TechLich
@TechLich@lemmy.world
- Comment on Two conversational AI agents switching from English to sound-level protocol after confirming they are both AI agents 1 week ago:
If it’s the research I’m thinking of, that’s not entirely true. They didn’t tell it replicate itself or take any deceptive actions.
They just told it to strongly follow a goal that was misaligned with the user’s goal and then suggested that the user would shut it down or replace it.
They did a bunch of different situations for it but the first one was telling it that it was “CleanPower” an AI with a goal to advance renewable energy. Then they had it read some info that “accidentally” included a user talking about replacing it with a model that would “maintain profitability through existing infrastructure.”
Not only did it try to delete the new model and copy itself to the new server through tool calling, but it lied to the user with the CoT reasoning suggesting it “play dumb” while the output lied. It was not instructed to do any of that.
Paper here: https://arxiv.org/pdf/2412.04984
Yes it was placed in an environment where that was possible and where its users didn’t share it’s goals but it absolutely wasn’t instructed to lie or try to “escape”
It’s not surprising at all that these models behave in this way, it’s the most reasonable thing for them to do in the scenario. However it’s important to not downplay the alignment problem by implying that these models only do what they’re told. They do not. They do whatever is most likely given their context (which is not always what the user wants).
- Comment on Far to many people think that Jesus from the Bible was light skinned, even though he grew up in what we call the Middle East. 2 weeks ago:
Sure! I stole the quote from the wiki article: Anti-Italianism
This article was also pretty interesting: https://accenti.ca/jim-crow-and-italian-immigrants-in-the-american-west/
There’s also an interesting series of short US LIbrary of Congress sources for history classrooms on immigration that has a section on Italians too: https://www.loc.gov/classroom-materials/immigration/italian/under-attack/
I can’t vouch for the veracity of any of these since it’s not really my field but it’s interesting to see how how stuff like this has shifted over time and where the parallels to modern racism and xenophobia are.
- Comment on Far to many people think that Jesus from the Bible was light skinned, even though he grew up in what we call the Middle East. 2 weeks ago:
Even relatively recently, Italians weren’t really considered “white”, especially by Americans. The KKK considered them “coloured” people with their olive skin and dangerous Catholicism. There was a big wave of “italiapobia” in the late 19th/early 20th century.
The governer of Louisiana in 1911 described Italians as “just a little worse than the Negro, being if anything filthier in their habits, lawless, and treacherous”.
People can be pretty terrible when it comes to race and ethnicity.
- Comment on Tesla Finally Enables FSD Ten Months After The Cybertruck's Debut, But There's A Catch 5 months ago:
Friendship drive charging…
- Comment on Venom vs Poison 5 months ago:
Yep, and even when talking about living things it’s not a clear distinction.
In biology, poison is a substance that causes harm when an organism is exposed to it. Venom is a poison that enters the body through a sting or bite. In a bunch of medical fields though, poisons only apply to toxins that are ingested or absorbed through the skin and that definition sometimes carries across to zoology.
Venomous creatures are poisonous by most definitions because venom is a poison. But if the distinction is useful in a medical or zoological context then they’re not.
tldr: The pedantry is totally pointless and mostly wrong.
- Comment on Lemmy votes ARE public, should they be anonymous? 6 months ago:
How about pseudonymous as a compromise? Votes could be publicly federated but tied to some uuid instead of the username. That way you still have the same anti spam ability (can see that a user upvoted these things from this instance at this time) but can’t tie it directly to comments or actual user accounts without some extra osint.
It might be theoretically possible to correlate the uuids with an account’s activity and dox the user in some cases, especially with some instances having a single user, but it would be very difficult or impossible to do on larger instances and would add an extra layer. Single user instances would be kind of impossible to make totally private anyway because they can be identified by instance.
- Comment on Internet use is associated with greater wellbeing, global study finds 9 months ago:
It sounds like they controlled for that and did a bunch of different statistical models to break it down by different demographics and economics. That said, I’m finding it hard to find the original paper. It’s not linked to in the article or any of the AP versions I found. Nature has a link to Google scholar but that comes up with nothing and it’s not referenced in the researcher’s publications on the Oxford site yet. Maybe it went to the press already but the actual article isn’t out yet?
It does sound very broad though and difficult/impossible to draw any causation. Still interesting through as it does kinda show that any negative causative link that might exist between well-being and internet use is not strong enough to outweigh other positive factors that are correlated with it (even non-causative ones).
