excitedrustle
Joined 1 year ago
Karma
13
Submissions
10
Member since
Jun 26
Recent submissions
Comment · 1 month ago
Agree. I don't read it every week, but I greatly appreciate the quality (both of the technical content and the lack of advertising/sensationalism/clickbait) when I do read an article. Happy to pay to support this style of tech reporting and journalism.
Comment · 1 month ago
This reminded me that I'd let my LWN subscription lapse after a credit card expired. Just renewed for a year and turned on automatic renewals (at least until the next credit card expiration).
Comment · 3 months ago
> I found 4 different Postgres bugs.
Bugs in the upstream Postgres C implementations? Did you report them or submit patches? I'm curious to see what you found!
Comment · 1 year ago
Interesting. I am still defaulting to ChatGPT when I anticipate having a multi-turn conversation.
But for questions where I expect a single response to do, Google has taken over.
Here's an example from this morning:
It's my first autumn in a new house, and my boiler (forced hot water heating) kicked on for the first time. The kickboards in the kitchen have Quiet-One Kickspace brand radiators with electric fans. I wanted to know what controls these fans (are they wired to the thermostat, detect radiator temp, etc?)
I searched "When does a quiet-one kickspace heater turn on". Google Overview answered correctly [1] in <1 second. Tried the same prompt to ChatGPT. Took 17 seconds to get the full (also correct, and similarly detailed) answer.
Both answers were equally detailed and of similar length.
[1] Confirmed correct by observing the operation of the unit.
Comment · 1 year ago
Looks great! Wish Go wasm modules were smaller.
Comment · 1 year ago
Working on Fraim, open-source agents for cloudsec and appsec engineers to complement existing deterministic scanners. Born out of our 3 years of learnings building such scanners for IaC. Turns out in the real world policies are subjective enough to make this hard.
Examples:
- Policies are frequently subjective. Hard to codify, but LLMs can evaluate them more like a security engineer would. "IAM policies should use least privilege." What is "least" enough? "Admin ports shouldn't be exposed to the Internet." What's an admin port?
- Security engineers are stretched thin. LLMs can watch PRs for potentially risky changes that need closer human review. "PR loosens authz/authn." "PR changes network perimeter configuration."
- Traditional check runs (SAST, IaC, etc.) flood PRs with findings. Security doesn't have time to review them all. Devs tends to ignore them. Frequent false positives. LLMs can draw attention to the important ones. "If the findings are unusual for this repo, require the author to acknowledge the risk before merging."
www.fraim.dev
github.com/fraim-dev/fraim
Personal homepage:
https://www.davidbild.org