#pypi paper - Machine learning can find malicious packages because they just look weird (compared to other packages, but similar to each other, even across programming languages)
Home
Public posts preserved on my own site.
#AWS don't leave your security groups open to 0.0.0.0/0 and all ports.
Instead, add 100s of sg rules that combined get pretty close to that. Or maybe they don't, who can tell with that many security groups.
#Roblox money as a game mechanic means someone was bullying my son to try to get him to give them $60 worth of robux. It appears you can convert robux back into money. So the most popular game among kids is an elaborate way for Roblox Corp to enable bullies to harass little kids and take a cut. F*king game.
Again, the monetization mechanics of #roblox are pretty nasty
♡ 1 ↻ 0
VOA content's "license" is crazy. The content is public domain, but because some politician doesn't want, I don't know, "VOA acting as a propaganda machine to influence Americans" they want you to ask for permission before using their content. I don't know enough to know if this is legally sensable, but if the plain text of the license is self contradictory, that's going to thwart your goals.
Should I add the `async` keyword to my API methods that call opensearch, redis, postgres, & other microservices?
context:
#connexion + #starlette + #uvicorn + #gunicorn + supervisord, #python 3.12
Archived poll
- No! Stay in line3 votes
- Do, Yes! it!8 votes
- Nothing will change, because GIL, or something2 votes
- What?1 votes
14 voters
And yes, I understand I'd need to call the async version of opensearchpy, etc.
♡ 0 ↻ 0I don't let LLMs make my architectural decisions, I let underpowered Mastodon surveys do it.
♡ 3 ↻ 0
Reading some old news before I add the async keyword before my API controllers
**point**: #asyncio is slow
https://calpaterson.com/async-python-is-not-faster.html
**counterpoint**: well yeah, if you do it wrong.
https://blog.miguelgrinberg.com/post/ignore-all-web-performance-benchmarks-including-this-one
That was a pretty cool almost-ality
I can walk outside without getting sunburned, miracles
Fuzzy dot 2024
Are there any non-self referential recursion jokes?
Well, it is the start of the terral eclipse where the earth blocks my view of the sun so I'm going to go to sleep.
#DMV peeps, solar eclipse show is 2-4, peakin around 3:20pm
get your exact times here: https://eclipse-explorer.smce.nasa.gov/
Ever run a bunch of unit tests that leaves files all over the file system like a bunch of mouse turds? You can't even see which of the 1000 unit tests you have wrote those files.
Bot wrote me some code to assert (in the code under test) that if a #pytest is running, assert it writing to tmp_path. To make this a 0 cost abstraction, it would need to intercept file IO like #pytest-network does for network calls. (AFAIK, no one has made that plugin)
https://chat.openai.com/share/95e8a898-ca24-4d50-9869-b791f6a17cff
**As a racoon** digging through the dumpster of your code repo
**I want you** to make installing the Turkish hyphenation file optional
**So that** the deployable artifact isn't 95% Turkish hyphenation bytes
IDEA:
Source code is
- markdown of prompt that created the file (the specification)
- markdown of prompt for unit testing the file (testing plan)
- markdown of prompt to code view the file (quality standards)
- etc
- the source code
Generic prompts ("please write unit tests for this file") perform poorly even with smart bots. If you mention ANYTHING irrelevant, the bot will work it into the result.
e.g. "Bot, please use pathlib.Path instead of str if necessary. Use tmp_path for temporary files, if necessary"
Bot: <while testing code with no need for filesystem anything, it writes an unnecessary file to tmp_path because it felt compelled to>
Leave out the text on pathlib.Path? It uses str for every #!#$@$ path because that is what 90% of internet text does.
♡ 0 ↻ 0
@neurobashing It would be a small 2 person hatchback & no one seems to know how to make them look cool enough for people to buy them (except maybe cooper mini). Pre-Elon Tesla got it right that the initial market would be for a cool electric sports/luxury car.
Before looking at Eclipse, put on the glasses that block all light. After that, you can take the glasses off and go back to using #PyCharm.
My townhouse shakes ALL the time. Theories on why:
- Wind
- Car traffic (Surrounded by stroads)
- Airplanes flying overhead (I live not far from Dulles)
- Earthquakes. (It is never an earthquake)
- Delirium tremens. The house itself has no nervous system to damage with alcohol.
Google says shaking houses is not that uncommon.
#ElectionBettingOdds updated now shows 50/50, previous view said various fan fic dream tickets would throw the election to Trump (Yeah, Desantis has a %0.5 chance, and so do I)
And 3% odds of a 3rd party win. Maybe if supervolcanes started, an asteroid and a near by supernova hits earth and wipes out 99.99% of the population all before election day.
If gamblers could bet
- Trump
- Biden
- Supervolcano + planet ending asteroid + nuclear war + supernova gamma radiation wave all before election day...Gamblers would give disaster a 4% chance of happening instead of one of the two candidates winning.
♡ 0 ↻ 1
@andymckay Kind of like the cookie clicker game but less fun
Anyone figure out how to get "liblzma/5.2.5" off windows 11? Do we just wait for MS to push out updates?
