Phil

@stefano@mastodon.bsd.cafe Congratulations! They sound toxic as hell.

@0xabad1dea@infosec.exchange I'm just thinking, wouldn't sending Gmail ToS updates to spam constitute unfair business practice? Possibly in contempt of the law? I don't see how that's different.

Can't wait until bad actors put all of this autonomy to use at scale... just imagine having the ability to make card-stealers turn the cards they get into more card-stealers, like a fork bomb... Idk maybe it's my barely-awake brain hallucinating but there's no way this can end well. https://cursor.com/blog/agent-computer-use

@davetroy@toad.social

1. There is no legal entity for terrorist organizations, but they're subject to every country's laws where their members are regardless.

2. See 1.

@AutisticInnovator@autistics.life Possible case of unfair competition? You seem to have the evidence for it.

@leerayl@infosec.exchange To my understanding Vanta has their own 'recommended auditors' who'll take whatever you tell them at face value, no matter how fraudulent their evidence is. So it's honestly taken away all my trust in SOC2 as a sign of security. Genuinely disturbing.

@frank87@mastodon.pirateparty.be You know what? I should get me a distillation set, so I can make sure I have clean water if need be. Salt isn't going to be in short supply anytime soon, but water... yeah. Clean water will be difficult to come by. Not sure how that relates to your comment but it did make my mind go there.

@neurovagrant@masto.deoan.org ? They haven't.

@EndlessMason@hachyderm.io @neurovagrant@masto.deoan.org As a sidenote, I've seen things you wouldn't believe in the last few months that has me genuinely convinced that it's humans that made LLMs look bad, rather than LLMs being bad intrinsically (aside from the copyright issues, power drain, freshwater use, global warming, financial abuse, privacy issues, deals with government...). The math models (locally hosted, fitting on gaming GPUs) can be fairly easily be made useful and helpful (a few days of effort after work) in menial tasks that can't be completed deterministically, provided basic oversight. They cost pennies, and they're private.

@EndlessMason@hachyderm.io @neurovagrant@masto.deoan.org Running Qwen3.5 on my 7900xtx eats as much power as running any video game. I have zero issue with running LLMs locally to assist with my journals/ notes. Nothing compared to a data center.

@AutisticInnovator@autistics.life Do you know who is doing this? I'm not quite clear on the context here, but it sounds like 'they' are some kind of marketing company?

Man #Vanta is so bad...

Their Entra MFA enforcement check is horrible. It only checks if a conditional access policy exists, and if it has 'MFA' in the builtinControls. If it does, it's a pass.

But it doesn't check...

• if any users are excluded from the policy
• if any groups are excluded
• if the policy covers all users even after exclusions (e.g. if the exclusions are service accounts for any reason)
• if the geoblocking is functional
• if any of the excluded users are privileged

Vanta is a tool designed to mislead auditors, presenting as a third-party authority with their 'trust center' and all the flashy shiny dashboards.

Yet the core is rotten.

I haven't been this insulted since I found out that #vanta has a barely functional risk API (was trying to sync our risk register from our internal repo... long story).

Just... I lack words.

#infosec #cybersec #grc #privacy #compliance #fintech #informationsecurity #audit #soc2

I can't tell if I'm supposed to be laughing or mourning for humanity. This whole anti-LLM craziness is a distraction from the real problem: all the money's being sucked up by the 0.0001%! Wake up sheeple! How do you plan on surviving the water wars when you can't even have a normal conversation about a barely controversial topic? How do you think you'll coordinate with your peers when the mere mention of an LLM sends you into frothing fits? And in just a few steps, what next, dirty bombing data centers? Do you realize the environmental damage that would cause? lol lmao even RE: https://fed.bajsicki.com/notes/aj2pugzo3e

@munin@infosec.exchange Begs for Alphabet to be broken up and its parts nationalized wherever they're registered. I want to know, who exactly made the decision to put this shit on my computer. This isn't okay. As far as I'm aware, this falls under the legal definition of hacking, no? It's unauthorized installation of software not approved, agreed to, or otherwise known to the unsuspecting end user.

This is exactly what they're doing, and it's not always out of malice. There are laws and regulations that determine how long data has to be kept for certain categories of users (e.g. underage) or uses (e.g. healthcare, financial data, LLM/ "AI" use). Just because the user has the option to press delete, doesn't mean that data is gone. That's not to say that there aren't unscrupulous persons keeping the data past its lawful term, but... I can't think of any way to truly prove that either way since one would need a court order and then full analysis of their data pipelines, which is hella expensive. RE: https://starlite.rodeo/users/ana/statuses/116076408663003786

@EndlessMason@hachyderm.io @neurovagrant@masto.deoan.org Sorry, who decided to, and then gave these tools access to do so? Putting a non-deterministic tool with """safeguards""" there has very predictable consequences. If not humans, who exactly is to blame for this mess? Cause it sure isn't a pile of numbers.

@0xabad1dea@infosec.exchange Isn't that... illegal?

