mastodon 4.7.3
RE: @andrewnez@mastodon.social
Everyone involved with open source needs to read this. It's a deep, on-point analysis of the methodological and data source gaps in security, health, etc. evaluation of open source projects/tools.
There might not be anything most can do about it, but everyone should be aware of what they're seeing ... and, more importantly, *not* seeing ... when they look at these sorts of stats/metrics/rankings.
RE: @yossarian@infosec.exchange
I never knew how much I should have been appreciating the comparative simplicity of Python on this until I was faced with the 'npm ls' and 'npm why' output from a substantial project for the first time. 😵💫
A feature I'd like to see on LLM chat bots is toggles for color coding the text output based on underlying per-token inference metrics.
A heatmap of prediction confidence.
The weighting of RAG sources vs pretrain data vs raw speculative generation.
A metric of extent of extrapolation vs interpolation from pretrain/RAG corpus.
I bet only the first is actually technically feasible, though, and even so probably would just make the things burn money even faster...
RE: @distrowatch@mastodon.social
Oh, man. After all the thought and decisions I've put into my PyPI and NPM security over the last few months, just the past week or two I started wondering about vulns in Linux distro packaging systems. (Dockerhub images, too.)
Another paranoia proved justified. ☹️
Has anyone else had ChatGPT referencing malicious, forged, or other bad-actor web sources in its outputs recently?
Yesterday it answered a @pydantic@fosstodon.org question with a link to the genuine Pydantic docs sitting right next to a link to a copycat forgery of the Pydantic docs at pydantic[dot]com[dot]cn. The "ads" splashed everywhere really confused me, until I looked at the address bar and realized what had happened.
More good dev and maintainer security advice from Docker:
Might be interested in this, @pythonbytes@fosstodon.org - I'm interested in hearing about as many folks' approach to this as I can.
RE: @ancoghlan@mastodon.social
I wonder if this is behind the spate of reports of AI PRs deleting CI config to make the pipelines pass.
@jscalzi@threads.net I wonder where they got the notion from ... https://www.theguardian.com/world/2026/jun/12/china-spy-turtles-spy-fish-monitor-waters-claims
