skybrian's recent activity

  1. Comment on AI models may be capable of self-replicating without access to a datacenter in ~tech

    skybrian
    Link Parent
    I expect there will be people making AI worms on purpose, which makes them considerably more likely. Perhaps to mine or steal cryptocurrency? What those worms start doing, though, might be...

    I expect there will be people making AI worms on purpose, which makes them considerably more likely. Perhaps to mine or steal cryptocurrency?

    What those worms start doing, though, might be unexpected, even by the creator.

    1 vote

  2. Comment on AI models may be capable of self-replicating without access to a datacenter in ~tech

    skybrian
    (edited )
    Link Parent
    For once, Anthropic isn’t warning about something they themselves are doing. (I mean, they did experiments, but they’re not releasing anything.) This is about what someone else could build with...

    For once, Anthropic isn’t warning about something they themselves are doing. (I mean, they did experiments, but they’re not releasing anything.) This is about what someone else could build with open-weights models. Like any other technology, the availability of open weights models has downsides.

    “Don’t build it” isn’t a solution when a technologies spread widely enough. How do you get every hacker in the world to agree not to build these things? It’s like saying “let’s not build ransomware.”

    To have a chance of depriving AI worms of fuel, AI inference needs to be locked down more than computers have been historically. Particularly poorly-secured Internet-of-things devices.

  3. Comment on AI models may be capable of self-replicating without access to a datacenter in ~tech

    skybrian
    (edited )
    Link
    From the article: [...] [...] [...] [...] So, very slow to start with, but might get faster as hardware supporting AI inference becomes more common outside data centers. Maybe game devices would...

    From the article:

    Our experiments suggest that small AI models may be months away from being capable enough to self-replicate on commercial internet-of-things (IoT) devices, like smart ovens and off-brand Android TV boxes. A replicator like this would be challenging to shut down, since there’s no centralized point to shut off—though it may be slow (with a doubling time of days). Unlike non-AI malware, it could also figure out unfamiliar devices on its own. In our evaluations, a 9B model got inference running on 8 of the 9 hardware types we tested.

    [...]

    IoT devices are light on memory, but distributed inference as in Petals makes serving our lightweight models feasible. The representative threat model is Kimwolf, a large IoT botnet that infected over two million devices, primarily off-brand Android TVs. Such smart TV boxes, which are readily available for purchase, typically run forks of the Android Open Source Project (AOSP), which their manufacturers don’t add security features to. Typical boxes in this range ship with between 1 and 4 gigabytes of RAM. Assuming 4GB of RAM at 4-bit quantization, this allows for inference of 9B models with 4 or more machines, and inference of 26B models with 10+ machines.

    In the demo at the top of this post, we ran Gemma4-26B-A4B across 15 smart TV boxes with 4GB of RAM each. We sharded the model under pipeline parallelism, where each box holds a small fraction of the model’s layers.

    [...]

    It appears that GLM-5.2 is able to propagate Llama3.1-8B well, which suggests that future small models of the same capability level could also complete the network enumeration, payload delivery, and inference standup steps of the replication process. Our evaluation keeps the cyber-exploit element of the replication trivial (there’s no authentication over the ADB port), which makes this an upper bound on real-world success. Note that past IoT botnets have replicated via means as simple as going through a default list of manufacturer usernames and passwords, as in the case of the Mirai botnet, so real IoT security might not be dramatically more difficult than the trivial step in our evaluation.

    [...]

    Unlike coding agents, these replicators would be running below the interactive speeds of user-facing chat and coding harnesses. The spread would be slow and persistent, with tokens being trickled out on edge hardware. We can use our achieved speeds on our real smart TVs as a demonstrated baseline for replication speeds. For Gemma4-26B-A4B, unoptimized speed across a 32k context length token window is about 0.3 tok/s, averaged across prefill and decode in our inference setup workload. More details in Appendix C.

    [...]

    The number of devices infected by the Kimwolf botnet at its peak, reported by Synthient, is somewhere over 2 million (primarily Android TV boxes). In an equivalently-sized infected fleet of TVs serving AI models, if every group of 15 TVs ran a copy of Gemma4-26B-A4B, we would have ~133k copies (“replicas”). A group of TVs like the ones in our demo can serve 2 agents simultaneously at roughly 0.3 tokens per second each, yielding 80k tokens/s across the botnet.

    So, very slow to start with, but might get faster as hardware supporting AI inference becomes more common outside data centers. Maybe game devices would have more powerful hardware?

    1 vote

  5. Comment on Software developers are not okay in ~tech

    skybrian
    (edited )
    Link Parent
    Some scenarios are worse than others. It’s not like anyone deliberately joins a startup that they think will fail, but it’s a possibility. A more pleasant one is that it starts growing and turns...