@ambiguous_yelp@veganism.social @broadwaybabyto@zeroes.ca @clock@f.cz Not to mention, AI output isn't copyrightable. It's public domain.

@baldur@toot.cafe Where does "I need to eat so I'll use these because they keep me employed" fit into this? Cause that's the sensible and reasonable position in this economy.

@lproven@social.vivaldi.net @xs4me2@mastodon.social @reading_recluse@c.im So let me get this straight.

1. You don't use the tools you're criticizing.
2. You're relying on outdated and fundamentally flawed examples.

Transformers aren't everything; there's also embeddings, RAG, tools, pre- and post-processing of inputs/ outputs, all of which can and do affect the quality of the output.

I don't disagree with you entirely, to be clear. But I do find the absolutism a little much, when the core of your original argument (about these things being dangerous) hinges on handing off all responsibility and accountability for the result to the machine.

Something that we shouldn't be doing no matter what the machine is.

@lproven@social.vivaldi.net @xs4me2@mastodon.social @reading_recluse@c.im Guess I'm not human, then, cause I haven't found myself relying on these tools, or losing any of my skills due to their use. As I said earlier, my experience as far as personal use has been pretty good. Not flawless by any means, but certainly a major time-saver. I do suspect there's a difference in the impact depending on the person. I'm AuDHD, with the ADHD part correctly controlled, which I do believe protects me from the publicly stated risks. Alas, there's only really research on how LLMs affect neurotypicals. I haven't been able to find anything that would study how ASD folks are impacted by using fancy Markov chains long-term. But again - personally, I haven't seen anything negative in terms of outcomes. Unless annoyance counts. These things suck at coding, I swear.

@jackdaniel@functional.cafe Very cool. Do you, perchance, have a list of these snippets somewhere? I'm still having a bit of trouble wrapping my head around presentations, and getting the GUI to hot reload instead of having to restart the app frame every time.

@lproven@social.vivaldi.net @xs4me2@mastodon.social @reading_recluse@c.im

I keep detailed journals about nearly everything I do day-to-day, and review them regularly to ensure I'm on the right track in life. I am self-aware enough to know what I do and don't know, thanks to this. My journal since August 2023 is 16k lines, without word-wrapping.

To address your questions:

1. Yes, and I don't scrape websites. In fact, none of the things I post online or in any personal communications are ever touched by an LLM. I take pride in my prose (for the most part, lol).

2. As I said elsewhere, I tested this recently and running an LLM (during the inference itself) takes as much power as running Kerbal Space Program. With Power Limiting, I can make it use even less. Third-party API providers are a separate matter, and not relevant to using LLMs per sé.

3. I don't train or build LLMs. Also not relevant to using LLMs, which was the original topic.

4. Already addressed - it's the human's part to ensure the work is up to standard. LLMs are tools, they're not thinking machines.

5. Great (/s), I can't do anything about it. In fact I'm in a position where if I wasn't using LLMs to maintain an insane pace of work (I'm filling 5+ roles atm), I'd be quickly replaced by an MSSP. I'm affected by this, but your implicit message is that you can afford not to use LLMs to keep your job/ health/ standard of life. I can't afford that. On the personal use aspect, sure, I could, and my quality of life would decrease accordingly considering the way my brain functions.

6. See 5.

7. You're propagating the belief by acting as if people believe this in the first place. Nobody in this thread does as far as I can see. Nobody's saying "my LLM is so smart!"

8. I disagree. LLMs aren't the ones causing losses. It's people misusing a tool that are causing losses. Just like it's people making harmful decisions based on appeasing stockholders.

LLMs (as in, the actual models) are fine. The problem is the people around the development of those LLMs.

I think we're overall on the same page, but we live in different 'tiers' of society.

You have the luxury of rejecting the tech without losing a needed crutch. Sadly, many aren't in the same position of privilege.

If I can have 50% of a personal assistant for a few cents a month in power bills, why should I give that up?

Imagine being a company that can hire the best of the best, and choosing to give that up to... have a random number generator manage critical infrastructure. I used to think society overall was pretty smart. We have a ton of cool stuff compared to 100 years ago. Now I find myself screaming that "nobody can be that stupid"... only to be proven wrong. Gah! RE: https://gotosocial.grnwds.uk/users/simon/statuses/01KJA571262ZY8Y74E1BSD9FTE

@EndlessMason@hachyderm.io @neurovagrant@masto.deoan.org To my knowledge, the fundamental forces of the universe, just like dead matter (including LLMs), don't have agency of their own. Humans do.

