noperator

Leanstral 1.5 has 6B active parameters. How many parameters does GPT-5.5 have?

Yes, I did end up figuring out a clean way to allow normal reasoning inside <think> and then force JSON _after_ the closing </think>. Example here: https://gist.github.com/noperator/6c711ab19027ea8056442df839...

Having some success while testing this model out as a replacement for GPT-5 nano in source code security review. Running on RTX 3090 (24 GB VRAM) via vLLM. It's not great on structured output (as noted in the model card) but I'm working around that in my harness.

compute isolation means nothing if the sandbox can freely phone home.

Here's a project I've been working on to address the network risk. Uses nftables firewall allowing outbound traffic only to an explicit pinned domain allowlist (continuously refreshes DNS resolutions in the background).

https://github.com/noperator/cagent

Digital technologies can be terribly destructive, but they can also be gloriously empowering. How do we shape them into tools for conviviality rather than means of domination?

My prototype one-liners usually turn into Go programs :)

if you like fx, then you'll love https://jless.io/

Hey, author here. see also, sol: a de-minifier (formatter, exploder, beautifier) for shell one-liners

https://github.com/noperator/sol

I actually wrote jqfmt because I needed it for sol :)

kind of meta, but one of my most-used commands is sol: a de-minifier (formatter, exploder, beautifier) for shell one-liners

https://github.com/noperator/sol

Awesome! I found this section interesting: https://blog.kelvin.ma/posts/an-ode-to-pocket-analysis-of-ex...

I don't think of HN as a source itself but rather a way to discover sources. So I think my Pocket data reflects sources that I've discovered, but to your point, doesn't represent everything I've read from those sources.

Moved to Wallabag, but note that I don't read anything via Wallabag (or Pocket) UI. I export saved items as an RSS feed which I consume in an RSS reader like Inoreader or FreshRSS.

Hugo lives on GitHub which autodeploys to Cloudflare Pages. https://developers.cloudflare.com/pages/framework-guides/dep...

This is a relatively simple request when the server is under your desk: boot a rescue disk, use a tool like shred to wipe the data on all the hard drives, then press the power button. When the server is in a remote data center, it's a little more challenging: use a remote console to reboot into a rescue disk, wipe the server, then remotely pull the power using some networked PDU. When, like me, you have to wipe a server thousands of miles away with no remote console, no remote power, no remote help and only an SSH connection, you start scratching your head.

o3 spent that time "thinking" and built the profile using only the URLs/titles, no content fetching.

Thanks all for your feedback. Adjusted the title to clearly reflect that I'm the agent here.

Recalling Simon Willison’s recent geoguessing challenge for o3, I considered, “What might o3 be able to tell me about myself, simply based on a list of URLs I’ve chosen to save?”

You can also use https://github.com/noperator/raink to brainstorm TLDs that are relevant to some topic you care about. For example:

    curl -s https://data.iana.org/TLD/tlds-alpha-by-domain.txt |
        raink -f /dev/stdin -p 'which of these TLDs is most related to the concept of "hacking"?' |
        jq -r 'map(.value)[:10]'
    
    [
      "BLACK",
      "COMSEC",
      "TOOLS",
      "SECURITY",
      "ZERO",
      "EXPOSED",
      "FORUM",
      "SHELL",
      "BOT",
      "SOFTWARE"
    ]

Agree. I think LLMs are usually not "harnessed" correctly for complex, multi-step problems—hence the `raink` CLI tool: https://github.com/noperator/raink

Great questions. For commits or revision diffs as documents—either will work. Yes, I've applied this to N-day vulnerability identification to support exploit development and offensive security testing. And yes, for fuzzing, a sensible approach would be to dump the exported function attributes (names, source/disassembled code, other relevant context, etc.) from a built shared library, and ask, "Which of these functions most likely parses complex input and may be a good candidate for fuzzing?" I've had some success with that specific approach already.

That's awesome. Will take a closer look!

A concept that I've been thinking about a lot lately: transforming complex problems into document ranking problems to make them easier to solve. LLMs can assist greatly here, as I demonstrated at inaugural DistrictCon this past weekend.

palm rejection while using the stylus

Do you mean that it doesn't sufficiently reject palm touch while writing with stylus? I'm a long-time Onyx BOOX user and hoping that DC-1 writing experience is as good or better.

PRs welcome ;)

Yeah could do. I do this for some SSH hosts but not all.

I just like to be notified when I need to tap something with explicit intent.

I published a nearly identical tool, referencing the same paper, a few weeks ago :) Although I implemented a listwise algorithm instead of pairwise as described in the paper; ends up being a lot faster.

https://github.com/BishopFox/raink

https://bishopfox.com/blog/raink-llms-document-ranking

    raink \
        -f testdata/sentences.txt \
        -r 10 \
        -s 10 \
        -p 'Rank each of these items according to their relevancy to the concept of "time".' |
        jq -r '.[:10] | map(.value)[]' |
        nl
    
       1  The train arrived exactly on time.
       2  The old clock chimed twelve times.
       3  The clock ticked steadily on the wall.
       4  The bell rang, signaling the end of class.
       5  The rooster crowed at the break of dawn.
       6  She climbed to the top of the hill to watch the sunset.
       7  He watched as the leaves fell one by one.
       8  The stars twinkled brightly in the clear night sky.
       9  He spotted a shooting star while stargazing.
      10  She opened the curtains to let in the morning light.

I've found that when I'm cloning submoduled private repos via YK-backed SSH key, I'll need to touch multiple times but there's not always text in the terminal notifying me to do so. Easy to miss the small flashing green light.