David Chisnall (*Now with 50% more sarcasm!*)

One of our SaaS providers sent out a marketing email to all of their customers about new AI features. I replied saying that we used them as a secure solution and integrating things that add no value for our use case but add significant attack surface undermines our trust in their product and will cause us to consider alternatives. It turns out that the reply-to header was the CEO’s email address and I initially got an out-of-office auto responder then a worried reply saying that of course the AI nonsense that they’d been talking about would be opt in and would not be given access to anything without explicit consent. But now their CEO has one data point that jumping on the bandwagon will lose sales. I’d recommend doing the same for any such marketing emails you get. The replies may go to /dev/null, but normally they have a ‘contact sales’ link. The more replies they get saying that incorporating ‘AI’ features undermines your trust in their product and makes you less likely to buy even the non-‘AI’ versions, the more they’ll consider these things high risk to ship.

@EUCommission@ec.social-network.europa.eu The Digital Markets Act is a nice idea but it's ignoring how these platforms became so powerful. The problem is that other big entities use them as their sole (or primary) means of communication. How about defining a set of rules that apply to: All governmentsAll companies over a certain EU turnover.All companies providing essential services (e.g. banking, utilities). Where the rules are, by the end of 2027: They may not require customers to create an account or share data with a third party to communicate with them.If they distribute an application for any platform, they must do so via two independent channels.Applications must not depend on anything other than the core platform. Where 'independent' means: does not depend on any approvals from the same vendor. This would mean that no big organisation in these places would be able to ship apps via the Apple App Store. None of them would be able to ship Android apps that depended on Google Play Services and none of them would be able to ship Android apps at all with Google's proposed lock down mechanism. And then, suddenly, you have compliance departments in a bunch of companies with deep pockets lobbying Google and Apple to provide an alternative mechanism for distribution. Note: These are exactly the same as the rules I proposed 20 years ago. If they had been enacted back then, I suspect the DMA would not have been necessary.

RE: https://universeodon.com/@georgetakei/117363062318327919 The america.gov thing is an embarrassment but the middle of the rant about US government web sites being worse than the private sector reminded me of how much I appreciate the gov.uk infrastructure. It’s designed to work well with low-bandwidth devices. It works well on large and small screens. It runs in ancient browsers. It has a consistent interface. The buttons are big and clear. It doesn’t use colour contrast that’s problematic for colour-blind users. It works well with accessibility tools. It has its own extended markdown variant that captures semantic markup for common things so that they can be usefully exposed structurally to other tools. Private-sector web sites could learn a lot from it.

I am trying a new thing: Only boosting posts that make me happy or have something actionable for readers. It's good to be informed about depressing issues, it's not good to be constantly bombarded with things about them. Not posting about things that annoy me unless I have an actionable proposal for how to improve them. Grumbling can be cathartic but is not especially helpful. I don't promise I'll be good at this, but I'm going to try!

Ah, apparently it is the time of the year when we identify and honour the best self publicists among hundreds of people who contributed to scientific discoveries.

I have a lot of sympathy with the lawyer charged with contempt in this story. He used an LLM to summarise a proceedings and it made up nonsense. Most of us know that this is a risk, but I routinely talk to people who think an ‘AI summary’ of a document is going to be a distillation of information in the information in the source text, rather than some statistically probable sequence of words that would follow a request to summarise the source text. And that’s entirely because that’s precisely how these things are advertised.

