biosboiii

LLM-as-a-judge?

Given that LLMs are trained with RL && LLM-as-a-judge, is it really cheating if real competitions use the same?

Maybe the real alignment is the slop we decoded along the way

There are agencies in Germany where you can buy review removals in a web shop for like 50 euros per review.

You just have to link the review and they will send Google a legal document to delete it.

I guess this is a great report, but the parallax landing page shenanigans disrupt my reading flow, you cannot easily scroll back to get a overview of the key facts, so I stopped.

I love GeoJSON :) You can bring any Geo/GIS from 0 to visualization by just parsing it into GeoJSON.

geojson.io is a great editor/viewer by Mapbox. Also https://kepler.gl/demo is great for additional filtering, visualizations like heatmaps, arcs etc.

A extension to GeoJSON that works with JSONL-like semantics would be great for huge files, but this could also be solved by tiling.

fyi: modern vehicles are required to have a e(mergency)Call function (UNECE UN-R 144), therefore all of these cars have a modem with a unique IMEI (that is typically bound to a VIN), therefore you can track the movements of every car pretty precisely.

Disabling the eCall is not possible, and doing so (in the EU) would void your car's registration.

after 2+ years of non-engineers vibecoding applications, show me one startup/app without devs.

TIL: Generally all plastics exposed to UV start to photodegrade. If you google why old computers turn particularly yellow most sources point to bromine-based flame retardant agents in the plastic, but some people make a convincing case[1] that ABS just naturally turns yellow in UV light.

Not much real research into that topic, interestingly.

[1] https://medium.com/@pueojit/a-look-into-the-yellowing-and-de...

Holy slop.

Not only is the README.md largely written by a LLM (:emoji: :emoji:), the repo does not contain a single folder but 25 files (.py, .csproj, .png ...) , many of them 0 bytes.

they should finetune the LLMs with this

Tor on Chromium, when?

Seriously, I am saddened that Chromium dominates the browser market as much as it does, but at this point the herd-immunity of Chromium is necessary to keep users safe.

This feels a lot like X/Twitter nowadays lmao

The most interesting takeaway from this project and the Mac touchpad actually measuring it's pressure in grams[1] is how Apple seems to prioritise it's ability to deliver new features in later software releases rather than their BOM.

I work in the automotive industry, and for volume products the price-cutting is really brutal. If you can save a cent somewhere you will, because that cent multiplied by 8 million cars a year is a sizeable amount of money.

This seems to be generally true for most OEMs of hardware products, but not for Apple. Apple could have cut costs by just using a magnet and a reed switch/hall effect sensor, because it is not using the exact angle of the screen anyway (afaik?), but they chose not to.

They could have implemented their "3d Touch" by using a simpler circuit which just indicates if the press was really hard or soft. But again they chose not too.

And they sell over 20 million Macs per year, so they really sacrifice a sizeable amount of profit

[1] https://news.ycombinator.com/item?id=44635808

What is a cocaine-fueled "amusement park" to Silicon Valley techbros is another humans hell. I look forward to you guys joining it.

I no longer love blue skies. In fact, I now prefer grey skies. The drones do not fly when the skies are grey.

When the skies brighten, though, the drones return, and so too does the fear.

Zubair, 13 yrs old https://www.theatlantic.com/politics/2013/10/saddest-words-c...

Also crashes my MacOS Sequoia 15.3.1 Preview App :) https://gist.github.com/AltayAkkus/524acec2b16d4536af0fcee2f...

Great work!

I was working on something similiar, using ReVanced(1) Framework, which allows you to distribute fuzzy tweaks to regular APKs with their ReVanced Manager(2) which can persist multiple version updates.

They have their own DSL (3), kinda.

My target was Instagram Reels, I did not come that far with JADX in finding the appropriate methods/attributes to overwrite because I kept getting stuck scrolling reels on my Android Emulator.

Novel obfuscation technique by Meta :/

(1) https://github.com/revanced

(2) https://github.com/revanced/revanced-manager

(3) https://github.com/ReVanced/revanced-patcher/blob/main/docs/...

I dislike tech monopolies but Chrome leaving Google would be most terrible thing ever, security wise.

Google has become the benevolent dictator of the web, if you like it or not. We get secure browsers, performance improvements, stable implementations at the cost of one bad feature being shipped a year (like Manifest V3).

Mozilla/FOSS community has fucked up Firefox, big time, which is not even their fault as they cannot hire thousands of six-figure developers.

difficulty level: google search

2075 HN: Ask HN: Any active Java devs here? What LLM do you use?

I am sorry but this is insane cope, Amazon is still on-top everywhere, also in Europe.

As a reverse-engineer tinkering with iOS this reminded me of some system apps.

