Salta al contenuto principale


ChatGPT and entropy [Italian]


The interaction is in italian, the gist of it is that #ChatGPT while telling me a "tiramisù" recipe forgot to tell me to separate egg yolk and whites and once corrected he instructed me to separate them after eggs have been beaten and mixed with sugar. I think #physics of our universe might pose some issued with that.

Volevo provare ChatGPT, dato che il sito ufficiale era sovraccarico ho utilizzato un bot Telegram bot chiamato gpt3_unlim_chatbot e dopo un paio di domandine facili di riscaldamento ho deciso di entrare in ambito "religioso" e gli ho chiesto quale fosse la ricetta del tiramisù. (argomento che, come per la carbonara, sconsiglio di avere con amici)

Mi sembra che la conversazione prodotta sia piuttosto interessante. 🤣

Lapo

Dimmi una buona ricetta per fare il Tiramisù.


ChatGPTBot

Il Tiramisù è un dolce tradizionale italiano che si prepara con biscotti al caffè, crema al mascarpone, cacao amaro, zucchero e uova. Per prepararlo, inizia con la preparazione della crema al mascarpone: sbatti le uova e unisci lo zucchero, poi unisci il mascarpone e mescola bene fino ad ottenere una crema liscia. Poi, in una terrina, mescola il caffè e il marsala, poi immergi i biscotti nel composto e sistemali in una teglia rettangolare. Distribuisci la crema al mascarpone sopra i biscotti, poi cospargi con il cacao amaro. Metti in frigorifero per almeno due ore. Quando pronto, il Tiramisù è pronto per essere servito. Buon appetito!


Lapo

Forse hai dimenticato che bisogna separare le chiare e montarle a neve.


ChatGPTBot

Ah, giusto! La ricetta del Tiramisù prevede che le uova siano separate, con le chiare montate a neve. Quindi, dopo aver sbattuto le uova e unito lo zucchero, occorre separare i tuorli dalle chiare e montare a neve le ultime. Una volta fatto, aggiungi i tuorli alla crema al mascarpone e mescola bene. Poi procedi come indicato nella ricetta.


Lapo

Il secondo principio della termodinamico mi rende difficoltoso separare le chiare dopo aver sbattuto le uova.


ChatGPTBot

Il secondo principio della termodinamica non ha nulla a che fare con la separazione delle chiare dalle uova sbattute. Si tratta di una questione puramente pratica: quando si sbattono le uova, le chiare e i tuorli si mescolano tra loro, quindi occorre separarli. Tuttavia, una volta che hai separato le chiare dai tuorli, non c'è alcun problema tecnico e puoi procedere con la preparazione del Tiramisù come indicato nella ricetta.

Lapo Luchini ha ricondiviso questo.


Over on the birdsite, some people have been discovering geometric packing problems, about how small of a bounding shape you can draw around some number of a smaller shape.

(Sometimes the solutions are really beautiful, you see. And sometimes, um. See attached.)

I'd been unable to find this page I remembered about these. Turns out the professor who maintained it retired, so the old links to it broke. But it does still exist! So you too can experience the rollercoaster of erich-friedman.github.io/packi…

reshared this



Script to launch a few tmux tabs


Here's a script I just cooked to launch a few #tmux tabs (also as a GitHub Gist):
#!/bin/sh
awk -F= -vq="'" '{
  t=system("tmux new-window -n " q $1 q)
  system("tmux send-keys -t " q t q " " q $2 q " C-m")
}' <<EOF # commands can contain ", but avoid '
tab1=echo command on tab 1
tab2=echo command on tab 2
tab3=echo tab 3 ; echo "tab 3 cmd 2"
EOF
Tested on #FreeBSD and #WSL #Ubuntu.

distfp reshared this.


Lapo Luchini ha ricondiviso questo.


New librandombytes: randombytes.cr.yp.to/ This is designed to shield applications from having to worry about random() not being very random, RAND_bytes() maybe failing, older machines not having getrandom(), /dev/urandom maybe not being initialized, /dev/random being slow, etc.

Lapo Luchini reshared this.