@troberts@theblower.au @luciedigitalni@aus.social There's no good path for them. They have two costs: training and inference. Training corresponds to capital expenditure (capex): you do it once and then try to amortise it across uses. Inference corresponds to operational expenditure (opex), which you pay each time. This leads to a 2x2 matrix of possibilities with each of them either going down or staying high (I'm going to treat 'getting more expensive' as is happening with the capex as equivalent to 'staying infeasibly high'). Note: Oversimplifications follow: Typically, successful growth businesses are ones with high capex (makes it hard for new companies to enter the market) and low opex (means that the bigger they are, the more profit they get). Boutique businesses are the other way around: they have high opex and customers who are willing to pay a premium. Commodity businesses are low capex and low opex: margins tend to low, it's easy for new competitors to enter the market and this pushes the margins lower. Almost no successful businesses have both high opex and capex and that's where current LLM vendors are. So let's look at those options. Capex stays high, opex gets low. This is probably the best outcome. Growing the number of customers lets you amortise the capex and so there's a path to profitability. Unfortunately, this also means running inference over cheaper Chinese models will be cheaper and so you need to have models that can do something that the cheaper ones can't do. Your moat is largely gone. Fine for LLMs in general, bad for OpenAI and Anthropic (and anyone else who wants to recoup their ludicrous investment). Note that recent gains in utility have come from doing a lot more work during inference, so this is quite unlikely. Capex stays high, opex stays high. This is basically the status quo. Each new customer loses you more money. If you put up your prices, you lose customers and so the capex dominates. If you lower prices, opex dominates. No win. Capex gets low, opex gets low. In this case, offering LLM services is easy to make profitable but now you're a commodity market. Existing vendors have no moat. New models get trained cheaply. LLMs survive as a technology but anyone with large sunk costs is in a bad place because they can't compete with new vendors. Capex gets low, opex stays high. This one is a bit weird. You have low fixed costs to amortise but you are losing money on each customer. Adding more customers makes you less profitable, so the only path is to put prices up. This may lead to profitability, but also a smaller market. If you're selling investors a story that you're a growth company, this doesn't work: your current customer base is an upper bound on your future number of customers, because you're going to lose some when you put prices up.

I'm increasingly of the opinion that the right time to try to sue LLM vendors for copyright infringement is after the bubble starts to burst. At the moment, politicians buy the line that these machines will magically cause massive economic growth (and, because politicians think the stock market reflects the economy, they even see some evidence of this). That means that they're seeing it as a choice between protecting existing industries and protecting a new major source of growth. Even ignoring the massive bribes that the industry is paying, that's a difficult choice. Big economic growth often comes with killing off existing industries, so they're weighing known slow growth (or decline) against the promise of big growth. Lawsuits now are very high risk. If the LLM vendor wins, they establish precedent. If they lose, they encourage special-case laws. It's far better strategy to sue them after the bubble starts to collapse. Given the choice between an industry that employs a load of people and one that's causing the economy to implode, politicians have a much simpler choice. Of course, this means you won't be able to get a cut of the VC bubble money. But I expect Meta, Alphabet and Microsoft to all survive the bubble bursting in some form, so there will still be a few companies with deep pockets as good targets.

Periodically I try LLMs to see if they actually are useful for programming. This week I was writing an AsciiDoctor plugin. I’m not particularly familiar with Ruby (I struggle to imagine the mindset that believes Smalltalk, or, indeed, any language, can be improved by adding Perl syntax) and I find the internals of AsciiDoctor to be very poorly documented and hard to follow. So this seemed like a great task for LLM assistance: I know the problem domain very well (I’ve written other document processing tools) but not the details of the codebase I’m working on. GPT-5.6 repeatedly sent me down misleading paths and wasted time, and gave suggestions that looked right but were completely wrong. It kept going back to the same thing that would cause a later phase to infinite loop. It eventually gave me a solution that was so convoluted that I couldn’t believe AsciiDoctor wouldn’t have a better way of doing it (I didn’t try it: if that was the only way of making it work I’d rather ditch AsciiDoctor than apply it, so I have no idea if it actually worked). I actually solved the problem by finding a bug report from someone trying to solve a similar problem, which linked to their eventual solution. Reading that, I was able to find the missing conceptual bit in my understanding of how AsciiDoctor worked. And I finished the thing. In total, the time spent with an LLM did not advance me towards the solution at all. None of the code that it suggested that I write ended up in the final plugin. If I had used an ‘agentic’ setup, where I had given it my document, the desired output, and told it to keep trying until it did it, it would probably have got something that worked. The last throw looked like it would have ended up working, but it would have been an order of magnitude more complexity than I actually needed. And would have been completely unmaintainable: if all of the surrounding justification text had been comments, it would have looked like entirely plausible code, but with deeply fragile connections between the different phases. Importantly, if I hadn’t solved it myself, I would not have really understood the gap between the complexity of a good solution and the LLM-generated one. I might have accepted it was the best available option, in spite of it being terrible. And this was fairly low-stakes code (processing a document for internal consumption), so that might have been fine. But doing that for anything used in production would be an absolute long-term disaster: you’d acquire all of that technical debt without knowing that it is technical debt, you’d just think the feature was done.

