Nostr notes by Rob Ricci

Guess what news I was responding to in the groupchat ...

2026-10-28T16:58:27Z

Guess what news I was responding to in the groupchat

Nostr event nevent1qqsrpgx8zlkddxaqchuqh9xuq8xtfedawxrr4gm2g2qhehs2wyvrlpqzyq5df0nnl9u5afulsa7m88mf09ud0ffzvw2ywxnph06dcyzj3n33wqpgwsx

2026-10-28T03:22:34Z

transistor radio implies the existence of cisbrother radio

Wait, they just ... woke up? What kind of shitty haunted castle ...

2026-10-26T01:29:41Z

In reply to nevent1q…vua5
_________________________

Wait, they just ... woke up? What kind of shitty haunted castle is this

#Monsterdon

That portrait gives strong this energy #Monsterdon ...

2026-10-26T01:28:33Z

In reply to nevent1q…rx8p
_________________________

That portrait gives strong this energy

#Monsterdon

Oh shit this place is infested with ATTORNEYS #Monsterdon

2026-10-26T01:24:14Z

In reply to nevent1q…lfxr
_________________________

Oh shit this place is infested with ATTORNEYS

#Monsterdon

This placed has been cursed with excessive theatrical makeup ...

2026-10-26T01:18:44Z

In reply to nevent1q…zuhf
_________________________

This placed has been cursed with excessive theatrical makeup

#Monsterdon

REAL ESTATE TRANSACTION CINEMATIC UNIVERSE! REAL ESTATE ...

2026-10-26T01:15:31Z

In reply to nevent1q…r0a0
_________________________

REAL ESTATE TRANSACTION CINEMATIC UNIVERSE!

REAL ESTATE TRANSACTION CINEMATIC UNIVERSE!

#Monsterdon

Just imagine a world in which Vincent Price played Obi-wan ...

2026-10-26T01:13:14Z

In reply to nevent1q…yt3s
_________________________

Just imagine a world in which Vincent Price played Obi-wan

#Monsterdon

"why yes, I know him, he's me" #Monsterdon

2026-10-26T01:12:28Z

In reply to nevent1q…ry2z
_________________________

"why yes, I know him, he's me"

#Monsterdon

"oh no, not again" #Monsterdon

2026-10-26T01:10:40Z

In reply to nevent1q…tvuk
_________________________

"oh no, not again"

#Monsterdon

where do you get an urn that starts on fire when you toss some ...

2026-10-26T01:08:11Z

In reply to nevent1q…apg6
_________________________

where do you get an urn that starts on fire when you toss some powder in it

and do you think my employer would let me have one in my office

asking for a friend

#Monsterdon

damn, Vincent got some nice calves #Monsterdon

2026-10-26T01:05:41Z

In reply to nevent1q…ukj5
_________________________

damn, Vincent got some nice calves

#Monsterdon

🎶 Lightning crashes, a new mother crieieieieieies ... 🎶 ...

2026-10-26T01:04:44Z

In reply to nevent1q…7c0p
_________________________

🎶 Lightning crashes, a new mother crieieieieieies ... 🎶

#Monsterdon

no butterflies were harmed in the making of this movie, even ...

2026-10-26T01:02:53Z

In reply to nevent1q…9nlt
_________________________

no butterflies were harmed in the making of this movie, even though it really looked like a butterfly would be harmed in the making of this movie, the spider just wasn't up to it

#Monsterdon

(dramatic music continues) #Monsterdon

2026-10-26T01:01:33Z

In reply to nevent1q…eaqj
_________________________

(dramatic music continues)

#Monsterdon

Is Vincent Price going to be in this Vincent Price movie? ...

2026-10-26T00:59:41Z

In reply to nevent1q…ukcm
_________________________

Is Vincent Price going to be in this Vincent Price movie?

#Monsterdon

In two hours, a bunch of us will be participating in #Monsterdon ...

2026-10-25T23:08:29Z

In two hours, a bunch of us will be participating in #Monsterdon , which means LOTS AND LOTS OF TOOTS.

Perhaps you like lots and lots of toots? Great, you will get them.

Perhaps you do not like lots and lots of toots? In that case, you might want to mute the hashtag - in the Mastodon web UI, for example, you can click the hashtag, pick "mute", and it will take you to a screen where you can create a filter for it.

OR maybe you would like to MAKE lots and lots of toots! In that case, check out the #MonsterdonAlert hashtag, and you can learn about what we're watching this week and join in!

Nostr event nevent1qqsq46t7xnsuxamfpq68egpxuy4alsy09qx7943hzr6fsuyc7d0hzgszyq5df0nnl9u5afulsa7m88mf09ud0ffzvw2ywxnph06dcyzj3n33wxj5nt6

2026-10-23T03:06:26Z

You Wouldn't
P an HP

@npub17lq…luhd asked me to write about my mail setup and the ...

2026-10-22T19:31:47Z

Mugahed Izzeldin (npub17lq…luhd) asked me to write about my mail setup and the more I think about it, the more it (my mail setup) frightens me

I want to finish with some thoughts about software quality. The ...

2026-10-22T09:53:31Z

In reply to nevent1q…qnf0
_________________________

I want to finish with some thoughts about software quality.

The vulnerabilities above were, as far as I know, in human-written code. Some or all were found with the aid of LLMs.

If, as some believe, and, yeah, I think there is mounting evidence for this, a lot of future systems are built mostly by LLMs, what do vulnerabilities look like in that world? Is this software more secure? Or less?

I see five reasons to despair and two causes for hope.

The first reason to despair is that the large LLM-built systems that I've spent any time looking at, and which I've seen others' analysis of, are security nightmares. They are full of duplicated, but inconsistent, security checks. They have what you might call a security architecture, but then data flows through them in ways that means that just about anything can happen anyway. They have ad-hoc conditions and arbitrary limits. They are awful.

But wait: won't better models write more secure code? Well, here are my next two reasons to despair.

