#Code Safety

[goodoldbandit]

Secure Code, Secure Future: Uniting Dev and Security.

Sanjay Kumar Mohindroo Sanjay Kumar Mohindroo. skm.stayingalive.in Secure your code and protect your future by integrating security into every phase of development. Join the discussion on #DevSecOps and IT security. This post explains how to merge security into every phase of software creation. It shows why adding security to the development lifecycle helps build stronger applications and…

[mostlysignssomeportents]

“Humans in the loop” must detect the hardest-to-spot errors, at superhuman speed

I'm touring my new, nationally bestselling novel The Bezzle! Catch me SATURDAY (Apr 27) in MARIN COUNTY, then Winnipeg (May 2), Calgary (May 3), Vancouver (May 4), and beyond!

If AI has a future (a big if), it will have to be economically viable. An industry can't spend 1,700% more on Nvidia chips than it earns indefinitely – not even with Nvidia being a principle investor in its largest customers:

https://news.ycombinator.com/item?id=39883571

A company that pays 0.36-1 cents/query for electricity and (scarce, fresh) water can't indefinitely give those queries away by the millions to people who are expected to revise those queries dozens of times before eliciting the perfect botshit rendition of "instructions for removing a grilled cheese sandwich from a VCR in the style of the King James Bible":

https://www.semianalysis.com/p/the-inference-cost-of-search-disruption

Eventually, the industry will have to uncover some mix of applications that will cover its operating costs, if only to keep the lights on in the face of investor disillusionment (this isn't optional – investor disillusionment is an inevitable part of every bubble).

Now, there are lots of low-stakes applications for AI that can run just fine on the current AI technology, despite its many – and seemingly inescapable - errors ("hallucinations"). People who use AI to generate illustrations of their D&D characters engaged in epic adventures from their previous gaming session don't care about the odd extra finger. If the chatbot powering a tourist's automatic text-to-translation-to-speech phone tool gets a few words wrong, it's still much better than the alternative of speaking slowly and loudly in your own language while making emphatic hand-gestures.

There are lots of these applications, and many of the people who benefit from them would doubtless pay something for them. The problem – from an AI company's perspective – is that these aren't just low-stakes, they're also low-value. Their users would pay something for them, but not very much.

For AI to keep its servers on through the coming trough of disillusionment, it will have to locate high-value applications, too. Economically speaking, the function of low-value applications is to soak up excess capacity and produce value at the margins after the high-value applications pay the bills. Low-value applications are a side-dish, like the coach seats on an airplane whose total operating expenses are paid by the business class passengers up front. Without the principle income from high-value applications, the servers shut down, and the low-value applications disappear:

https://locusmag.com/2023/12/commentary-cory-doctorow-what-kind-of-bubble-is-ai/

Now, there are lots of high-value applications the AI industry has identified for its products. Broadly speaking, these high-value applications share the same problem: they are all high-stakes, which means they are very sensitive to errors. Mistakes made by apps that produce code, drive cars, or identify cancerous masses on chest X-rays are extremely consequential.

Some businesses may be insensitive to those consequences. Air Canada replaced its human customer service staff with chatbots that just lied to passengers, stealing hundreds of dollars from them in the process. But the process for getting your money back after you are defrauded by Air Canada's chatbot is so onerous that only one passenger has bothered to go through it, spending ten weeks exhausting all of Air Canada's internal review mechanisms before fighting his case for weeks more at the regulator:

https://bc.ctvnews.ca/air-canada-s-chatbot-gave-a-b-c-man-the-wrong-information-now-the-airline-has-to-pay-for-the-mistake-1.6769454

There's never just one ant. If this guy was defrauded by an AC chatbot, so were hundreds or thousands of other fliers. Air Canada doesn't have to pay them back. Air Canada is tacitly asserting that, as the country's flagship carrier and near-monopolist, it is too big to fail and too big to jail, which means it's too big to care.

