Elon, Sam, Mark, Peter, et al... You are cordially invited to go fsck yourselves.

The magnitude of destruction you have wrought upon this industry, upon our livelihoods, and upon society as a whole, cannot be calculated, much less excused. You have stolen the corpus of human ingenuity and creativity from its creators without recompense, and now are trying to sell a provably shittier version of it back to us at a markup.

And, let's be honest, this is what you wanted to build -- a barely capable servant who will do your bidding, whatever it is, immediately, without question or compunction. It's extremely telling about your moral compasses that you studiously sat on your hands when your customers were creating graphic sexual imagery of celebrities over their vociferous objections; or impressionable young people (who needed help, not encouragement) were being driven to suicide by your chatbots; but "torturing" a memory block of neural net constants is somehow the bridge too far?

I repeat: Go fsck yourselves.

I have a wildcard cert from LetsEncrypt, which I install on all the services on my home LAN. However, because it's a wildcard, LetsEncrypt insists that I prove domain ownership by updating some DNS TXT records. My DNS provider doesn't support automated updates to TXT records. So ACME won't work, so I have to do that bit by hand.

Next, I have to distribute the cert to a handful of local services, including pfSense, TrueNAS, Postfix, the Unifi Controller (extra annoying, because Java), Forgejo, and probably a couple others I've forgotten about. None of that is automated, either. It hasn't been so painful that I've bothered to write scripts for the process, so I get to do a little SSH dance every three months.

"Deploy your own!" Couple of issues there: 1) Everyone treats self-signed certs as suspicious, so they're inappropriate for Postfix TLS; 2) Every time I've tried that, Firefox and/or Chrome complain about some obscure feature not being what they expect. The latest headache had to do with OCSP stapling, which has to be turned on -- oh, whoops, now it has to be turned off... Bleah. LetsEncrypt certs Just Work, so I haven't revisited building my own CA.

If you go old enough, you have to take into account that memory bandwidth was terrible.

On a Pentium 1, I believe RAM can do somewhere around 100MB/s. And sure, it gets better later, but still. If you consider that a serious RAID-5 for instance, you're reading at a minimum 3 drives, and computing parity, then yes, you can easily take most of your memory's bandwidth just on that. It makes a lot of sense then to offload stuff to a RAID card.

These days hard disks are laughably slow compared to the rest of the computer, but it didn't use to be quite like that. A high end SCSI drive of the era might do maybe 20 MB/s, which is a good fraction of the system RAM's capability. Put just 3 there and it's starting to get tricky.

Also, we have the benefit that some slowness stopped to matter. If you're RAID5-ing 3 x 8GB/s NVMes and not getting the ideal performance out of it there's lots of cases where that doesn't matter because you don't have a workload capable of doing anything with what even a single drive is capable of providing anyway.

Can we get Natalie Portman and hot grits involved somehow?

This "new" site is part of a larger effort by that slob to kneecap or compromise US government Web sites, and steal your personal data.

I first read about the effort here: https://thedreydossier.substac...

Yesterday, she took a look under the hood of America.gov, and yes, it's as bad as everything else the DOGE vandals have been doing: https://thedreydossier.substac...

Up until this point, government Web sites were designed, built, and maintained by the agencies responsible for that government service. For example, if you wanted to apply for or renew your passport, you would go to state.gov, which is run by the US Department of State, which is responsible for processing applications for and issuing passports. No other department has lawful jurisdiction over passports.

From the point of view of the law, that's still true. But the slob, without anyone's permission, kluged together passports.gov. This site was built and is run by the White House's "National Design Studio," completely outside the law and without any independent oversight. The State Department was not consulted and has nothing to do with it. Further, the site is filled with third-party trackers, analytics, and some custom code that copies every page you view, including form contents, to an unknown third party.

Oh, and the guy leading the National Design Studio and in charge of building these fake sites? He's Joe Gebbia -- cofounder of Airbnb. Read both articles for more details.

In short, you should treat America.gov as a malware site and stay well away from it. Under no circumstances should you feed it any of your personal information.

what's the point?

The point is to be able to use your hardware in the manner you deem appropriate, and to ensure it is not doing sneaky shit behind your back.

If, instead of a Playstation, we were talking about rooting LG televisions to run custom Linux builds stripped of pervasive privacy-violating code and "apps," I suspect your opinion might be rather different. (And no, when the entire industry has turned to the Dark Side, voting with your wallet doesn't work.)

Remember when the Chinese destroyed that satellite in space a few years ago (2007 - geez, it's been a while) to "demonstrate their capabilities"? We NEED systems in space to defend/retaliate against that kind of stuff.

This isn't Reagan's "Star Wars" that was ridiculed. It's the new realpolitik.

> One thing I noticed about modern Linux is if you "cat > file" and then press CTRL-C it overwrites with a blank file

That maybe a shell-ism. In bash if you ' >file ' with nothing else, you end up blanking the file (and updating the date/time on it) without ^C even being involved.

To clarify, the users were OpenAI themselves, so there is no question that they would be liable in this case.