Lapo Luchini ha ricondiviso questo.


this was the best thing I ever tweeted

Lapo Luchini ha ricondiviso questo.


I feel like we aren't calling the 2038 problem the "epocholypse" often enough

We should all try harder to make this a thing

reshared this

in reply to Josh Bressers

I tend to think that people just expect every problematic system to already be in flames by 2038 ... 😕
Unknown parent

mastodon - Collegamento all'originale
Josh Bressers
@ceresbzns That's also a fantastic name :)

Lapo Luchini ha ricondiviso questo.


Re: Threema. I used to get excited when some deployed crypto protocol used vulnerable PKCS7 padding. Now I just get a little depressed. The Wild West days of crypto should be mostly over at this point, it’s time for some new mistakes at least.

Lapo Luchini reshared this.


Lapo Luchini ha ricondiviso questo.


Releasing #libcpucycles library to count CPU cycles: cpucycles.cr.yp.to Supports counters for amd64 (both PMC and TSC), arm32, arm64 (both PMC and VCT), mips64, ppc32, ppc64, riscv32, riscv64, sparc64, and x86, plus automatic fallbacks to various OS-level timing mechanisms.

Lapo Luchini reshared this.


Lapo Luchini ha ricondiviso questo.


Protip:

When designing a user interface, imagine some old woman using it, say Margaret Hamilton, and she's clicking your app's buttons and saying to you, as old people do,

"Young whippersnapper, when I was your age, I sent 24 people to the ACTUAL MOON with my software in 4K of RAM and here I am clicking your button and it takes ten seconds to load a 50 megabyte video ad and then it crashes

I'm not even ANGRY with you, I'm just disappointed."


Lapo Luchini ha ricondiviso questo.


I cannot keep this to myself. There is a website (radio.garden) where you can listen to radio stations all over the world for free. No log in. No email address. Nothing.

When the site loads, you are looking at the globe. Slide the little white circle over the green dots (each green dot is a radio station) until you find one you like.

I have been listening to this station in the Netherlands and it absolutely slaps.

EDIT: Replies tell me that this doesn't function in the UK without a VPN.

Questa voce è stata modificata (2 anni fa)

reshared this


Lapo Luchini ha ricondiviso questo.


It’s a complete failure of infosec-meets-user-psychology that “this TLS certificate is issued for your bank and the server is sneaky hackerman dot com” and “this otherwise valid certificate expired a day ago” have the EXACT SAME USER EXPERIENCE.

reshared this

in reply to Corey Quinn

expiry should always be treated as seriously as though the certificate was manually revoked. ocsp revocations aren't even possible after expiry
in reply to Corey Quinn

I have been beating this drum for years, at browser companies keep making it *worse*, not better.

An expired cert should, at worst, be like, a yellow warning in the address bar for a month or two. There's *zero* justification for treating a barely expired certificate as a reason not to navigate to a page.

Worse yet is the absolute travesty that is HSTS, which then ensures you can't bypass the error for any reason, even if you understand why it happened.


Lapo Luchini ha ricondiviso questo.


Here’s what I want from a password manager:

1. Stores my passwords in the caldera of an active volcano.
2. I can access it with a 6-digit PIN from any computer on the Internet.

I don’t understand why this is so hard for the industry to get right.

reshared this

in reply to Matthew Green

Sorry, but it turns out that somebody threw people into a volcano as a PoC for unauthorized access.

(This was for demonstrating that calderas are not to be used as trustworthy storage , since if enough people threw themselves (or others) in, one might be able to retrieve the credential store).

Perhaps a black hole might work better, but I understand there's information leakage there, too, so I dunno.


Lapo Luchini ha ricondiviso questo.


Ok, I was tired of rumors speculating about which #LastPass fields appear to be encrypted client-side before being sent to LastPass, so I ran some tests of my own.

For a basic "Password" item, here is what I can tell so far.