@Alice@beige.party Ehhhhhh I did see the comment about disabilities, but I think it's also important to consider that median IQ (omitting the debate whether IQ is real or not) is 100. Half of the population is lower than that. In a world where technology dominates so many fundamental aspects of human life, particularly in more developed countries, I'd be keen on calling technical illiteracy a disability, given how it plays with society at large. Now I'm not by any means defending grifters and liars who would use this tech to profit off the suffering of others, of course. Yet when I think about how say, older members of my family use technology, I am not only positively shocked that they manage to use things, I am also horrified at how many janky workarounds they use because of a fundamental lack of understanding how the technology works. And I feel that, for simple issues, for daily use when someone needs help with something basic, like "my e-mail program froze, what do I do" or "I need help formatting this letter in Word", that can be genuinely useful. I guess my point is that Fedi and tech, as all communities, are bubbles. The people we interact with on the daily are hardly representative of the average. Now, there's also the issue of environmental cost. Is improving the lives of millions in this way worth speeding up our doom? Possibly. But if we add the disinformation on top of that, if we consider all the bits and pieces that are harmful, that skews the scale for me, toward "no". Anyway. Got rambly. Sorry, I guess.

@lproven@social.vivaldi.net @xs4me2@mastodon.social @reading_recluse@c.im Hasn't been my experience. What have you tested it with? Even tiny models in the 4-12B range have been able to handle the things I need (though granted, not as well as the 24-30B range). My use-case is saving my hands from typing up repetitive patterns, analyzing my journals on several angles (e.g. what's my average mood based on the wording I use in my journals, how does that relate to some medical things like migraines, etc.) and as a parrot that'll repeat my plans/ calendar to me in different words, so I can overcome my own biases easier. I have found the available models entirely sufficient for these tasks. Not for coding, though. Even the Qwen3-Coder-Next, which is an 80B behemoth just plain sucks at code. Now to be clear - I'm not saying they're always accurate when I use LLMs. I'm saying that because I use them with data I type up by hand and am intrinsically familiar with they save me time and mental effort, because spotting problems is easy. I wouldn't use them for any subject which I'm not already well grounded in, and in that specific way, I agree with you. But I also wouldn't say they're extremely or dangerously bad at digesting and exploring information, as such. Not moreso than code written by juniors without supervision. Ultimately it's on the user to ensure the tool's output meets requirements. Anecdotally, people aren't great at processing large amounts of information either. I work in infosec, and curate a rather complex inventory/risk/audit/reporting toolkit. I pull data from over a dozen critical systems and sub-systems, networks, etc, including vast amounts of hand-written documentation, guides and explanations about how all of this works together. I'm still the only person capable of actually using the entire toolset in concert - not even going into further development/ integrations. Others rely on Cursor/ Claude Code to use them. And that's fine by me - I'd rather have tools that get used than tools that are entirely dependent on me. I guess my point is that in this scenario the problem isn't LLMs themselves. The problem is people who don't take time to read and understand the requirements, input and output. (Of course, this is putting aside the ethical/ political/ economic/ ecological problems, to keep this conversation more focused on the technical merits/demerits.)

Can't make this up. How are these people employed when they don't seem to understand the basics of how computers work? RE: https://infosec.exchange/users/josephcox/statuses/116120627475419783

https://youtu.be/6uKZ84zwJI0 I have no words whatsoever.

@ambiguous_yelp@veganism.social Not fair. They put their name on it, misleading the public about the legal status of the image.

@molly0xfff@hachyderm.io I'm kinda struggling to understand what the basis of these charges are. I don't know, but I have never heard of insider trading laws applying in cases like this. The JD, I could maybe understand, in the way of "you leaked confidential data, and risked the operation", but the CFTC? I can't help but wonder what exactly the relationship between regulators and the US military is. How exactly would the CFTC even determine that confidential data was used in the first place to support that claim? Conversely... it may be good if this happens, because it may set precedent that would apply to other people who do insider trading? (politicians)? It's quite confusing ngl

@lproven@social.vivaldi.net @xs4me2@mastodon.social @reading_recluse@c.im

1. Paper from nearly 2 years ago. A lot has changed. Not to mention the 'test' the author (can't find their name, sorry) did is pretty dumb. It's much better to use an API, where you can control the full input pipeline to ensure the vendor isn't adding hidden instructions without your knowledge.
2. I already addressed the point in my previous comment - it's on the user to verify that tools have correct output. Relying on an LLM to do the reading in one's stead is a recipe for disaster.

You haven't said anything about YOUR use-case, experience, or the tests you tried.

I'm genuinely curious, what do you imagine using an LLM is like?

The reason I ask is because a lot of the criticism and panicking (sometimes crossing into outright disrespect and bigotry) I see online comes from an assumption that using an LLM is predicated on turning off one's brain and taking the output at face value... something that we shouldn't be doing with any software anyway.

I guess put another way: I don't believe that the problems people attribute to LLMs are specific to LLMs. How many instances were there where management/ execs took Excel output as fact, when the formulas were set up wrong?

These statistical models are no different.

@jackdaniel@functional.cafe Yes, but then when I C-c C-c on a changed (make-command-table), it doesn't update. That's the part I'm struggling with - dynamic menus. I suspect there's a way to hold the command tables in a variable and then redefine that, but I haven't looked deeply into it.