Show newer
robryk boosted

Just tried ChatGPT. I asked it a series of specific Qs about areas I've studied in detail.

On all Qs, it gave answers that are plausible sounding but wrong. Not obviously wrong: wrong in subtle ways that need deep domain knowledge to grasp.

The ways humans will be practically misled by this kind of tech if trusted with, say, doling out medical, legal or business advice is horrific.

Letting this tech loose on the world will further destroy search engines that are already riddled with SEO BS.

@grrrr_shark Is it an arms race though? I agree that if we are aiming for allowing other people who have nothing to do with $NEWCOMER find $NEWCOMER, then it is an arms race -- you can only distinguish $NEWCOMER from $SPAMMER by their contents or the (possibly totally faked) network around them.

If we are aiming at allowing people to walk along the social graph, then it seems to me that we can require potential attackers to confuse an actual human to gain the initial foothold. Do you think this is also arms-raceish due to how easy it is to confuse a human?

@niconiconi

What do you mean by quality?

I expect that it would easily reach the stylistic quality (and often exceed it; it's not trivial to keep it when the document is often changed in localized ways by different people). I would expect it to be abysmal at not being wildly wrong every one~two paragraphs.

@roelfrenkema @ij @Natanael_L @ruud @Steeph

So we should be distrustful of instances being operated by for-profit entities (which host users other than representation of that entity) in general, right?

I wonder whether them requiring (non-token?) payment from users should be counted in their benefit: on one hand, this means that there is a business model for them that doesn't rely on deception; on the other, it incentivizes them to acquire more users (because their profit scales with usercount) by means that are potentially harmful for the environment.

@roelfrenkema @ij @Natanael_L @ruud @Steeph

You mean that 1€ is too little or too much for it to be considered commercial? The rest of your comment suggests that instances operated by for-profit entities that charge _too little_ are likely to match your intuitive meaning of commercial.

@grrrr_shark If you don't mind saying, did it appear cult-like due to off-scale-high deference, or something else?

@grrrr_shark I would really love for non-Mastodon to become more popular on fedi. Currently, mastodon has some weird quirks (in that IIUC it doesn't adhere exactly to the APub spec/APub spec does not specify something well enough; I haven't tried to figure that out) and it would be nice if everyone didn't have to adopt to them.

Alas, having more popular instance server software would probably not alleviate the issues you see: I haven't seen any that try to deal with spammy creation of new instances at all. I wonder when we will start seeing software that e.g. considers instances that aren't in instance_of(followers(followers(me)) or sth similar to be likely spammy.

@nandalism

You are probably aware of long polling; it seems to me that this is very much a good candidate for that (and that makes all the jazz with reverse proxying easier, because it's just an http request).

@SwiftOnSecurity Thinking about redundancy often pushes people into a vastly simpler architecture, though: it belies many assumptions about various pieces of the system staying in sync, and thus outright breaks some fragile setups.

@PeterCxy It does span multiple different signing keys (is this what you meant?). Why does this make it more likely that some attacker managed to exfiltrate all those keys as opposed to an attacker managing to get something signed with all of them?

test toot 

@timorl see toys/sprayandpray.go

@timorl Default avatars on github and on gravator do, though. (I agree that lack of choice is an imposition.)

@timorl You do have an avatar, it's just a function of your username.

test toot 

@timorl Try making a non-public boost and see what Mastodon will make of it.

@PeterCxy Do we know that the keys were leaked (as opposed to misused)? I've seen reports of malware that was signed with them only.

@Natanael_L @ij @roelfrenkema @ruud @Steeph

But they do! It's a semi-common practice to send one's outgoing email via e.g. gmail to circumvent issues where either your ISP doesn't want you to open connections to SMTP, or if your target doesn't even want to listen to you over SMTP.

@deonandan I know of one example (around Kristallnacht) and one counterexample ('68 in Poland, which ended up causing lots of emigration to Israel, but no further lasting effects). Do you have more examples (or disagree about 1968)?

@ij @roelfrenkema @ruud @Steeph

Like some people already mentioned, AP is email-like enough to end up with same problems (modulo ones that are fixed in email by DKIM, because an equivalent thereof is already here).

Show older
Qoto Mastodon

QOTO: Question Others to Teach Ourselves
An inclusive, Academic Freedom, instance
All cultures welcome.
Hate speech and harassment strictly forbidden.