In order to produce secure code, you have to care about producing secure code, and you have to be able to tell how secure the code is. Yeah, people screw this up. In fact, they *usually* screw it up. But: I think that both of these factors are *often* (not always!) lacking in LLM-generated projects. A major use of LLMs is for people to do things that they are not, themselves, very good at. Makes sense! But if you (not you personally, of course, some other "you") don't have expertise in understanding the security of web applications, well, you're not really going to be able to tell whether the thing the LLM generates for you is very secure, are you? Additionally, our current moment has shifted the balance towards caring about "just building cool new stuff", and away from caring about its security. Again: not new, that's a pretty normal instinct. But, as the value of the code itself gets driven to zero in favor of the value of the product, the value of security is getting driven in the same direction.

Okay, maybe you don't care about the security of the code, and wouldn't be able to tell how secure it was anyway, but surely the LLM "cares" and can tell, right? I don't think so. A major strategy used to improve the quality of code that comes from LLMs is extensive testing. People hate writing tests, but matrix math doesn't hate anything, so you can get it to churn out huge amounts of test cases. Maybe some of them are even good! Then you can follow an iterative improvement process, where the LLM produces code, it gets tested against various things, if it fails, it gets improved until it passes. But security is not so testable. Knowing that something is secure means proving that some undesirable thing *cannot* happen. You can't "prove" something like that through testing, without testing every possible execution (as well as being able to precisely define and identify "what shouldn't happen"!) (I know! I know! Formal methods! I'll get to that in a minute!) Plus, most security vulnerabilities these days involve things like complex orderings in concurrent code, resource exhaustion of various types, complex chains that corrupt values in one place and make use of that corruption much later in other code paths, re-use of the application's own code as "gadgets" to execute attack logic - the kind of stuff that is just a nightmare to test. We're not talking your basic unit test here where you check to see if the code URL-encode values in a string. Tools like fuzz testing, or LLM-based vulnerability search are great auditing tools. But they are slow, expensive, and not really part of iterative development loops. So, no. I don't think testing by agentic loops or semi-antagonistic LLM "teams" is going to make up for lack of careful human oversight.

I don't dispute that LLM-written code is getting, and will continue to get, better. I don't dispute that a person who cares about producing secure code and is capable of understanding its security properties *can* use LLMs to generate code that is as, or maybe even more, secure than human-written code. But I do not believe that the major things driving improvements in LLM code are going to drive us to more secure code.

Fourth, products that, themselves, contain an LLM that is hooked up to "tools" that can interact with something other than just text (coding agents, personal assistants, etc.) have an extremely strange security posture. Most software products are built to protect themselves, and hopefully you, from "external" threats: network attacks, malicious files, that kind of things. But products with an LLM in them have to be built to protect *you* and *the external world* from the *product*. If the product has access to your medial history, and email, then you have to consider the fact that the product might email your medical history to Mark Zuckerberg. Bizarre. Based on what I've seen of coding harnesses and personal agents, we are exceptionally bad, so far, at adapting to this threat model.

Fifth, LLMs generate a lot of code. A LOT of code. They are not limited by exhaustion, boredom, or frustration. They are, to a degree, limited by time, but this is why people use multiple agents to ramp up the code output. The more code, the more it tends to contain vulnerabilities. We've known this forever. Yeah, of course, you can take precautions against it. But that doesn't change the basic math. Vulnerabilities in human code are limited, in part, by the fact that humans only write so much code. If you believe in a world (which, to an extent, we are already in) where LLMs churn out far more code than humans ever did, then you've removed one of the caps we had on how many vulnerabilities were getting created.

Two reasons to be optimistic, though:

First, there's formal methods. These are ways that you *do* get to prove properties - including security properties - about code. Far more powerful than testing it to death. Think mathematical proof of additive identity, instead of exhaustively testing that every integer, when you add zero to it, is still the same. This has historically been a hell of a lot of work, but some parts of the proofs have gotten more mechanized, and people are trying to get LLMs to do some of the other tedious work that has previously made this infeasible for large complex systems. This may work out well. I'll rain on this parade a *little* though, because you still have the problem that you need to be sure that the formal, math-like properties you're proving about the software (a) correspond to the informal things you care about ("does not send my medical history to Mark Zuckerberg"), and (b) are comprehensive. I don't see these being particularly compatible with *most* vibe coding.

Finally, there's a significant chance that the current euphoria (in some quarters, anyway) for churning out huge quantities of code, just because we can, might cool off. This would reduce the "too much code" problem, and may reduce the amount of code generated by people who do not and cannot care about its security. There are, I would propose, limits to how much software we can realistically use - right now, there is plenty of novelty to be grabbed, but eventually we'll reach a sort of saturation again where, yeah, we do still produce a lot of new software, but it's limited by how much software anyone actually *wants*. Perhaps, once Candy Crush *does* start emailing your medical history to Mark Zuckerberg because an ad asked nicely, we might start caring a bit about security, too.

(Okay, I realize, that's pretty much what was going on BEFORE LLMs, and we didn't care then, either, sorry for failing to end on an optimistic note.)

There is another kind of defense that LLMs can potentially be ...

2026-10-22T09:53:05Z

In reply to nevent1q…mkve
_________________________

There is another kind of defense that LLMs can potentially be useful for that I skipped over before. Largely, because my thinking on it is less developed at this point. Yes, LLMs can help us find - and patch - security vulnerabilities. But what about the "LLMs as cops" or "good guy with an LLM" argument, where they are used to provide active defense against the threats from other LLM-discovered vulnerabilities or agent-driven attacks?

This sounds like a dystopia to me. What's the fundamental difference between a cop-agent taking action against a "bad guy" agent, and a cop-agent taking (digital! I'm not talking about RoboCop here - I hope!) action against a person on the network? How can it even know? In the physical world, we have processes for allocating resources to, and limiting, policing. I'm not going to call these processes "good." In the US, for instance, I think we have gone much too far in militarizing our police (along with many other ways we do policing wrong). But now imagine the agentic version of this. SWAT teams, at scale? Whoever has the biggest datacenter gets to enforce their own version of "safety"? It's hard to see how this ends up anywhere other than extreme digital authoritarianism.