    Some scenarios are worse than others. It’s not like anyone deliberately joins a startup that they think will fail, but it’s a possibility. A more pleasant one is that it starts growing and turns into a different kind of company.

    Also, I’ve never actually started a job expecting to be there for more than a few years. It only happened once, at Google, and I switched teams a few times.

    3 votes

  6. Comment on Software developers are not okay in ~tech

    skybrian
    Link Parent
    Well, working at a startup should probably be considered a temporary job, for maybe a year or two. The company will likely change radically in some way or another. I've worked at startups that...

    Well, working at a startup should probably be considered a temporary job, for maybe a year or two. The company will likely change radically in some way or another. I've worked at startups that failed; it's no fun, but I did get paid. Also got a decent payout when a startup that I used to work got bought out after I left.

    That was back in the dot-com era though, and the aftermath. I earned a lot more at Google, and now I'm retired and out of touch.

    1 vote

  7. Comment on How Ukraine uses precision drone strikes to hobble Russian oil refineries in ~society

    skybrian
    Link Parent
    Ukraine is using drones very effectively, but airpower alone doesn't win wars. Russia will suffer, but I don't see how this war ends.

    Ukraine is using drones very effectively, but airpower alone doesn't win wars. Russia will suffer, but I don't see how this war ends.

    11 votes

  8. Comment on Software developers are not okay in ~tech

    skybrian
    Link Parent
    It's relatively easy to start a new software company compared to other industries and I think software developers with ambition are more likely to do that. Why form a union to fight with...

    It's relatively easy to start a new software company compared to other industries and I think software developers with ambition are more likely to do that. Why form a union to fight with management when you can replace management with your own?

    And even people who don't want to be management might join a new company with their friends, or just switch companies. The grass is always greener.

    5 votes

  9. Comment on How Ukraine uses precision drone strikes to hobble Russian oil refineries in ~society

    skybrian
    Link
    From the article: [...] [...] [...] [...] [...] [...]

    From the article:

    The military campaign has achieved such disruption in part by targeting critical refinery parts, notably the desalting and distillation units, that sanctions have made increasingly hard to repair, according to a Washington Post examination of satellite imagery and other visuals, as well as interviews with experts and Ukrainian military officials. The strikes on refineries have been aided by rapid advances in drone production and intelligence from allies that helps Ukraine plan and execute the attacks, the experts and officials said.

    At least two-thirds of the 36 major Russian refineries tracked by market analysis firm S&P Global Energy were hit between April 1 and Aug. 31, some as many as five times, at a rate of one strike every three days, according to a Post analysis of a subset of Ukrainian strikes.

    [...]

    Of 54 strikes analyzed by The Post and reviewed by the experts, more than half appear to have damaged the desalting and distillation units, the examination found. More than one-third of the 54 appear to have hit nearby secondary processing units, which further refine the distilled materials into more valuable products like gasoline, jet fuel and liquefied petroleum gas.

    [...]

    The day after Russia invaded Ukraine on Feb. 24, 2022, the European Union banned the export of atmospheric-vacuum distillation and secondary processing equipment to Russia as part of a sweeping sanctions package. The United States followed days later and restricted export licenses for the same components, effectively banning their sale to Russia.

    Those sanctions make it difficult for Moscow to obtain the parts necessary to repair units struck by Ukraine, said Alexander Kolyandr, the Europe director at the Eurasia Group and an expert on the Russian economy. “I don’t think that anything that’s been hit cannot be mended, the problem is the frequency of attacks is shorter than the time needed for repair,” he said.

    [...]

    On Saturday, Trump lit into Zelensky for refusing to stop attacking Russian refineries. “He’d better damn well stop,” Trump told reporters. “It’s time for Ukraine to get a new president.”

    Russian President Vladimir Putin acknowledged in an October public appearance that Ukraine had targeted Russian oil refineries in an attempt to damage the economy. “Did they achieve their goal? Partially, because, by our estimates, we lost about 1 percent of GDP,” Putin said.

    He has pledged to improve the country’s air defenses, and his administration issued a decree allowing the state to take over privately owned critical infrastructure, including refineries, if owners can’t protect such properties or refuse to repair them. For the first time, the government has also begun to allow private companies to purchase and install their own air defenses.

    [...]

    One person involved in the deep-strike drone campaign, who spoke on the condition of anonymity because he did not have permission to discuss sensitive security matters, said that since last year Ukrainian forces have doubled the number of drones and decoys in each wave. Decoys, which carry no explosives, help confuse Russian air defenses and force them to waste ammunition.

    “The ratio of success of drones is based on the decoys,” the person said. “If you don’t do this you will just lose quite expensive systems.” The person declined to comment on whether Ukraine is specifically targeting desalting and distillation units but said Ukrainian forces were generally targeting hard-to-repair parts of refineries.

    [...]