E.g. in the app store you click a button, send a request, receive the response which contains a xml-like structure describing the UI mutation to your action.

<Alert>

   <Header>iTunes Login</Header>

   <Body>We could not find a user with those credentials.</Body>

type stuff.

My profile is largely unused, I follow no one, and like 1/3 times I open up the front page I get straight holocaust denial threads suggested. Completely insane.

Yeah, you can basically just unzip IPA files. Gaining them is hard though, I have a pathway if you are interested.

But the Objective C code is actually compiled, and decompilation is a lot harder than with the JVM languages on Android.

My next article will be about CoreML on iOS, doing the same exact thing :)

You're right about the TPM, I won't get the key out of it. It's a special ASIC which doesn't even have the silicon gates to give me the key.

But is the TPM doing matrix-mulitiplication at 1.3 Petaflops?

Or are you just sending the encrypted file to the TPM, getting the unencrypted file back from it, which I can intercept, be it on SPI or by gaining higher privileges on the core itself? Just like with this app but down lower?

Whatever core executes the multiplications will be vulnerable by some way or the other, for an motivated attacker which has the proper resources. This is true for every hardware device, but the attack vector of someone jailbreaking a Nintendo Switch by using a electron microscope and a ion-beam miller is neglectable.

If you are that paranoid about AI models being stolen, they are worth it, so some attacker will have enough motivation to power through.

Stealing the private key out of a GPU which allows you steal a lot of valuable AI models is break-once-break-everywhere.

Apple trusted enclave is also just a TPM with other branding, or maybe a HSM dunno.

I think you are starting off from the perfect direction, being a forward-engineer first, and then a reverse-engineer.

The community around Frida is a a) a bit small and b) a bit unorganized/shadowy. You cannot find that many resources, atleast I have not found them.

I would suggest you to use Objection, explore an app, enumerate the classes with android hooking list classes or android hooking search classes, then dynamically watch and unwatch them. That is the quickest way to start, when you start developing your own scripts you can always check out code at https://codeshare.frida.re/.

For everything else join the Frida Telegram chat, most knowledge sits there, I am also there feel free to reach out to @altayakkus

Oh and btw, I would start with Android, even though iOS is fun too, and I would really really suggest getting a rooted phone/emulator. For the Android Studio Emulator you can use rootAVD (GitHub), just install Magisk Frida. Installing the Frida gadget into APKs is a mess which you wont miss when you go root

Your second note is very interesting, having looked at the model myself this is very plausible.

For models which use a lot of input nodes, a lot of "hidden layers" and in the end just perform a softmax this may get infeasible because of the amount of data you would have to transfer.

You may have inspired a second article :)

But then you could compromise the GPU, probably :)

Look at the bootloader, can you open a console?

If not, can you desolder the flash and read the key?

If not, can you access the bootloader when the flash is not detected anymore?

...

Can you solder off the capacitors and glitch the power line, to do a [Voltage Fault Injection](https://www.synacktiv.com/en/publications/how-to-voltage-fau...)?

Can you solder a shunt resistor to the power line, observe the fluctuations and do [Power analysis](https://en.wikipedia.org/wiki/Power_analysis)?

There are a lot of doors and every time someone closes them a window remains tilted.

Thanks a lot :)

My general writing style is directed mainly towards my non-technical colleagues, which I wish to inspire to learn about computers.

This is no novelty, by far, it is a pretty standard use-case of Frida. But I think many people, even software developers, don't grasp the concept of "what runs on your device is yours, you just dont have it yet".

Especially in mobile apps, many devs get sloppy on their mobile APIs because you can't just open the developer tools.

Author here, no clue about homeomorphic (or whatever) encryption, what could certainly be done is some sort of encryption of the model into the inference engine.

So e.g.: Apple CoreML issues a Public Key, the model is encrypted with that Public Key, and somewhere in a trusted computing environment the model is decrypted using a private key, and then inferred.

They should of course use multiple keypairs etc. but in the end this is just another obstacle in your way. When you own the device, root it or even gain JTAG access to it, you can access and control everything.

And matrix-multiplication is a computationally expensive process, in which I guess they won't add some sort of encryption technique for each and every cycle.

Author here, it would be nice to claim that I did this on purpose but I really did not know it was open source.

I was rather interested in the process of instrumenting of TF to make this "attack" scalable to other apps.

I think the comment author means offering inference via Firebase, with the model never leaving the backend.

This works, just like ChatGPT works, but has the downside of 1. You have to pay the computing for every inference 2. Your users can't access it offline 3. Your users will have to use a lot of data from their mobile network operator. 4. Your inference will be slower

And since SeeingAI infers the model every second, your and your customers bill will be huge.