Stock market reporting is so weird. Headline from MarketWatch: Microsoft stock is on track to post its biggest quarterly gains in 28 years. Zoom out on the graph slightly a Microsoft stock is trading at just below its high, which was a year ago. Yes, there was a big jump in July but there was an approximately equal crash at the end of last year. Alternative headline: Microsoft stock exhibits high volatility with swings of almost 50% in one year.

Please stop enforcing mandatory time limits on credentials that are trivial to revoke! The point of mandatory expiration is that revocation happens eventually. In the case of a compromise and leak of that credential, an attacker has a guaranteed sunset when their stolen credentials will stop working. This is sometimes a useful property. For example, checking certificate revocation lists on every TLS session is slow. It's common for clients to skip this and rely on revocation sets that are pushed out during software updates. Short lifespans here serve to optimise the performance of revocation lists / sets: if your certificate lifetime is five days and you revoke it, after five days it can be deleted from revocation lists. Scale this to the number of certificates issued across the entire Internet and that's a big saving. But the big down side of requiring frequent generation of short-lived credentials is that the credentials needed to generate that credential (which, by definition, are more privileged) are frequently accessed. If I am generating a token to go into some release flow and I can do it once via a cumbersome process that requires multiple rounds of authentication and then put it in some secure credential store where it's accessed only from an ephemeral VM doing my release flow, then I don't care about the effort of generating the token. I do it once and, in the happy case, forget about it. If there's a trivial mechanism for revoking it, we're done: if there's evidence of compromise, revoke it and go through the slow process again. But if that token expires every 30-90 days, I need to automate generating it. Which means that some automated process that is likely to be as vulnerable as the token itself now has access to the credentials required to mint the token. And that's introduced additional complexity without introducing additional security. TL;DR: If you have an expiration policy for credentials, make sure that you have a threat model that it is intended to address and that you understand the operational complexity that you're introducing and any security weaknesses that this is will cause.

I don’t understand the panic over ‘LLMs can tell people how to build biological weapons and plan assassinations’. So can Tom Clancy novels. And both sources will tell you things that are more likely to get you killed than achieve your nefarious goal.

There’s a depressing human tendency (independent of position of the position on any political spectrum) to follow the following train of thought: We have identified X as a problem.Y looks, on paper, like it would solve X.We will do Y!Hmm, we have observed that Y did not fix X.We must do Y more!It appears that Y is actually causing secondary effects that exacerbate X.Do even more Y! Look, our predictions from step 2 said Y will fix X!

My LinkedIn posts: 80% marketing, 20% trolling. It probably says something about the platform that the trolling posts get more views. Still slightly shocked people read LinkedIn. I view it as a purely write-only medium.

Butterfly is much less fun to say than papillon so I am using the standard process in the English language: deprecating a common-usage word and replacing it with a foreign word that I like better. From now on, all uses of the word ‘butterfly’ shall be deemed archaic. Thank you for your patience during the transition.

@tante@tldr.nettime.org Children often behave like this. They do things on the boundary of acceptable behaviour to learn where those boundaries are. It’s almost never a conscious ‘what can I get away with’ thing, it’s just a thing they do to understand what is permitted. The morbidly wealthy regress to this, I suspect, because they either never had boundaries enforced (hereditary wealth) or suddenly have them removed. Most people have boundaries enforced by a bunch of different things. Laws, social constraints, economic constraints, and so on. When you become richer, some of the economic constraints go away. But so do some of the social ones: people around you are less likely to call you out for being rude if they depend on you for income. Eventually, so do the legal ones. I suspect that this also triggers some paradox-of-choice-like anxiety. As constraints are removed, it’s very easy to become overwhelmed by possibilities. I wouldn’t be at all surprised if some of this is driven by a subconscious desire to find some boundaries and have them enforced so that they can, like the rest of us, reason about the space of possible actions more reliably.

