rkletr

rkletr

@merkletr.ee

cryptography liker. ctf player. array languager? music enjoyer. en/frCA. SPDX-License-Identifier: 0BSD

349 followers191 following3.9K posts

would be cool if there was a common ffi interface between js runtimes and there could just be one node: polyfill that works for everyone and then people can stop all duplicating the same fucking backcompat work

the node compat is the least interesting part of a js runtime probably and yet one of the most important if you wanna actually run the js out there. surely we could be smarter about it

i dont mind deepseek distilling gpt for their models if it gets us capabilities but id really rather they not distill their harness too codex ui fucking sucks and idk why dsh had to copy it

what are people even doing that they need abliterated versions of models? i've had ds be like super enthusiastic to pwn a site i explicitly had no authorization to touch, executing attack reqs against their production (i just wanted to audit the source). and people still want less refusal than that?

"is responsible disclosure dead" no coordinated disclosure is fine actually you just have to release patches at the same time as public disclosure

i get that its an integral part of the song and you get used to it and start to enjoy it over time but also sometimes i am just not in the mood to listen to a minute of noise in the middle of an otherwise chill track

most annoying thing about LLMs might be that they seemingly don't know what an explanation is

this book constantly reiterates an idea that we don't know how to do computer security, encouraging thinking that making things safe is an unsolvable problem people who have this mindset in the industry are the ones who choose to fail to apply the engineering principles that solve security problems

rkletr@merkletr.ee

"If Anyone Builds It, Everyone Dies" makes me so fucking angry as an actual software engineer everything is just so so so wrong

you should always be operating under the mindset that computer security is a hard engineering *project*. it takes time, and effort, but you can do it. you always can. it's not a "problem" unless you outright refuse to do the work.

private follows ingestion is broken and i can't figure out why; there might not be any new posts on the feed for a little bit

"If Anyone Builds It, Everyone Dies" makes me so fucking angry as an actual software engineer everything is just so so so wrong

View full thread

"computer security experts have said that computers cannot be made truly secure" which experts? what definition of secure? which security properties are they saying can and cannot be guaranteed? which ones does your argument rely on being impossible to guarantee? are these impossibilities provable?

idk man i wouldn't include "the ai" doing a thing in the story, and say "It’s just not that hard.", when you could make software that provably doesn't allow that thing to be done

"If Anyone Builds It, Everyone Dies" makes me so fucking angry as an actual software engineer everything is just so so so wrong

View full thread

the 4th paragraph casually tells you to assume this fictional ai (that they want to convince you could exist in the real world) breaks Amdahl's law. "yeah parallel scaling laws trust me it's just like the other scaling laws" and then they start talking about a cluster... no mention of communication.

every time they ignore the model/harness/environment distinction and just say "AI" and let you guess which one they mean (or, y'know, hope you don't know!) i get angrier because they're just setting you up for the inevitable moment their argument requires you to accept the conflation

"If Anyone Builds It, Everyone Dies" makes me so fucking angry as an actual software engineer everything is just so so so wrong

in the middle of reading and... the first part, where they argue in the abstract, just philosophy, yeah okay whatever. it's a bit of a stretch and i disagree with a lot of the reasoning, but i'm willing to let it pass. then they start a "concrete" story. and oh no i'm not willing to let that pass.

i mean this isnt even particularly hard gpt is just confidently wrong about the utmost basics of typescript generic inference

rkletr reposted

Publishing “Cryptographic Right Answers” for developers is a tradition by now. Colin Percival started in 2009, Thomas Ptacek followed up in 2015, and then Latacora carried on in 2018 and 2024. I put together a list updated for the renewed urgency of migrating to post-quantum algorithms.

words.filippo.io(Post-Quantum) Cryptographic Right AnswersIn the tradition started by Colin Percival and Thomas Ptacek, a set of “Cryptographic Right Answers” updated for the accelerated post-quantum transition timeline.

turns out you can just make a sandbox better than openai's in a day it's really not that hard

