Tom Bortels

I know I'm opening up a can of worms here, but: Maybe, just maybe, a 200+ year old set of laws designed to give a short-term limited monopoly to book printers may not be suitable to apply to all forms of human expression? And maybe, just maybe, it's been extended and made all-encompassing and applied to other forms of expression not for the benefit of society, but for the benefit of large corporations that want to own everything, including artistic expression? It feels particularly problematic in music, where riffing on and extending/mutating what is popular is 100% normal and traditional. To the authors I follow: you're good. Your use fits the original intent! But - if your copyrights never expire, you won't be remembered like Shakespeare. Things need to pass to the public domain eventually if you want them to live forever.

@Hex@kolektiva.social I'd add a more explicit point: cars didn't do anything. They are blameless. *People* replaced horses with cars, and they did it out of their own self-interest, not that of society. AI isn't doing a damn thing. People are. And AI doesn't replace humans - it displaces them. Often very poorly. I'd have less of an issue (but still issues) if it was a viable replacement. When you see "AI slop"? That's people who are phoning it in. When you see "AI replaced this call center"? No, some asshole did, and it's a poor replacement. Copyright violations, intellectual theft? People again. And when you see "This AI solved this proof" or made a scientific advancement? Yeah, people again. AI can be a very useful tool when you have smart people prompting and correcting and using the tool - but it's just a tool. Just as the assholes deserve blame, the successes are to the credit of the humans involved. The technology is interesting. But the people pushing it hard? Assholes.

@darkuncle@infosec.exchange The biggest drawback of AI isn't that it's expensive. Or disrupting. Or drives up hardware prices. Or displaces humans, poorly. Or violates IP laws. Or flat out lies, dangerously so. Those are all bad, but the thing that *bothers* me? That they *displace learning*. If you can make an AI do it - you don't need to learn how. That is - until the AI isn't available. Or - importantly - when you need to learn something that relies on the learning you just missed because the AI did it for you. Reminds me of the olden days when I was a kid, and the adults would admonish "Don't smoke cigarettes, it'll stunt yer growth". AI usage can stunt learning. If you are already an expert in your field, maybe that's not an issue. But for students or early/mid career folks it should be a show-stopper.

@kibcol1049@mstdn.social @codinghorror@infosec.exchange @bencurthoys@mastodon.social Get and use a password manager, make all of your passwords long random gibberish, and opt out of ever worrying about it again. Because it's not about your password - it's about your passwordS - and people who memorize a long ugly one tend to re-use them. I know I did. Which leaves you susceptible to stolen hash attacks. Because advice without concrete details is mostly useless, I use and am very happy with 1password for family sharing (paid service) and KeePass (free and open source) for backup/non-shared/non-online. Either or both or really any password manager that lets you easily make long ugly passwords is the right long-term solution.

@antanicus@puntarella.party Sunlight is good - but heat is death. And lately the issue is not a lack of sunlight - but too much heat. Shade helps life tremendously.

@gloriouscow@oldbytes.space You have inadvertently invented the worst programming language ever. Also the best. I don't even. All praise the @gloriouscow.

@1password@1password.social @darkuncle@infosec.exchange So - lunch rules apply. It does no good to complain - I'm not *not* using a password manager. If I'm going to switch, I need something at least semi-close to being on-par. What are the options? Protests have no teeth without an explicit, realistic alternative. The only one I am aware of that even begins to approach viable is keepass (many variants, but I like KeepassXC) - but it's not a great alternative because it lacks a lot of features 1pass has.

@darkuncle@infosec.exchange Unfortunately, practically speaking today if you don't have both email and a phone number, you can't participate in much of society; they are the de-facto standard for business comms and mfa, despite being entirely inadequate. But - I can't remember the last time I received or sent a "recreational" email or phone call. They've been entirely supplanted by better options.