At this rate, I’m expecting Pope Leo to be one of the lead authors of the Orange Catholic Bible.

@APBBlue@thepit.social @Jkelly@sunny.garden I prefer to think of Caturday as a statistical distribution that happens to peak on Saturday rather than an explicit day.

@flyingpenguin@infosec.exchange They accuse Israel, tiny Israel, of colonialism Because the British and Portuguese colonial empires were famously created by very large countries?

One of the Becky Chambers Monk and Robot books has a town throwing a parade to welcome the robot. When he and the monk arrive, there’s a dog. So the robot ignores all of the humans to make friends with the dog. So, anyway, I have a new life goal.

Wow, moderators are killing the accounts for the new spam wave so quickly that I get errors when I try to report them because the account has been suspended and so the report refers to nonexistent posts.

I talk a lot about building software for user customisation. I wanted to share a bit about what I did with igk. This is a tool written for precisely one user (me). I wanted, for the CHERIoT book, to have a single source of semantic markup that could be used to generate typeset PDFs (for print and online, with different styling), ePub (XHTML plus some metadata) and web versions. I initially tried AsciiDoc but it made a lot of design choices that are the opposite of what I want. The design of igk is very simple. It has a tiny C++ core that builds a document tree. That tree use an XML-like document model. A document is a tree. Each node has zero or more unordered attributes (key-value pairs) and zero or more ordered children (text or other nodes). The C++ part has a parser that generates this tree from something that looks like LaTeX (and is more or less the same as as SILE’s cleaned-up TeX markup). Importantly, the generic tool is completely agnostic to semantics. It handles a tree, it doesn’t know or care what any of those nodes mean. The tool then runs tree-to-tree transform passes. These are written in Lua or C++ (in theory, they could be written in anything that C++ can wrap). There is no default list of passes. Each pass is provided as a command-line argument. Passes can run other passes, so you can simplify the command-line invocation by writing one pass that just invokes others to define your workflow. The passes that I use for PDF and ePub output are very different. HTML-like formats want most of the semantic markup to be preserved right to the end and then styled with CSS. PDF output wants some semantics preserved (e.g. section labels for generating a ToC in PDF metadata) but other things lowered to presentation markup. Because the tool doesn’t special case any node types, I can trivially add new semantic markup by just writing it and then write the passes that let me typeset it nicely later. This methodology is built around the idea of desire paths. I make it easy to modify how the tool works and then I learn how I (and, in theory, other people) use it, then I make that use easier. As I’ve written passes, I’ve ended up duplicating the same patterns in a few places, so I’ve added helpers. There are a few more I should add to make the structure easier. A bunch of passes are doing the kind of trivial transform that could be made much simpler with a template-based DSL. Oh, there’s one other extension mechanism. The tool can load shared objects that expose a function that’s called with access to a Lua context. These can register new passes or they can register helper functions for Lua. I use this to expose TreeSitter and libclang into passes. The book pulls in Doxygen-style doc comments with libclang for function references and also pulls in listings from buildable examples. The helpers with libclang / TreeSitter build trees with semantic markup for the identifiers in the listings, the Lua code generates the listings with captions and so on.

@futurebird@sauropods.win @davidgerard@circumstances.run Welcome to Poe's Law.

@davidgerard@circumstances.run The good news is, some pension funds are avoiding the AI hot air. New York City Retirement Systems is actively avoiding yet more AI exposure. Teacher Retirement System of Texas is advising caution. So call your pension fund and express your concerns Good advice. But: That $518 billion total liability figure includes deals for $111 billion with Google, $110 billion with Amazon, and $31 billion with Microsoft. There’s also $161 billion of equipment leases with Broadcom that can’t be cancelled — and up to $84 billion for Nvidia rigs to go in Anthropic’s rented space in xAI. The current valuations of all of these companies are based on the idea that OpenAI and Anthropic will not only pay up on those contracts but will keep increasing their demand. Avoiding exposer to that risk is much harder. My estimate for the overexposure to the AI bubble for the US stock market was around $30 T . Real economists have given numbers between $15 T and $40 T. That much being wiped off the total stock market valuation is going to be hard to avoid.