This does not rule out LLMs for defense, but positions them as tools for defenders, not agents with a cop badge and a gun.

This phrase seems to have somewhat gone out of style, but when I ...

2026-10-22T09:52:41Z

In reply to nevent1q…8u98
_________________________

This phrase seems to have somewhat gone out of style, but when I was first administering networks, we called people capable of using offensive tools that others built - but unable to build their own - "script kiddies." The idea is that the main resources that a script kiddie has are time and a certain moral vacuity. Not, really, much in the way of expertise.

I think that LLMs already are - and will continue to - enhance security experts' abilities to find exploits. However, these experts tend to be fairly rare, and many of them have specific goals. Think, for example, state intelligence services. Militaries. Corporate espionage. That kind of thing. The limiting factors here are expertise, and the "market" for these services. Seems like at least the latter will probably grow. But my money is not on it growing in a way that fundamentally re-shapes our network environment.

Where LLMs for offense really shine is with the script kiddies, who neither have, not care about, gaining expertise. They want to steal. To extort. They are bored. They have grudges. They want to watch the world burn. Time used to be an important resource here, since it took time to find and use the tools that others made, and to turn that into whatever you were seeking. I suspect time becomes less important with LLMs, since you can (to some extent now, and likely more in the future) turn them loose against targets. This leaves a lack of morality as the main "feature" needed to become a script kiddie.

To me, then, the question as to whether LLMs wreak havoc on the internet as offensive weapons comes down to whether our society maintains, or degrades (or even improves) its moral character. It's not, directly, the technology. It's the people, and whether we let the technology change us and morally de-skill ourselves.

So what do I take away from this? First, we have had days like ...

2026-10-22T09:52:07Z

In reply to nevent1q…5dda
_________________________

So what do I take away from this?

First, we have had days like this before. Not exactly like this, but kind of like this. The first one I personally remember is when the Code Red worm hit in 2001. We didn't run any vulnerable servers, but the huge increase in traffic all over the world just wrecked everything all day. In 2003 there was a remote root exploit in OpenSSH, get root on any machine in the world without a password. In 2008, it was discovered that most Debian machines had the same SSH keypair for the root user, due to a fixed seed when generating them "randomly." Again, free root on a ton of machines. In 2017, Spectre came out kicked off an era of side channel attacks. There are lots of others. So, the world being on fire, all at once, is a thing that has happened before, and a thing that will definitely happen again.

Does AI change this? Yes and no. It *is* being used to find new vulnerabilities. And, as we saw above, the act of fixing a vulnerability, itself, makes the exploit public knowledge too. But you have to do it: you have no idea who else might have already known about it, and even have been exploiting it, quietly. We've had other rounds of tools used to do mass scans of software looking for bug and vulnerabilities: program analysis, fuzzing, etc. Each have kicked off waves of bug reports, then eventually become part of the standard bug-hunting toolkit. That said, LLMs seem to be causing a much bigger wave than earlier tools.

But.

I believe that only *part* of LLMs' effectiveness in finding and exploiting vulnerabilities comes from the technology itself. Yes, they are surprisingly good on both fronts. They do seem to be getting better at it. But you cannot ignore the economic factor: there have been orders of magnitude more investment, over a much shorter time, than any other bug-finding tool. How much of their effectiveness comes from the fact that, right now, a whole lot of people - especially the frontier AI labs - are willing and able to spend tens of billions of dollars training new models and millions of dollars (probably more? a lot more? I haven't seen any estimates so I'll stick with a low number) pointing them at open-source software?

I really don't know the answer to this question, and I don't get the sense that anyone else *really* does, either - we're just going to have to wait and watch and learn. While the system is stuffed full of investors' cash, I expect we're going to get a lot more AI-assisted vulnerability and exploit finds. Does the system transition to being stuffed full of consumers' cash? Does it level off or contract? People have clearly placed their bets, but we have to wait to find out.

And this brings me to another point, which, I must say, is going a bit out on a limb, but which I think is very important - I'd really like to hear people's feedback on this.

Right now, finding and exploiting security vulnerabilities in software is good PR for the AI labs.

Right now, while they are spending money that was invested, not earned, and are desperately pushing for more investment, it makes a lot of sense for them to put special attention into training models for this purpose, and to spend inference money, themselves and with security research partners, on the task.

Look: today, hundreds of thousands? millions? more? of administrators of all kinds spent their day on defense. And they know it was because of AI. Hundreds of millions of other people have heard us complaining, or being awed, or being smug that we don't use NodeJS, or whatever.

It's a very, very good demonstration of the very real effectiveness of the technology.

At some point, the labs need to actually make money, though.

Is this going to be a good way for them to do it, long-term?

Is overall model improvement just going to be so effective that it doesn't matter if they spend money on this specific use case, it'll just keep being great?

It's worth noting that every other bug finding technology has generally followed a trajectory where it's *very* effective at first, opening up new classes of vulnerabilities. Once the kinds of bugs it's good at finding have mostly been found, it's a long, slow path of incremental improvement. Still useful, becomes part of the permanent toolkit, but the shine wears off. If the PR value of finding bugs with LLMs fades, and it becomes just another use case, will it start looking like the other tools in our toolbox? Or is this fundamentally different? I don't trust anyone who thinks they have a definitive answer to this question. My hunch is that we have a bunch of turbulence, then reach a new equilibrium, but I could be wrong.

Oh but wait: we are NOT done. In the late morning, GitLab ...

2026-10-22T09:51:12Z

In reply to nevent1q…xl42
_________________________

Oh but wait: we are NOT done.

In the late morning, GitLab released a patch for an RCE of their own. Completely unrelated (it's not written in PHP). This one didn't have a severity of 9.2 - it had a severity of 10.

We run a sizeable GitLab server, it has 700 users and 2.5k repositories - this is the main thing we have to defend against bots, so we know that they know it's there. (The bots mostly spend their time downloading every diff between every revision of several copies of ... the Linux kernel. Super rare stuff, guys. Never before has so much dumb shit been done in service of "smart" technologies.)