People bitch about AI slop - but it's not the AI's fault. The AI just does what it does; it lacks the ability to reliably judge its own output. It's not a new problem - many or most humans also lack that ability. That's why we have editors and test audiences and standards committees and inspectors. The fault lies squarely on human laziness. If a farmer in a field plows a crooked row because they didn't bother steering the tractor - that's not on the tractor. Stop calling it "AI slop" and use a phrase that puts the blame where it belongs - lazy humans who didn't do due diligence and just phoned it in. This is why we can't have nice things.

@mhoye@cosocial.ca There's a false dichotomy at work here: "do it myself" or "let the AI do it unreliably" are not the only options. Rather than spend 4 hours cutting and pasting boilerplate do do something I've done 8 times before at another employer, I can have the AI take 10 minutes to put together that same boilerplate - likely from the same sources I use - and then spend an hour turning the unreliable result into reliable, tested code. You don't do "either-or", you do "and". Then spend the 3 hours you just saved doing something more creatively interesting. The AI isn't a replacement - it's a tool. It accelerates. And yes the output is often crude or just wrong - correctness (and planning and fit-for-purpose and budget and about 18 other things) is your job. A chainsaw is dangerous, and can cut down the wrong trees. It's your job to mitigate that danger and choose the right trees. The real issues with AI are not as simple as "it's wrong, a lot". It's issues of training and intellectual rights and what it's doing to the economy and displacement of workers and *none* of those are the AI's fault - they're the fault of human beings creating and selling them. As is crappy output making it past the human who should have fixed it.

@darkuncle@infosec.exchange To be fair - you get that third thing on vacation and not on vacation. Griping is universal.

@sqhistorian@dosgame.club It was a very long time ago and I've forgotten a ton, so I'm not your source, but one thing I remember vividly was if you had a 1040, you could make a ramdisk and copy the game to it is it *absolutely flew* compared to running off the floppy directly.

@arina@girlcock.club @mayazimmerman@gamedev.lgbt Well - not every one. "Price too high" is pretty transparent. Basically cloning another game is also pretty obvious. A game not available in your language/localization is easily noticed. But granted - there's lots of things we may not want developers to do. I'd prefer they not beat their children too. Does that merit a disclaimer? Would it even work? There's a trap humans fall into - we see a problem and we want to do something, anything, to fix it. But human behavior is complex, and the solutions suggested rarely do much more than allow us to pretend we are helping. Speeding. Drinking. Drug use. Cheating. All bad. All prohibited, almost entirely ineffectually. Punishing bad behavior drives it underground. Prohibition in the 1920's US is a classic example - it largely didn't prevent drinking. But it did end up supporting organized crime. In the end, prohibition laws don't prevent bad behavior. They simply let us punish it in those who get caught, and we pretend it's a deterrent. So, while it might be nice to pretend that labeling games with your favorite bad behavior will reduce it - the reality is it mostly just drives that behavior underground. By all means, require disclosure of AI usage. Just understand it is very unlikely to reduce AI usage - the ones phoning it in with AI will just lie about it. So - what's the real solution? There may not be a good one. And yeah that's annoying. But reality. You can't always force people to do (or not do) what you want.

@darkuncle@infosec.exchange Ok but if someone sold you "Lord of the Rings: The Fellowship of the Ring" and it was about Frodo and Sam's high value deals on wall street and Gandalf being Kidnapped by the Ent-Lord - you'd be quite correct in feeling misled, at best. Giving it the same name and sequence number and calling it a remake implies a certain continuity that seems to be lacking, no matter how good it actually is. If someone sold you a "Rolex" and it turned out to be a Swatch with "swatch" crossed out in magic marker - you would be justified in feeling somewhat misled and wonder why they would do such a thing.

@darkuncle@infosec.exchange My point exactly. I played FF7 on my PS1. I mean - I can't point a finger, I'm currently deep in Diablo2 - but it's on an open platform that won't try to sue me for running software I paid for on an emulator.