`> tar --help`
`bsdtar 3.6.2 - libarchive 3.6.2 zlib/1.2.5.f-ipp liblzma/5.2.5 bz2lib/1.0.8 libzstd/1.5.4`
<Viking LLM App developer Meme>
"Pick your logging. Pick more logging styles than that. Now add some more logging styles. That's still not enough logging styles"
(I can't find a clean version of the actual meme image)
I got your traditional logging INFO and DEBUG to console, to file.
Got logging the conversation to markdown.
Got logging the convo to json for replay.
Got logging the commentary to comments in the final output (python source code).
Got logging to a faux sentry website.Still not enough logging.
♡ 0 ↻ 0
From this image we can see that we should put all the thickest armor on the west and north of the country.
Credit for the image, @bimmer https://elk.zone/mastodon.social/@bimmer/112208873543305251
What local #LLM bot are you using for unit testing your AI apps?
My question on reddit:
Bot driven unit testing
Yield, % of usable tests
- titan 5%
- gpt3.5 30%
- gpt4 60%
Bot driven unit testing
"Hey this needs redesign" signal
- titan - bot struggles with all APIs, almost like watching a bad coding interview
- gpt3.5 - bot uses API, but gets confused if the API is bad.
- gpt4 - bot reads your mind and codes around a bad APISo point to the dumber bot.
♡ 0 ↻ 0Bot driven unit testing
"How did the human's workflow improve"
- titan - bot exercises the test generation script's failure handling. Bot's tests are deleted as not worth salvaging.
- gpt3.5 - All the easy to write tests are done. Tests didn't find bugs. Woot! Time saver, prevents future bugs.
- gpt4 - Bot wrote unit tests that demo bugs. Woot! Code is actually better now. You are also now $10 poorer.♡ 1 ↻ 1Matt, why are you using Titan, you clearly hate it. It is cheap.
♡ 1 ↻ 0Other surprising elements
- Unit tests used to be 1 file per code under test. Now I got many, many batches of unit tests, each with 1 test file per CUT file.
- When code evolves, easier to regenerate a new suite of tests than to ask the bot to edit a test (or have a human edit a test)
- If it looks like an integration test, (i.e. testing the entrypoint of whole app), the bots make bad tests that pass only with massive mocking or a miracle♡ 0 ↻ 0
Is part of the "I hate dependencies" really, "I hate c/c++ dependencies because the language didn't have package management for the first decades of its life"
Impressive engineering to have a 7+ story building lean that much without collapsing or falling over.
If companies who use open source orgs have some obligation or at least motivation to support the maintainers of the the projects- do they even know who the maintainers are?
Anyhow feels like we need more tools that are like `poetry show --tree` but would return all the people and orgs that the tree of dependencies represents. I mean, if you ran that you got back "They're all dead. Everybody's dead, Dave." would that change your plans?
@neurobashing Yeah, if Ukraine is going to win, it sure would help for them to have all that. I think it is still possible for them to lose (e.g. if they like literally run out of bullets and shells), but w/o a big increase in aid, the most likely is stalemate. I think both sides got a few years worth of soldiers & exactly because the Russians are losing soldiers faster than the Ukrainians, Russia's greater base pop isn't going to be decisive.
@neurobashing ha, I just realized this is a version of would you rather fight a horse sized duck (a few competent soldiers) or many duck sized horses (a bunch of unskilled, wastefully used conscripts). The Russians are a bunch of duck sized horses. They're trying to build an empire like it is 1206AD and Genghis Khan is conquering the world with just a bunch of people.
♡ 0 ↻ 0
@engler@chaos.social The things, they are so small.
@neurobashing 50% of all soviet tanks & tank-likes destroyed and only 2 more years of supply left. The navy is either parked or sunk. The air force likewise is parked or shot down. The skilled infantry has been eliminated (i.e. human capital). (I got no info on experience, but I'm guessing the distribution of month of experience in the military is unfavorable, with the high fatality rate). Because of demographics, even the supply of unskilled infantry is running low.
#xz hacker's time zone more likely near Eastern Europe than China via analysis of mistakes, implied travel times, holidays schedule and daylight work hours
Time zone's are always messing with developers, even reducing their anonymity.
https://rheaeve.substack.com/p/xz-backdoor-times-damned-times-and
`unittest.mock` has the most astonishing API.
side_effect can be an Exception class, Exception object, a callable, or a iterable. But of course! They all look like ducks to me.
You see, your API can be an Hieronymus Bosch nightmare as long as you document it and blame the user.
Why everyone so negative, you get a free tool to fix your ssh connection problems and you're mad. Think of all those tickets "can't reach server XYZZY by ssh, I lost my keys", you can use xz instead.
@neurobashing It would have to be a gadget invented & built before 2000 & still in use & still works, or it would have to be something you could order from alibaba
Anonymity has costs, so if your preferred version of privacy is "no one can tie me to my real world persona" then you have a much, much, much harder job of creating a system of trust that doesn't appeal to real world institutions. For example, I want to maintain my privacy and participate in OSS financial software. It should be much, much harder for me to convince people to become a core contributor.
Paraphrasing my boss when I found a security problem in our code, he said security is being able to send the person recording fraudulent transactions to jail.
And xz can't do that because they relied on a 100% privacy model of reputation. They can only block, nothing with real world consequences.
♡ 0 ↻ 0
Feels like home again now that @uscpsc is in the Fediverse.