So, we had it down within minutes. Updated and back up 15 minutes later.

Somewhere in this mess, I don't know exactly when, NodeJS releases patches for *their* own high-severity RCE. All supported versions (probably old unsupported ones too.) Again, completely unrelated.

Luckily, we only run one NodeJS thing, and could just firewall it off from everything but the one machine that needs to use it.

(I do, however, run some stuff in my homelab that uses NodeJS. I just pulled it all down, only brought back up the bits that had updated their container images.)

I had a chat with a potential collaborator, went to class, talked with a friend, went home, and fell asleep.

I didn't manage to get my Real Job, giving my feedback on one of my student's papers, done. I'll work on that when I'm done getting this out of my system.

One of the problems we had is that we were on a version of PHP ...

2026-10-22T09:50:50Z

In reply to nevent1q…jr2q
_________________________

One of the problems we had is that we were on a version of PHP that reached end-of-life (EOL) a few months ago. So it didn't get patched, and we had to do a version update in addition to applying the patch. We knew this in advance, one of the reasons why it's good to give folks some warning.

Our code is, let us say, "vintage." It was originally written for PHP 3 (the world is on 8 now). Over the years, we've modernized it and ported it forward, and we were already on an earlier release in the 8.x series, so it wasn't a *huge* jump. But the code has some history, is what I'm saying.

Knowing this, I had done a quick check the night before, and it *seemed* that we were going to get a bunch of warnings about deprecated syntax, but nothing would break.

Luckily, that turned out to be true.

But I spent most of the rest of the day tracking down and fixing deprecation warnings. And installing the fixed code very carefully, hoping no users would notice - seems that they didn't.

So, my research group got ready. We know which of our services ...

2026-10-22T09:50:27Z

In reply to nevent1q…7snf
_________________________

So, my research group got ready. We know which of our services use PHP - we wrote them! We divvied up responsibility for the major services between us. I threw together a quick scanner to check the rest of our IP space in case there was stuff we had forgotten (in fact, there was.)

Some of the machines we had to update were in datacenters. On campus. In our university's off-campus datacenter. On rooftops around our campus. In boxes attached the sides of buildings. In buses (yes, literally) - these, and the rooftop, and building-side nodes are part of our POWDER wireless testbed. Of course, it's 2026, and we visited none of those places - I was in my office, everyone else was at home.

Four of us were ready at 8 AM our time, including someone who was supposed to be leaving on vacation. Shortly before 8, we shut down many of the webservers, and firewalled off others.

As it turns out, the patch was *huge*. (It also came out something like 30 minutes early.) Looks like a re-write of the entire memory allocator, but I haven't dug too far yet. The vulnerability was, as expected, a Remote Code Execution (RCE) vuln - send the right traffic to a vulnerable server, it doesn't matter what application is running inside of PHP, you get to run something else, with the permissions of the webserver, of your choosing.

These are people I've worked with for 10 to 25 years, and it's great to work as a team. We co-ordinated over slack. We all know what each other know. When something goes wrong, we know who to ask. When something needs doing, we know who can do it. Everyone has a common goal, and overlapping, but diverse, expertise.

We build packages for our most of our FreeBSD servers ourselves, and we couldn't start until the patch was out. So a fair amount of time was just waiting for builds to complete. Some of the Linux distributions we use were "late" getting packages into their own repositories. More waiting. We installed new PHP packages, did *very* light testing, brought webservers back up. In one case, we had been planning to move a website to a new server anyway, but this forced our hand - there was some last minute databases syncing and whatnot to do. We had another server that simply cannot be updated, so we carefully cordoned it off so that it can only be reached by the hosts that actually need to contact it. While we were at it, we made sure to revoke the number four from all of our servers.

As the day went on, more of the group came online. Offered encouragement. Lent a hand. Like I said, this is a social process.

A lot of stuff was back up within 30-60 minutes. Some took a few hours.

While waiting for packages to build and stuff to restart, I Posted Through It on social media. It lightened my mood.

We let CloudLab and POWDER users know that everything was clear.

Later in the day, the PHP foundation, which is responsible for ...

2026-10-22T09:49:59Z

In reply to nevent1q…l2vk
_________________________

Later in the day, the PHP foundation, which is responsible for the PHP language that runs a *large* part of the web (estimates on how much vary) announced that they were going to drop a patch for a security vulnerability that affected every single version of PHP going back decades.

Under a common way of scoring the severity of vulnerabilities, this one got a 9.2. Out of 10.

So.

If you don't work in security, you might wonder: why tell us that they were going to release a patch, instead of just releasing it?

Well, once you release the patch, people can start trying to figure out what it fixed. And once they do that, well, they can start developing exploits, and using them.

And this is where, however many words I am into this post, I finally say: "AI"

Based on what we *think* we know now about the vulnerability (-ies, plural, as it turns out), they are somewhat complex to exploit. A few years ago, we would have *probably* assumed that it was going to take a while to make an exploit. In fact, that's *exactly* what happened: a few years ago, apparently, the potential for this vulnerability was noticed, but people didn't, at the time, figure out how to exploit it, so they considered it hypothetical and didn't prioritize fixing it. Recently, it was re-discovered, and an exploit found, with the assistance of an LLM.

But today, the assumption is: once the patch was out there, people would use LLMs to develop exploits, and this would happen *fast*.

The current state of the world is that bots scraping web pages to collect training data for LLMs are *ubiquitous* and *relentless*. My research group has had to battle them many times in the last few months, and we haven't "won," we've just kept the load on our servers to a level where they're still usable for their *actual* purpose. It seems very likely that some of these bots are run by people malicious enough to turn them into botnets that start exploiting this new vulnerability.

So, the current best practice is: let the OS vendors, big companies, clouds, etc. know, so they can start making packages for people to update to. Announce a time, give everyone a little while to get ready.

Here's the first thing that has gone horribly wrong in ...

2026-10-22T09:49:29Z

In reply to nevent1q…4tj2
_________________________

Here's the first thing that has gone horribly wrong in computer security recently.

