Moral obligation is a good point. Maybe I'm just lucky that authorities really dont enforce DMCA complaints much where I live, so I dont worry too much about that.
Has anyone actually had the police come to complain about pirated media?
Yeah. A lot of inexperienced self-hosters probably don't appreciate how much their ISP has protected them honestly. The first time you open a port on a truly public trunk line at a datacenter is certainly an eye-opening experience!
Fair. I guess what really prompted this question was a chat with a "normie" relative who was self-hosting jellyfin on their main computer, no security (username: user, password: pass, SSL: disabled). I had to explain all the issues (even no fail2ban on their server with an exposed port 22). They thought I was paranoid. But even my suggestions weren't as extreme as many people put.
That's actually a good point. Especially since I think most of us share our services with family members who may be less equipped to protect themselves.
Yeah, my thought here is that dockerization isn't a security measure really. I, for one, run my jellyfin on bare metal with nixos, but secure it behind a keycloak SSO system.
That's fair. Though a compromise enough to run arbitrary scripts on a system to use it in a bot net doesn't take nearly as much security as some people install.
I'm not saying 0 security. A VPN is sensible, or in absence, some good firewalling, a&a, ddos&bot protection, etc. But I've seen posts of people seemingly worrying about security while running a system that's more secure than some systems that hold top secret data.
I just wanted to know why they do it (since I do it too lol).
Oh boy. I had a crazy experience as a coop student (software engineering). Written on mobile, so may have some typos/styling quirks, sorry.
Term X: I worked for company Y, it went well, they wanted me back.
Term X+1: I get the automated message from the university job system saying I have an offer from company Y for the upcoming term, do I accept? I do. 3 months later, urgont email from university's coop office. The offer was glitched in the system. Company Y got a rejection from me, hired someone else. I have about a week to land a job from the dregs that nobody else accepted.
There's no CS related jobs left, but luckily I can speak french at about a B2ish level, so I look at a few french-english translator postings. Get a job doing translations for a mobile app. It'll probably suck a bit, but at least its something.
Fast forward to first day on the job. They say "we saw on your resume that you can code, one project you made was an android app. Here's our competitor's suite of 7 android apps (SAP). We want you to 'translate' them and make us our own versions. Here's a link to our API document." So I guess I got a CS job anyways. I'm put in a cubicle with Mr Doe. My supervisor, Mr Smith says Mr Doe will show me the ropes.
Mr Doe tells me "its a pretty casual place, no real fixed hours, just try to get your work done, no big deal." he then pulls out his lunch and starts eating at his desk saying "I'll just be here if you need anything" I ask about the dev team. He says "we're an HR consulting firm, we don't have a dev team" So I guess I'm on my own. 7 apps in 4 months isn't really feasible, but I'll try to make at least a quality MVP for one or two of them that they can use as a starting point.
Fast forward again, 2.5 months into the 4 month term. Mr Smith barges into Mr Doe and my cubicle. He yells at Mr Doe saying we run a tight ship here, I told you before our hours are 8 to 4 and you keep coming in at 10. Plus our corporate policy is clear about taking your lunch at your desk. You are fired. Mr Doe protests a bit, but ultimately ends up being let go. Mr Smith says he noticed that I've been late and eating at my desk too and he's going to send a letter to the university that I am violating company policy and am now on probation. I tell him this is the first I've heard of this, but he insists it was in the employee manual. I never got any manual. He insists that Mr Doe must have given me one, but relents and gives me a 'new' one.
Next he asks to see how the apps are coming along. I tell him one is almost ready to test as a minimum viable product and show him it, also show a second work in progress and demonstrate that it can make writes to the database (I started with the easiest app that only needed read access).
He is furious. Saying I should have at least 3 full apps done, not 1 partially complete app and 1 completely broken one. I told him that without a dev team or even a senior dev that was unreasonable. He says "they're just mobile apps its not like we're asking you to make full programs or anything, just copy the ones SAP made" I tell him that a mobile app is still a full program, and they really should hire a full dev team for it, but he's not having it.
Anyways, I finish the term the best I can. When I get back I of course get called in to the coop office and the dean of my program is there. They got a letter of complaint saying I couldn't speak french, I was always late, I was a slob, etc. The university has a reputation to maintain, I was representing them and made them look bad...
