• 47 Posts
  • 259 Comments
Joined 1 year ago
cake
Cake day: June 25th, 2023

help-circle


  • wow, remember when a bunch of random posters came to that security thread to try and gaslight us into thinking the very similar attack described in @dgerard@awful.systemsā€™s blog post wasnā€™t a security vulnerability? and now itā€™s a Black Hat talk, aka ā€œyou fucked up and now the world knows about itā€

    ā€œItā€™s kind of funny in a way - if you have a bot thatā€™s useful, then itā€™s vulnerable. If itā€™s not vulnerable, itā€™s not useful,ā€ Bargury said.

    holy fuck thatā€™s damning. LLMs are so worthless on their own that they canā€™t do anything unless youā€™ve got everything hooked up to RAG, which is just a wide-open API with access to all your data.


  • I like the idea of small communities, but a major issue (possibly the biggest issue) as demonstrated by many mastodon servers over the years is longevity. What happens when your admin gets bored/burns out/dies/goes fash/is replaced with an asshole/is unable or unwilling to moderate effectively?

    this is something Iā€™ve been thinking on quite a lot myself ā€” how do we (being a small web service without effectively unlimited VC money to burn on cloud credits or an entrenched corporate infrastructure) have continuity in case anything happens? and as an established community, that continuity has to encompass our infrastructure, our data, and the understanding and expectations that make moderation work.

    • for infrastructure, weā€™re somewhat ok ā€” our deployment code is open, and thereā€™s just enough docs that a replacement admin can spin up an identical cluster with a bit of work
    • dataā€™s a lot harder. Iā€™d love to regularly publish a dump of our database with the sensitive details redacted to as many places as is practical (thereā€™s a bunch of archive sites for this), but that would open us to a number of garden-variety and lemmy-specific attacks (and I wonā€™t be describing those in public for obvious reasons, but established posters can inquire in DMs). most likely in the short term thisā€™ll involve rsyncing full database and image storage dumps to trusted parties on a regular basis, though Iā€™m open to any better ideas.
    • the problem of guaranteeing continuity of moderation is unsolved. the only idea I have in this direction is effectively a guild or co-op model thatā€™d exist to teach and certify moderators and admins how to maintain communities like ours. I havenā€™t taken any steps in this direction, and thereā€™s a lot to the idea thatā€™s still effectively magic (how should certification work? what systems should be in place in case of bad actors? should this thing itself be a mostly technical solution or a mostly social one?), but it could potentially guarantee moderator continuity for federated systems other than ours too.

  • my thoughts on paullyā€™s output are along the same lines ā€” itā€™s really a shame that heā€™s the guy a lot of people learned Lisp from, because itā€™s very clear heā€™s just a rich white guy bullshitting on that and every other topic heā€™s famous for

    also, this stood out from a quote in your first linked post:

    Server-based deployment of software was a central theme in Grahamā€™s essays, and his continuation-based web framework was an interesting and fairly novel way to create continuity across multiple requests in a single session.

    Seaside did this first, though it never got a ton of traction. if naive continuations are how the orange siteā€™s doing sessions and state tracking, that goes a long way towards explaining why itā€™s so incredibly bad at scaling and has such weird performance characteristics. thereā€™s ways to make continuations more performant in this role, but it takes a degree of low-level understanding paullyā€™s never demonstrated, since his languages have always been built on top of Racket (which is a fine language for making languages! itā€™s fun as hell! but one day you will run out of runtime to repurpose)

    (I should see if Racket finally has good LSP support for #lang languages. Iā€™d seriously use it so much more if I could bring my own editor)

    also, holy shit those responses to your second linked post really havenā€™t aged well at all, have they?