There are certain secret numbers that, if you know them, you can use to impersonate secure connections to just about any server on the Internet. It may (or will absolutely not, if you are familiar with web security) surprise you to learn that this is actually the normal state of affairs, and it's by design: we, collectively, trust a certain set of organizations, called Certificate Authorities (CAs), to create and safeguard these numbers - you can prove that you know the number without revealing what it is, and if you do this, we trust you to attest to the identity of things like websites. This is called Public Key Cryptography, and it's extremely cool.

This is not the problem (well, it kind of is, but that's a whole different story).

The problem is that yesterday, we learned that one of these secret number is, and has been for about a year: 4.

Yes, *technically* 4 is just as random as any other integer, but this does seem bad, right?

The thing is that these numbers are supposed to be very very long, such that guessing them is infeasible. You can guess 4. I can guess 4. Anyone can guess 4.

I don't think we know the full story yet, but what it looks like is that one of the CAs that almost all of us trust generated some random secret numbers and threw away almost all of the digits, leaving them with secrets like 4, 56, and 155. They've been using them since early 2025. Why didn't someone notice this until now? I think it mostly boils down to (a) the fact that it's not as obvious to notice as my simplistic presentation here makes it sound, and (b) generally speaking, this is not something people are usually looking for (it probably will be now!)

The scramble yesterday was to stop trusting those numbers to secure websites, and to reduce our trust in the CA that "created" them, eMudhra. Did you know you trusted eMudhra? Well, you did.

This kind of situation has been planned for, and there systems in place that help mitigate it in some settings (primarily web browsers). For example, there are public lists maintained of numbers you shouldn't trust anymore: you can "revoke" the number 4, and some (but by no means all) clients will learn about it eventually. It's bad when these secrets are compromised, it's a legitimate major security problem, but things like this have happened before, and they're going to happen again, and there is an (imperfect) system in place to help make it not quite so disastrous.

Thus, for most of us, yesterday afternoon was largely a matter of making sure that software was generally up to date, and having a good laugh at memes about the number four.

Well. Today* was fueled by caffeine and adrenaline. If you're ...

2026-10-22T09:49:06Z

Well.

Today* was fueled by caffeine and adrenaline.

If you're any sort of system administrator, or know any system administrators, you know what I'm talking about.

If you aren't and don't, the short version is that *multiple* pieces of software that form the foundation of large parts of the web were announced to have security vulnerabilities, and there was a mad dash to get things patched before (more) hell broke loose. It started yesterday, escalated several times, and is probably not actually over.

The unavoidable question is: so, is this was our lives are just like now? A life of running fire drills?

To start at the ending, my answers are (and please, realize that these are coming at the end of a long, over-stimulated day, and I'm talking about stuff that's still ongoing, for which we definitely don't have the complete story):

* Sorta, but this was already kinda what our lives were like
* Bad things will happen, probably with some increased frequency, going forward
* The basic problem is, as it always has been, and always will be: people
* Life will go on

Now: I'm not a professional system administrator: I have been in the past, but now I'm a professor. I know quite a fair bit about computer and network security, including doing research in the area, but I'm not an infosec professional. I still play a small but significant role in administering my research group's computing infrastructure, as well as the testbed infrastructures we run for computer scientists, which have tens of thousands of users. So, take this piece with these grains of salt.

Fundamentally, I *like* administering computer systems - it's what drew me to computing research in the first place, and it's why I administer a bunch of stuff at home that I really would be, objectively speaking, better off not administering.

I also *like* working on teams with smart, competent, resourceful people, which is why I don't just computer at home by myself, I work with other faculty, with research staff, with students.

Administering computer systems is a social activity.

* Okay, yesterday. I slept all evening, then wrote for several hours, so technically it was yesterday. But please, let a tired man have his literary devices.

I'm listening to the police scanner, and all it's doing ...

2026-10-22T05:19:58Z

In reply to nevent1q…9pj9
_________________________

I'm listening to the police scanner, and all it's doing is messing with me since I have no idea what I'm listening to. I do know that some cars exist. And some people. There are lots of numbers too.

Oh good, not enough shit going on today (I am, FWIW, not in the ...

2026-10-22T04:50:30Z

Oh good, not enough shit going on today

(I am, FWIW, not in the area mentioned)

Nostr event nevent1qqswfvdq7vaxu72mwhqmmxzcvpzxx6zumefty7mae526qmsrwh9hjngzyq5df0nnl9u5afulsa7m88mf09ud0ffzvw2ywxnph06dcyzj3n33wkvmf0l

2026-10-22T03:07:48Z

The revolution will not be tokenized

People who produce large documents with LLMs seem to frequently ...

2026-10-21T21:22:36Z

People who produce large documents with LLMs seem to frequently be under the impression that the recipient would like to receive a large document

They are pretty much always wrong

Nostr event nevent1qqs89qnynhuq5ezpncx9eazr8mckam7zupty903y84f4fdzs30j4ucszyq5df0nnl9u5afulsa7m88mf09ud0ffzvw2ywxnph06dcyzj3n33wnhd6uq

2026-10-21T20:18:00Z

What a terrible day to have a computer

10-alarm fire for #gitlab installs: ...

2026-10-21T19:39:22Z

10-alarm fire for #gitlab installs: https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-5-1-released/

Every sysadmin tonight ...

2026-10-21T02:04:12Z

Every sysadmin tonight

Ken Thompson, 1983: wouldn't it be awful if someone snuck ...

2026-10-20T21:17:41Z

Ken Thompson, 1983: wouldn't it be awful if someone snuck secret code into a compiler that broke our ability to trust the output of a computer

AI Guy, 2026: wouldn't it be cool if we stuck something we know can't be trusted into every part of the computer

My buddy whose upper management was all-in on AI is reporting ...

2026-10-20T16:28:55Z

My buddy whose upper management was all-in on AI is reporting that management is backtracking after one of the people who was exciting them with AI-generated videos made one of their president giving an (innocuous) speech he never made. Not so exciting when someone does it to you, huh?