Luckily when I told them the whole story, plus showed proof (which I was documenting extensibly ever since Mr Doe was fired), they took my side, unlisted that company, and gave me a free pass on my next coop term (so a 4 month vacation).
That HR consulting firm took 3 years to send me my tax forms btw... Yeah, they're out of business now. Good riddance.
Except that AWS is (for better or for worse) a tier 1 network solutions provider, in part because of advertised uptime. Due to that, it is possible for a minor AWS outage to result in lack of 911 service in an area, for example. Hopefully they have the common sense to try out these new things on less critical nodes though.
Just the historical Russian ties, which is enough for some people/organizations to avoid them. The biggest practical reason is the dependence on tooling. Kotlin is a great language, but loses a lot of its allure when you can't use an IDE for whatever reason. It makes sense, given that its developed by a company whose main product is IDEs; but it can still be an issue in some circumstances.
Good clarification, thank you. I guess it would still require some extra care when interfacing with plain Java libraries, but so does e.g. Kotlin. Cool implementation.
There are many valid practical reasons to avoid Kotlin in certain circumstances (not the least of which being Russian ties). More tools for Java isn't necessarily a bad thing. However I don't really think it works. It reminds me of this blog post: https://www.javacodegeeks.com/2017/02/elvis-not-visit-java.html which I think accurately reflects many of my thoughts about null-safety in Java.
Thats exactly what I so often find myself saying when people show off some neat thing that a code bot "wrote" for them in x minutes after only y minutes of "prompt engineering". I'll say, yeah I could also do that in y minutes of (bash scripting/vim macroing/system architecting/whatever), but the difference is that afterwards I have a reusable solution that: I understand, is automated, is robust, and didn't consume a ton of resources. And as a bonus I got marginally better as a developer.
Its funny that if you stick them in an RPG and give them an ability to "kill any level 1-x enemy instantly, but don't gain any xp for it" they'd all see it as the trap it is, but can't see how that's what AI so often is.
I'm not sure if this is the best place to put this, but I wanted to share my thoughts.
For background, I got an undergraduate degree in software engineering. I took a few electives on AI, but it was more primitive back then (state of the art were GPT-2 and early stable diffusion models, it was pre "Attention is all you need"). Since then I've tried out the new stuff, made some generic profile pictures with "AI", messed around with a few prompts on GPT-4, but not really used any "AI" for anything productive. I haven't found a single valid use-case at my work for anything past MLPs (which admittedly work great).
My first reaction was: "wow, that's actually pretty impressive -- at least relative to what AI/ML could do a decade ago". I then noticed the size of the models, leading to my first question: how bad is the "efficiency" of increasing model size?! I know that MLPs reach serious diminishing returns before getting into the billions of parameters; and I understand that the transformers eat up a bunch of additional parameters. Nonetheless, I almost expected more from statements like "480 billion parameters". IIRC that's significantly more parameters than neurons in the human brain (though probably fewer nodes due to the more connected nature of artificial neural networks).
The next thing I realized was that there are a lot more models out there than I thought. I had of course heard of the GPTs, and played around with LLaMA, plus news has made me aware of Gemini, Claude, and Grok. I didn't realize just how many models there were. Given their size, that leads me to my next question: given the cost (in both $ and environmental impact) of training an AI, why are so many companies training their own AIs instead of in some way sharing training time on the same model? Surely the training sets can't be that different given their size. A handful of different models makes sense, but this seems like a massive waste of resources to me.
Finally, I realized that I really am a bit out-of-date on AI usage (though not overly out-of-date on AI research). I haven't tried interrogating weights of any modern model, I didn't even know you could reasonably ask modern models to dump their output probabilities like that, though of course it makes sense. So my final question: are there any FOSS models with state of the art techniques being used? (i.e. expert dispatch and LoRAs)
The Cluefinder series, Minecraft beta from 1.4 to 1.6, BOTS, Secret of the Solstice, Realm of the Mad God, Skyrim, Mindustry, FTL, and currently CS2 and PokeRogue. Though I'm sure I'm forgetting at least one.
It would be hilarious if the more security focussed hobbyists were to pen-test that link, eh? Careful where you spam.