mikewarot

I'm very strongly in camp 1. My reaction to this whole bru-ha-ha has been to start trying to build an open source data diode with entry/exit proxies that nets out to less than $100 retail. So far I've determined that while a WaveShare RP2350-ETH seemed like it might be perfect for it, the onboard CH2910 chip just isn't up to the requirements for the various proxies that have to be handled. I'm now moving on to the Raspberry Pi B+, yes, the old one, with no wireless at all, Adafruit still had some in stock. Once I get this working, I'll likely use something like a 6N137 optocoupler for the actual data-diode between two serial ports, with a data fountain handling the egress of data in a hard unidirectional manner.

Given the enormous burn rates that these LLM companies have, surely they could have put everything in an air-gapped network, with some data-diodes proxying out the logging information. It's not rocket surgery. [1,2,3]

I think someone involved in this needs to be prosecuted, the threat of prison time might be a strong enough incentive.

It would also be good if there were legislation requiring that a State Licensed Professional Engineer sign off on the testing systems for LLM training over a given threshold.

[1] https://www.youtube.com/watch?v=JBIR8dKX_UA

[2] https://www.elonx.net/spacex-stories-how-spacex-used-tin-sni...

[3] https://ntrs.nasa.gov/api/citations/19770014245/downloads/19...

I've never strongly agreed with the max karma thing, but I do know I stopped paying attention once I reached 10k, so I know it has subtle persistent nudging effects. I don't know what I would use as a handle if I tried to reset things, as my name seems to work well for remembering my ID. It's nice to have a fairly Internet Unique name... I've only found one other Mike Warot so far. (He works at the British Museum)

I'm retired, with long Covid, so personally, I'm going to be here until I age out, or get kicked out for banging on about data diodes one too many times.

Good luck with your future endeavors.

Software product manager might be a good fit. Personally, I'd go with programmer, the same thing I've used for decades. Being retired does remove the need for title inflation.

Since there's no statutory legal liability for the product of one's work, nor state licensure, the term Engineer isn't appropriate, and never has been. (But that's a pet peeve of mine, apparently not shared by the majority here)

The point is to have a reliable way to distinguish someone who actually accepts responsibility for the systems they build, from programmers with title inflation.

You can't easily discuss or legislate things that don't have solid definitions.

1632 by Eric Flint is an interesting exercise in alternative history. He extensively studied the real town of Mannington, West Virginia and used it as the basis of Grantville, a town that is transported from 2000 back in time to late 1631 in Thuringa, Germany during the 30 years war.

It was quite an engaging read, and lead to a series. You'll learn lots about the infrastructure of civilization along the way.

Nothing is supposed to ingress, that's the point. You'd do a TLS exchange with the proxy on the outside of the protected network. Then proceed as normal.

The short term solution to this problem may be to burn gigatons of liquid sodium in the exhaust of jet engines in the stratosphere.[1]

If you burn liquid sodium in steam, you end up with sodium bicarbonate particulate of just about the right size to offset global warming.[2]

[1] https://ntrs.nasa.gov/api/citations/20250000498/downloads/Re...

[2] https://www.youtube.com/watch?v=ST49jDo4d-Q

> In fact, in some Canadian provinces, titles in computing such as “software engineer,” “computer engineer,” and others containing “engineer” are (in principle) reserved for people licensed as engineers by the provincial engineering regulator.

A most rational stance. One we should enforce here in the US.

Edit: Yes, I'm arguing that Software Engineer should be a licensed profession, but programmer shouldn't, and would be a fine substitution in the cases where you didn't need rigor.

--

If I were an engineer, there's no way I would trust any interface to a control system for a water purification plant that connected to the internet and allowed for ingress of control. Just as an example.

The OPM hack of 2015[1] is the worst case, in terms of national security, that clearly proves no Engineers were involved in the design of their computer system. Ingress of control should be absolutely prohibited, and it wasn't. I don't know why that database was ever put into a computer, instead of filing cabinets in a vault, nor why it was ever connected to any other system, and not completely air-gapped in said vault, with manual controlled exfiltration of data upon request.

[1] https://en.wikipedia.org/wiki/2015_Office_of_Personnel_Manag...

Every since the OPM hack of 2015, I've been apparent to me that my former field of IT administration has lost the plot. Nobody knows what a data diode is, or why you would use one. Systems that should clearly be air-gapped aren't.

While it's easy to lay this at the feet of AI getting better at hacking. I see it as an primarily an IT issue. We've collectively ignored the lessons of history, and made do with patch jobs over poorly chosen operating systems instead.

--

We need air gaps, data diodes, and capability based operating systems. Now that I'm retired, when I have the energy, I'm working on the data diode part.