@darkuncle@infosec.exchange I'm concerned they always do, to a greater or lesser extent. Research is a skill as well. But if you use the AI to research - how do you check the answers. More research? Experimentally? I suggest using AI for research is a lot like using it for coding; the usefulness is proportional to how much you already know. Code is good; there are purely mechanical non-AI methods to confirm validity. But research? We've seen the AI give bad legal advice, we've seen it give bad medical advice. How do you confirm validity? I'd also add that the people *most likely* to use an AI for research, as opposed to going to original sources, are the least likely to recognize bullshit.

@darkuncle@infosec.exchange There's a reason I don't give any money to nintendo anymore.

@darkuncle@infosec.exchange Generalists always have the advantage in a changing environment. This has less to do with AI per se, and more to do with adaptability in the face of disruption.

@EatYourSheep@furries.club The price isn't the issue. Availability is. Valve seems unable to make enough hardware to meet demand.

@lcamtuf@infosec.exchange Lots of people avoid calculators due to math trauma - but everyone needs a clock.

@mhoye@cosocial.ca @Ryan1729@mastodon.social I did some stuff last week that amounted to very boring consolidation of logs from different sources (guthub CI/CD and AWS Events around spot instance evictions) and consolidating/munging them together to do some data analysis. Took me about an hour to bang it together with gemini. Looking at the resulting code - it would have been a half day of me piping to jq and working out nesting and doing simple data parsing and mapping out data structures. Nothing I haven't done in other circumstances 20 times before with different data sources, but - I only type so fast, and I have to stop and remember the weird name someone called the thing and I make typos and so on. I don't trust the AI for so so many things - but if you prompt with care, it generates code well. It works out how to query the data structures you are building and deal with quoted versus not and yeah - I'm a good 4x faster using the AI, at least for that type of task. Just doing a data dictionary for the different jaon objects formats those will output would take an hour or more. Would I ask it for medical or legal or tax advice? Lol no. Do I frequently stump it or have to say "stop, that way is a dead end, do it this other way"? Yes. But I'd do exactly the same with a grad student. And do. I'm damn near 60 years old. If I never have to puzzle out some random JSON blob's structure again just to pull the 3 items I want, works for me. And the AI is pretty good at that.

@maxleibman@beige.party Option 3 - be vaguely annoyed then bypass their stupid paywall if I care enough.

@DamnInteresting@mastodon.social I believe it was Wolfgang Pauli who called certain plans "not even wrong" - implying the speaker has so fundamentally misunderstood the situation that their suggestions were entirely outside of the realm of even becoming correct. The linked article is not even wrong. The flaws in the presented plans make my brain hurt.

@darkuncle@infosec.exchange Mmm... I get it. I'm not sure I agree. Mathematics proofs are in (mostly) english, or russian, or some other natural language. Legal docs are the same. You can absolutely be precise in English. We just normally don't bother because we know the entity we are speaking to can handle ambiguity. The AI can handle ambiguity. I can say "go look at the cloudwatch logs" and it knows I mean aws, and the current context - and if it doesn't it will ask. Besides - ambiguity happens in code as well. Is "1" a number? Floating point? An ascii character? In perl, it depended on context, and could change depending on usage! If I say "one time" is it really better for that to generate an error rather than DWIM? A preference to use a language you are fluent in is a preference; it doesn't make other's preferences invalid or wrong, and they aren't saying that. My point is simply that it's nice to have other options. I like not having to be pedantic and let the AI make intelligent guesses, especially since they are often correct.

@georgetakei@universeodon.com My thoughts? This could have been avoided, but he likes to be a "bad boy", and he's done and is doing far worse things. If he is going to take credit for successes - he should be held accountable for failures, especially those he has intentionally caused (DOGE).

@mhoye@cosocial.ca Goes to show you defcon is equal opportunity and allows the terminally stupid to attend as well. To deauth a wifi network is rude, at best. To do it to a plane is likely criminal. To do it to a plane in flight shows a serious lack of judgement. To do it on a plane you are on in flight - here's yer sign. Throw the book at them, they've decided to be the example. Losing the hardware is just a slap on the wrist.