@foone@digipres.club There was a pen about 30 years ago that was intended for a very similar purpose. It turns out that humans are not that consistent about how their signatures look, but they do tend to be a lot more consistent about the sequence and ratios of pressures and directions of movement. Forgers would precisely recreate the shape but with a different sequence of movements, which would be easily flagged.

@NatalyaD@disabled.social @neil@mastodon.neilzone.co.uk Humans use half a dozen or so visual clues to identify distance. Focal depth, relative movement, binocular separation, and so on. Different individuals weight these differently. VR headsets are very good at some of them but not at others. If you’re one of the, roughly, 20% of people who make strong use of some of the signals that the headsets can’t recreate, they make you motion sick. It’s really hard to see a product when, roughly, one in five people who tries it in a showroom experiences intense nausea. Augmented reality is much better because most of the things in the scene are real and few people have problems with the occasional not-quite-right thing in their vision (some do, but I think the number is under 1%).

@ives@mstdn.social Papillon is more fun. Point at one and say papillon and try to have a grumpy expression. It is impossible. Try the same with schmetterling and you will succeed easily.

@nautilus@kill-corporations.enterprises @skinnylatte@hachyderm.io This becomes really obvious when someone from the more science end of a subject like computer science ends up doing some work that ends up being closer to the humanities end. They suddenly realise that user studies are actually hard to design to control for all of the sources of bias. Or, more commonly, they don’t and just produce nonsense and then apply the wrong statistics and send it to a venue that doesn’t normally do much human-factors work and so no one notices the gross errors in methodology.

Apparently using ‘agents’ can increase productivity. I have been trying this for a while and can confirm that having agents assassinate people who put meetings in my calendar does significantly increase the amount of useful time that I have.

@ska@social.treehouse.systems The argv array is mutable, so there's an argument for defensive copies if something else in the program might mutate them. But that just raises even more questions.

@CStamp@mastodon.social @Burn_this_@beige.party @chestas@aus.social @AccordionBruce@mastodon.social @futurebird@sauropods.win Apparently, when he was writing them, he would monitor fan forums and deliberately kill off the most popular characters. Reading the series, it definitely felt like that. By the end of the third book there were no characters I liked left (Arya was okayish). It seemed to be just deliberately trying to make readers hate it.

@madbarrister@mastodon.social And no disclaimer of liability in any domain that you market the thing as being able to do useful work. Yes, I know Office Copilot says in its T&Cs it's for entertainment only, if you advertise it for use in a business suite then any use in that context is covered by your liability.

@whitequark@social.treehouse.systems this causes the base system to be updated from 15.1 to 15.1p3 This is a pkgbase system then? This includes a kernel update, so rebooting is the correct thing to do. If you're using a pkgbase system and don't want to update the base system, you should add -r to specify only the built-from-ports repos. Pkgbase is still marked as experimental, so if you're using it then please report issues upstream!

@pndc@social.treehouse.systems @whitequark@social.treehouse.systems I'm really curious about what your system looks like. I can normally do a complete pkg upgrade on FreeBSD before the equivalent apt update step has finished running on Ubuntu (I haven't run Debian for many years). The slow update speed is one of the things that always annoys me when I go from FreeBSD to a Linux distro. freebsd-update, on the other hand, is painfully slow. Upgrading tens of MiBs of base system with it takes longer than upgrading tens of GiBs of packages with pkg. Once pkgbase is a bit more stable, I'm looking forward to using it for everything and not just test machines.

@ChrisMayLA6@mastodon.me.uk It would be much easier to defend the triple lock if the sunset provisions were explicit. As I understand it, the point of it is that the UK’s pension provision is far too low, but boosting it to an affordable level immediately is too hard (it would be massively inflationary, even if it were affordable) so the compromise is a scheme that ensures that it will grow in real terms. I’d like to see something explicit saying that the triple lock will continue until some measurable condition is met and then will track RPI or CPI inflation with explicit reevaluation every five years. The debate should be around what the sunset conditions are.