In 2015, Shannon Vallor wrote a paper about technology and moral ...

2026-10-20T16:02:26Z

In 2015, Shannon Vallor wrote a paper about technology and moral de-skilling; it is even more relevant now than it was then. This is my take on her argument, extrapolated to 2026.

* Technological changes (as well as social ones) modify the way we spend our time and the types of activities we engage in
* This creates a process of upskilling and deskilling, where we (individually, and as a society) gain new sets of skills while others atrophy - this happens both intentionally, and as an inevitable effect of how we now spend our time
* Acting in accordance with our morals is a skill - it requires intention, practice at recognizing the "right" actions in ambiguous situations, experience to predict outcomes of our choices, and sometimes self-restraint to act against our immediate self-interest in service of outcomes that align with our morals
* The more we use machines and automation for tasks that have a moral dimension, the more we engage in a process of moral deskilling of ourselves

Evidence of many types of deskilling are all around us; skills that used to be common because of their necessity, like knitting, woodworking, hunting, food foraging, etc. are relegated to the margins, have become the realm of specialists, or are treated as hobbies, because we have mostly automated away the need for large segments of the population to engage in them.

Vallor uses examples of warfare (offloading decisions about killing to machines) and caregiving (offloading physical, mental, and emotional support to robots, chatbots, etc.) as cases where we are likely to morally deskill our society; these were somewhat hypothetical in 2015, but it seems clear that we're well along this path in 2026. I think the judicial system, law enforcement, employment decisions, and allocation of resources such as healthcare, education, and social services would also make good examples.The more we automate or outsource these activities, the less good we get at performing them in ways that align with our morals.

While it's easy to think of this in the context of actions that have a clear, classical connection to morality, it operates in much smaller, and more pervasive ways as well. The way we act towards each other - whether we respect each others' dignity, autonomy, time, and humanity. The way we use common, finite, and shared resources. The decisions, large and small, we make about our interactions with the natural environment. Every one of these, and more, has a moral dimension, and the more we put machines between us and the practices of deciding and acting, the more we erode our ability to make moral decisions and to act morally.

We consider people who are skilled at acting morally to be virtuous, and those who are not as having poor moral character. As individuals and as a society, our current technological choices are morally deskilling us, reducing our moral character.

Maybe we should re-consider our relationship with some of this technology, lest we end up in a future where moral reasoning is something that is just done as a hobby, idly, while sitting in a boring lecture, like knitting.

https://bhaven.org/uploads/3/4/0/3/34038663/vallor2015_article_moraldeskillingandupskillingin.pdf

Nostr event nevent1qqs9e8acazvgrl6n4sgd4sr4d4e6zphsw9r0a5a3c4yy30yvnc2y2cqzyq5df0nnl9u5afulsa7m88mf09ud0ffzvw2ywxnph06dcyzj3n33wlu6hq0

2026-10-19T13:31:11Z

the existence of kia implies its negation nokia

Wait, this started in Europe? Are you telling us it came from ...

2026-10-19T01:40:57Z

In reply to nevent1q…fmhx
_________________________

Wait, this started in Europe? Are you telling us it came from GERMany? eh? eh?

#monsterdon

I think that's what Greg Abbot insists on being called, ...

2026-10-19T01:39:18Z

In reply to nevent1q…9vnr
_________________________

I think that's what Greg Abbot insists on being called, right?

#monsterdon

The solution here is clearly billions of tiny wooden stakes, ...

2026-10-19T01:37:02Z

In reply to nevent1q…985q
_________________________

The solution here is clearly billions of tiny wooden stakes, injected via vaccine

#monsterdon

but have you tried killing it with garlic #monsterdon

2026-10-19T01:36:15Z

In reply to nevent1q…wer6
_________________________

but have you tried killing it with garlic

#monsterdon

"Virge" is short for "Virgil" #monsterdon

2026-10-19T01:34:43Z

In reply to nevent1q…40fn
_________________________

"Virge" is short for "Virgil"

#monsterdon

Damnit, Ben, I'm a scientist, not a doctor!!! #monsterdon

2026-10-19T01:33:15Z

In reply to nevent1q…nnma
_________________________

Damnit, Ben, I'm a scientist, not a doctor!!!

#monsterdon

"No way that COVID is airborne, dipshits" #monsterdon

2026-10-19T01:30:27Z

In reply to nevent1q…vhwn
_________________________

"No way that COVID is airborne, dipshits"

#monsterdon

Vincent Price looks very awkward at being a, like, normal guy, ...

2026-10-19T01:29:17Z

In reply to nevent1q…sg3e
_________________________

Vincent Price looks very awkward at being a, like, normal guy, with a family and a camcorder

#monsterdon

That's a good laugh, Vincent #monsterdon

2026-10-19T01:27:49Z

In reply to nevent1q…xh0x
_________________________

That's a good laugh, Vincent

#monsterdon

I just want to point out that a movie called The Last Man On ...

2026-10-19T01:24:49Z

In reply to nevent1q…8rel
_________________________

I just want to point out that a movie called The Last Man On Earth could *technically* still get a Bechdel pass

#monsterdon

no one punches a zombie quite like Vincent #monsterdon

2026-10-19T01:24:04Z

In reply to nevent1q…ag0m
_________________________

no one punches a zombie quite like Vincent

#monsterdon

you wouldn't DOWNLOAD A GARLIC #monsterdon

2026-10-19T01:20:15Z

In reply to nevent1q…zlq5
_________________________

you wouldn't

DOWNLOAD A GARLIC

#monsterdon

I'm sorry, there's no way this character's name is ...

2026-10-19T01:19:30Z

In reply to nevent1q…lhur
_________________________

I'm sorry, there's no way this character's name is Morgan, it's Vincent Price, and that's that

#monsterdon

Uh, look, Vincent, I know that garlic doesn't grow on trees, ...