@louie@pdx.social I can say from experience that for the commonly used actions in World of Warcraft, we no more look at the icons than we look at the keycaps when touch type - the icons are bound to keystrokes and it's muscle memory, we could and did play without looking at them at all, as we looked at the tactical situation. We look at them when we set up our bindings, and honestly we look at the mouseover text, not the graphics. Personally, right now on my mac, day to day my muscle memory is about position in the dock for frequently used items. My browser is far left - librewolf for my home machine, chrome for the work laptop, but both far left and muscle memory. Apple itself belies any concept that icons convey a ton of meaning by switching the rules every few years. The squircle is the new fad - until it's not. Honestly it doesn't feel like it's about the user at all, it's about style and branding and what Apple wants rather than what is best for the user or developers.

@darkuncle@infosec.exchange As for coding: do as you will. There is nothing wrong with just coding in a language you are fluent in. But when you aren't - it's damn handy to have something that takes fuzzy english pseudocode and gives you something you can run. And the AI can fairly reliably transcode my code in, say, python, to a language I am only semi-fluent in. You may need to iterate a bit, but - being able to take my python code and have the AI redo it in golang or rust is pretty cool and useful at times. I code for a living. It's not "fun" coding - it's usually data analysis and troubleshooting. The sooner I can get working code, the sooner I can fix the thing I'm fixing. Letting the AI do the scutwork by saying "ingest jsonl on stdin and emit the following fields as csv with headers" is faster and easier than working out the exact paths I need. /shrug

@mayazimmerman@gamedev.lgbt The problem with the full on refusal is you are in-effect saying "I might buy a game made with AI if you don't tell me about it", almost certainly unintentionally. As a policy it drives game creators to do the wrong thing. They will simply hide their crimes. Prohibition doesn't change behavior - it simply drives it underground. I am not sure "I used an AI" is any better or worse a sin than the EA death marches they put their people thru. I'd prefer neither, but I see no realistic way to ensure it. Judge a game on price and quality.

@gamingonlinux@mastodon.social It's a pity the color one isn't true 64x64. I'd have uses for that above and beyond...

@mhoye@cosocial.ca I feel seen.

@darkuncle@infosec.exchange Making sure I understand: new game. New plot. New everything. Same name. Why would they use the same name?

@Hex@kolektiva.social @AdrianRiskin@kolektiva.social @DejahEntendu@dice.camp The simile is apt. But we don't jail guns or swords, because they lack culpability. We do regulate them, despite resistance, but we punish abusers of them, or try to. Guns and swords have been around a very long time - the law has yet to catch up with AI.

@louie@pdx.social Are you reacting to the *icon* in WoW - or to its position and timer overlay? My point is you could replace them with a letter and easily adapt - it would be functionally identical. The artwork is aesthetic and what you are used to, but a "glowing book" has little real meaning except what you are using it for. This as opposed to program icons, which presumably are intended to communicate branding and (ideally) functionality. I kinda miss the skeuomorphic icons - a notebook looked like a notebook. The rounded corners aren't new - but the mandate is. And frankly - apple trying to force a look-and-feel isn't a great look. It stifles creativity at best, and honestly the "liquid" stuff has been detrimental to vision-limited users like myself. As the actual user looking at the actual icons on my own computer, I kinda want the final say on the icons TBH. The actual developer has a similar claim - but Apple has control issues, sadly.

@mhoye@cosocial.ca @Ryan1729@mastodon.social It can. But I don't need to get that specific. "Write a python script to run daily that goes to cloudwatch for the last day in account xyz in us-west-2, and give me a summary of failure modes for the top ten mentioned lambdas" mostly just works. And I didn't need to mess with pagination on cloudwatch or escaping or decoding or working out the jsonpath. And that prompt will work out-of-the-box 9 out of 10 times. And then I can say "good, extend that for all active regions" - and it just works. Minutes instead of an hour of screwing around. Now I can spend my time on interesting, non-routine tasks. The reality - jq users will know this - is that jq syntax is difficult and quirky and simple things are doable but complex things are difficult. Beyond a certain complexity - just go do python. It's easier to code and easier to read. But neither of them will understand from context when I say "include any tags that are relevant".

