• 0 Posts
  • 72 Comments
Joined 2 years ago
cake
Cake day: July 9th, 2023

help-circle

  • Could you let me know what sort of models you’re using? Everything I’ve tried has basically been so bad it was quicker and more reliable to to the job myself. Most of the models can barely write boilerplate code accurately and securely, let alone anything even moderately complex.

    I’ve tried to get them to analyse code too, and that’s hit and miss at best, even with small programs. I’d have no faith at all that they could handle anything larger; the answers they give would be confident and wrong, which is easy to spot with something small, but much harder to catch with a large, multi process system spread over a network. It’s hard enough for humans, who have actual context, understanding and domain knowledge, to do it well, and I’ve, personally, not seen any evidence that an LLM (which is what I’m assuming you’re referring to) could do anywhere near as well. I don’t doubt that they flag some issues, but without a comprehensive, human, review of the system architecture, implementation and code, you can’t be sure what they’ve missed, and if you’re going to do that anyway, you’ve done the job yourself!

    Having said that, I’ve no doubt that things will improve, programming languages have well defined syntaxes and so they should be some of the easiest types of text for an LLM to parse and build a context from. If that can be combined with enough domain knowledge, a description of the deployment environment and a model that’s actually trained for and tuned for code analysis and security auditing, it might be possible to get similar results to humans.


  • I’m unlikely to do a full code audit, unless something about it doesn’t pass the ‘sniff test’. I will often go over the main code flows, the issue tracker, mailing lists and comments, positive or negative, from users on other forums.

    I mean, if you’re not doing that, what are you doing, just installing it and using it??!? Where’s the fun in that? (I mean this at least semi seriously, you learn a lot about the software you’re running if you put in some effort to learn about it)


  • ‘AI’ as we currently know it, is terrible at this sort of task. It’s not capable of understanding the flow of the code in any meaningful way, and tends to raise entirely spurious issues (see the problems the curl author has with being overwhealmed for example). It also wont spot actually malicious code that’s been included with any sort of care, nor would it find intentional behaviour that would be harmful or counterproductive in the particular scenario you want to use the program.




  • A closed group of users can all have a seed ratio above 1.0, but it’s a bit of a contrived set up. For simplicity, in the following examples we assume that each file is the same size, but this also works for other combinations.

    Consider the smallest group, two users. If user A seeds a file and user B downloads it, whilst B seeds a different file, which A downloads, both users will have a ratio of 1.0 as they’ve up and down loaded the same amount.

    For three users, A seeds a file, B and C then download a different half each, which they then share with each other. A has a total (upload, download) of (1,0), whilst B and C have (0.5,1). If you repeat this with B seeding and A and C downloading, then C seeding to A and B, you get each peer uploading 2 files worth of data, and downloading 2 files worth, for a ratio of 1.0 each.

    You can keep adding peers and keep the ratios balanced, so it is possible for all the users on a private tracker to have a 1.0 ratio, but it’s very unlikely to work out like that in real life, which is why you have other ways to boost your ratio.





  • It sucks that we need such an extensive amount of work put in to make devices private

    The issue is that, short of the extremes suggested in places like privacyguides, you’re not really making the device private. You could argue that you’re making it more private, but the counter-argument is that you’re still leaking so much data that you haven’t significantly improved your situation.

    Doing something probably is better than doing nothing, but it’s not going to satisfy those who seek actual privacy. If you’ve got a particular leak that you’re worried about it’s definitely worth looking to address it though.







  • notabot@lemm.eetolinuxmemes@lemmy.worldSnap bad
    link
    fedilink
    arrow-up
    3
    arrow-down
    1
    ·
    2 months ago

    I couldn’t agree more. Occasionally I’ll use an appimage where something is not packaged for my distro version and I only need it temporarily.

    Maybe I’m just long in the tooth, but linux used to be a simple, quite elegant system, with different distros providing different focuses, whether they were trying to be windows clones, something that a business could bank on being there in ten years, or something for those who like to tinker. The common theme throughout was ‘the unix way’, each individual tool was simple, did one job, and did it well. Now we seem to be moving to a much more homogenous ecosystem of distros with tooling that tries to be everything all at once, and often, not very well.




  • The trouble is, you have to account for transport costs that way. Either to bring it to them, or them to it. A Redundant Array of Inexpensive Decapitators (or RAID array) gives you higher throughput, better resilience to component failures and can lower your total costs versus building a single entity that is robust enough to be as reliable.

    I am, of course joking. Unfortunately, just eliminating billionaires, cathartic though it might be, wouldn’t actually solve any problems as it doesn’t meaningfully redistribute that wealth, or stop someone else accumulating in the same way, only with better personal security. It’s going to take changing the system at a much deeper, more fundamental, level than that. At the point it becomes actively undesirable to the individual to accumulate that much wealth, and I don’t think mere threats to their physical safety will do that, you’ve effectively decapitated capitalism.