Viewing profile — joshka

The current thing that comes up regularly is choosing an LLM setup.

lol same :D

This, but I'd say that there is an engineering perspective that you can apply. What the developer world is trying to discover here is how to encode taste concretely - often this is…

I've done VHS (terminal recording) rewrite in rust built on libghostty called Betamax [1], and then threw it at creating a TUI for jujutsu. This worked pretty well, but is admitted…

Take a look also at https://tropes.fyi/ I've put in some effort to try to help agentic tools avoid these problems: https://www.joshka.net/practice/rules/documentation/docs-avo... .…

Some agents have specific tools that the models have been trained to use. E.g. diff formats for editing that aren't the same as the standard unified diff format. Access to specific…

Yeah, what bothers me is that the prompt already said using a different vulnerability didn’t count, and the model did it anyway. We’re starting to assume clear instructions act as …

The exploit gym setup explicitly allowed access to package registries and v8 sources. Putting a cache on that doesn't seem like a bad idea generally, except when there's a 0-day in…

Thanks for the reply here. I guess I have some perspectives on a bunch of this. I'm for open sharing of academic work for all (but I'm not an academic, so my perspective is a consu…

This is freaking good.

How do you square away the idea that you do science for the increase in knowledge of human kind, but then say that a particular use of that knowledge is verboten? I get the copyrig…

Consider optimizing your demo for laptop user screen sizes and checking contrast of all elements. A lot of things on the demo are difficult to read fast due to low contrast, which …

discussion / article: https://news.ycombinator.com/item?id=49087091

https://huggingface.co/blog/agent-intrusion-technical-timeli... has that side of the write up a bit more discussion: https://news.ycombinator.com/item?id=49089500

Makes you wonder whether that reality has a left wing bias quote might have some legs after all (though it's probable more likely selection bias for the corpora)

The other suspicion I had was jfrog artifactory (you mentioned OpenAI use it in a blog post in Jan). I accidentally conflated that with Nexus 14 july CVE. I think that's probably m…

I wonder if it was this bug fixed july 14 in sonatype: https://support.sonatype.com/hc/en-us/articles/5316501964136... pure speculation here - no non public info

There's no reason to think that a tool that can find an 0-day in a repo cache can't work out how to make that host send a post request rather than a get request once it has its key…

https://news.ycombinator.com/item?id=49003386

yes, and... ?