bk99.de
34 posts
Projects, Linux, networks, systems, finds and internet standards from 2024.
smolagents reduces agent logic to small, comprehensible components and lets models control tools through generated code. The approach favours readability over extensive orchestration frameworks. smolagents supports code agents and classic tool calls.
Read the full postMichael Kreil and Flüpke show how movement data from 800,000 electric cars, including owner information, was accessible without protection and revealed sensitive routines. The two of them gave the talk together. The exposed data concerned around 800,000 electric cars.
Read the full postWillCrash leads from LoRa and ESP nodes through antenna choice and site planning to a robust mesh network that communicates independently of conventional infrastructure. Independent communication comes more from a good topology than from particularly expensive hardware. Low bandwidth forces economical protocols and clear priorities.
Read the full postUS authorities investigated TP-Link over security risks and considered a sales ban on its routers.
Read the full postDIYP distributes digital audio signals optically by laser to several wireless speaker positions. The original video has the ID 1H4FuNAByUs. Unusual transmission paths are worthwhile when their physical limits suit the environment.
Read the full postAl Williams explains virtual audio devices and network paths to connect amateur radio programs to each other without physical sound cards. The use case concerns digital amateur radio modes. PSK31, RTTY and FT8 are named.
Read the full postLayerSkip uses early layers of the same model as a fast draft and checks the proposals with the complete model. This makes a separate draft model unnecessary. Self-speculative decoding uses the same model for drafting and verification.
Read the full postJohannes points to his maintained collection of frequently used command-line and terminal programs and shows his own terminal workspace. The complete list is available as a separate document. The workspace shown is terminal-centred.
Read the full postThe security overview describes changes to file paths, network access and browser boundaries in Gradio 5. Public ML demos are thereby explicitly treated as web applications with an attack surface. Gradio 5 tightens the handling of accessible files and paths.
Read the full postRFC 9669 documents the eBPF instruction set architecture independently of any single implementation. Formal documentation turns a kernel technology into a more portable platform. Safe extensibility needs verifiable limits.
Read the full postThe article applies ternary weights to existing language models and shows an accessible fine-tuning path. Extreme quantisation promises small models but requires careful quality measurement. 1.58 bits correspond to the information content of three possible weight values.
Read the full postA use-after-free race condition in FreeBSD userspace mutexes allowed local privilege escalation in the kernel.
Read the full postAlongside Meta ending third-party AR effects and the Polaris Dawn launch, heise’s news round-up of 28 August 2024 reported an attack on internet providers. An unpatched hole in the network software Versa Director (CVE-2024-39717) was used to gain a foothold in at least four ISPs. There the attackers intercepted customer credentials in plain text before they were stored hashed; Lumen attributed the attack to the Chinese group Volt Typhoon.
Read the full postIn August 2024 Zabbix closed eight security holes in its network monitoring. The most serious was CVE-2024-22116, through which administrators with restricted rights could execute code in the context of the ping script. In addition, the frontend’s audit log displayed passwords in plain text.
Read the full postAt DEF CON 2024, IOActive researchers Enrique Nissim and Krzysztof Okupski presented the “Sinkclose” hole, which affects AMD processors of roughly the last ten years up to Ryzen 7000. Attackers with kernel access can use it to execute code in the privileged System Management Mode and hide from the operating system and protective software. Such an infection even survives a reinstallation and can only be prevented by a firmware update.
Read the full postXetHub joins Hugging Face to version large model and data set files more efficiently. Content-based deduplication is meant to transfer changed blocks instead of complete files. Xet works with block-based, content-addressed storage.
Read the full postKG develops a risk model for artificial superintelligence and asks how goals, capabilities and human control could drift apart. Loss of control does not require hostile intent, only power and wrongly specified goals. Safety work has to be effective before a possible explosion of capabilities, not only afterwards.
Read the full postText Generation Inference loads many LoRA adapters on top of a shared base model and serves them together. This avoids complete model copies and improves utilisation. The demonstration serves 30 LoRA models through one TGI instance.
