• 0 Posts
  • 112 Comments
Joined 1 year ago
cake
Cake day: June 23rd, 2023

help-circle





  • That’s the thing about automation and training models.

    First, they implement some sort of auto-reporting bot that requires a human to review them. In the beginning, it only about 50% accurate, but as they give it more and more examples of good and bad results through the human reviews, it moves to 80%, then 90%, then 99%, then 99.99% accuracy.

    After a while, the humans on the other end are so numb to the 9999 entries they have to mark as approved that they can barely tell what’s a rejection themselves, and the moderation team is asking itself just what this human review is actually doing. If it’s 99.99% accurate, why not let the bot decide?

    Then, the model moves on from auto-reporting to auto-moderation.








  • So if your Rust app is built against up to date libraries in Cargo, it’s going to be difficult to package those apps in Debian when they ship stable, out of date libraries since Debian’s policies don’t like the idea of using outside dependencies from Cargo.

    As they should. You don’t just auto-update every package to bleeding edge in a stable OS, and security goes out the window when you’re trusting a third-party’s third-party to monitor for dependency chain attacks (which they aren’t). This is how we get Crowdstrike global outages and Node.JS bitcoin miner injections.

    If some Rust tool is a critical part of the toolchain, they better be testing this shit against a wide array of dependency versions, and plan for a much older baseline. If not, then they don’t get to play ball with the big Linux distros.

    Debian is 100% in the right here, and I hope they continue hammering their standards into people.