This weeks lesson for me, personally, as I try to build an open source data diode, is that the Waveshare RP2350-ETH is a horrible choice for a proxy/data source/sink, as the CH9120 ethernet interface can't do promiscuous mode. It might still be sufficient to build a data diode that can mirror a website, with << $50 component cost. Time will tell.

They missed two big causes.

#1 Hording: If you've got a house full of crap, and you're deeply ashamed of it, you're not going to be having visitors over, ever. You're also not going to mention it on surveys.

We, the American public, have been collecting shit at a prodigious rate. Many of us pay rent for stuff that won't fit in our home. It's why the storage industry is so reliably profitable.

#2 Paranoia: Otis Toole[1] kidnapped then killed Adam Walsh. His father publicised his kidnapping, and fueled a moral panic that sent American parents deep into paranoia. Kids used to be free range, and were often collectively instructed to "go outside to play, and come inside when the street lights come on". After that event, we're afraid to even let them walk to a friends house a few doors over.

The end of the fairness rule, and the rise of fear based media like Fox news certainly didn't help in the rise of distrust.

[1] https://en.wikipedia.org/wiki/Ottis_Toole#Murder_of_Adam_Wal...

[2] https://en.wikipedia.org/wiki/Off-by-one_error

It seems to me what they're actually demonstrating here is who has the least competent IT staff. If you're testing a model with potentially superhuman hacking abilities, why the fsck wasn't it completely air-gapped from the internet?

You're burning through Billions of dollars of investment, and you can't be bothered to spend a bit of resources keeping it completely offline?

WTF?

In the olden times, students started off with a micrometer, a file, and a block of steel, and had to make a perfect 1" cube as part of their studies in the first year.

You can start really cheap with just basic hand tools, there are lots of bench size machine tools, like mills and lathes, that come onto the market as their owners age out.

Know that if you do get a mill, lathe, CNC, etc... fixtures, jigs and cutting tools will cost at least as much as the tool itself. All the things like vices, t-slot hold down kits, various milling and lathe bits add up fast.

Most of the newer to us (1990s+) radio test gear has embedded versions of Windows running the controller. It's much easier than writing custom firmware that hands all the file system I/O for dealing storage, building a GUI, etc.

One of the greatest features of FreePascal is that strings are managed. You never allocate or deallocate them, you just declare the variable, and it manages them. They're counted, reference counted, copy on write, and can hold gigabytes.

According to google:

When you assign one dynamic string to another, Free Pascal does not duplicate the actual characters in memory. Instead, both variables point to the same character buffer in the heap, and the runtime increments an internal reference counter. A physical memory copy is only triggered when one of the string instances is modified (written to)

Free Pascal strings are as close as you get to magic, compared to C/C++.

Ward Christensen taught me the joy of hacking, just modifying things to suit my will. He once told me that he heard "You can't write programs in assembler for OS/2" at work at IBM. With his help getting me the C++ compiler kit, this challenge resulted in Forth/2, a direct threaded forth for OS/2, written in assembler, of course.

Russel Reynolds taught me the nature of software development. He was the Operations Manager at Will County Generating Station, which burned coal and turned it into power. He saw computers as a tool, and one that had to be as practical and unobstructive as possible. In the 1980s, he sought out hand-held computers for recording the inspections of fire fighting equipment. He tried running them with gloves on, spilling coffee on them, dropping them on the concrete floor. I wrote the software to record the inspections. He'd pull in a person from the staff, back in the day when most people didn't have computers, and explain to them that They weren't being judged, I was, and if anything went wrong it was MY fault, he then told them what he wanted them to do, and I had to watch. I learn huge amounts about software usability in a very compressed timeframe.

Jack Woermbke taught me that you don't every upgrade software unless you actually have to. He taught me you only change one thing at a time, so you can actually know what broke things, or fixed them.

The folks at Live Marketing taught me how tradeshows work, how marketing works, and how to keep folks who have to use computers happy and productive.

Norman Teiber taught me how to make gears, and gear shaped objects, of all sorts at his job shop, Allied Gear, sold in 2019.

My friend Jim has shown me how to repair old radios, test equipment, and the like. We've repaired TVs from the 1940s, Test Equipment and ham radios of all vintages, and even a few Cesium Beam atomic clocks.

Jim Hoover from Fermilab taught me that the world isn't as it seems, you can't just take the news at face value, back in the early 1990s.

The Gear cutting job shop I worked for had a CNC lathe running with a GE Computer from the late 1970s that stored data on punched Mylar tape, until it was bought out in 2019.

The bevel gear generator setup was some formula calculations running in version 1 of TK!solver, which would have been a $5000 upgrade to get the latest version, so they ran them under MS-DOS in DOSbox, and saved the grief.

