Posts by JLV 2827 publicly visible posts • joined 4 Mar 2013
In a narrower analysis of why LLMs have issues wrt malware and escaping guardrails, the Risky Biz folk were saying it comes from the fundamental sin of mixing essentially code and data: it's very hard to discern prompt-like content from purely static data content when the two can be interspersed.
Idempotency can include side-effects as well.
Using a tool like Ansible, most commands, notably those for package installation/removal are idempotent: you can run them as many times as you want, even though a package will only actually get installed once.
QUERY seems like a very good idea for complex requests. Using POST with its assumed you-are-changing-data semantics only due to GET limitations was a - minor - ick factor.
One problem not mentioned here is the weight of the big firms on stock indices. Even if you’re an AI skeptic, as a fund manager not investing means the index is being lifted without you. That was true when Apple was at $2B. More so for nVidia at $5B.
Back in 2006 or so, IIRC, Wells Fargo’s CEO got into big trouble with stockholders. Fool had been sitting out the subprime lending and underperforming! Warren Buffett too during dot com boom times (but he’s Warren Buffett so he mostly got away with it).
It’s an interesting dilemma for capitalism. How do you avoid something that’s built into its incentives?
Yeah but the indebtment level in many countries is already pretty dire. Debt servicing often approaches spending on education in magnitude.
Governments never balancing budgets even in good years is a feature of almost all Western democracies at this point. Right and left, centre and populist.
That will bite at the next crisis.
It may have had a better outcome. The dotcom cable investments lost investors money but they supported more useful traffic later.
Ditto railways.
Huge buildings full of leccy-guzzling aging single purpose computers may have less lasting benefits.
Things may be better at the power generation side of things, when not fossil. Nukes are perking up.
Like all of those, and unlike tulips, there is a kernel of enhanced tech at the core of this mania. Shorn of some irrational expectations it may become more useful over time.
Leaving us with “just” the jobs impact to deal with. And the financial whack if a full meltdown happens.
FWIW, a good local-only time tracker / task manager duo in a terminal are Time Warrior and Task Warrior. I only use Time Warrior, but it’s both super simple and quite powerful. Stopping and restarting to track your loo break is more a function of preference than it is in any effort expended in doing so. : `time-warrior stop 3min ago` and `time-warrior continue`. New project? `time-warrior start Project2028` and it will notify that’s it’s a new one in case that was just a typo on your end. These are tags so each time slice can get multiple ones.
It’s very fast, written in C and runs individual commands, not a running service. No, it’s not Linux only, just FOSS.
No affiliation, just a happy user.
What, you think it’s their real money at risk? Sweet summer child, it’s investors’ money at risk. Probably yours too if you have mutual funds or the like. Your company’s pension fund too. Your government’s pension funds for civil servants, which will get a top up fer sure if needed.
Of course, Ellison n Musk’s paper worth will go up and down. But most of their ilk will likely have salted away real, vested, monies away in humdrum businesses. Why, maybe in recession-hedging biz like repo providers :-)
Meanwhile a real unwinding of this particular tulip mania will/would hurt everyone. Bad.
Savvy PR investment? Or an Indulgence?
Don’t get me wrong, retraining and adaptations in changing tech/trade/employment circumstances matrices is key and should be a goto. But I can’t help thinking this is first and foremost a fig leaf in this instance.
Not to mention that when you think about it, if a company follows a predictable jsmith/johnsmith@foo.com pattern, jbezos@amazon.com or andyjassy@amazon.com is pretty much a known public domain email, making it all the more in need of protection.
Though I’d wager the really big corps CEOs have underlings vetting the mail anyway.
Guilty as charged on being a dev.
I think you make a very good point. Yes, you can end up in a tar pit with Access. But it also addresses a need that is not met by traditional development frameworks, especially when it comes to entering data easily via a GUI. Excel fits there too. Hypercard, in case anyone remembers it.
Those tools empower end users. What comes after can be problematic but that’s indicative that our industry still doesn’t have a good story for end user productivity. Something that would easily spin up a front end with forms, serve it up on the web securely, hook it to Postgres and then run calculations with likes of Pandas or Polars. Then simple reporting possibly to an Excel spreadsheet. Oh, and version controlled too, plain text code files.
If I had to make a guess, Access line-of-biz apps will get replaced instead by LLM generated line-of-biz slop. And that will likely bring its own problems, though again this opportunity/need would be better addressed if we found ways to robustify end user creativity.
I’ve only ever had peripheral acquaintances with Access but this sounds right, from shuddering IT folk talk about Access line-of-biz apps. It’s an early stage 80/20 tool, which can do “good things” for a clever user. It’s seductive because it looks more serious than using Excel to “do database”.
That’s the 80% part, sucking you in.
The 20% part which will do 1000% of the pain, comes later, after it graduates to becoming something the business relies on. It was never meant to be multiuser. Since it was typically hacked together by a non-programmer “on their spare time”, no one is going to believe how much time and resources it takes to convert the app to something more solid so they’ll double down on keeping it.