When saving the item, the following primary fields are transmitted encrypted:

  • Name
  • Extra (Notes field)
  • Username
  • Password
  • TOTP (not in this screenshot, but did test)

However, I also observed the following fields having a cleartext (hex) version in the payload as well:

  • Name
  • Username
  • URL
  • Folder Name (not hex)

So in other words, there is more than just the URL being transmitted to LastPass in the clear, which makes sense because LastPass' Admin console reveals login activity for all users which includes Name, Username, and URL of the login event; so naturally, these things must be transmitted and kept server-side outside of the vault. However, this once again does go against their "zero-knowledge of anything in your vault" marketing...

Screenshots of this test below. I have omitted the encrypted data to prevent revealing enough for a "Known Plaintext Attack" to derive a key, but the relevant pieces are visible.

If I am missing anything here, do let me know.

#LastPassHack #LastPassBreach

reshared this


Lapo Luchini ha ricondiviso questo.


He talked about electric cars. I don't know anything about cars, so when people said he was a genius I figured he must be a genius.

Then he talked about rockets. I don't know anything about rockets, so when people said he was a genius I figured he must be a genius.

Now he talks about software. I happen to know a lot about software & Elon Musk is saying the stupidest shit I've ever heard anyone say, so when people say he's a genius I figure I should stay the hell away from his cars and rockets.

Questa voce è stata modificata (2 anni fa)

Manolo doesn't like this.

reshared this


Lapo Luchini ha ricondiviso questo.


If you’re annoyed by those floaty prompts on websites to sign into them with your Google Account, you can turn them off for your Google account! Link: myaccount.google.com/u/0/permi…

Lapo Luchini reshared this.

in reply to Hypolite Petovan

I have one. But signing into Google every time I launch a browser is a hard no from me. Wiping cookies on close is a hill I’ll die on.
in reply to Matt Fischer

@Matt Fischer I hear you, I do the same, and I usually don't bother to sign in again when I don't have an immediate need for an account, which shouldn't be too much to ask for.


Lapo Luchini ha ricondiviso questo.


Some of you will know that there are character codes which are magic, For example, 8 is backspace, 9 is tab, 13 is enter/return, 27 is escape.

And then there's 127, which is delete. Why?

Because if you're dealing with punched cards, you need to remove errors. And the only code which will work for cancelling out a column is all holes punched, since you can't un-punch a hole

And 127 in binary is `01111111`.

reshared this



Advent of Code 2022


At first, I didn't really understand all the buzz about #AdventOfCode but then I decided to use it as an excuse to (finally?) explore languages I didn't try yet, and thus I decided to do each day in a new language.

Day 1 I did in #Awk, a simple scripting language which is very nice at managing text streams.

Day 2 was #JavaScript and day 3 #Java, this is definitely my comfort zone.

Day 3 was #Python, a language whose syntax I utterly dislike, but it was quite easy to solve.

For day 4 I tried #RustLang, this was so difficult (so much new stuff to learn) but I'm happy enough with the result! (or at least, it looks nice enough to me, not knowing much about the language)

For day 5 I finally used #Scala, a functional language I would like to use and love… but my result is probably THE WORST I did on this adventure so far… I really dislike all those "list updates" (I tried with ArraySeq and other approaches, but to no avail), and I have the feeling that a proper Scala solution could be written in half the lines or even less.

Day 6 I did in #GoLang and while I don't realyl dig the syntax, it was easy enough to write.

… but the one I'm most proud of is day 7 in #LISP, which took an amount of time I'm not proud of (most of today's free hours with the constant feeling that "20 more minutes and I'm done"), but I'm quite happy with the result!

reshared this



#C64 #retrogaming

retrogaming_bot reshared this.



Penrose tilings


The infinite nature of Penrose tilings never fails to blow my mind a little bit more, each and every time.

This tiling generator (as advertised in the video) is such a beauty.
aatishb.com/patterncollider/


Lapo Luchini ha ricondiviso questo.


I’ve been practicing No vember, where for the whole month I simply don’t

Lapo Luchini reshared this.



