devttyeu

This is so much worse that the title makes it out to be:

  1. Your OS installs malware (technically manufacturers software) from a 3rd party vendor in background, zero user interaction
  2. Happens as soon as you or anyone with physical access plug in a device into the HDMI port
  3. That malware has internet and full system access, no sandboxing
  4. It starts with every system boot
  5. This software gets installed when you plug in a new LG monitor
  6. OR ALREADY HAD AN OLDER LG MONITOR PLUGGED IN, BECAUSE LG APPARENTLY ROLLED THIS OUT FOR MANY OLDER MODELS TOO!!
  7. And yes, if you think that's horrendous, as mentioned in the video below, that also applies to 'Professional' LG monitors!

GamersNexus has a video diving deeper into what LG did here - https://www.youtube.com/watch?v=Q9uefFYe6bM

How does the prompt “Generate an SVG of a pelican riding a bicycle” add up to 95 input tokens? OpenAI’s tokenizer counts 10, Anthropic’s counts 10 for Opus 4.6, 30 for Opus 4.7 and 25 for Sonnet 5/Fable 5. Prompting “hi” to Kimi K3 counted 86 tokens, suggesting there may be an 85 token hidden system prompt. It refused to leak it though.

This is quite possibly reasoning-effort prompt which is injected before the opening <think> token whenever you set a custom reasoning effort, see e.g. DeepSeek-V4 max mode prompt: https://huggingface.co/deepseek-ai/DeepSeek-V4-Pro/blob/main...

Oh wow didn't expect this to be either possible or this perform so well.

Also fascinating how small the wasm binary is. I made a Wasm port of FreeCad (also had a fairly popular thread here a few days ago) but that image was close to 300MB uncompressed / 90MB compressed with Brotli.

(btw none of my wasm CAD ports seem to run, each with slightly different flavors of missing wasm features it seems - I have them linked on https://magik.net if you want to debug for whatever reason)

Thought of using Iroh/LibP2P under the hood?

Building a rootless, namespace powered (deeply stretching the definition of a container), on demand application workspace.

- Each component in a mini app in a heavily locked down container - Components are deployed and built in a web workspace, in the same workspace you can open a terminal and use your favourite coding agent to work on component code (each terminal is itself heavily sandboxes, has rw access only to the edited component code and users home dir) - Everything comes with heavy rbac and minimum permissions - Oh so much more

Explaining this well is hard, much like explaining to someone what Kubernetes or AWS does. This is at a level of what a sophisticated company infrastructure team would run, just as a workspace you can deploy for yourself easily and agents just build within that framework (I’m a cofounder of a infra/compute/datacenter startup and intimately familiar with this kind of complexity)

The main thesis is that Claw-style agents still feel like school projects, and that in the agentic era apps on demand will be more of a thing, and that the current systems weren’t built to deal with a whole new app built every few minutes.

May or may not end up as open source soon

Any plans to standardize Iroh IoT protocols, e.g. Matter over Iroh / Some other standard that would be plug-able to things like Home Assistant?

(I made this port) Fwiw I personally had no reason to do this port beyond using it as a benchmark of the agentic capability of Fable, where something of this shape is IMO a way better gauge than those dumb X.com 'I oneshot game with models X/Y/Z this is how it compares'

I published the actual prompts, and you can see quite clearly that vs Opus which is ok at implementing one big feature, Fable was really able to push through a good chunk of the port. That said it definitely didn't one-shot the port, it also didn't figure out a broken docker sbx sandbox by itself, and also later needed some gaslighting into thinking that the port is not really that hard (by any human measure it was quite hard given the scope of code involved.. The nearly 200MB wasm binary is mostly code afaict..). So there are some clear patterns of how the model was trained and also roughly the scope of task visible in those traces. What I see is that it likes prompts that would take an L4/L5 2-4 weeks to do with Cursor ~2 years ago, more needs some direction and deliberate prompting.

I will also note that it's possible to compile this with wasm asyncify, but the result iirc is a ~400MiB Wasm binary that will crash the browser tab before you will be able to do anything useful in it.

I made the port, roughly ~one maxed out Claude Max 20x sub, at the bottom of the article I've shared the full claude code transcripts, so you can probably to some rough math on token usage with that.

Edit: to be precise 'maxed out' means one weekly limit on fable used over those 4 days

Author of the port here, you need a browser with JSPI support, which means recent Chrome, or Firefox Nightly with the feature flag flipped, or Firefox from the future.

