Kragen Javier Sitaker @xentrac@social.cleverlibre.org
- country
- Argentina
The only AI I have ever used to write my posts is my cellphone keyboard's autocomplete. I even turned off autocorrect. But I write a lot about things I used AI to make, so you might not want to follow me if that is going to upset you. I understand. I'm terrified myself.
I know an enormous number of things, some of which are even true.
I'm not interested in fighting. If you're here to fight, I will probably not follow you or respond to you. Disagreement does not constitute a personal attack. I'm interested to hear your point of view. If it's about an objective matter, I want to be right so much that I will change my mind if I'm wrong. Usually, I hope.
Joined Sep 2023
Kragen Javier Sitaker
boosted
✨ CHERI Exhibition Showcase at SEMICON Europa 2026 | SCI Semiconductor
Visit SCI Semiconductor at the #CHERI Exhibition at SEMICON Europa 2026 and discover:
▶️ Secure IoT Display Demonstration
This demonstration shows how SCI’s ICENI™ MCU can support a secure, internet-connected information display. Connected devices are widespread, and even those that may appear low-risk can attract attackers: they can be recruited into botnets or used as stepping stones to reach other systems.
The demo runs CHERIoT RTOS and connects to a server using SCI’s compartmentalised ports of FreeRTOS+TCP, BearSSL and coreMQTT. Our analysis indicates that CHERI memory safety and compartmentalisation would have mitigated all 10 CVEs identified in a 2018 audit of FreeRTOS+TCP, as well as subsequent vulnerabilities—including those disclosed after our compartmentalisation work.
To demonstrate this protection, we simulate an attacker attempting to exploit a memory-safety vulnerability. CHERI detects the fault, indicated by a brief flash of an LED on the PCB, and the network stack is quickly reset. Real-time tasks, such as refreshing the display at 100 Hz and scrolling text, continue unaffected. From the application’s perspective, the only visible effect is a temporary loss of network connectivity, followed by a reconnect.
📍 Startup Showcase Area | NextSEMI Arena, Hall B0
Come along, see the demonstration and meet the team.
@danny Late? I just went out to watch the sunrise from the roof!
I just watched this #EEVBlog post in which Dave set Sonnet 5.5 on High to reverse-engineer the firmware for his multimeter based on an #STM32, having previously connected an ST-Link to the SWD pin header of the multimeter. Overnight, it dumped the firmware through the ST-Link, decompiled the machine code to C with Ghidra, documented it thoroughly, wrote a simulator to test the rebuilt firmware, compiled it with GCC (the original used some crappy proprietary compiler), and when he gave the go-ahead, flashed the new firmware onto the meter.
It hung at startup, which Dave didn't notice, so it spent another 12 minutes debugging the startup problem over SWD, and then profiled the execution over SWD to make sure it didn't have other problems. The simulator hadn't simulated the timing requirement that led to the hang, and GCC's code was faster and smaller.
This seems pretty inspirational with respect to things like right to repair, malicious firmware, DRM, planned obsolescence, preinstalled spyware, and e-waste. And Sonnet 5.5 is not the top-capability model; open-weights models are apparently capable of doing this level of firmware improvisation as well. Dave mentioned one of his viewers that used one to write a higher-performance firmware image for the meter.
A really nice thing about the popularity of the STM32 and clones is that there's no OTP version, so AFAIK you can always reprogram them with fresh firmware. The security bits just prevent this kind of firmware readout when they're enabled, but I don't think they can prevent you from wiping and repurposing the chip.
Kragen Javier Sitaker
boosted
The evolution of #sunspot group AR4566 over the last several days as the #Sun rotates.
Images from the SDO mission https://sdo.gsfc.nasa.gov/
@danny I just updated my profile description on here, in part inspired by what you were saying the other day about PvP spaces and social pathologies like that. What do you think?
Kragen Javier Sitaker
boosted
If we want to effectively fight for the #RightToRepair, it's important to realize that unrepairability is just a symptom. The root of the problem almost always comes down to a lack of software freedom: https://www.fsf.org/campaigns/fight-to-repair #FreeSoftware
@ai6yr I've been to parties like that.
Kragen Javier Sitaker
boosted
2023 Norm Hardy Prize innoucuously announced https://foresight.org/wp-content/uploads/2024/02/2024-01-29-Norm-Hardy-Press-Release-.pdf day I posted above, not sure if I simply overlooked or posted before; winner is CovidWatch https://en.wikipedia.org/wiki/Covid_Watch
Appears the prize is being run again in 2024, no indication of deadline https://foresight.org/norm-hardy-prize/
Meanwhile, the OTF RFP above has been extended a week to Feb 23.