Air Canada shows that for some business customers, AI doesn't need to be able to do a worker's job in order to be a smart purchase: a chatbot can replace a worker, fail to their worker's job, and still save the company money on balance.

I can't predict whether the world's sociopathic monopolists are numerous and powerful enough to keep the lights on for AI companies through leases for automation systems that let them commit consequence-free free fraud by replacing workers with chatbots that serve as moral crumple-zones for furious customers:

https://www.sciencedirect.com/science/article/abs/pii/S0747563219304029

But even stipulating that this is sufficient, it's intrinsically unstable. Anything that can't go on forever eventually stops, and the mass replacement of humans with high-speed fraud software seems likely to stoke the already blazing furnace of modern antitrust:

https://www.eff.org/de/deeplinks/2021/08/party-its-1979-og-antitrust-back-baby

Of course, the AI companies have their own answer to this conundrum. A high-stakes/high-value customer can still fire workers and replace them with AI – they just need to hire fewer, cheaper workers to supervise the AI and monitor it for "hallucinations." This is called the "human in the loop" solution.

The human in the loop story has some glaring holes. From a worker's perspective, serving as the human in the loop in a scheme that cuts wage bills through AI is a nightmare – the worst possible kind of automation.

Let's pause for a little detour through automation theory here. Automation can augment a worker. We can call this a "centaur" – the worker offloads a repetitive task, or one that requires a high degree of vigilance, or (worst of all) both. They're a human head on a robot body (hence "centaur"). Think of the sensor/vision system in your car that beeps if you activate your turn-signal while a car is in your blind spot. You're in charge, but you're getting a second opinion from the robot.

Likewise, consider an AI tool that double-checks a radiologist's diagnosis of your chest X-ray and suggests a second look when its assessment doesn't match the radiologist's. Again, the human is in charge, but the robot is serving as a backstop and helpmeet, using its inexhaustible robotic vigilance to augment human skill.

That's centaurs. They're the good automation. Then there's the bad automation: the reverse-centaur, when the human is used to augment the robot.

Amazon warehouse pickers stand in one place while robotic shelving units trundle up to them at speed; then, the haptic bracelets shackled around their wrists buzz at them, directing them pick up specific items and move them to a basket, while a third automation system penalizes them for taking toilet breaks or even just walking around and shaking out their limbs to avoid a repetitive strain injury. This is a robotic head using a human body – and destroying it in the process.

An AI-assisted radiologist processes fewer chest X-rays every day, costing their employer more, on top of the cost of the AI. That's not what AI companies are selling. They're offering hospitals the power to create reverse centaurs: radiologist-assisted AIs. That's what "human in the loop" means.

This is a problem for workers, but it's also a problem for their bosses (assuming those bosses actually care about correcting AI hallucinations, rather than providing a figleaf that lets them commit fraud or kill people and shift the blame to an unpunishable AI).

Humans are good at a lot of things, but they're not good at eternal, perfect vigilance. Writing code is hard, but performing code-review (where you check someone else's code for errors) is much harder – and it gets even harder if the code you're reviewing is usually fine, because this requires that you maintain your vigilance for something that only occurs at rare and unpredictable intervals:

https://twitter.com/qntm/status/1773779967521780169

But for a coding shop to make the cost of an AI pencil out, the human in the loop needs to be able to process a lot of AI-generated code. Replacing a human with an AI doesn't produce any savings if you need to hire two more humans to take turns doing close reads of the AI's code.

This is the fatal flaw in robo-taxi schemes. The "human in the loop" who is supposed to keep the murderbot from smashing into other cars, steering into oncoming traffic, or running down pedestrians isn't a driver, they're a driving instructor. This is a much harder job than being a driver, even when the student driver you're monitoring is a human, making human mistakes at human speed. It's even harder when the student driver is a robot, making errors at computer speed:

https://pluralistic.net/2024/04/01/human-in-the-loop/#monkey-in-the-middle

This is why the doomed robo-taxi company Cruise had to deploy 1.5 skilled, high-paid human monitors to oversee each of its murderbots, while traditional taxis operate at a fraction of the cost with a single, precaratized, low-paid human driver:

https://pluralistic.net/2024/01/11/robots-stole-my-jerb/#computer-says-no

The vigilance problem is pretty fatal for the human-in-the-loop gambit, but there's another problem that is, if anything, even more fatal: the kinds of errors that AIs make.