@mhoye@cosocial.ca @Ryan1729@mastodon.social There are utilities that do that. Many of them. The problem, at least for me, is that a lot of my real-world sources tend to be very not-regular. One log stream will have many different record types depending on the event. I have yet to find a more flexible utility than python and incremental iteration - and again, the advantage here is the AI is that it accelerates that process, pretty reliably. The filter/summarize utilities don't *interpret* and infer patterns - and it turns out that's useful. It's almost as if a purpose-built tool for analyzing streams of tokenized text and making predictions based on what it sees is useful for analyzing streams of tokenized text and making predictions based on what it sees. I repeat: the problems around AI, the real ugly ones, are all *what humans do*. Humans train on sources without permission. Humans trade stocks to create a bubble. Humans don't do their due diligence on validating results. Humans lay off humans because they incorrectly think the AI is something it's not. Humans ascribe actual thought to a pattern matcher with a feedback loop. If some asshole suns rampant in the streets with a chainsaw and hockey mask - it's not the chainsaw's fault.

@darkuncle@infosec.exchange "A subscription for my subscription". Ouch. Disney+ wanted how much? I think it was $20 for the live-action "Mulan" - on top of my existing Disney+ subscription? Resulting in: cancelled Disney+. I got 99 problems, but subs on subs ain't one.

@MarkHoltom@mastodonapp.uk Research is research. Future units will be more efficient. Looking at this and extrapolating to the future is like looking at a model T and assuming you could predict modern car culture. Simply multiplying is both misleading and misses the point. The reality is we need to look at and try all potential remediations, and one is not exclusive of others. Direct carbon capture doesn't mean we aren't also looking at conservation and other mechanisms. The unfortunate reality is we need to not simply stop dumping carbon into the atmosphere - we need to reverse the flow. Carbon capture and sequestration technologies is that process, and needs to happen *in addition to* conservation. I suspect the eventual efficient solution will be something not invented yet. But to get there we need to iterate on what we can achieve. This isn't a solution - it's part of a process.

@cynblogger@sfba.social @darkuncle@infosec.exchange Cellular machinery moves *really fast*. When you see animations they're slowed down many orders of magnitude. And the following ratios are mostly similarish (within a few orders of magnitude): Atoms in a cell Cells in a human body Stars in the galaxy Galaxies in the observable universe. It's really hard - maybe impossible - to fully comprehend that kind of scale. Our brains aren't built for it. We have to resort to symbols to represent orders of magnitude.

@darkuncle@infosec.exchange I am a big fan, and it would harsh my mellow to bag on Alice - but the argument they are having with whoever is missing an important point. AI output is inherently untrustworthy. Ok! Lots of things are. Noise makes things untrustworthy. Bias does too. Humans are notoriously untrustworthy. That's why we have error detection and correction mechanisms - feedback loops so we don't accept erroneous data as valid. This has been studied for *decades*. And a lot of the mechanisms can and do apply to AI output. You don't use AI output directly - not if you're savvy. You feed it into an error detection/correction step. Sometimes that's easy - does the produced code compile and pass its unit tests? Strong indicator there you're ok. Don't have unit tests? Ah - I see the problem. Point is - you don't have the AI do data analysis. It's really bad at it. You have the AI write code to do data analysis. It's good at code. And you test it, exactly as you'd test your own code. We all test our code - right? It's harder if it's not code - but it's the same as having an intern. You gotta check the results. Hit the URLs. Spot check facts. Some of that in some cases can be automated, but when you can't check the output - you had no business asking the AI to begin with. If you ask the AI for advice about life-and-death - that's evolution in action. Now - there's plenty of excellent reasons to avoid AI that have nothing to do with unpredictable output. They aren't wrong. IP issues, market issues, expense and the bubble and data centers and layoffs - all big problems. But they's *human misuse* issues. We had similar ones with cybercoin and NFTs and data brokers and a lot of other techs - and it all boils down to human misuse. https://youtu.be/CD9YqdWwwdw It's worth noting in the clip above (spoilers): HAL was correct. It was human error. GIGO.