Agree. Serious research, convenient PR for Google.
That’s indeed a lot of (very skilled specialized) labor to generate lowish savings. One thing that causes me pause is that having 2000 near identical phones donated en masse by the vendor may not be representative of challenges with more heterogenous supplies. Another is the challenge of dealing with a cluster with components that will fail at different times but whose replacements may again differ. Not insurmountable but adds more complexity.
Still, well worth looking into. Maybe an optimal near-automated configuration method can be figured out and maybe some of the strip and reassembly work can be done in poor countries (where quite dangerous home smelting methods are used to recycle electronics). And maybe this research just crosses off this type of solution as unsuitable: a big part of engineering is figuring out what doesn’t work.
The collection part at least isn’t too inherently problematic: some manufacturers have trade ins when you buy a new one.
> Google, who wrote the Android code on them
Regardless of support considerations Android wouldn’t be a good fit for compute clusters. A good deal of a mobile OS is designed to support sensors, IO and a UI screen.
Things that aren’t needed here. Plain old Linux is better.
It’d be the same for iOS though Apple has instead talked up having robots that can strip an iPhone apart for materials recycling.
At least from a Python mindset using a library to strip out spaces is a good idea. The reason is that many Python operations are shunted off to C-based backends that are much, much faster than doing it in raw Python. Writing lots of low-level Python to do simple things is a bit of a noob giveaway.
The difference however is also that Python’s standard library, unlike JS, has long included extensive convenience functions on strings and does not rely on a random dude in Nebraska Turkey.
It's even slightly worse than that. If you are inclined, you can ask NoScript to route you to a vetting provider like virus total, wmtips or google safe browsing to check out the domain serving a particular JS.
So you can make up your mind on trusting or not doubleclick.net, stripe.com, sttripe.com or warezstealers.ru.
But what do you do when one of the 20 JS providers is some random x8l234xxx@cloudfront.net, as is becoming more common?
Fair enough but his YouTube channel has some good contents. He’s got the time, money (for experimental hardware) and expertise and is not adverse to getting his hands dirty and putting up numbers.
And he covers some esoteric subjects well to boot. Recently he had a whole 20-25 minutes on IBM mainframe hardware, complete with factory floor tour footage. I personally would have liked to know more about the OS side and the modern MVS/Linux and hypervisor mix-and-matching, but it was still solid.
No showman influencering a la Primagen.
I am surprised at so much anti-Brew sentiment here. Anyone care to explain?
Honest question. Not defending Brew, my goto is MacPorts.
The reason I am asking is that Brew-love is pervasive on macs. Go to github and, 90% of the time, you’ll only see `brew install` as instructions. Nothing about `ports`. Devs typically only talk if brew as well. I’ve learned to just auto translate brew -> ports mentally myself.
Hence my surprise and question. Why is this community more skeptical?
Is there such a thing as ports-on-Linux though? I was surprised enough to find Brew on it.
I was half thinking of trying Nix as a package manager but an install of its package manager - not as a full distro via NixOS - left me scratching my head. It seemed to perform some major surgery on my system installing itself and didn’t seem to work at the end. I didn’t spend much time on it but was not impressed. Especially not when there seemed no obvious way to remove it afterwards.
You can use both at the same time. They each have their little slot in $PATH. Of course, you may have some duplication in dependencies, but in practice it works out well enough. I am 90% MacPorts, 10% Homebrew. What might be helping me is that I typically only have very specific, standalone, utilities in brew.
Anyone have any details they care to share on their experience using Homebrew on Linux? I use MacPorts for the most part and Homebrew only for things I can't find there.
But on Linux - Ubuntu - I find it very difficult to understand how we are supposed to get the latest and greatest of application packages. Say for example Postgres. On an LTS, you could be year behind in what Postgres version you can get without using a PPA. But using multiple PPAs, besides being a pain, seems like exactly the kind of thing to avoid in these days of ever-increasing supply chain attacks.
So, a curated gatekeeper like Homebrew sounds good, if it had the same outcomes as on MacOS, where you can track recent versions of Postgres, while being on an older OS release.
In your experience, how well does Homebrew work out, in practice, on Ubuntu based distros?
p.s. if anyone has better pointers to tracking recent releases of quick moving applications like postgres or python yearly releases on Linux without upgrading the OS to new versions, just tracking security patches, please share !
This seems to make 3 assumptions:
First that Safari is the greatest rendering engine in terms of safety, better than anything else that could be deployed on iOS. What makes anyone think so, other than MS acting as an anti-expert of sorts here? I happen to think glitches and JS and CSS standards non-compliance are an indicator of browser immaturity, unless those bits of the standards themselves are security-risky.
Second that I would use Edge. Or Chrome. Most certainly not. Firefox with its own rendering backend is what I’d prefer. Once it had proven robust - see next point.
