TechLich

While this advice is true for all models, when it comes to agentic tasks (add this small feature/write this test harness/find bugs/suggest improvements), open source models are still way behind, vibe code or not.

Claude Fable or even Opus in an editor like Zed have a 1 million token context window and will "think" through the goals of the application, test their changes, work through debugging processes the way a programmer would, stop to ask for clarification, check diagnostic tools and linters, prompt to run test code, etc.

Llama, Gemma and Qwen etc. Do lack a lot of the world knowledge to get the goals of the application, but they also just don't have the debugging skills, won't test their code, don't always tool call correctly, get confused as the context increases and nobody has enough vram to run on large context sizes locally.

They can do autocomplete on small functions but aren't really there for more complex tasks.

On top of that, the biggest problem is that the best open source models are trained and released by the same giant tech conglomerates that have an interest in not competing with their own products. Qwen is Alibaba, Llama is Meta, gpt-oss is OpenAI. Even the more "independent" ones, kimi (Moonshot) and GLM (z.ai) are mostly funded by Alibaba and Tencent. They're released for research and marketing purposes and to please their corporate backers with inflated stock. Almost nobody has the resources to train new models from scratch. People make lots of merges and fine tunes but AI is not democratised the way that traditional programming tools have been.

Maybe some day there will be enough cheap compute for open source communities to pool together resources to build competing models but they're not really there yet :(

There are quite a few. The best ones are sustainable closed loop datacenters with on-site solar which is becoming pretty common across the world, especially for new builds. Often producing more power than they need and feeding it back to the grid (especially if the local government has an energy buy back scheme).

But most data centers are pretty tiny and just built into an office building with a bunch of server racks.

Depending on where you live, a quick web search for data centers in your local area will probably show up dozens of them of varying quality hosting people's websites and business apps etc. They aren't any scarier than anything else you find in a city. They're critical infrastructure that helps make the internet a thing. In most cases, if it wasn't a datacenter, it would be a car yard or a factory, etc.

But! There are also truly evil datacenters. Like this insane Utah monstrosity built for a shitty purpose and the size of a freaking city. An obscene monument to the US tech cesspool's hubris.

I mean they're not all for AI and they're not all environmentally devastating.

This one very much is.

That's fair. The nuance that people lose is more that people are often painting them all with the same brush. Protesting any datacenter regardless of impact.

It becomes something like: "datacenters are evil and are a symbol of techno fascist distopia! If they build a datacenter in my city, the taps will run dry and Elon Musk will use it to make ai porn of my children!" Even if it's a small solar powered closed loop that provides VPS, storage and web hosting for nerds and small businesses.

I also do think there's also a scale of evil there. Some environmental impacts are not immediately obvious and might not be known about during planning. Some were built a long time ago with older tech and are a bit shitty but have a plan to transition to be more sustainable, etc.

The world is full of "alright but a little bit shit." It's not all perfect angels and mustache twirling villains.

I don't want to detract too much from the real villains though. Nobody needs a 9GW datacity for military ai.

Not all data centres are evil and the issue is nuanced. This one sounds pretty evil though.

9GW is totally insane and they're building a gas plant for it instead of renewables (although there's some solar too). It's closed loop so the water use fears once it's running are probably a bit overblown, but the construction itself is going to be ecologically insane. The thing is basically a data city, 162 square km is even larger than a lot of cities and involves building an entire power plant and new energy infrastructure. Building it is a full megaproject and even just noise pollution and the construction impacts will mess with bird migration etc. Obviously the whole thing isn't going to be full of data centre, some of that space is empty but still.

It's also going to have the US military as a major client so... Pretty high up there on the evil scale IMO.

Yes kinda? It depends a lot on the system. It's still pretty common, even with containers like docker, for different services to run with different accounts and permissions. Eg. If you have a webapp with a small database or something, the web server will be www-data or whatever and the db will be a different user account like a postgres user or something. Even a fresh Linux install will have a separate user account for things like ntp (or systemd-timesync) etc. Users aren't usually people, they're daemons with limited scope and rule of least privilege.

Even if it's all docker containers and you deploy them with the same docker account on the host, there are almost certainly a bunch of different accounts inside.