@darkuncle@infosec.exchange You are speaking specifically about *mathematical* proofs. Not all proofs are. For example - we prove a case in court. In English. And yes, there's some jargon to help make things more precise, but the soul of the proof isn't the words, it's the logic. But we've moved goalposts. We're not talking about proofs. We're talking about unambiguous instructions. A formal language can certainly help there, but my assertion is simpler - a more intelligent listener (or "interpreter") is even better. I can write the same logic in any sufficiently complex language - assembly, COBOL, BASIC, Pascal, Perl, Python. And it *generally* gets easier as the languages get more complex, because they can succinctly encapsulate higher level constructs without having to enumerate the details. Sorting, for example, becomes easier and easier as the language gets more recent. COBOL as an attempt to make programming resemble English, on the theory it would allow non-programmers to program. It turns out that's not true - you need a programmer's "mindset" to write code, to be able to work out what you want done with sufficient rigor to get the computer to do it. I submit to you: talking to the AI, in English, with sufficient programming mindset rigor - is the next step. I can produce the same artifact by either writing python directly or instructing an AI - but the context the AI embodies about code and coding and best practice and so on means I can do it faster and easier, significantly so - which leaves me more time for the other important bits, like design and security and testing. Is it perfect? No. In particular, the AI can't fill in for a lack of that programming, logical mindset. Garbage in, garbage out. You need to learn *how* to talk to an AI about coding, in much the same way you needed to learn Perl - or you're going to have a poor experience. And I fear we have folks missing that step. But perfection was never the promise. You hear a lot of people bag on AI. For lots of reasons - many good. But you know what you don't hear? People who have used it for coding and abandoned it as useless. Because - it's not.

@darkuncle@infosec.exchange Related to that: https://youtu.be/YhwkaH1-S7Q TLDW: You have never seen, with your own eyes, a "typical" star. Every star we see with the naked eye is either extraordinarily bright, or in one case extraordinarily close (and still not typical). The vast majority of the stars in the milky way galaxy - red dwarves - are too far and dim to see with the naked eye.

@foone@digipres.club The Zeus trojan used to lie in wait watching for a banking login, then launching a second session in the background using your existing fresh session cookie. You log in and do whatever - and it's in the background transferring your funds away. The second MFA is intended to confirm that it's still you doing the transaction and not a bot that stole your session. There are better ways to auth and secure a session now, but those kind of countermeasures tend to get written into policy, especially in places like banking, and are requirements long after they cease to be useful.

@darkuncle@infosec.exchange Were maybe. Today they're mostly remakes. I mean - how many times do you need to buy mario cart?

@darkuncle@infosec.exchange Boldly played. Let me know if they respond.

@darkuncle@infosec.exchange "Contrarian" is an excellent replacement. Probably nicer than my current "anti-vax moron" description.

@DamnInteresting@mastodon.social "Startlingly Dirty" in this case meaning they found zoned industrial land, bought it, applied for and were approved permits, and began construction. Their "crime" was in not asking the community first and getting approval, and not being loud about their intent. 🤔

@masnick.com Calling it twitter is making a point - we're unwilling to let the oligarchs swap identities when they make one toxic by their own activity. Elon is welcome to rebrand twitter all he wants (not really but we san't stop him), and so long as we keep calling it that we want we won't forget what he bought and ruined. And yes, I'm also looking at Facebook, aka "Meta" and Google aka "Alphabet".

@mattblaze@federate.social The entire idea of CW as an effective self-censorship/moderation mechanism in an effectively global forum is flawed to begin with. Even if everyone agreed (everyone doesn't) - there are simply too many different cultural and personal triggers out there - you'd have to CW every post. And that's ignoring the trolls. It might work in a small, insular group of like-minded people - but a federated global chat isn't that. The reality is if you see a post - you was it because you followed the poster, or someone you follow boosted it, or you're browsing the local feed. Unfollow. Block. You have tools. But forcing self-censorship isn't one of them.