Salamander

  • 5 Posts
  • 67 Comments
Joined 4 years ago
cake
Cake day: December 19th, 2021

help-circle

  • Definitely, disclosing (either private or publicly) a vulnerability that has been verified is significantly better than passing on the LLM output without verifying it.

    It isn’t my intention to argue one specific case. What I think is that normalizing public disclosure of LLM-inspired vulnerabilities would lead to a wide distribution of cases. We would have some successful cases like yours, and also some cases of the type that I have mentioned. Increase in disclosures will raise the noise floor, and the fact that it is done publicly adds the additional pressure that I mentioned.

    I see your point, but I don’t agree that the benefit of public awareness offsets the increase in noise. This disagreement isn’t rooted in aspects that we can objectively quantify though - we just have a difference of opinion here.


  • And in that world, doing a private disclosure made a lot of sense because you did a lot of hard work to find it, and it wasn’t easy for somebody to replicate. This was valuable and dangerous knowledge that had to be communicated in a responsible fashion.

    Private disclosure still makes sense to me when you add LLMs into the mix. It is possible that an LLM outputs some plausible-sounding story that over-estimates the actual risk and impact of the exploit. If this story is publicly announced to people who use the software but are not capable of assessing these risks themselves, this can easily have a negative unnecessary consequence - for example, people may bring their server down until an expert or developer provides an assessment or fix.

    This is a source of noise, and I don’t agree that this is better than private disclosure. Via public disclosure one is applying a lot of pressure to the developer(s) to prioritize whatever is being disclosed, which may not always be the nicest thing to do, especially if the impact is not as significant as the LLM suggests. This may not have been what happened in your case (I don’t know the details), but I am thinking about the idea of the average person disclosing publicly LLM-discovered vulnerabilities.


  • Salamander@mander.xyztoNew Communities@lemmy.worldLabRats
    link
    fedilink
    English
    arrow-up
    6
    arrow-down
    1
    ·
    29 days ago

    All volunteer efforts are welcome, and using AI tools to support volunteer work is completely reasonable to me.

    I personally value well-crafted human-made art more highly than AI-generated art. If someone wants to invest the time to create original icons and donate them, I am always very happy to see that!

    That said, requiring unpaid contributors to meet a craftsmanship standard before they are allowed to help does not seem constructive to me. Volunteer communities usually work best when people contribute with the time, skills, and tools they actually have available.

    A middle-ground alternative to AI-generated work is searching through Creative Commons assets, but even that still takes time to source, filter, adapt, and integrate. Expecting volunteers to always provide fully custom artwork or spend significant additional time curating assets does not seem like a fair expectation to me.








  • EDIT: After reading through the Git issue and the other comments in this thread, it is not very clear to me what “combining comments from cross-posts on the post screen” means. I understood it at first to mean that you will pool all comments together and show all of them in all cross-posts, but now I am not so sure. Still, in general terms, I think that mechanisms to share activity with niche communities are good

    I would say yes, there are cases in which I have thought that this would be a nice thing to have. Especially when cross-posting to a smaller niche community.

    I can think of a few potential small issues. For example, cross-posters can edit the body of the message, so you might in some cases end up with comments that seem out of place as they refer to the content specific to a cross-post. You also have the rare case in which the same post might mean different things in different communities.

    But, overall, I see it as beneficial. Quirks can be fine-tuned later on.





  • I do take your feedback and other’s seriously. I have looked into it and I also have my concerns about the fit, so I will talk to them.

    If there is an example of mod abuse, a user report can lead to me taking direct action without contacting anyone. But a bad fit is not an emergency, we can talk and resolve it that way.

    Following that same logic I suppose it’s okay for anti-vaxxers, fruitians, naturopaths, chiropractors, acupuncturists and conspiracy theorists to also join the team if they dedicate enough effort towards it.

    If they have positive/valuable interactions with members of the community, enforce the rules fairly, follow the rules, etc… Yes, I don’t mind.

    In this case, the moderator thinking that eating exclusively meat is healthy is not the reason why I think they might not be a good fit to mod that community.

    The user should be a commentator not a moderator,

    I think so too

    backgrounds are important to consider in predicting how they will shape the community

    I do not disagree with you on this. When I said:

    I am quite receptive to specific reports of specific actions, but I am not going to micro-manage users or mods and make assumptions/predictions about potential future behavior.

    I am not saying that the background is not important. I am talking about delegation. The people who create communities and moderate them own them, not me. I (admin level) am not micro-managing the decisions of the community builders and running background checks on users. I respond to reports. In this case, I was responding to the user that tagged me, letting them know that I am alert and ready to respond to reports of mod abuse.

    This is a disappointing response that will cause a schism in the community as I don’t want people like RFK Jr. anywhere near positions of power when it comes to health.

    Why would it be disappointing? This is the drama community! Schism in the community is what we live for!!

    No, but, really. Sorry to disappoint you, and I do appreciate you being attentive to the community and bringing this up.


  • Sure. I do not mind if people hold views that I disagree with, and I am very appreciative of anyone who chooses to donate some of their time and effort to moderation.

    If someone abuses moderation powers to disrupt a local community, let me know and I’ll try to understand the situation, have a chat with them, or possibly remove them if the situation does get out of hand. I am quite receptive to specific reports of specific actions, but I am not going to micro-manage users or mods and make assumptions/predictions about potential future behavior.

    To be specific, in the context of moderating a “public health” community…

    Acceptable: Mod or user posts often scientific articles discussing some positive relationship between the health in communities and eating meat. The user/mod may be biased to post articles that conform to their belief/opinion. If the content they post is high-quality and relevant to public health, and they do not overload the community with this single topic, then it is not a problem. Users are free to contribute on-topic however they’d like.

    Unacceptable: Moderator removes posts about peer-reviewed scientific articles about public health benefits of vegan diets, a reasonable paper pointing out a risk in meat-eating diets, or bans users who make comments arguing against the conclusions or validity of a paper simply because the paper conforms to the mod’s beliefs.

    I think this is reasonable.


  • I bought a National Instrument’s data acquisition card (PCIe-6535B) not knowing that National Instruments is not very Linux-friendly and I was not able to get it working. At least it was a used card so I did not pay to much for it, but I learned my lesson not to assume compatibility.

    Once I also used ‘rm -rvf *’ from my home directory while SSH’d into a supercomputer (I made a syntax error when trying to cd into the folder that I actually wanted to delete). I was able to get my data restored from a backup, but sending that e-mail was a bit embarrassing 😆




  • How did I miss that?!

    My timeline is incorrect then. Since the post from sassymetischick.bsky predates the wiki edit, it is more likely that the wiki edit was made in response to this meme, and not the other way around. This pretty invalidates what I said above…

    I still can’t find any evidence of this being an actual trend, but I no longer have a good guess about the origin.


  • They have gone from:

    Unlike other companies, we don’t sell access to your data. … Nope. Never have, never will. And we protect you from many of the advertisers who do. Firefox products are designed to protect your privacy. That’s a promise.

    To (paraphrasing) “Ahh, well, we don’t have ownership, we just have a nonexclusive, royalty-free, worldwide license for the purpose of doing as you request with the content. We can also process your data as we describe in the Firefox Privacy Policy… Ah, and, of course, we may change the policy in any way we want and you automatically agree with it by continuing using the service”.

    In the past, they used language that included very specific limits on how the data could be used. Now, they make no promises and obfuscate the possibilities by providing ‘examples’ of ways that the data might be used.

    If they were serious about privacy, the minimum would be to be transparent and specific about the data use. The lack of specificity makes it abundantly clear that they intend to use the data in ways that users would disapprove.