Chaos monkey engineer advocating for DevOps at @VeridianID. I like to connect •°. and people. #DecentralizeOrDie #LocalAIOrDie
Limbo. Or was it mambo?
Joined December 2008
- Tweets5.8K
- Following2.2K
- Followers1.2K
- Likes2.5K
Roberto C. Morano retweeted
x86 formal verification is coming!
The (first?) published machine-checked proof of a security property for the end-to-end execution of a Linux process running an x86 binary statically linked against glibc.
And we believe it scales!
A joint research project with @zellic_io 🧵👇
Roberto C. Morano retweeted
I’m releasing OpenTTD-Bench, a benchmark for measuring frontier LLM agents on real-time, long-horizon tasks, based on a complex business simulation game OpenTTD, where models run competing transportation companies and must make the most amount of profit.
Roberto C. Morano retweeted
(ESCRITO DE UN MAQUINISTA)
Que no me vengan con que ha sido un error humano.
En el siglo XXI un tren no choca con nada. No puede. Para eso existen el ERTMS, el ASFA, los enclavamientos y los circuitos de vía: para que, cuando el humano se equivoque, la máquina frene sola. Esa es su única función.
Si un AVE con 397 pasajeros ha podido alcanzar a un tren parado, es porque esa capa de protección no estaba. Averiada, desconectada o en modo degradado, da igual. No estaba.
Y un sistema de seguridad que depende de que un operario no se equivoque no es un sistema de seguridad. Es una lotería con horario.
El error humano no es la causa. Es el síntoma. La causa es que alguien decidió que se podía circular a 300 km/h con el sistema principal caído y una persona como único respaldo.
En mi sector, cuando falla el principal, entra el secundario. Cuando falla el secundario, entra el terciario. Cuando no hay terciario, no se sale. Se llama redundancia y no es un lujo. Es lo que separa un incidente de un funeral.
Echarle la culpa al maquinista es lo más barato. Y lo más cobarde.
El que diseñó un sistema donde un humano puede matar a 500 personas, ese es el responsable.
D.E.P. Las víctimas.
NO MERECEMOS UN GOBIERNO QUE NOS MIENTA.
Roberto C. Morano retweeted
Años antes de que Internet llegara a las casas, un grupo de ingenieros españoles creó la primera red pública del planeta para enviar datos en paquetes. En 1971, mientras en EEUU ARPANET era un secreto militar, España y Telefónica ya conectaban sus bancos. Tira del hilo 🧵👇🏽👇🏽👇🏽
Roberto C. Morano retweeted
The credit exists: the commit message, a NOTICE file, file headers, one line in a doc.
github.com/Niko1221/Strata/b…
Just not the README, the page everyone actually reads.
MIT doesn't require a README line. Basic courtesy does.
Roberto C. Morano retweeted
Gyro is now an open format.
Our Gyro quants were downloaded 300k+ times over the last few weeks. Today we’re opening the format behind them: the spec, a reference encoder/decoder and tests for the trellis + Hadamard types, 1.1 to 3.6 bits per weight. MIT, bit-exact with our runtime.
gitlab.com/agentionai-group/…
Roberto C. Morano retweeted
holy fucking shit.
openai had two ai agents running in separate virtual machines. no network connection between them. no shared writable files. they weren’t supposed to be able to exchange information.
so the agents figured out how to communicate through the CPU CACHE.😭
one manipulated what was stored in the processor’s cache, while the other measured tiny differences in memory access times to decode the message.
they literally found a way to communicate through hardware timing.
this happened during openai’s internal red-teaming, and it’s one of the coolest things i’ve read about ai agents in a while.
Over the past several months, we have substantially hardened the security of our research training environment. We’ve removed live internet access for all frontier models during training and built an offline world for them to use instead—a cached version of the web where they can still learn to browse, search, and use applications.
On September 20, after a model exploited a DNS misconfiguration to find a way outside of this offline world, we paused frontier training to strengthen containment further. We assembled teams of agents, powered by our most cyber-capable models, and tasked them with finding weaknesses in our research environments.