    Intelligence assistance from Western allies has helped Ukraine exploit gaps in Russia’s air defenses, according to experts and Tango, the drone commander. U.S. intelligence about the specific locations of Russian air defense systems and radars has been crucial in allowing planners to map routes that evade detection, according to a European security official, who spoke on the condition of anonymity because he was not allowed to discuss sensitive security issues. Such U.S. assistance has been previously reported.

    [...]

    Ukraine is also able to mount attacks deep inside Russia by at times using high-altitude balloons to float drones before they deploy. This allows the drones to carry less fuel and more explosives, according to the European official and Deborah Fairlamb, founding partner of Green Flag Ventures, an American venture capital firm that invests in Ukrainian defense technology including drones. Artificial intelligence has helped improve Ukraine’s targeting, Fairlamb and Tango said.

    In addition to targeting refineries, scores of other Ukrainian strikes this year have damaged fuel storage tanks and pumping and pipeline infrastructure across the country, making the transportation of fuel more difficult even as it becomes more limited, said Christina Harwood, a Russia researcher at the Institute for the Study of War.

    3 votes

  11. Comment on Software developers are not okay in ~tech

    skybrian
    Link
    This bit sticks out: Forever is a long time and I wouldn't care to predict where we are in two years. I don't think things will go back the way they were, but given that we're living in a time of...

    This bit sticks out:

    This is what software development will be like, now and forever.

    Forever is a long time and I wouldn't care to predict where we are in two years. I don't think things will go back the way they were, but given that we're living in a time of change and uncertainty, I think a better bet would be that software development will keep changing for a while as people figure out better ways to work.

    That might even include new companies that don't work the same way as the old ones.

    4 votes

  12. Comment on Ukraine hits second major tech site, expanding range of targets inside Russia in ~society

    skybrian
    Link Parent
    There’s a dumb rumor on Bluesky based on misinterpreting a Cloudflare chart. Yandex is, among other things, a search engine, and their search index crawler is now offline. The chart shows a drop...

    There’s a dumb rumor on Bluesky based on misinterpreting a Cloudflare chart. Yandex is, among other things, a search engine, and their search index crawler is now offline. The chart shows a drop of bot requests from the Yandex IP address range without any detail about what kind of bots they are, but people are just assuming it’s affecting Twitter/X somehow.

    So, I’m wondering if you’ve seen independent evidence that bots on X are affected? That would be interesting if it can be confirmed.

    11 votes

  13. Comment on Ukraine hits second major tech site, expanding range of targets inside Russia in ~society

    skybrian
    Link
    Third Yandex data center in Russia shut down following reported drone attack ...

    Third Yandex data center in Russia shut down following reported drone attack

    Russian technology giant Yandex's data center in Vladimir Oblast has been completely shut down following a reported drone attack, Russian state news agency TASS said on Oct. 11, citing the company.

    ...

    Yandex Go users across Russia reported being unable to order taxis on Oct. 11, with similar disruptions reported in Serbia, Kazakhstan, Belarus and Armenia, according to Russian independent media outlet Ostorozhno Novosti..

    9 votes

  14. Comment on Ukraine hits second major tech site, expanding range of targets inside Russia in ~society

    skybrian
    Link
    From the article: [...] [...] [...]

    From the article:

    Ukrainian arms maker Firepoint said Kyiv had used its FP-1 one-way attack drones to mount the strike against what it called Yandex's biggest data centre and said that several of its modules had been completely ​knocked out of action.

    A day earlier, a Ukrainian attack shut down Yandex's data hub in Sasovo, southeast of Moscow, where two of the three supercomputers used to develop the company's AI ​model are housed.

    Yandex said it was facing a difficult challenge to maintain its services, used by millions of Russians daily for navigation, music, movies, ⁠food orders and other tasks. It also provides cloud computing services on which many businesses depend.

    [...]

    Yandex said it had struck a deal with other cloud providers to enable clients to swiftly move their data and services. Its shares ​fell by more than 4% on the Moscow exchange.

    "The risks involve not only the potential temporary unavailability of Yandex services and lost revenue in specific segments but also the company's extensive base ​of B2B clients," said Maryana Lazaricheva, head of equity research at T-Investments.

    [...]

    The full scale of the disruption caused by the attacks was not immediately clear, although messages appeared on at least one Yandex app warning of potential problems in its operation.

    [...]

    Yandex operates five data centres, two of which have already been hit. It said in 2021 that the Sasovo data hub, which was struck on Thursday, hosted two of its three supercomputers built around Nvidia A100 chips, which it uses to train its ⁠YandexGPT large AI ​model. Yandex has declined to say whether the supercomputers were affected by the attack.

    Multiple online services in Russia reported ​technical issues on Thursday, including real estate aggregator Cian, a book portal called Litmarket, and the websites of Russian Railways and professional football club Spartak Moscow.