View full thread

the nix modules that make it work on the guest are generated from the config so you can just scp it on from the host. or hell, have the repo on the guest and generate nix inside. it's not like having the code actually gives any power, the only thing breaking the nix side can do is remove capabilites

(i mean, the agent i deploy inside could theoretically remove the sshd but i can always just mount the fs and put it back there, or zfs rollback it or whatever)

turns out you can just make a sandbox better than openai's in a day it's really not that hard

View full thread

nothing here is particularly novel imo (barely took a day to setup) but basically firecracker vm everything through vsock (only socat on guest for tcp) mitmproxy-like gateway on host configured with a list of upstreams, each with policy; path whitelist for nix cache, only read git ops, etc.

there can't be a "oops we accidentally gave it internet access" because it's annoying as shit to give a firecracker a nic, i'd know it if i did it (and it's trivial to check) there can't be "oops artifactory has some route we didn't know about" because only the requests intended tools do go through

turns out you can just make a sandbox better than openai's in a day it's really not that hard

this doesn't have the agent yet but the intent _is_ to put a harness in it and have a persistent agent which i know is not gonna hack the planet because its only internet accesses are read-only because i actually cared to be responsible for the automated systems i deploy

i think i did underestimate the effort involved in this project but it's gonna be so cool when it works

i wish i could delegate all my programming to the machine god but the machine's capabilities are jagged and unfortunately lag behind in areas i consider critical

rkletr@merkletr.ee

this post brought to you by llms once again being terrible at software engineering in ways that to me seem egregious until i once again remember that the average software engineer actually sucks at software engineering and llms are probably above median

i don't actually wish for this to be clear. i do hope that machines can eliminate all work and lead us to post-scarcity, but until then... i have fun with writing code and it's a point of pride that i'm still better at it than the machine that's probably gonna take my job in a few years.

designing normal databases has probably been one of the more important things a cs degree taught me (in my case moreso gave me vocabulary and formal framework for what i already knew intuitively but still) if you don't intuitively get sql schemas i would highly recommend putting the effort in for it

this post brought to you by llms once again being terrible at software engineering in ways that to me seem egregious until i once again remember that the average software engineer actually sucks at software engineering and llms are probably above median

it's wild how common it is for people to think "large systems just always have vulns" it is quite hard to make software with zero bugs, but it's not impossible most large systems just have lots of vulns because people do not care enough about systems they build to actually rigorously engineer them

maybe the reason llm benchmarks mostly suck and dont represent performance is just cause the average llm user cant stop themselves from making slop how hard can it be to just actually manually go through and audit your damn benchmark tasks before releasing it to the world

Epoch AI@epochai.bsky.social

Introducing Benchmark Reviews: our new initiative to audit AI benchmarks. We are launching with 15 benchmarks: 4 Verified, 9 Flawed, and 2 with not enough information for a review.

man am i gonna have to make my own software engineering benchmark just cause you can't trust any of the mainstream ones

wish i could tell transit to always show me metro-only trips first even if they're slower. i *will* choose a slightly longer trip if it means avoiding stm buses

after raytracer (3kuymtsx53k2y, 3lm656ah3622k) i thought it would be fun to do rasterizer i don't think i'm gonna be able to fit this in 300 after adding shading, especially since some of the tricks i used to golf this wip are evil (e.g. got rid of some opts, renamed the input from teapot.obj to i)

i:(1_'i)@=`s$*'i:" "\'(97>*:')_0:`i w:640;s:w,h:480 v:@[+.''i`v;1;-:] p:0.5*s+h*(2#v)*\:q:1%1-0.2*v@2 f:((.*"/"\)''i`f)-1 d:{-/x*|y} (a;b;c):++'p[;f] D:1%d[b-a]c-a "o.ppm"1:("P6\n640 480\n255\n"),,//{{`c$$[#k:&~0>&/e:(1-B+C;B:D*d[x-a]c-a;C:D*d[b-a]x-a);_255*e[;k@*>Q:+/e[;k]*+q@f@k];&3]}'(!w),\:x}'!h

wtf is there not a single _un_opinionated js formatter. why is the whole industry just copying one other formatter's defaults