2026-10-19T01:15:13Z

In reply to nevent1q…u2mv
_________________________

Uh, look, Vincent, I know that garlic doesn't grow on trees, but it DOES grow, you don't need to get it from the grocery store

#monsterdon

corn pit >> body pit #monsterdon

2026-10-19T01:12:23Z

In reply to nevent1q…gse6
_________________________

corn pit >> body pit

#monsterdon

If I were the last man on earth, I'd take the plates off my ...

2026-10-19T01:11:48Z

In reply to nevent1q…7kjz
_________________________

If *I* were the last man on earth, I'd take the plates off my car, FTP

#monsterdon

Incorrect, this is an insufficient amount of garlic #monsterdon

2026-10-19T01:06:20Z

In reply to nevent1q…f9r3
_________________________

Incorrect, this is an insufficient amount of garlic

#monsterdon

"I had a major role in The Last Man on Earth as 'man face ...

2026-10-19T01:01:58Z

In reply to nevent1q…j4k5
_________________________

"I had a major role in The Last Man on Earth as 'man face down on church steps'"

#monsterdon

everything looks 27% more creepy in black and white, that's ...

2026-10-19T01:00:53Z

In reply to nevent1q…rf9q
_________________________

everything looks 27% more creepy in black and white, that's just a fact

#monsterdon

When this post is not ONE but TWO hours old #monsterdon will be ...

2026-10-18T23:14:31Z

When this post is not ONE but TWO hours old #monsterdon will be the Last Hashtag on the Fedi.

That's right, we're watching The Last Man On Earth, starting Vincent ... but at what Price?

It's streaming free (in the US at least ) on Tubi (see also #MonsterdonAlert for some other links too) , so you can watch along! Or, if you don't want a barrage of out of context toots, you could mute the hashtag. Better yet, you could mute ALL OTHER HASHTAGS for the true Last Hashtag on the Fedi experience!

Apple cider donuts! ...

2026-10-17T20:16:53Z

Apple cider donuts!

Me trying to make CD's cool again: "oh, yeah, I've ...

2026-10-11T22:47:12Z

Me trying to make CD's cool again: "oh, yeah, I've got that on foil"

Please get your day off to a good start by enjoying this photo of ...

2026-10-09T12:45:05Z

Please get your day off to a good start by enjoying this photo of Kiki getting some outside time

#fedicats #catsofmastodon

The set of all sets that can contain a little bit of themselves, ...

2026-10-08T23:47:43Z

The set of all sets that can contain a little bit of themselves, as a treat

Nostr event nevent1qqst7kepmc07ffateegrr9dalyc8lmccp23egtx2ucjd5xmgkwhda3szyq5df0nnl9u5afulsa7m88mf09ud0ffzvw2ywxnph06dcyzj3n33whcf8qu

2026-10-08T15:28:17Z

Damn, I hate it when my email gets fixed

"bagel with everything" is a scam by big bagel to sell ...

2026-10-08T15:05:42Z

"bagel with everything" is a scam by big bagel to sell less nothing

"Intro to Computer Science" implies "Outro from ...

2026-10-05T00:37:46Z

"Intro to Computer Science" implies "Outro from Computer Science"

404 WHALE_NOT_FOUND ...

2026-10-04T03:30:19Z

In reply to nevent1q…85dz
_________________________

404 WHALE_NOT_FOUND

If you don't understand how funny this is see the alt text ...

2026-10-04T03:26:29Z

In reply to nevent1q…v32q
_________________________

If you don't understand how funny this is see the alt text for context

The shark was on the Salt Lake County Council for a while ...

2026-10-04T03:20:17Z

In reply to nevent1q…l8sn
_________________________

The shark was on the Salt Lake County Council for a while

There was a costume contest! ...

2026-10-04T03:17:53Z

In reply to nevent1q…vs8e
_________________________

There was a costume contest!

The artist who gave the whale it's new coat, Jiyoun ...

2026-10-04T03:09:23Z

In reply to nevent1q…qugu
_________________________

The artist who gave the whale it's new coat, Jiyoun Lee-Lodge, spoke at Whale Fest. The sculptor of the statue and the previous painter were also there.

How much do you know about the whale and would you like to know ...

2026-10-04T02:59:58Z

How much do you know about the whale and would you like to know more?

I find 'congressperson' (or substitute your local ...

2026-10-04T01:41:18Z

In reply to nevent1q…7st7
_________________________

I find 'congressperson' (or substitute your local equivalent) as a good stand-in for someone with low tech literacy

A buddy of mine works at a place where they did the "please! ...

2026-10-03T17:18:37Z

A buddy of mine works at a place where they did the "please! use as many llm tokes as you can!" to "oh shit this is way more expensive than the people and services we thought it was going to replace" speedrun in just a couple of months.

Their suggestion for reducing token use? "Ask Claude how you can use fewer tokens."

Corporate America is out of ideas, folks

Whale Fest this afternoon! Whale Fest this afternoon! ...

2026-10-03T16:48:12Z

Whale Fest this afternoon! Whale Fest this afternoon!

https://publicart.slc.gov/whale-fest-2026/

OMG I have this problem SO OFTEN trying to get measurement papers ...

2026-10-02T23:38:31Z

In reply to nevent1q…muwx
_________________________

OMG I have this problem SO OFTEN trying to get measurement papers published in academic venues, we answer some interesting question and the reviews are basically "but why didn't you answer this OTHER question", and I just want to respond to say *this is an interesting question and I have answered it, if you want to answer this other question, how about you answer it*

well... what I'm doing is using a list of servers that are ...

2026-10-02T23:33:48Z

In reply to nevent1q…7udz
_________________________

well... what I'm doing is using a list of servers that are currently up, and just getting nodeinfo for them, so I do have a list of *some* historical servers that are gone now, but I doubt it's anywhere near as good as Evan's data.

Someone who might have good data is Minoru (npub156g…qpa2) who has been crawling the lists of federated servers for several years now to make https://nodes.fediverse.party/ (the list I use), and would have probably have a bunch of no-longer-reachable nodes in his database, including ones that were only known by nodes that are themselves no longer up, etc.

Hey, welcome my student @npub17hf…gsvd to the Fediverse!

