Retr0id

23 ms·

691.
by Retr0id 5mo ago
There are lots of ways to get root on a typical Linux developer workstation, the point is that agents shouldn't be using any of them unprompted.
692.
by Retr0id 5mo ago
I wrote about this exact thing as a hypothetical a few months back: https://www.da.vidbuchanan.co.uk/blog/agent-perms.html
693.
by Retr0id 5mo ago
The stronger signal is the grammatical structure, not the specific glyph used.
694.
by Retr0id 5mo ago
My point is I don't consider em dash vs hyphen to be a strong signal either way, humans and bots alike use both interchangeably.
695.
by Retr0id 5mo ago
A lot of the LLM bots on HN (and elsewhere) will find-and-replace their em dashes with hypens in an attempt to evade detection.
696.
by Retr0id 5mo ago
For calibration purposes, I offer you a pre-LLM README I wrote that includes an em-dash* followed by "No X, No Y, No Z": https://github.com/DavidBuchanan314/stelf-loader *actually a hyphen but it's funct
697.
by Retr0id 5mo ago
> RLVR is weirder, and I suspect it's why we see "It's not X, it's Y" so often. This feels like an easy enough hypothesis to verify, for anyone in the business of training LLMs - does the not-X-but-Y rate increas
698.
by Retr0id 5mo ago
I think you'd still be better off training in greyscale and dithering after the fact.
699.
by Retr0id 5mo ago
oops MCL_ONFAULT kinda does the opposite of what I wanted - I think if you omit that you can skip the madvise, and mlockall will populate everything for you.
700.
by Retr0id 5mo ago
Statically allocated memory can still OOM on access, due to overcommit and lazy page table population. What you really want is mlockall(2) (probably with MCL_CURRENT|MCL_ONFAULT followed by madvise with MADV_POPULATE_*)
701.
by Retr0id 5mo ago
The only kind of ad I don't find objectionable is the kind where someone makes a genuine recommendation, with no money changing hands. Or if money did happen to change hands, the same recommendation would've been made without it.
702.
by Retr0id 5mo ago
I did the same. Something that helped me get my head around it was realising that NTT is mostly a performance optimization, a bit like montgomery form in RSA. You can conceptually implement ML-KEM without it, it'll just be slower (it a
703.
by Retr0id 5mo ago
"will we have a CRQC soon " is the subject of much debate but "will we have a CRQC ever " is pretty uncontroversially a possibility, and so it is worth defending against harvest-now-decrypt-later attacks in the present
704.
by Retr0id 5mo ago
daviid - or trim to davii and pronounce it "davey". But tbh I quite like dav2d.
705.
by Retr0id 5mo ago
Lattice-based cryptography exists in the present (Both Chrome and Firefox support X25519MLKEM768 hybrid key agreement, by default)
706.
by Retr0id 5mo ago
In those situations you wouldn't have ads on the human version of the site either, surely?
707.
by Retr0id 5mo ago
So why serve them at all?
708.
by Retr0id 5mo ago
Or indeed an illegal LLM prompt: "/goal locate and patch out the licensing check"
709.
by Retr0id 5mo ago
Unless you snapshot a VM and run clones of it.
710.
by Retr0id 5mo ago
That would be nice, but the emergent properties of LLMs defy any kind of first-principles reasoning if you ask me.
711.
by Retr0id 5mo ago
Do you use Firefox? I have a theory that there's some kind of Firefox-aarch64-linux-specific memory leak but I haven't been able to track it down. I have a 16GB x86-64 Thinkpad and I rarely get OOM issues, whereas my 32GB M1 MBP r
712.
by Retr0id 5mo ago
Why is it unfair to compare two different CPU architectures?
713.
by Retr0id 5mo ago
I'm asking about TPM attestation in general, not Bitlocker
714.
by Retr0id 5mo ago
Something I've never understood about TPM attestation, is what happens if you plug the TPM into a microcontroller and give it all the same measurements that it would normally receive during a normal boot? Would that let you spoof attes
715.
by Retr0id 5mo ago
Forgot to switch accounts?
716.
by Retr0id 5mo ago
well, they did say "up to" 8
717.
by Retr0id 5mo ago
Newer devices support Remote Key Provisioning (RKP), so you still can't export keys but you can im port them. (Physical attacks are still possible, just very difficult)
718.
by Retr0id 5mo ago
The github OP reports that browser-based login still works, so it'll likely be circumventable.
719.
by Retr0id 5mo ago
> Or using a phone as a credit card payment terminal without the possibility of displaying one payment amount on screen and authorising for a different amount. It only attests that the device booted normally (locked bootloader, factory f
720.
by Retr0id 5mo ago
fwiw this is a correct definition of Remote Attestation, matching what is mentioned in the github thread, but Client Assertion is something mostly unrelated (an OAuth implementation detail)

More ›