Without that software, they would have to pay Gleason $500+ to do the calculations for each new gear setup.

There are strong and reasonable reasons to keep very old systems alive in offline production environments.

>Progressives have, on the whole, abandoned the forum.

That's news to this progressive from Indiana, a deep red state.

Interesting screed, but I mostly don't buy it.

I'm deeply thankful for DanG and the other moderators who keep the noise down, and actively push to keep discussions from bogging down in AI slop, cheap posts, and off topic rants.

Metamine was a language that appeared here on HN a few times, but seems to have disappeared. The thing that made it interesting is that it let you mix imperative and declarative code in the same program. It did this with a "magical equals", after executing it once, the left side auto-updated outside the flow of the imperative code.

  =   magical equals, which maintains the relation for the rest of the runtime
           note: once you use it on a variable, you can't redefine it later, that's an error
 :=   normal assignment, which only fires once

The demo was pretty fun to watch.[1]

[1] http://web.archive.org/web/20201014024057/https://www.youtub...

Machining is a good skill to have. The ability to shape objects to tight tolerances comes in handy from time to time.

Personal anecdote: It was circa 1985 that I encountered a similar problem. I hand a hand held barcode scanner that had to upload the collected data via a proprietary serial protocol, for eventual reporting, to a PC.

The customer asked "what happens if I disconnect this right now?" during the upload. It was a corner case I hadn't considered. It only took a few days to make it bulletproof.

---

The authors don't seem to consider the case of very slow or intermittent Internet.

I'd be worried about corruption in the download, and check for that. I'd also make very sure the watchdog hardware was on and the code respected it.

It seems to me you need 3 buffers for the OTA code, not 2. There should be a way to keep the last version that runs for X seconds in addition to any new updates, where X is quite large, perhaps a whole day.

I remember 38400, 8, n, 1

38400 bits per second, 8 bits per character, no parity, 1 stop bit

All bleeding stops.

If Ed Zitron is to be believed, Anthropic, and all the other LLM based tools companies are bleeding cash at one of the highest burn rates in history, subsidizing your tools, and likely giving them to you at around 5-10% of their costs. Even if you're prepared to pay 10x or more for the same thing, most aren't, and they don't have a sustainable future.

Your best bet is to develop a local capability on your own hardware while you've still got Claude to compare it to.

Second best is to have an LLM model and harness you can run in the cloud independent of Anthropic or any other AI company.

>Now imagine that we had spent all these resources on doing the basics: ensuring your organization has an up-to-date and comprehensive asset inventory with fine-grained package listings; building infrastructure that supports regular, frequent, and automated OS and applіcation updates; automatically rebooting systems when they hit, say, 30 days of uptime to ensure these updates are picked up;

That would still leave the root cause of most of our problem un-addressed, ambient authority based Operating Systems are fundamentally insecure. Unfortunately, all of our systems share that architecture.

To answer the question as I misread it:

  What's the most career altering *course of action* you've gone through?

I was an IT guy, and I took a job making gears in a job shop. The pay and commute were horrible, but it was immensely satisfying. Some of the gears I helped make will still be in service in a century.

Uptimes used to be measured in years. Clearly we no longer have OSs or server software that are fit for purpose.

I think this could be the thing that finally pops the AI circular financing bubble, leading to World Depression II. I'm not sure either of the existing 2 faces of the duopoly infesting politics will survive, and there's a non-zero chance this breaks civilization as supply chains collapse, and we enter a new dark ages.

The Boy's Second book of Electronics by Alfred Morgan(1957) introduced me to electronics circa 1975, and lead to a technical mindset and lifestyle.

The containerizing is almost a capability based security system. Instead of adding that layer to block everything except a certain resource, why not change the defaults in the OS so that it defaults to NO access instead? Saves resources, provides much better security.

First you need an Operating System that can withstand direct Internet exposure for a decade without incident. Any administration required is going to kill it dead. There are no suitable OS options available at present.

Then you need to make the actual service dead simple to use from anywhere. Punching through NAT and firewalls are the main issues there.

The Memex as described in 1945, especially with the ability to recall and spit out a complete copy of a given path through Hypertext with all the references. It recorded everything, unlike our web browsers.

A capabilities based Operating System that could run Linux, Win32 and other OSs applications natively, replacing the system dialog boxes with power boxes.

An open data diode based on a pair of Raspberry Pi (without wireless of any kind, obviously) and a high-speed optocoupler.

A Streaming variant of SQL, so you could get a live view of any query that publishes updates

A variant of Lazarus, with much better documentation, and a new, magical equals in addition to all the existing code, like that from Metamine. You do the assignment, and it keeps the equality updated as the value on the left changes, like auto-recalc in a spreadsheet.