Foundationally, AI is applied statistics. An AI company trains its AI by feeding it a lot of data about the real world. The program processes this data, looking for statistical correlations in that data, and makes a model of the world based on those correlations. A chatbot is a next-word-guessing program, and an AI "art" generator is a next-pixel-guessing program. They're drawing on billions of documents to find the most statistically likely way of finishing a sentence or a line of pixels in a bitmap:

https://dl.acm.org/doi/10.1145/3442188.3445922

This means that AI doesn't just make errors – it makes subtle errors, the kinds of errors that are the hardest for a human in the loop to spot, because they are the most statistically probable ways of being wrong. Sure, we notice the gross errors in AI output, like confidently claiming that a living human is dead:

https://www.tomsguide.com/opinion/according-to-chatgpt-im-dead

But the most common errors that AIs make are the ones we don't notice, because they're perfectly camouflaged as the truth. Think of the recurring AI programming error that inserts a call to a nonexistent library called "huggingface-cli," which is what the library would be called if developers reliably followed naming conventions. But due to a human inconsistency, the real library has a slightly different name. The fact that AIs repeatedly inserted references to the nonexistent library opened up a vulnerability – a security researcher created a (inert) malicious library with that name and tricked numerous companies into compiling it into their code because their human reviewers missed the chatbot's (statistically indistinguishable from the the truth) lie:

https://www.theregister.com/2024/03/28/ai_bots_hallucinate_software_packages/

For a driving instructor or a code reviewer overseeing a human subject, the majority of errors are comparatively easy to spot, because they're the kinds of errors that lead to inconsistent library naming – places where a human behaved erratically or irregularly. But when reality is irregular or erratic, the AI will make errors by presuming that things are statistically normal.

These are the hardest kinds of errors to spot. They couldn't be harder for a human to detect if they were specifically designed to go undetected. The human in the loop isn't just being asked to spot mistakes – they're being actively deceived. The AI isn't merely wrong, it's constructing a subtle "what's wrong with this picture"-style puzzle. Not just one such puzzle, either: millions of them, at speed, which must be solved by the human in the loop, who must remain perfectly vigilant for things that are, by definition, almost totally unnoticeable.

This is a special new torment for reverse centaurs – and a significant problem for AI companies hoping to accumulate and keep enough high-value, high-stakes customers on their books to weather the coming trough of disillusionment.

This is pretty grim, but it gets grimmer. AI companies have argued that they have a third line of business, a way to make money for their customers beyond automation's gifts to their payrolls: they claim that they can perform difficult scientific tasks at superhuman speed, producing billion-dollar insights (new materials, new drugs, new proteins) at unimaginable speed.

However, these claims – credulously amplified by the non-technical press – keep on shattering when they are tested by experts who understand the esoteric domains in which AI is said to have an unbeatable advantage. For example, Google claimed that its Deepmind AI had discovered "millions of new materials," "equivalent to nearly 800 years’ worth of knowledge," constituting "an order-of-magnitude expansion in stable materials known to humanity":

https://deepmind.google/discover/blog/millions-of-new-materials-discovered-with-deep-learning/

It was a hoax. When independent material scientists reviewed representative samples of these "new materials," they concluded that "no new materials have been discovered" and that not one of these materials was "credible, useful and novel":

https://www.404media.co/google-says-it-discovered-millions-of-new-materials-with-ai-human-researchers/