Are you sure you created a new canvas first? Should be black, not grayish.

Mmm FreeCAD you say, let's see.

Just enabled, however note that I don't really intend to support this much more, but would happily get this repo to someone who would want to support wasm mode more properly / ideally upstream in longer term

If you believe a 128gb machine that is essentially DGX Spark in a laptop chassis can run models comparable to SOTA you either never ran open models on hard tasks, or you aren't scratching the surface of SOTA closed LLM capability in how you're using them.

More like $1M at current prices at this scale / level of performance.

If you go with HDD arrays probably $50k

Well if you're a devshop just billing hours of mostly low impact work then hours are very much equal to productivity.

Fwiw if you trained an LLM in an RL sandbox that would require it to have goals, the output llm probably would "have goals"

That's here for anyone wondering - https://cdn.openai.com/pdf/1625eff6-5ac1-40d8-b1db-5d5cf925d...

For the stuff in more sensitive deployments it's really quite simple, just setup CORS etc properly and don't do anything overly fancy on the frontend. Worst case the user may force some internal function to eval some JS by pasting scripts into the browsers debug console.

Critical severity vulnerabilities are only critical when they are reachable, but are completely meaningless if your application doesn't touch that code at all. It's objectively more risky to "patch" those by updating dependencies than just let them be there.

If it runs in a harness that will alert me when something dodgy is detected I'm fine to stay at that level.

I don't read it in detail because reading in detail is precisely what I delegate to the harness. The alternative is that I delegate all this trust to package managers and the maintainers which quite clearly is a bad idea.

Whether the $$ pricetag is worth it is.. relative. Also in Go you don't update all that often, really when something either breaks or there is a legitimate security reason to do so, which in deep systems software is quite infrequent.

Funnily enough for frontend NPM code our policy was to never ever upgrade and run with locked dependencies, running few years old JS deps. For internal dashboards it was perfectly fine, never missed a feature and never had a supply chain close call.

Cargo is spiritually based on NPM so it's not much better.

Go Get is closer to always locking dependencies unless you explicitly upgrade them with a go get, so it's much much better in my view.

Yes, you can lock deps in NPM/Cargo/etc. but that's not the default. It is the default in Go.

In Go projects my policy for upgrading dependencies includes running full AI audit of all code changed across all dependencies, comes out to ~$200 in tokens every time but it gives those warm 'not likely to get pwned' vibes. And it comes with a nice report of likely breaking changes etc.

Enterprise NVMe on the high end is now starting to ship batches at $1000/TB with existing stock around $500/TB. No consumer is going to pay that.

But if you're buying a $500k GPU server putting 100TB of nvme in there for $50-100k is justifiable.

403 B is the revenues - https://www.sec.gov/Archives/edgar/data/1652044/000165204426...

Also not able to access Gemini API.

At least our local GPU server still serves Kimi K2.5 to my team just fine.

Also like some popular youtubers and popular speakers.

Funny you mention that, I have very recently just came back from a one-shot prompt which fixed a rather complex template instantiation issue in a relatively big very convoluted low-level codebase (lots of asm, SPDK / userspace nvme, unholy shuffling of data between numa domains into shared l3/l2 caches). That codebase maybe isn't in millions of lines of code but definitely is complex enough to need a month of onboarding time. Or you know, just give Claude Opus 4.5 a lldb backtrace with 70% symbols missing due to unholy linker gymnastics and get a working fix in 10 mins.

And those are the worst models we will have used from now on.

Visual puzzle solving is a pretty easily trainable problem due to it being simple to verify, so that skill getting really good is just a matter of time

In Go you know exactly what code you’re building thanks to gosum, and it’s much easier to audit changed code after upgrading - just create vendor dirs before and after updating packages and diff them; send to AI for basic screening if the diff is >100k loc and/or review manually. My projects are massive codebases with 1000s of deps and >200MB stripped binaries of literally just code, and this is perfectly feasible. (And yes I do catch stuff occasionally, tho nothing actively adversarial so far)

I don’t believe I can do the same with Rust.

Cryptography is the science of turning any problem into a key management problem

If you have Pro users why not leverage with debt without giving up equity for no good reason?

Maybe the value prop is not clear, the website talks a bunch about AI agent integrations, that sounds like a completely different product to a parser library, which however advanced it may be, investors will likely see as tangential bit of IP that a senior engineer can build for $10-20k in a few days.