2026-10-02T05:44:33Z

Hey, welcome my student pkuppili (npub17hf…gsvd) to the Fediverse!

I had a physician named Siri

2026-09-30T23:02:24Z

In reply to nevent1q…m477
_________________________

I had a physician named Siri

LLMs do not return truth. They return answer-shaped text that is, ...

2026-09-30T18:04:06Z

LLMs do not return truth. They return answer-shaped text that is, sometimes, correct.

Unless of course someone configures them to return text that deliberately hides the truth.

https://newrepublic.com/post/216016/trump-rigs-americagov-ai-chatbot-fact-check-lies

I'm looking to hire a project manager! I'm working on a ...

2026-09-29T18:00:06Z

I'm looking to hire a project manager!

I'm working on a project with materials scientists and physicists to build stacked quantum heterostructures, which have potential interesting properties as semiconductors, etc. It's a crazy process that involves crystal growers, driving microscopes with an Xbox controller, a adiabatic demagnetization refrigerators, and exfoliation with scotch tape. We need a project manager to help us ... well, manage the project.

Apply at:

https://utah.peopleadmin.com/postings/209788

Fine to ask me questions here or at ricci at cs dot utah.edu

#getfedihired

The whale is free! ...

2026-09-28T14:48:32Z

The whale is free!

Uh oh I didn't get the memo that physicists and biologists ...

2026-09-24T12:57:11Z

Uh oh I didn't get the memo that physicists and biologists dress better for PI meetings than computer scientists do

At least I have a shirt with buttons

(back)

2026-09-19T02:37:28Z

In reply to nevent1q…ht4d
_________________________

(back)

how do I get this life

2026-09-19T02:37:10Z

In reply to nevent1q…kdl6
_________________________

how do I get this life

gotcha, enjoy missing the point entirely

2026-09-18T15:14:46Z

In reply to nevent1q…qdve
_________________________

gotcha, enjoy missing the point entirely

you are replying to an academic with lots of peer reviewed work. ...

2026-09-18T15:02:43Z

In reply to nevent1q…aqts
_________________________

you are replying to an academic with lots of peer reviewed work. And a book which is, yes, not peer reviewed. But based on her own, and others', peer reviewed work

But please, do go on

congratulations, this is the most ignorant thing I've read ...

2026-09-18T14:59:04Z

In reply to nevent1q…qgch
_________________________

congratulations, this is the most ignorant thing I've read this week, this is for you: 🏆

:darealchef:

2026-09-18T00:41:46Z

In reply to nevent1q…fe5z
_________________________

:darealchef:

Six months ago, I scheduled my regular dental visit for today ...

2026-09-18T00:41:04Z

In reply to nevent1q…qhgw
_________________________

Six months ago, I scheduled my regular dental visit for today

Last week, my primary care physician prescribed some PT for lower back pain, that's where I am right now

They also recommended that I get checked for sleep apnea, and the options for that appointment were today or April

I was having trouble with my primary care portal, and it's right by my dentist, so I stopped by and got that sorted

And my optometrist has had new lenses for me for weeks, but I've been too busy - and they're right by the sleep consultation, so...

I'm in a doctor's waiting room for the fifth time today ...

2026-09-18T00:36:48Z

I'm in a doctor's waiting room for the fifth time today

That kind of seems like a lot, especially given that there's nothing that wrong with me

Nostr event nevent1qqsdvn4ejv9rgq4l79g5er54p8dymu2nu8ug97q390ancgq8fcvt4agzyq5df0nnl9u5afulsa7m88mf09ud0ffzvw2ywxnph06dcyzj3n33wv08u69

2026-09-14T01:34:23Z

Y'all, I'm so tired

Good idea! It's already in my data ...

2026-09-10T14:06:21Z

In reply to nevent1q…gens
_________________________

Good idea! It's already in my data (https://arewedecentralizedyet.online/map/fedi-mau/fedi-mau-geo.json) so it'll be pretty easy to add. Will do when I get some time.

And argh, I swear I fixed the Carto API key thing, I must be installing from a checkout I didn't pull on

I'm not convinced that they will keep growing at that rate - ...

2026-09-10T02:28:26Z

In reply to nevent1q…7y7v
_________________________

I'm not convinced that they will keep growing at that rate - I think we are fairly well along the road of diminishing returns for dollars-to-model-quality.

Yes, models are getting better. I agree.

But I don't think that it's currently true that if you spend 10x as much, you train a model that is 10x better. I'm not going to pretend that I know what the constants of this function are, but I think they are sub-linear. I think that a scenario of ever-increasing amounts of money spent for ever-decreasing marginal improvement is going to make further linear increase in models unlikely.

I'm also not convinced that number of neurons are a great proxy for intelligence - both in terms of comparison to synapses, and in terms of linear scaling. At some point, it used to be easy to convert more transistors on a chip into a commensurate amount of computing but now ... it's not so linear. I don't know if there is such a point of diminishing return for neural nets, and if there is, what it would be but - my hunch is that it likely exists. There are not a lot of things that scale linearly forever.

Thanks for this thought-provoking thread!

I think that one of the things that's so hard about being a ...

2026-09-08T00:19:48Z

I think that one of the things that's so hard about being a tech worker in this era is simultaneously finding out that a lot of people who make less view you as part of the capitalist class while also finding out that your bosses absolutely do not

ohhhhhh

2026-09-06T18:52:31Z

In reply to nevent1q…2rdm
_________________________

ohhhhhh

wait, what did I miss?

2026-09-06T18:45:25Z

In reply to nevent1q…e4gy
_________________________

wait, what did I miss?

"asshole" is a gender, there's even a Unicode symbol ...

2026-09-06T05:35:20Z

"asshole" is a gender, there's even a Unicode symbol for it: ⚵

Nostr event nevent1qqstkw0erh3znfze9plrcv5egephd0lj5mq4x9p3489detzth8chjtczyq5df0nnl9u5afulsa7m88mf09ud0ffzvw2ywxnph06dcyzj3n33w5tav6e

2026-09-06T04:53:44Z