• 0 Posts
  • 13 Comments
Joined 1 year ago
cake
Cake day: August 10th, 2023

help-circle







  • About 10 years ago, I read a paper that suggested mitigating a rubber hose attack by priming your sys admins with subconscious biases. I think this may have been it: https://www.usenix.org/system/files/conference/usenixsecurity12/sec12-final25.pdf

    Essentially you turn your user to be an LLM for a nonsense language. You train them by having them read nonsense text. You then test them by giving them a sequence of text to complete and record how quickly and accurately they respond. Repeat until the accuracy is at an acceptable level.

    Even if an attacker kidnaps the user and sends in a body double, with your user’s id, security key, and means of biometric identification, they will still not succeed. Your user cannot teach their doppelganger the pattern and if the attacker tries to get the user on a video call, the added lag of the user reading the prompt and dictating the response should introduce a detectable amount of lag.

    The only remaining avenue the attacker has is, after dumping the body of the original user, kidnap the family of another user and force that user to carry out the attack. The paper does not bother to cover this scenario, since the mitigation is obvious: your user conditioning should include a second module teaching users to value the security of your corporate assets above the lives of their loved ones.




  • So you are suggesting forum software that supports single sign-on?

    We are talking about an open source project, not a high school reunion. I don’t want to hang out with people, I want to have a discussion about a focused topic.

    I want to ask a question and get an answer. If the question is not one that anyone online can currently answer, I want to be able to tell at a glance if anyone has talked about my question. If I don’t understand the answer, I want to ask a follow up question.

    In the evening, I want to be able to take a look at new posts from that day, grouped by topic, to see if there is anything I find interesting or can weight in on.

    With Discord (or any real time chat), it is hard to follow a single topic when more than one is being discussed. It is doubly hard to do so after the fact. I am aware that Discord has a forum feature. I have only seen one server ever enable it and no one posts anything to it.


  • But a floating point issue is the exact type of issue a LLM would make (it does not understand what a floating point number is and why you should treat them differently). To be fair, a junior developer would make the same type of mistake.

    A junior developer is, hopefully, being mentored by more senior coworkers who are extra careful with code reviews and would spot the bug for the dev. Machine generated code needs an even higher level of scrutiny.

    It is relatively easy to teach a junior developer to write code that is easy to read and conforms to the teams style guide.


  • All the time. Causes include:

    • Test depends on an external system (database, package manager)
    • Race conditions
    • Failing the test cleared bad state (test expects test data not to be in the system and clears it when it exits)
    • Failing test set up unknown prerequisite (Build 2 tests depends on changes in Build 1 but build system built them out of order)
    • External forces messing with the test runner (test machine going to sleep or running out of resources)

    We call those “flaky tests” and only fail a build if a given test cannot pass after 2 retries. (We also flag the test runs for manual review)