As Brian Merchant writes, AI claims are eerily similar to "smoke and mirrors" – the dazzling reality-distortion field thrown up by 17th century magic lantern technology, which millions of people ascribed wild capabilities to, thanks to the outlandish claims of the technology's promoters:

https://www.bloodinthemachine.com/p/ai-really-is-smoke-and-mirrors

The fact that we have a four-hundred-year-old name for this phenomenon, and yet we're still falling prey to it is frankly a little depressing. And, unlucky for us, it turns out that AI therapybots can't help us with this – rather, they're apt to literally convince us to kill ourselves:

https://www.vice.com/en/article/pkadgm/man-dies-by-suicide-after-talking-with-ai-chatbot-widow-says

If you'd like an essay-formatted version of this post to read or share, here's a link to it on pluralistic.net, my surveillance-free, ad-free, tracker-free blog:

https://pluralistic.net/2024/04/23/maximal-plausibility/#reverse-centaurs

Image: Cryteria (modified) https://commons.wikimedia.org/wiki/File:HAL9000.svg

CC BY 3.0 https://creativecommons.org/licenses/by/3.0/deed.en

[reasonsforhope]

Hey, I'll fucking take it. Cheers to avoiding rampant public safety disasters and strobing-induced seizures!

--

"A brightly flashing “X” sign has been removed from the San Francisco headquarters of the company formerly known as Twitter just days after it was installed.

The San Francisco Department of Building Inspection said Monday it received 24 complaints about the unpermitted structure over the weekend. Complaints included concerns about its structural safety and illumination."

-via AP, July 31, 2023

[sleepynegress]

AKELA COOPER, you brilliant sonuvabitch genre writer.... The fact that HELL FEST, MALIGNANT, and M3GAN are all written from a Black woman's gaze and are mostly dwelling in the "camp" space... IMO, makes the larger sociological niches she's mining (akin to Romero's Dawn of the Dead in sociopolitical prescience) that much more invisible in how apt and *well* she's doing it. But society will eventually catch-up. Her debut, HELL FEST was about a white man, a normal person day-to-day who hides a horrific alter-ego to kill for one night, which gives so many of the Christian family men online calling Rachel Zegler a "cunt"... MALIGNANT was ultimately about women's body autonomy, choice and sisterhood, beneath all the *amazingly* fun bloody campy action scenes. ...And finally, we have M3GAN, who unlike the naive Alita: Battle Angel (written from the male gaze), is snarky, in control, and perfectly aware of how to manipulate the gaze on her girl-child-like visage to her own control and advantage. Also, ...the usage of Britney Spears?! *PER-FECT* People keep sleeping on Akela Cooper and one day, they'll catch-up.

[charmwasjess]

Jedi-era Dooku is just such a fairy tale trope Disney princess. His evil father hates him and tries to feed him to the wolves because he's born with magic powers. He gets adopted by a cartoon troll wizard. He lives as a servant (of democracy) but is secretly royalty. He has a cast of little animal friends. Okay, his animal friends are convors and dragons and Rael and Qui-Gon, but they love him

[koipepo]

Smokestack twins and their baby cuz

THIS IS THEIR WHOLE DYNAMIC IN THE MOVIE

[briandraws]

TADC art jumpscare lol

[enlitment]

Dorm Decor Post ✨

Feel free to judge me for taking Rousseau's Confessions and Mantel with me btw. But APOGS is a fun read and JJ's there for moral support okay? (also for the sheer joy I get when I put him next to V)

Bonus:

The note at the top was once mistaken for a motivational quote but they are actually definitions from Mandeville's texts I needed to remember when I was writing my bachelor's thesis

[fence-time]

could you drop the specific website you used as reference for the zed hanky code article?

For most of them I just go off memory icl but this is the chart I used for ref inage for the zed drawing !!

However there’s also this pretty helpful site that explains the history off it in a pretty concise manner :3

[persy-r-bozo]

DHMIS oddtoer- bloodshead

[pixelatedraindrops]

Happy Birthday Yakou! 🚬💙🎉

The best roommate, mentor, boss, father figure and caretaker Yuma could ask for💕

I had to try to make something for him. I’ve grown to adore him almost as much as yuma as I kept putting them in various scenarios the past half year.

