, 2026 @03:24AM (#50349460)
Well I think the verdict on Shakespeare is in, and it's positive. I assume you've read some, if you have you'd know that the positives outweigh any minor negatives. We still use some of his phrases today.

Of course Shakespeare made mistakes or made allusions that contemporary audiences struggle to understand, and he's not the be all and end all. Saying judgement is subjective does not mean judgement is useless or impossible. He's pretty good though and you can tell when you read him, it's gripping, human and tight.

Back to this particular text. From the start, it smells of AI:

> That morning I woke up at 6:58, two minutes before the alarm. I lay there and waited for it to ring. And it rang. We both did our jobs.

Short choppy sentences more suited to advertising than prose, ambiguity without purpose, pointless personification, melodrama and tension over the most mundane details.

It's possible this was written by a human so steeped in the language generated by LLMs they don't know what is human and real any more, but it seems much more likely it's a translation which was translated by LLM and 'improved' by taking its style suggestions, or simply generated/written by the LLM based on a much shorter prompt.

The most important thing though is not who wrote it, but the quality of the writing, and I think the verdict of most people disagrees with you.

Re:Nvidia – open-source auto-ontology on Tuesday November 03, 2026 @03:14AM (#50349384)
Fixing unreliable agents by adding more unreliable agents. It's a shame we can't do something about the tendency of LLMs to give more weight to their weights than to the data they're analysing.

I guess it all comes back to the fact that they don't have a clear division between data they have learned about the world, instructions and data under analysis.

You can ask them only to consider the 5 facts in front of them, but they won't do that, and cannot do that.

Re:Let Me Ch... on Monday November 02, 2026 @04:37PM (#50344161)
Having used Claude a fair bit, it reads like the very distinct style Claude settles on when it tries to write fiction. I mean it's hugely improved from the early attempts of LLMs to create fiction (remember the adverbs!), but it's still pretty awful.
Re:Let Me Ch... on Monday November 02, 2026 @04:18PM (#50343897)
This is terrible writing, and if you can't tell, there is something deeply wrong.
You are dreaming if you think that has been the reality for the last 20 years. Your data is all sitting on servers in Utah, either decrypted or waiting to be decrypted. You can easily be identified and tracked by your online footprint, unless you take really quite extraordinary measures.

The internet does not provide anything close to anonymity and never really has. Even a simple IP address is enough to out the majority of users, when combined with fingerprinting, metadata tracing and the use of metadata from other users, there really is no possibility of hiding your identity from a determined attacker.

I would choose the opposite option personally, and would welcome it if this site for example allowed biometric identification and used that to weight comments. While I wouldn't want to force that on anyone I do think it's going to be necessary given the rise of LLMs.

Re:WTF Ubuntu? on Monday November 02, 2026 @10:45AM (#50338415)
I think the official CTF is up here:

https://ubuntu.com/security

server: nginx/1.14.0 (Ubuntu)

Re:WTF Ubuntu? on Monday November 02, 2026 @10:14AM (#50337916)
Their main point is that Canonical do in fact charge for security updates (they charge some companies for support), and yet are not providing them.
Would it though? I suspect the answer of these stores would be different after these attacks.
Well it's what we need unfortunately, unless you want to talk to potentially malicious machines and think you're talking to a human. Identity is vitally important for us, the end users interacting with each other. Far more important than it is for nation states and companies, who have always had ways to track us and care more about us in the aggregate than as individuals.

I'm not sure I share your concern about surveillance capitalism - that ship sailed long ago - you are stored in many nation-state and corporate databases under all the aliases, phone numbers, IPs you've ever used. I sincerely doubt your opsec has always been even near good enough to evade this surveillance, it's a little late to start worrying about it now, particularly when there are other concerns.

I'd be more concerned about billionaires spending on bots impersonating humans to sway elections in my local state than a nation state snooping on forum comments and linking them with something else.

Proof of identity is badly needed in order to use the online spaces we've come to know and trust, and time is running out.

Perhaps it could just check the length of files and not crash?!? Don’t you think that’s sensible?
We can't reliably detect AI text, and they are getting better at producing plausible humanlike text (albeit still with flaws and mistakes). I do expect them to become impossible for humans to detect when the companies put effort into that (so far they've been focussed on other domains like dev or maths).

I'm afraid your dystopian future where the zone is flooded with shit and nobody can trust anything seems eminently plausible, partly because the internet was built without identity.

I think to solve this you'd have to have strong proofs of identity locked to biometric identifiers. We'll probably need that anyway for other reasons.