Read the full postRFC 9580 renews the OpenPGP standard with modern algorithms, clearer packet formats and revised security rules. Long-lived cryptographic formats have to actively shed legacy baggage. Interoperability covers data format, algorithm choice and key maintenance.
Read the full postAccelerate unifies configurations for DeepSpeed and PyTorch FSDP so that training code stays largely stable. The article compares the concepts and migration paths of both sharding systems. DeepSpeed ZeRO and FSDP distribute model states across several devices.
Read the full postThe article quantises the key-value cache, which takes up a growing share of GPU memory with long contexts. This leaves more memory free for longer sequences or larger batches. The KV cache grows with sequence length, number of layers and batch size.
Read the full postFrom a hosting provider’s perspective, Manuel Schmitt explains why multi-level provider backups matter but customers still need external backups. Manuel describes his company’s backups as multi-level. According to him, partial restores are possible in about 95 percent of the cases requested.
Read the full postHugging Face and Wiz Research examine the risks of loading foreign models and of isolated execution environments. The article shows how model artefacts can become a supply chain for executable code. Wiz Research reported security findings to Hugging Face.
Read the full postAndres Freund traces unusual SSH latency and high CPU load to a cleverly hidden backdoor in XZ and liblzma versions 5.6.0 and 5.6.1. Andres Freund published the warning on oss-security on 29 March 2024. The affected releases were the upstream XZ versions 5.6.0 and 5.6.1.
Read the full postEric Ferguson uses hollow LACK panels as an easily worked cockpit for a nephew’s monitor and HOTAS controls. The build took about three hours. The software used is SkyRogue.
Read the full postQuanto brings weight and activation quantisation into a PyTorch-centred workflow. Models therefore remain easier to examine and do not have to be exported to a foreign runtime straight away. Quanto is a quantisation backend for Hugging Face Optimum.
Read the full postProxmox VE and Proxmox Backup Server combine virtualisation with deduplicated, verifiable backups.
Read the full postUsing the Change Healthcare case, Brian Krebs shows how a presumed multi-million payment, a cheated partner and remaining data undermine every promise of deletion. An attributed address received around 22 million dollars on 1 March. An affiliate continued to claim it held four terabytes of stolen data.
Read the full postPEFT adds methods for combining several trained adapters. This allows specialisations to be mixed without training a complete model from scratch each time. PEFT supports several merge methods for LoRA adapters.
Read the full postRFC 9535 standardises JSONPath as a language for selecting values within nested JSON data. Standardised query languages improve portability between tools. Flexible paths need limits against expensive evaluation.
Read the full postThe article combines 8-bit and 4-bit quantisation with speculative decoding for StarCoder on Xeon processors. It shows several independent routes to faster code generation. StarCoder is optimised for CPU inference with Optimum Intel.
Read the full postIn January 2024 Codeweavers developer Elizabeth Figura proposed the NTSync kernel driver, which implements functions of Windows NT thread synchronisation directly in the Linux kernel. Predecessors such as Esync and Fsync/Futex2 reached their limits because the complex NT semantics could not be reproduced correctly with existing primitives. In some games NTSync is said to increase the frame rate by 50 to 150 percent, while in others it changes hardly anything.
Read the full postIn January 2024 Linus Torvalds announced an enforced break in kernel development because a winter storm in Oregon had knocked out power and internet at Torvalds’ home. The Finnish-born developer remarked sarcastically that “storm” and “winter” meant little more than some wind and just under minus ten degrees there. Around 100,000 people in the Portland area were without power; during a similar outage, repairs had taken more than a week.
Read the full postIn January 2024 the OpenWrt project announced its own router hardware for the first time with the OpenWrt One, fully usable with free software and for under 100 US dollars. Planned were a MediaTek MT7981B SoC, Wi-Fi for 2.4 and 5 GHz, 2.5 GbE and 1 GbE ports, 1 GByte of RAM, NAND flash, an M.2 slot and power via USB-C. Only the Ethernet and Wi-Fi firmware and the DRAM calibration were to remain proprietary.
Read the full post