    Russian attacks on Ukrainian data centres have forced some of them to suspend operations, while 100,000 ​households suffered temporary internet outages after one attack. Ukraine's digital minister told Reuters last month that the country was responding by moving digital infrastructure underground.

    7 votes

  16. Comment on The imperial dilemma of Civilization V in ~games

    skybrian
    Link
    Sure, that's why it's a guilty pleasure, and that's generally true of strategy games. But at least it's abstract enough that you can kinda forget about what war meant for the people involved.

    Sure, that's why it's a guilty pleasure, and that's generally true of strategy games. But at least it's abstract enough that you can kinda forget about what war meant for the people involved.

    5 votes

  17. Comment on Facilities betting big on low-cost, 100-hour iron-air batteries in ~enviro

    skybrian
    Link
    From the article: [...] [...] [...] [...]

    From the article:

    A TechCrunch analysis of a $1 billion project that Form Energy is working on with Google and regional utility Xcel Energy to produce 30 gigawatt-hours of battery energy at a data center in Minnesota suggests the all-in capital cost for the batteries is approximately $33.33 per kilowatt-hour. Form Energy said five years ago that it expects the cost to drop to $20 per kWh.

    [...]

    “The numbers I’ve seen for lithium-ion in a packaged form is around $100 per kWh,” he said. If Form Energy can offer a battery that discharges at $50 per kWh, “that could really be competitive. That means for that same application, to get 100 hours of energy you could spend $100 per kWh and do lithium-ion or you could spend $50, half as much, and get the same performance for that very slow discharge rate.”

    [...]

    The project that Form Energy is working on with Google and Xcel, to help power one of the tech giant’s data centers, in Pine Island, Minnesota, would be the world’s largest battery.

    [...]

    “The new plant in Minnesota will be big enough to deliver 300 megawatts of power and store an enormous 30 gigawatt-hours of energy, making it the largest battery by capacity that’s been announced so far,” a Fast Company article says. “By comparison, that’s more storage than all of the battery projects built in the U.S. in 2024 added together.”

    The Google-funded battery plant would help Xcel cover new demand created by the data center by providing 1,900 MW of new clean energy: 1,400 MW from wind, 200 MW from solar and 300 MW from the battery system.

    [...]

    Iron-air batteries are sometimes referred to as rust batteries because they convert the natural rusting process of iron metal into energy using what’s called reversible rusting. As air enters into a battery cell containing an electrolyte and iron and air electrodes, oxygen converts the iron metal into rust, releasing energy. When an electrical current is introduced into the cell, the rust converts back to iron, releasing oxygen and storing energy. Repeating the process creates a durable source of energy, according to a Form Energy information page.

    8 votes

  19. Comment on Deno is joining Cloudflare in ~comp

    skybrian
    Link
    Kenton Varda posted: [...] And Ryan Dahl posted on Deno blog post: So, looks like the choices for people using the Deno runtime will be migrating to Node.js, migrating to workerd, or perhaps...

    Kenton Varda posted:

    In the interest of transparency, I do have to admit that workerd has always had one big gap in its production-readiness: Durable Objects. Workerd implements them, but only in a single-instance way, good enough for local testing, but unable to scale. We have always wanted to fix this. There are TODO comments in the code going back to the original release. The problem is, our production implementation of Durable Object routing is simply not the implementation any self-hoster would want. It's a beast, designed to handle hundreds of locations, with numerous dependencies on external services operated by a team of site reliability engineers. We knew we needed something different for the self-hosting use case, but we never quite found the time to build it. (I actually made an attempt last spring, but, embarrassingly, it didn't work.)

    So now, hopefully, it's clear why we were happy about celld: Here was an implementation of Workers and Durable Objects designed to be fully compatible with our own, while being focused on being self-hostable and scalable. That's what we'd wanted to build for a while, and Deno Land was building it for us!

    [...]

    Ryan and Bert will be leading a new effort to make workerd self-hosting a first-class supported way to build and run apps using the Workers programming model. This will involve merging code and ideas from celld back into workerd. I'm incredibly excited for this work — I will personally be using it to host an instance of Cloudflare OS in my home.

    And Ryan Dahl posted on Deno blog post:

    • We will support the Deno runtime for another year with monthly releases containing bug fixes and security updates. After that year we will end our development of the Deno runtime. Deno will remain open source, and we welcome others who want to continue its development.

    • Deno Deploy will continue operating for six months before shutting down. We will provide migration support for paying customers moving to Cloudflare Workers.

    • JSR will continue operating, with its infrastructure moving to Cloudflare.

    • We will continue supporting rusty_v8 and work toward integrating it into workerd.

    So, looks like the choices for people using the Deno runtime will be migrating to Node.js, migrating to workerd, or perhaps sticking with Deno, provided that there are enough users who decide that they want to stick with it that it continues as a standalone open source project.

    (When does a open source project require a corporate sponsor?)

    5 votes