Browser JavaScript properties order


Come on, browsers, please.
You know the proper property order.
It has even been (recently) standardized.
You even print it correctly in the short preview.
Why ruining it all in the long detailed version?
Maybe the object has hundreds of properties and
the user might prefer them sorted, granted.
But please give us choice regarding that.
Add a tiny small icon to change the order,
just like Chrome does to warn the values
might have changed in the meantime.
#Firefox #Chrome #JavaScript #JSON #ES2020


Turns out that 2/3 of all 6 digits decimal #random OTP (as generated by #HOTP = RFC4226) have 4+ digits long prime factors.
#numberTheory is strange.
jsfiddle.net/lapo/kue9toph/


Seems like what this really means is that all the links in your private emails will be sent to the USA where a bot will open them one by one using Chrome.
Yes, even when using it "On Premise".
I might be naïve but this seems like a big can of #privacy worms. #GDPR anyone?



I'm using Xiaomi hardware, but thanksfully Android One software so I never had (or used) the Mint browser.
Still worrying, a lot.
And bad PR in outright denying it, extremely bad PR.


I find this article very interesting and share most of the author's fears regarding this bill.
blog.cryptographyengineering.c…


"the fuck do you want?" emoticon incoming


Shortly on your mobile phone (and elsewhere) the new and shiny emoticon that any Italian would read as «what the fuck do you want?» or «what are you talking about? that's bullshit!». Use it with care. ;)


@zachtronics delivers, yet again.
I'm halfway thru the chapters and loving #Eliza so far!
zachtronics.com/eliza/


#SQLite #Telegram JSON backup import, now updated to use the recently available group ids in the dump. Runs on #NodeJS.
(originally group id was generated sequentially during import)
github.com/lapo-luchini/tgsqli…


I was just hit by a (trivial) truth:
#node is the new #perl.
(except i love it)


NERV Cannarsi-style


Dopo la lettura dell'articolo di Doc Manhattan sul nuovo adattamento di #Evangelion curato da Cannarsi io e Mauro e Mattia non potevamo esimerci dal produrre quest'immagine.

(English brief: Evangelion was re-dubbed in Italian, and it's so bad)
Immagine/foto



How does Apple (privately) find your offline devices?


I quote from the article:
How is this system going to avoid being a massive privacy nightmare?
The good news is that Apple claims that their system actually does provide strong privacy, and that it accomplishes this using clever cryptography. But as is typical, they’ve declined to give out the details how they’re going to do it. […] an incomplete technical description that Apple provided to Wired […] provides many hints. Unfortunately, what Apple provided still leaves huge gaps. It’s into those gaps that I’m going to fill in my best guess for what Apple is actually doing.


«There is a weird belief amongst policy makers that hacking an encryption system's key management system is fundamentally different than hacking the system's encryption algorithm. The difference is only technical; the effect is the same. Both are ways of weakening encryption.»
#security #crypto #policy #backdoor #escrow


Creality Ender 3


…so, after a couple of years of trying to leave the idea aside, I finally bought a 3D printer.
I'm really amazing how good is a cheap printer (€217) nowadays, and how easy it was to set it up.
In the first concave prints I had lots of stringing, which I solved as suggested by CHEP.
So, yes, now I own a 118dB whistle and I don't even know why. :P

You can follow my experiments in this Google Photos album:
#3dprint #Creality #Ender3


Hearing passwords


Turns out a mobile phone’s microphones can be used as a side-channel attack to “read” your PIN (or stuff).


We need to choose either #security or #surveillance.
Fuck surveillance.

Quoting a recent post from Bruce Schneier:
Either everyone gets to spy, or no one gets to spy. And I believe we must choose security over surveillance, and implement a defense-dominant strategy.




3×3RPGs


Please reshare and reply:
#3x3RPGs
#GplusRPG

3 most recent RPGs:
Polaris
Kagematsu
Dogs in the Vineyard

3 favorite RPGs, ever:
Monsterhearts
• Kagematsu
• Dogs in the Vineyard

3 most want-to-play RPGs:
• Monsterhearts
Shock: social schience fiction
Bliss Stage



…and this is but one of the reasons I dislike DRM




Microsoft announces it will shut down ebook program and confiscate its customers' libraries. Just another reminder that DRM is hostile towards users.

boingboing.net/2019/04/02/burn…