Third, that I would not privilege safety. I would, but I’d much rather base my choices in that regard on industry experts’ say-so (hint: not MS) than a blanket fiat Apple nyet that ensures they don’t really have competition to challenge them.
Last, iOS itself is pretty robust safety wise. Any _actual_, _demonstrated_, risk to the OS itself should indeed result in a browser’s ban.
Well, I can say that, in the past at least, Safari was notoriously bad at following standards. For example, it was years behind in implementing http verbs other than `GET` and `POST`: `PUT`, as an example. I get the sense that some web devs see it as backward when it comes to JS and CSS features as well.
Also, while speed to load content is one thing, battery use is another. Browsing on iOS seems to guzzle batteries far beyond other activities like YouTube.
I can certainly see the risk in a half-baked browser engine being exploited, but methink Apple doth protest too much on our behalf.
> PEP politics and process
Well, PEPs can be fairly anal at several levels. First goal is to keep the syntax clean. There was for example a big old discussion of how to represent C’s ternary operator. Everyone agreed on the idea itself but there was split between “use the C syntax” and “make it more obvious”. The pattern-matching match statement, more or less lifted from Rust, took a long time to gel.
On the tech side, the GIL-ectomy proposal, to remove the Global Interpreter Lock (which holds back thread concurrency) was long in gestation. The concern was: don’t break existing code, including on code that relies on C modules. And don’t screw single thread speed or blow up mem use to enable multithreading.
These things take a long time to get right. Git branching and merging may not be as helpful as you think if the JIT code is embedded finely in critical, and changing, blocks of the main execution engine. Which, IIRC, is “just” a big ol’ C case looking at all the incoming Python operators.
This is mentioned in the article:
> Asked whether development could continue in a fork, Shannon said it was not easy due to the way optimizations are generated, leading to very large code differences that are hard to manage.
Past forays into big structural code changes have been very carefully weighted, and planned, after the execution teams had done lots of initial prrof-of-concept work.
And if you feel you need to diss “waterfall” i.e. planning in this case, I guess that means you’d want “agile”, hmmm?
Totally agree. The language still gets a bit of flak for the breaking changes that came with Python 3 and that was with a robust migration path.
Having a deeply-embedded JIT somehow repeatedly crap in the nest under edge conditions would not to be good at all. Performance enhancement is seeing a number of somewhat-independent initiatives in Python now, and in the past few releases, so that’s not an entirely outlandish possibility.
But note that the article also warns that this JIT initiative could wither if it has to wait for 3.16+.
Yeah so take “mordant wit” a la Pratchett, add a good dash of malice a la Gibson and strip away Banks-style innate benignity, and, especially infallibility. Give it a good shake.
Wanna bet your soul the result will work out for you?
So, should I understand that, in a powershell shell, those coreutils commands will just output a stream of text? No more, no less? With all the limitations, and advantages, of that format?
(After some quick use, I could easily see the advantages of Powershell for configuring systems due to its precise typing/object orientation, if you're wearing a sysadmin. For casual developer scripts and workflows on the other hand, this seems, to me, is an unwanted complication).
adding weird pointless small requirements in public sector often happened from mid level managers or biz analysts, from what I saw:
- higher ups don’t really know or care, as long as the buzzwords are ticked off
- the worker bees are rarely asked anything in depth. If the preceding system isn’t too catastrophic, they’ll say “more of the same”. Generally, they’re like mushrooms and programmers: keep them in the dark and feed them shit. Mostly they want it to just work and minimize change. Many projects flounder because the mgrs and techs are all circle jerking and don’t involve them.
- mid level managers and biz analysts however see it as a unique chance to prove their importance. Out-of-the-box application behaviour always needs “customizing”. Sometimes radical surgery that breaks the app because of some nitwit idea that the sales guy agreed could be done.
… will go away once it’s properly priced.
Less AI slop content. Less malware. Less vibe coding BS. Less Doctor Jesuses (I wish). Less AI tai chi ads (I wish). Less layoffs when folks consider the alternative of getting a $500M bill :-(
What’s uncertain is whether there’ll be a hard landing for investors as people realize just how expensive it is.
I suspect many will look into running models locally via Ollama or the like, putting more pressure on hopes for golden geese.
Pretty Orwellian all around. Think about it: when your group does it, good speech. When your opponents do it: bad speech.
Next election, Americans really need to put the kibosh on the minority of citizens who believe Kings, Doctor Jesuses, censorship and taxpayer-funded accolades to felons are acceptable interpretations of their own constitution.
It's not just that Democrats need to win in November and in 2028. Longer term, the Republican party need to get its soul back (including on budget deficits!). It's unhealthy to have one party rule because the opposition can't be trusted to run a dogpound competently.
We rely on external libraries to do stuff nowadays. So might as well secure dependencies. Will this work? Won’t speculate, further than some smart folk are trying to lock a door other clevers are doing their best to force. Worth trying to fix however.
If you disapprove so much of 3rd party dependencies, let’s see you trying to roll out your own crypto ;-)