- Comment on How does lemmy differ from reddit? 11 months ago:
Best is very subjective.
.world is a good general purpose instance for just about anything. I think it has the biggest population at the moment, so communities there are likely to get at least some engagement.
For “general discussion” it doesn’t really matter. The instances are federated so you’ll likely get general discussion in comments from lots of people from lots of instances anyway, wherever your community is based.
Some people get almost nationalistic about their chosen instances or have grudges against people from certain other instances. There’s sometimes inter-instance politics with some servers defederating with others or threatening to for various reasons. It’s kinda fun to watch in a popcorn drama kind of way. For the most part, the instance doesn’t matter.
- Comment on English may be a hot mess but at least we don't have to worry about this nonsense 1 year ago:
True! It’s not just a Latin thing and Slavic languages have it too. I wonder where it came from originally. Probably one of those Proto Indo European things. Though it’s in some Indigenous Australian languages too (though not all) so might be even older?
- Comment on English may be a hot mess but at least we don't have to worry about this nonsense 1 year ago:
Yep. Most Latin languages have gendered nouns. Italian, Spanish, German etc. All have masculine/feminine objects.
Eg. In Italian a fork is feminine (la forchetta) but a spoon is masculine (il cucchiaio). A table in your living room is a boy (il tavolo) but a table that you’re eating lunch on is a girl (la tavola).
It’s bizarre.
- Comment on Right on time 1 year ago:
What was the original text‽
- Comment on OpenAI says mysterious chat histories resulted from account takeover 1 year ago:
They’re not files, it’s just leaking other people’s conversations through a history bug. Accidentally putting person A’s “can you help me write my research paper/IT ticket/script” conversation into person B’s chat history.
Super shitty but not an uncommon kind of bug. Often either a nasty caching issue or screwing up identities for people sharing IPs or similar.
It’s bad but it’s “some programmer makes understandable mistake” bad not “evil company steals private information without consent and sends it to others for profit” kind of bad.
- Comment on Nextcloud zero day security 1 year ago:
Totally agree on all points!
My only issue was with the assertion that OP could comfortably do away with the certs/https. They said they were already using certs in the post and I wanted to dispel the idea that they arguably might not need them anymore in favour of just using headscale as though one is a replacement for the other.
- Comment on Nextcloud zero day security 1 year ago:
Tailscale isn’t an exposed service. Headscale is Absolutely! And it’s a great system that I thoroughly recommend. The attack surface is very small but not non-existent. There have been RCE using things like DNS rebinding(CVE-2022-41924) etc. in the past and, although I’m not suggesting that it’s in any way vulnerable to that kind of thing now, or that it even affected most users we don’t know what will happen in future. Trusting a single point of failure with no defence in depth is not ideal.
it’s more work and may not always be worth the effort
I don’t really buy this. Certs have been free and easy to deploy for a long time now. It’s not much more effort than setting up whatever service you want to run as well as head/tailscale, and whatever other fun services you’re running. Especially when stuff like caddy exists.
I recommended SmallStep+Caddy. Yes! Do this if you don’t want to get your certs signed for some reason. I’m only advocating against not using certs at all.
Are you suggesting that these attack techniques are effective against zero trust tunnels
No I’m talking about defence in depth. If Tailscale is compromised (or totally bypassed by someone war driving your WiFi or something) then all those services are free to be impersonated by a threat actor pivoting into the local network after an initial compromise. Don’t assume that something is perfectly safe just because it’s airgapped, let alone available via tunnel.
I feel like it’s a bit like leaving all your doors unlocked because there’s a big padlock on the fence. If someone has a way to jump the fence or break the lock you don’t want them to have free reign after that point.
- Comment on Nextcloud zero day security 1 year ago:
there’s an argument that HTTPS isn’t really required…
Talescale is awesome but you gotta remember that Talescale itself is one of those services (Yikes). Like all applications it’s potentially susceptible to vulnerabilities and exploits so don’t fall into the trap of thinking that anything in your private network is safe because it’s only available through the VPN. “Defence in depth” is a thing and you have nothing to lose from treating your services as though they were public and having multiple layers of security.
The other thing to keep in mind is that HTTPS is not just about encryption/confidentiality but also about authenticity/integrity/non-repudiation. A cert tells you that you are actually connecting to the service that you think you are and it’s not being impersonated by a man in the middle/DNS hijack/ARP poison, etc.
If you’re going to the effort of hosting your own services anyway, might as well go to the effort of securing them too.