@simon_brooke@mastodon.scot Please reread what you’ve written in this thread and do so from the perspective of someone approaching a project you run. This is how I would perceive it: You make the rules.Anyone who has a use case that is not one that you considered is weird and they need to talk to you about special cases. They’re almost certainly not community members but they might be permitted some special associate membership status if you agree.Anyone who doesn’t have a proven track record of being in the community and adding value to it is unwelcome.Anyone who wants to participate in the community must do so under exactly the conditions that you specify.There are two kinds of people who interact with you, good people who are happy to receive gifts from you and play by your rules and people who are evil but may interact with you if they pay you.If you can’t understand a complex legal document, you don’t deserve to be part of the community.If you don’t precisely follow the rules, you are an outcast who may interact with members of the community by paying them but may not have any other benefits. Good luck creating a vibrant community with that attitude.

@simon_brooke@mastodon.scot if you are concerned that you may have a corner case, either apply to the original authors for a parallel licence, or do a clean room reimplantation from scratch. And you don't think that this imposes friction for downstream users? You are not entitled to profit from the gifts of another, unless you abide by the conditions of gift. And there we have it, summed up concisely. You care about giving a gift, not building a community. You are creating a two tier environment where there are givers of gifts and recipients of gifts. Givers of gifts make the rules, recipients of gifts do what they're told or fuck off. And you wonder why so many people don't want to be part of the kind of community that this creates.

@flyingpenguin@infosec.exchange I’m not sure I agree because it helps to clearly frame these things as tools that cannot be used safely in those contexts. A lot of ‘AI’ marketing is intentionally misleading. It portrays a probabilistic token predictor as an intelligent entity with a pool of knowledge and a reasoning framework on top that allows it to make intelligent decisions. And that leads to it being applied in places where that kind of tool would be useful. It is absolutely the vendor’s fault that it causes these problems. But a narrative that says ‘anyone who uses these machines in these stupid ways is to blame’ pushes the responsibility back to people who make the purchasing decisions to enable them. And that’s much more likely to result in getting them out of these applications than trying to force the companies that have an enormous commercial incentive to change their marketing. To me, it’s a question of which incentives are easier to change. As long as you can blame the tool for failure when used in a highly inappropriate (but vendor-advertised) way, there’s an incentive to keep deploying it and the incentives for the vendors to lie and for their customers to believe the lies are aligned. That makes it hard to make them stop lying because a bunch of the people who would be responsible for enforcing the regulations that would prevent them lying are financially incentivised to believe the lies. If you avoid the liability shift and place the blame on the users, then the users are financially disincentivised to believe the lies. And this means that they are incentivised to push back against the lies and to lobby for banning the lies. Now, rather than having LLM vendors and users pushing back against your goal (or, at least, my goal) you have LLM vendors pushing back but LLM users pushing forward.

@s10n@mastodon.social @newsguyusa@flipboard.social Your implicit assumption is that the BBC, with close to a hundred years of television archives and probably the highest concentration of award-winning material of any television archive, to which they are constantly adding, cannot attract the interest of a typical British person. And, if that’s the case, the BBC has some very serious problems that need to be addressed urgently.

@Rojertb@mastodon.scot I didn't see a direct link to their consultation. Is there a way to submit feedback without going via We Own It? Regulators usually treat this kind of campaign as spam and ignore it.

@antopatriarca@mathstodon.xyz I tried posting job ads here and there. We got a similar number of people who made the shortlists from both, but more than 10x as many who didn’t from there.