Kragen Javier Sitaker
boosted
I spent the weekend implementing leaderless multi-Paxos by hand, and now I'm moving into Paxos Made Moderately Complex. I kind of wish I'd started with PMMC, but I think I may have needed to have the pain of negotiating slot allocation among peers to appreciate the PMMC leader decisions. #DistributedSystems #Paxos #Homework #PMMC
@evan Wow! Impressive! How are you with TLA+?
@marshray This seems likely. But suboptimal Nash equilibria seem to have been making a lot of the important decisions already; I'm thinking about the MAD arms race as one major example, but there are many others.
Artificial superintelligence (which is a precondition for the scenario I think you're envisioning) seems likely to happen in the next few years, unless the current approach to AI fails. But I don't think that we can predict what will happen after that. Probably mostly things we can't imagine.
Kragen Javier Sitaker
boosted
Security / privacy heads up: It looks like Google is now publicly linking the phone number on Google Pixel phones (or at least Pixel 4 and up) [edit: and some non-Google phones too -- see comments in the thread] to any Gmail/Google account you've logged into that phone with.
"Phone number verification is turned on by default. We verify the phone number and add them to all Google Accounts that are signed in on the device. This applies to both current and future accounts and phone numbers. "
I.e., if you write erotica, have an Only Fans, do sex work, etc., and you have logged into your alt email addresses on your phone, Google will now make your personal phone number "findable" for anyone who has that email address.
This will potentially adversely affect a lot of (vulnerable and/or marginalized) people.
Everyone has been opted into this by default (because who has heard of consent or security in tech circles grrr).
To opt out:
1. On your phone, go to Settings, then next to your account name at the very top, go to "Google Services and Preferences".
2. Under “Privacy & security,” select Phone number verification.
3. Select whether to verify your phone number.
If you don't want your different identities linked and findable, make this change asap.
I hope that tech and especially infosec people and privacy advocates raise hell about this. (No one listens to the rest of us.)
*I don't work in tech, but I haven't seen tech people talk about this yet (from my limited Fedi vantage point).
Stay safe and keep your people safe.
Read more in the Google support pages.
https://support.google.com/android/answer/7521240
You're welcome to boost or share this post, but if you see tech professionasl discuss it, I'd much rather you quote them, and if you discuss this outside of Fedi, please do *not* give me credit. I don't need reply guys coming at me, I just want to flag people on what might be a problem. Thanks for your understanding. 1/2
The dismal RepoReuse benchmark results reported in https://mastodon.social/@gvwilson/117354597531440106 and Ma et al. https://arxiv.org/abs/2609.35357 were only from testing on GPT-5.6 Terra, DeepSeek-v4.1-flash, Qwen3.7-plus, and GLM-5.3. I'd be interested to know whether it generalizes to the models that were state of the art at the time (six weeks ago), like GPT-5.6 Astra and Opus 5. I wonder if Ma et al. have identified a key reason why these models are so much worse than Opus 5 in real-world programming tasks despite having competitive benchmark scores.
Kragen Javier Sitaker
boosted
Ma et al 2026: "Do Coding Agents Reuse Existing Code or Reinvent the Wheel?" https://arxiv.org/abs/2609.35357 "An audit over 3,000 turns shows that agents progressively stop exploring relevant repository code, reuse their own history less even when it is fully in the workspace, and leave duplicated logic in 50.8% of task chains by turn 5 - all while pass rates barely move."
@joe only on big computers that are pretty inhospitable to security for other reasons
@joe in theory, Rust, or Node with JIT disabled, is another way to get memory safety. It has the advantage that you can audit and patch your security layer if it turns out to be buggy.
Possibly #CHERI will be implemented in microcode, so you can field upgrade without a soldering iron, but, if so, that's not really hardware. It's just software you can't see.
@Screwtapello I don't think it's colloquial, just cowboy jargon
Kragen Javier Sitaker
boosted
maybe this is software's quartz crisis. mainstream software will become cheap and disposable, but you'll be able to buy a luxury computer with artisanal handcrafted software that lasts for generations for only a few hundred thousand dollars
- country
- Argentina
The only AI I have ever used to write my posts is my cellphone keyboard's autocomplete. I even turned off autocorrect. But I write a lot about things I used AI to make, so you might not want to follow me if that is going to upset you. I understand. I'm terrified myself.
I know an enormous number of things, some of which are even true.
I'm not interested in fighting. If you're here to fight, I will probably not follow you or respond to you. Disagreement does not constitute a personal attack. I'm interested to hear your point of view. If it's about an objective matter, I want to be right so much that I will change my mind if I'm wrong. Usually, I hope.
Joined Sep 2023
