Disclaimer: : All of my LLM experience is with local models in Ollama on extremely modest hardware (an old laptop with NVidia graphics) , so I can’t speak for the technical reasons the context window isn’t infinite or at least larger on the big player’s models. My understanding is that the context window is basically its short term memory. In humans, short term memory is also fairly limited in capacity. But unlike humans, the LLM can’t really see (or hold) the big picture in its mind.

But yeah, all you said is correct. Expanding on that, if you try to get it to generate something long-form, such as a novel, it’s basically just generating infinite chapters using the previous chapter (or as much of the history fits into its context window) as reference for the next. This means, at minimum, it’s going to be full of plot holes and will never reach a conclusion unless explicitly directed to wrap things up. And, again, given the limited context window, the ending will be full of plot holes and essentially based only on the previous chapter or two.

It’s funny because I recently found an old backup drive from high school with some half-written Jurassic Park fan fiction on it, so I tasked an LLM with fleshing it out, mostly for shits and giggles. The result is pure slop that seems like it’s building to something and ultimately goes nowhere. The other funny thing is that it reads almost exactly like a season of Camp Cretaceous / Chaos Theory (the animated kids JP series) and I now fully believe those are also LLM-generated.

I always saw Ken as just as out of touch as the rest of the characters, but I think you’re right. Relatively speaking, he is the straight man character. TIL.

Thanks!

Veep is, obviously, about D.C. and I’m from Maryland which is not far from there, so the eastern dialect “vah” is what everyone uses here. So I guess Kent is correct.

I’m similar but it’s a side effect of my general gluttony. I’ll watch one episode and immediately want more. I didn’t intend to wait until the season was over to binge it all, but it just sort of happened because of life being hectic right now.

If it turns out to be the former, I don’t blame them.

I used to buy their stuff and use tuya-convert to flash Tasmota onto them. But they kept updating the firmware to lock that out, and I ended up returning a batch of 15 smart plugs because none of them would flash. They were too much of a PITA to try to crack open and flash the ESP8266 manually so I returned the whole batch as defective, left a scathing review, and blackballed the whole brand.

Nice. I’ve got the Anker version but it’s half the capacity at 1 KWh. It charges exclusively from 800W of PV input (though it can only handle 600W input) and can push out 2,000 W continuous and 3000 peak.

I’ve got a splitter from the PV that goes to both the Anker and a DC-DC converter which then goes to a few 12v -> USB power delivery adapters. Those can use the excess from the PV to charge power banks, phones, laptops, etc while the rest goes to the Anker (doesn’t seem to affect the MPPT unless there’s basically just no sunlight at all). Without the splitter, anything above 600W is wasted until I expand my setup later this spring.

All I can say for it is that it absolutely rocks! On sunny days, I run my entire homelab from it, my work-from-home office, charge all my devices, and run my refrigerator from it if I feel like running an extension cord). It’s setup downstairs, so I also plug my washing machine into it and can get a few loads of laundry done as well.

All from its solar input.

Solutions that work for a corporate application where all the staff know each other are unlikely to be feasible for a publicly available application with thousands of users all over the world

This is something of a hybrid. There will be both general public users as well as staff. So for staff, we could just call them or walk down the hall and verify them but the public accounts are what I’m trying to cover (and, ideally, the staff would just use the same method as the public).

Figure if an attacker attempts the ‘forgot password’ method, it’s assumed they have access to the users email.

Yep, that’s part of the current posture. If MFA is enabled on the account, then a valid TOTP code is required to complete the password reset after they use the one-time email token. The only threat vector there is if the attacker has full access to the user’s phone (and thus their email and auth app) but I’m not sure if there’s a sane way to account for that. It may also be overkill to try to account for that scenario in this project. So we’re assuming the user’s device is properly secured (PIN, biometrics, password, etc).

If you are offering TOTP only,

Presently, yes, but we’re looking to eventually support WebAuthn

or otherwise an OTP sent via SMS with a short expiration time

We’re trying to avoid 3rd party services, so something like Twilio isn’t really an option (nor Duo, etc). We’re also trying to store the minimum amount of personal info, and currently there is no reason for us to require the user’s phone number (though staff can add it if they want it to show up as a method of contact). OTP via SMS is also considered insecure, so that’s another reason I’m looking at other methods.

“backup codes” of valid OTPs that the user needs to keep safe and is obtained when first enrolling in MFA

I did consider adding that to the onboarding but I have my doubts if people will actually keep them safe or even keep them at all. It’s definitely an option, though I’d prefer to not rely on it.

So for technical, human, and logistical reasons, I’m down to the following options to reset the MFA:

1. User must contact a staff member during business hours to verify themselves. Most secure, least convenient.
2. Setup security questions/answers and require those after the user receives an email token (separate from the password reset token). Moderately secure, less convenient, and requires us to store more personal information than I’d prefer.
3. Similar to #2 except provide their current password and a short-term temporary token that was emailed to them when they click “Lost my MFA Device”. Most convenient, doesn’t require unnecessary personal info, possibly least secure of the 3. Note that password resets require both email token and valid TOTP token, so passwords cannot be reset without MFA.