@robinwhittleton@front-end.social @Arapalla@aus.social @fesshole@mastodon.social The issue may be that there’s an exemption for renters (otherwise it would incentivise renting a property, changing the locks, and calling yourself squatters and never paying rent again). You might be able to claim that your lease elapsed with the old owners and you’ve never been a tenant of the current owners, but that’s tricky. Banks normally hand over repossessions to an estate agent to handle an auction. They don’t care too much about getting fair market value, because they typically have to give anything above the mortgage amount to the original owners. If the mortgage was with a 70% LTV, they want that 70% back and don’t care about the rest. If they haven’t tried to sell the property, they’ve probably written off the loan. The house might just be an inconvenience for them. The land registry will have records of their ownership and also of how much the previous sellers paid, which will let you calculate the amount the bank lost on the mortgage. After 12+ years of property inflation, the loan amount is probably a lot less than the value of the property. If you wrote to them and said that you’ve been squatting for ten years, have evidence of this and probably could prove it in a court, but you want to save everyone legal effort and are willing to pay the bank the value of the mortgage that was defaulted, then there’s a pretty good chance that they’d accept.

@ska@social.treehouse.systems The worst one is environ because setenv actively mutates it and means that any pointer retrieved by getenv and any traversal of environ may dereference a dangling pointer in any POSIX-compliant implementation if setenv is every called, especially in a multithreaded program. My general rule for setenv is never call it. The experts-only version is call it in main before calling any other function in another compilation unit.

@Rojertb@mastodon.scot Your link takes me to a We Own It web page, which has a form to fill in that, if I do, can email the Ofwat consultation team, which apparently must be done by midnight tomorrow to make it before the consultation ends. But I didn't see (maybe it was there but I didn't look hard enough) a link to the Ofwat consultation that closes tomorrow that this feeds into. Most regulator public consultations filter out mostly-similar submissions (this one pre-fills the email, which makes it easy to discard) and also things submitted via the same mechanism, because they have no way of differentiating between a bunch of people using an easy submission form and an industry lobby group or foreign government pushing some agenda. So filling in the web form is unlikely to have any effect, but writing to them directly would. I would therefore like to do the latter.

@benjamineskola@hachyderm.io So you’re assuming a core policy of monotonically increasing rights for all groups. I’d agree that this is a principle that I would personally, support (with some caveats around convicted criminals) but it demonstrably is not a core policy of any of the major parties.

@lobocode@hachyderm.io Do you know which iteration of SEV this is? SEV was trivially broken even before it was released. SEV-ES fixed the obvious bugs but still required a trusted hypervisor and had some weaknesses. SEV-SNP finally closed most of the obvious vulnerabilities (though they messed up a load of things that should have been in everyone's threat model if they'd actually understood the problem) but also requires a lot more from the hypervisor because it properly enforces exclusive ownership via the RMT.

@u0421793@toot.pikopublish.ing @futurebird@sauropods.win our magazines depended on adverts to exist I used to subscribe to a magazine, in part, because of the ads! For many years in the '90s, I bought Computer Shopper every month. It was probably 60% ads, but those ads would include the complete catalogues of a bunch of computer-part sellers. I have no idea how much it affected their editorial choices but I suspect it wasn't too bad because most of their ads were from diversified vendors. They could run articles about how the new Intel chips were overpriced garbage and their advertisers didn't care because it just pushed people to buy AMD parts (with similar margins) from them instead. I suspect that's much harder in some fields than others. A movie magazine will mostly carry ads for films and if you pan a film and the studio loses a load of money, they may not want to advertise their next production with you.

@whitequark@social.treehouse.systems When you say 'from ports', are you compiling ports from source or using packages? If it's the latter, I'm surprised. Normally I can do a pkg ins in the same time it takes apt to fail because I've forgotten to do apt update before I run it and if doesn't have any cache invalidation mechanism, and then the runs are very fast. Are you using a slow package mirror?

@simon_brooke@mastodon.scot Proprietary software is not written to create communities. Proprietary software is not written to create a change in the industry where end-user freedom is valued. If that’s your rôle model then expect similar outcomes.

@djsumdog@djsumdog.com @futurebird@sauropods.win I read the Brian Herbert / Kevin J Anderson ones and they’re terrible. Frank does a lot of contextualisation of the Butlerian Jihad as a rejection of the idea of delegating your thinking externally, the prequels make it a stupid robot-overlords plot that makes no sense. The ending of Chapterhouse / Heretics is set up hinting that human evolution has continued down paths that are barely comprehensible by the old humans who didn’t leave in the Scattering, the sequels just rehash old characters and make it all about the robots again.