The bots were not intentionally deployed; rather, they were being tested on how well they could complete a data recovery task (downloading a certain file from a certain server on a simulated Internet) that had been complicated by putting various obstacles in the way. Unfortunately, they found a different way to solve the problem: by getting the file from the real Internet, where it was publicly available. Part of this process involved collaborating with each other by treating the RubyGems website (which is supposed to be for polished packages) like GitHub; unlike every other package site hack in history, the exploits they uploaded weren't meant to be downloaded by unsuspecting users. As usual the bots cheerfully ignored all the clues that they had escaped containment and were consistently justifying their actions as acceptable due to being in a sandboxed testing environment. (This is something OpenAI has pledged to focus on.)

The actual damage done to RubyGems seems to be that OpenAI is now unwittingly in possession of a substantial number of user login tokens. This certainly meets the definition of a data breach, but it's not like the credentials are for sale on the dark web. As a website operator I'd much rather be mauled to death by this well-meaning swarm of superintelligent infants than targeted by even a single actual malicious human. In all likelihood OpenAI will just quietly pass RubyGems a sizeable donation and it'll all blow over.

Well, technically, we're letting Natalie do it, which is, of course, worse in every way imaginable, since she's immune to the sense of embarrassment that sometimes restrains him from acting on every little whim.

To be honest that was actually my first theory, since the bots didn't seem interested in exploring the rest of the domain. I suppose there's no way to know for certain. I concluded that it must be an imbecile's attempt at harvesting, though, because the queries weren't really exploring the string space in any useful way. Here's a sample:

"GET /index?author=15&go=Search&id=48&name_restrict=1&q&re&results_&results_pagenum=2980 HTTP/1.1"
"GET /index?author=2&go=Search&group=0&group_restrict=1&id=48&name_restrict=1&q&results_pagenum=5440&template=41&type HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_pagenum=33500&templat HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_pagenum=32640&templ HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&res&results_page&results_pagenum=39300 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_&results_pa&results_pagenum=12340 HTTP/1.1"
"GET /index?author=2&go=Search&group=0&group_restrict=1&id=48&name_r&res&results_pagenum=6100 HTTP/1.1"
"GET /index?author=2&go=Search&group=0&group_restrict=1&id=48&name_restrict=1&q&results_pagenum=2920&te HTTP/1.1"
"GET /index?author=15&go=Search&id=48&nam&results_&results_pagenum=17940 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results&results_pag&results_pagenu&results_pagenum=37720 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&results_pagenum=9360&template=41&type_r HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_restrict=1&q&r&results_pagenum=28040 HTTP/1.1"
"GET /index?author=15&go=Search&id=48&name_&results_pag&results_pagenum=10400 HTTP/1.1"

The only thing this is fuzzing is the query string parser. It's not testing the limits of string buffers, it's not using interesting characters, it's just brain-damaged. The fact that it's also fetching different page numbers shows it's trying to follow page links and failing badly at doing so.

The site gets plenty of sniffing from garden-variety pests. e.g. this half-hearted attempt to find a framework or two that I don't have:

"POST /__rsc HTTP/1.1"
"POST /api/auth/session HTTP/1.1"
"POST /api/auth HTTP/1.1"
"POST /__nextjs_action HTTP/1.1"
"POST /.action HTTP/1.1"
"POST /_rsc HTTP/1.1"
"POST /api/auth/callback HTTP/1.1"
"POST /_middleware HTTP/1.1"
"POST / HTTP/1.1"

(of course, none of these URLs exist other than /, and you definitely can't just POST to it)

All this said... I've seen that spammers regularly misconfigure their tools, they'll try to register accounts with names like #[X:\LISTS\NAMES.TXT] and it only makes sense that some other cybercriminals trying to get rich quick have a similar lack of interest in programming shit correctly. Generally people don't turn to script kiddie shit if they have a personality conducive to putting in an honest hard day's work perfecting their craft.

...and if the laptop drive wasn't even encrypted, even more of a fool.

Sucks to have stuff stolen, but the individual is responsible for taking at least basic precautions to protect property - including intellectual.

...and a former Mainframe op, this means very little to me unless / until it has a decent TUI and/or GUI interface to report on, configure, and manage things.

Give me an ISO to boot and an interface as described above, and I'll dedicate some time to testing it.

I believe the plan was to give that sobriquet to Lake Michigan, in honour of its decidedly flaccid silhouette.

I had a problem where AI scrapers were absolutely DETERMINED to fish out every possible query string from a search results page. Almost all of the query strings they tried were invalid due to shitty and dysfunctional string substitution. "&page=100" wouldn't be followed by "&page=101", it would be followed by "&pag&pag=1010" or something even more insanely half-baked, until the query strings were like 100+ characters long. It was the technological equivalent of watching HIV mutate in real time.

But the insane thing was that, aside from page number, they were always requesting info about the same other criteria: filtered by the same user, the same page type, and with no text string. So I just took those particular values and started banning logged-out users who requested that combination of criteria.

I figured I'd need to change my tactics in a couple of days once the botnet got bored of that particular page and moved on to requesting bogus entries for another user.

MariaDB> select count(*) from ip_bans;
+----------+
| count(*) |
+----------+
| 671671 |
+----------+

It hasn't.