That way if there's some vulnerability in ntp or something, an attacker might have permission to mess with the time but can't, in theory, take over the whole container.

I think there is a trend towards caring less about that aspect of defence in depth if each service is in its own container and just rely on isolation. People are deploying services running as root with ansible or even just in dockerfiles, and not caring about it because there's nothing else on the box for an attacker anyway. If they compromise the service, they've already got what they want.

I get the thought process but it still doesn't feel good to me. If some docker bug shows up that allows a container user with root to break isolation and use the shared kernel to pivot to the host or other containers, then that one dodgy webapp that's not running as a restricted user can become a part of a larger kill chain. It's really easy to develop systems with least privilege in mind and there's not much downside to doing it. It's a good habit to create different accounts for different services (even if there's one admin/docker/ansible/whatever account for deployment).

Your user account can run applications and read and write to a lot of locations on the disk.

So it can be used to run malware (cryptominers, ransomware, RATs etc.) Exfiltrate the data your account has access to, download or plant malicious or illegal data, use your internet connection to attack other systems with DOS or similar, use any logged in social media accounts to attack or spam your contacts, steal saved passwords and credentials from your web browsers, use your peripherals or connected devices (printers cameras microphone speakers), pivot to access other services on your local network (smart devices, IoT, TVs, home lab) etc.

There are comparatively few things an attacker wants on a desktop that actually require root access. It's mostly just system files, package management and settings changes that require root to mess with. Eg. You would need root to dump a shadow file or stuff like luks encryption keys from kernel memory, but if an attacker has your logged in user account, the disk is already decrypted and account is already logged in.

I think they're saying that it's not generating slop from nothing. They take the artist's "structure data" as a "ground truth" and the generation is "guided" to generate slop that won't deviate too far from the original?

I thought so too. I seem to remember it almost being a selling point. Like: "Your adventures are being used to improve maps and train AI systems for the future of humanity! Yay!"

But I had a look at their old pages from 2017-2020ish in the Wayback machine and there's no mention of it. In fact, their privacy policies seemed to try to make it very clear that they don't sell or share user data except where needed to deliver the service or in anonymised aggregate to third parties (48 people went to your business while playing Pokemon!).

There's some mention of using it to advertise but none of them mention using it to build an advanced geo-spacial dataset for AI. Unless I'm missing something or reading it wrong?

Might be a Mandela effect.

Those things come with a big convenience and implementation trade-off that slows adoption.

If it's hard to export for technical reasons (eg. Needs to be in a tpm) then that adds hardware requirements and complexity and makes it difficult to log in on other devices. If it's a software thing, then it's rippable. Either way "install our government app to watch porn" is not an enticing prospect for people.

Aggressive rate limiting is also frustrating if you want to log into multiple things and it keeps blocking you because you're using your key too fast, but if it's not aggressive then it likely won't be effective unless all the kids sharing a key are trying to use it at once.

If it's a temporary thing where you have to auth with the government to get a fresh signing key that expires, you have the issue of having to sign into the government when you want 18+ content which is super uncomfortable.

I can see it being a browser-based thing set up a bit like video DRM but that would still need to talk to a government server each time for a temp key (like how licence servers work) and you'd need to be logged into their systems. It might still be the best option but it does still leak "X person wants to access 18+ content right now" to the government.

I'm really interested in seeing a technical/cryptographic solution that actually works but so far I haven't really and I'm starting to doubt that it's possible.

I think they supported the pixel fold which has the same sort of second flippy screen thing. I think the multiple screen stuff is just in the aosp base.

Whenever this comes up, this style of zero-knowledge proof/blind signature thing gets suggested. But the problem is that those only work if people care about keeping their private keys secret. It works to secure eg. "I own $1" but "I'm over 18" is less important to people and it won't be hard for kids to get their hands on a valid anonymous signing key on the web. Because the verification is anonymous and not trackable, many kids can share the same one too, so it only takes one adult key to leak for everyone to use. It's one of the reasons they push biometrics that at least appears to need a real human. Requiring ID has a lot of the same issues on top of being a privacy nightmare.

I'm starting to think that actual age verification is technically impossible.