I’m leaning toward #3 unless there’s a compelling reason not to.

Life Pro Tip: Cannabutter on your pancakes.

I thought about generating a list of backup codes during the onboarding process but ruled it out because I know for a fact that people will not hold on to them.

That’s why I’m leaning more toward, and soliciting feedback for, some method of automated recovery (email token + TOTP for password resets, email token + password for MFA resets, etc). I’m trying to also avoid using security questions but haven’t closed that door entirely.

If you’re gonna repost stuff from ml at least re-upload it so I don’t have to connect to it.

• Not every <input type="text"> is suitable for political opinions.
• Political opinions are like assholes: we all have them, they all stink, we all think our own doesn’t stink, and the world is a better place when everyone doesn’t have them on constant display.
• People who inject politics into everything are generally insufferable and there’s a reason major communities have rules prohibiting politics.

Yeah, I hadn’t even heard of PF keys and naively assumed that was a different term for the function keys I knew.

I’m sure we’d be forced to use it if we own an android phone or Gmail account

That’s part of why Google’s attempt failed so hard. They did force you to use it if you used several of their products. Comment on a YT video? Now you have a Google+ profile with that in its feed.

They basically created a social media profile of your activity, automatically, any time you interacted with a handful of their products. Like, WTF were they thinking?

Personally, I love that layout.

I’m always at a loss for what to put up as wall decorations, and I hate rats nests of cables. Win-win!

New U.S. rules will soon ban Chinese software in vehicle systems that connect to the cloud

Seems to me that the easiest way to get into compliance would be to not make the car connect to the cloud/internet. I’m gonna drive my 2017 model until I can buy a new car that isn’t a smartphone on wheels.

which does not explain why this port or the others are blocked. I also lack the technical background to understand this decision.

Don’t take this the wrong way, but understanding the reason for that decision is pretty important if you’re planning to run your own email server. A misconfigured email server (which is very easy to do) becomes a problem for everyone else when it inevitably gets used to spam. There’s also a lot of ancillary things to configure correctly as well (DKIM, SPF, DMARC policies, spam filtering, etc) lest everything seems to work but no one is able to receive mail from you or it always ends up in their spam folder.

While I disagree with port 25 being permanently blocked on residential (and often even business-class) connections, I understand why in the grand scheme of things.

I don’t read Finnish, but here are the general reasons why:

1. Port 25 is for SMTP transport and typically only used for server-to-server (MTA) email traffic. This is unauthenticated between servers. Clients (MUAs) connect through a “submission” port which is pretty much expected to be authenticated/access-controlled. That’s why you can send emails to an email provider but you can’t be an email provider yourself. By blocking port 25, malicious people or people that have been compromised with malware cannot just blindly blast out spam email. This reduces spam considerably, though with a compromise of slightly restricting what a residential connection can be used for.

2. Most big email providers universally block emails that originate from an IP address that’s assigned to a residential IP/provider. Same reason as above. This means even if your ISP were to unblock port 25 for you, you likely wouldn’t be able to send email to any major email provider (Gmail, Outlook, Yahoo, AOL, etc) as they would just sinkhole any messages you send to users there.

That’s pretty much it in a nutshell.

Can you bypass that and host at home?

Yes, if you’re willing to work for it. You can setup a VPS (cloud server) and port-forward across a VPN connection to your home server. Your DNS records for your email server would point to the VPS’s IP, and the email server would need to be configured to use the VPS as its default route so all traffic goes in/out over the VPN connection. This is how my email server is configured.

Sounds easy enough, right? Well, good luck getting a VPS with a “clean” IP. Most VPSs you can get in public clouds are already on one or more public spam blocklists as well as many private/internal blocklists. You can clean up an IPs reputation and make it work with minimal to no delivery problems, but it’s a LOT of work and often requires finding hidden forms to submit the request (Microsoft/Outlook was a brute, and I only found the link to the form in a forum post). I’ve cleaned up two IPs like that, and it took 2-3 weeks of work before I was able to get reliable delivery.

Seems like they’re creating a new account per post now.

Suggestions (keep in mind I don’t know the technical viability of these):

1. Rate limit signups in Lemmy to one per 24 hours per IP (if I understand the rate limits correctly). Anyone requesting multiple accounts per day is immediately sus anyway.
2. Block their IP address
3. Use registrations the way they’re meant to be used instead of rubber-stamping them with a bot
4. In addition to the above, check against a list of their known accounts. There’s not an easy regex way I can see, but the account names all have a similar “feel” to them.

I get mine from ebooks.com

Not all are DRM free, though, but there’s a good selection available. It’s up to the author/publisher whether to release them DRM-free, though, so it’s not their choice.

For the DRM-free ones, you can just straight-up download the epub for them which is fantastic.