It's not a trivial problem. Websites like this could require webauthn tied to a hardware identifier of their choice (like a fingerprint or faceid) - I'm not sure if webauthn provides that level of detail to providers (which method was used), and how secure that attestation is. Of course that's not going to be popular but it might be the lesser of two evils.

Re:Postgres 19 is late, and it's AI's fault on Monday November 02, 2026 @02:28AM (#50334042)
I disagree that the prompt is the most important thing, I'd say other things like the model you use, a clean codebase, actually reading code and using discretion about which changes are accepted are far more important if you're using AI for work that needs to be correct. LLMs still make significant mistakes in design especially.

Harness, prompt etc etc are all peripheral IMO, though people like to think their super long prompt, custom harness and MakeNoMistakes.md skills are what contributes to their special skill with AIs, but really models are just improving .

You can just trust the AI to generate a perfect answer (and why are humans slowing it down at all if so?), but if you don't expect that yet you have to put in the work.

Re:Mathematics has changed. Let's act like it on Monday November 02, 2026 @02:19AM (#50333991)
It's not absurd if you think about the lifetime of software. It is created once and used immediately, but reread, adapted and tinkered with for decades after that if it is useful.

The number of reads is FAR greater than the number of writes for any given piece of code, and it needs to be comprehensible if it is to be extensible.

So in fact that instruction applies to all software, and I wish more people would take it seriously. It also applies in the AI era, because the AI has to understand the code too, and AI's spend more time reading code than writing it, indeed they base what they write more on what they read than humans do.

Unfortunately it's worse than the problem with email, and it's also adding to the problems of email, but making it very cheap to send infinite unique and persuasive messages.
In this new era it is almost zero effort to stand up a convincing website on any topic, which is mostly correct, but riddled with small confabulations and errors. It can take typing one sentence (even with grammatical errors) to do so, the bar is now zero for creating plausible 'content' and flooding the internet with it. As the article notes bad actors, but also people who have good intentions, are flooding the zone with slop.

If it was all clearly completely incorrect, it wouldn't be such a huge problem, but it is plausible and hard for humans to detect in a short time unless it is long form text.

Even search providers are giving us this new kind of generated result at the top of their results, which most people will be using blindly to verify answers. So it's turtles all the way down.

If you're not a domain expert you have no idea which things are right and which are wrong so it's very hard to determine the truth or trust results.

To top all that, LLMs are being trained on this new untrustworthy data without differentiating it from older data, and trained by other LLM instances in a sort of recursive loop to improve performance on very narrow goals. What could possibly go wrong!

LLMs have created a new problem. Previously it was a lot of effort to create a bad wiki with unreliable information that looked plausible. Now you can generate one with thousands of pages and correct grammar and spelling (or not if you prefer) in an instant.
Re:Binance restarts customer withdrawals after $6.3B heist on Sunday November 01, 2026 @01:53PM (#50328486)
Anyone withdrawn yet?
Re:Proton's CEO Cancels AI 'Re-Interviews' on Sunday November 01, 2026 @07:34AM (#50325027)
Thanks for that, presumably it's hard to disentangle the different services they use to process email and some may still live in the US. This isn't a big worry for me right now personally (if the US gov is your adversary they'll sweep up your emails through 5 eyes IMO, data in the EU will not save you), but I understand for some companies it's important.

Vouched, no idea why this comment was dead.

People have tried this and it failed horribly even with human help and lots of visits for the novelty value:

https://andonlabs.com/market

https://andonlabs.com/cafe

Our current version of AI (based on LLMs) is nowhere near ready to do this, in spite of the dreams sold by companies like OpenAI and Anthropic.

Just because something is hard, doesn't mean it isn't worth doing. OpenAI haven't even tried to contain their agents, instead letting them loose on the internet and telling them to collaborate. While this is interesting research, it's very much academic research at this point (though of course it will enter training data for AI agents being encouraged by OpenAI to escape their 'sandbox').

We are a long way from AI agents escaping air-gapped computers, let's worry about that when it's an actual problem and when the companies running thousands of agents are acting responsibly.

Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @04:26PM (#50319803)
Hoping fix will be out soon so we don’t have to.
Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @04:20PM (#50319739)
Thanks. Expanding exploits is something LLMs seem pretty good at so I’d expect people to manage a more general exploit soon if not already. Hopefully it’ll be patched before that happens.
Re:TCP Use-After-Free: CVE-2026-98432 / CVSS 9.8 on Saturday October 31, 2026 @04:14PM (#50319678)
Well somebody is wrong, this blog post says:

Why it's urgent: the bug sits in code every Linux server runs when it accepts an IPv4 TCP connection, before any application sees the connection.

It reads like it was LLM generated though so who knows. There is at least a simple mitigation for Golang apps if that is the only concern.

Older »