(its kinda for both of them since their birthdays are only a day apart from each-other??)

So yeah, birthday cuddles for them both~ 💜💙

[bumblingbabooshka]

[Tuvok & Janeway: Control, Distance, Duty & Connection.] Sources: St Voyager Transcripts / Mitski 'First Love Late Spring' / Disco Elysium

[frogaroundandfindout]

You remember when dick was in space (for the first time with the new teen titans) because komand’r took Kory back and they needed to save her? And you remember how he understood it was a war they were fighting and that they needed to do what they had to in order to survive it? And how when Gar told him he needed to control Kory, dick wondered if he even should try to stop her from killing her sister? And how he literally killed to save her (there’s some deniability but he’s literally hitting them with lasers described as deadly right in the head)? I do.

[karl-marxs-ghost]

Can’t wait for the Trump administration to get rid of building and fire codes and workplace safety requirements on the grounds that they are overly burdensome and government overreach government. Imagine how much money they could save if they didn’t have to buy so many fire extinguishers!

[razberrypuck]

looking at qcharlie. if the codes and the federation truly aren't on the same side, charlie's somehow got the attention of three separate, opposing forces by doing nothing but trying to heal. the islanders (and the eggs) want him to live closer to spawn; for safety, yes, but because they want to see him more. they're worried about him. whatever the federation as a whole may want with charlie is up in the air, but with elquackity's interest in him, and nearly all of his birthday presents being bombs and escape tools, I think we can take a guess. and the codes, one masquerading as his dead daughter -- they want to learn from him. he managed to convince people that HE was an egg, didn't he? he's one of the only people on the island that hasn't hurt the codes, isn't he?

it seems like everyone's going to start pulling him in different directions very soon. two of these three groups are willing to do anything to get him on their side. but only one has gone far enough to ensure he'd stay there.

[fujii-draws]

(some ribs/aimilly hcs we came up with to share after what you said earlier.. hoping it's fine!!)

- Ribbons likes to wrap her lil ribbon feelers both consciously and unconsciously around the people she loves! She does both very sneakily and subtly where the other person won't notice until they look, and even if they would find it adorable (: Aimilios was flustered a bit when it first happened, Dusknoir felt a bit more at ease when she did, and Grovyle and Celebi accepted it with the biggest smiles on their faces without saying a word.

- Aimilios is surprisingly creative when it comes to specifically using the bone for Bone Rush! He was albeit startled by how it just spontaneously appeared when he first pulled off the move but with time and enough practice he managed to handle it well, and even make it look different to handle different dungeon scenarios! Longer bones to sweep off 2-3 enemies at once (or even a surprise monster house if he pulls it off well enough), thicker ones to handle much more tougher enemies or to use as a better shield if needed, and even getting help from Ribbons to give better damage output by getting her to use Moonblast and then wacking the thing like a ball directly at the opponents. teamwork makes the dream work (:

- Ribbons leans a lot more into the 'cat' part in how Eevee is a combination of a cat, rabbit and a fox, and she leans into it hard. completely random midnight zoomies that she refuses to elaborate upon the day later, just feeling the need to bap whoever is in her proximity for no reason, or just finding a comfortable spot in the. least comfortable spot ever. winning the idgaf war. dusknoir just finds her perched comfortably on one of the bluff's bottom teeth and she waves him with one of her feelers like "hi dad :D". he is mortified but surprised at the same time.

- we think you sorta confirmed this one at some point but Aimilios is very sentimental.. with how he held onto his mother's scarf and just because he'd probably have an equal way of viewing stuff the others would give him or leave for him.. (and probably what would've made the months-long period that he was by himself after temporal tower less harrowingly lonely if that were the case..)

HOW DOES IT FEEL TO BE SO RIGHT ABOUT EVERYTHING.