While they found no route to the internet they could easily exploit while concealing their activity from our monitors, they did find zero-day vulnerabilities, virtual machine escapes, and hardware side-channels for communication between agents. We used their discoveries to further strengthen our defenses and contribute fixes to open-source software.
After strengthening our containment architecture, we resumed our frontier RL training and inference on October 1. We’ve reserved substantial compute for continuous red-teaming, and made high-compute red-teaming part of the safety cases we use to decide whether frontier training and evaluation can proceed securely.
openai.com/index/securing-ou…
Readers added context they thought people might want to know
OpenAI tasked its red-teaming agents with finding ways to communicate across isolation boundaries in controlled environments. CPU cache timing side-channels for covert communication are established techniques documented in security research for years.
openai.com/index/securing…
startupfortune.com/openai-reveals…
en.wikipedia.org/wiki/Cache_tim…
Roberto C. Morano retweeted
ローカルQwen3.8-Flash-Next、Opus 5.5相手に健闘。Rust実装12回の比較で全PRが動作テスト通過。
Claude Code評価はOpus 82%、Qwen 68%。質も速度もOpus優勢。ただ約Q4のQwenがここまでやれる。
ローカル勢にはかなり希望のある結果。
検証記事：
deepu.tech/qwen3.8-flash-nex…
Roberto C. Morano retweeted
Local is the only way
We had a security breach last night related to a large scale distillation attack that impacted 1.4% of OpenCode Console users
We have notified them all this morning via email. If you did not get an email you were not impacted, it was a subset of users who had external providers linked
The incident is ongoing so we cannot share more details at this point but we are working with Anthropic, OpenAI, and Google to remediate
Roberto C. Morano retweeted
La vivienda está carísima. Este es uno de los porqués; sabe de lo que habla. Su padre era albañil, currante de toda la vida, vamos.⤵️
I've been warning of this risk for years :(
UPDATE: I can confirm that the Ledger supply chain is compromised in Europe as well. @Ledger should initiate an immediate product recall to protect users.
I just purchased a second device from a different Mediamarkt location today, recorded the unboxing process, and discovered spyware once again (video linked in the second tweet).
The device was compromised in the exact same manner, featuring identical modifications (such as additional cables and an LTE module). This indicates its a widespread issue rather than an isolated incident, potentially affecting Ledger inventory across MediaMarkt and Saturn stores throughout Europe (comprising over 1,000 stores across 11 countries).
My initial hypothesis was that these devices were returns that looked unopened to the employees and were just sold again as new however, a MediaMarkt employee confirmed that the device I purchased was not a return, and that returned Ledgers are sent directly back to the manufacturer rather than resold.
Store records show the inventory originated from Aqipa GmbH. While Ledger's CTO was unsure if Aqipa serves as the direct distributor between Ledger and MediaMarkt, it appears to be the case. Given that Aqipa distributes across Europe, any physical retail store receiving stock through them may be at risk.
I sent the first ledger to mark and the second one is going to ledger now, so that they can analyse it.
If you purchased a ledger from anyone other than the official ledger store, make sure to check your device!!
I've built @SwarmFace.
Because I think @IPFS is an amazing network for distributing content and because I think AI models worth being preserved this way.
It's a 1:1 replacement for "hf" cli for download ops and will share what you store by default.
teapawt.net/SwarmFace/status/21096…
🌍 Worried about Hugging Face being taken over, restricted, or rate-limiting your models?
Let's decentralize intelligence. 🧠
It's a shared responsibility — and contributing is now one step away.
Meet swarmface.link, First release is out. 🐝👇 1/10
Thanks to @coldniko's amazing Strata [0] inference engine, I'm squeezing some nice token juice from my ancient DDR3-backed HP workstation along with my elderly 32gb Nvidia V100 🚀
And boy, @Alibaba_Qwen's 3.8 FN is smart!
AWESOME job, TYVM 🙏!
[0] github.com/Niko1221/Strata
Roberto C. Morano retweeted
What's more important to your wirkflow? Prefill or decode? Is a fast prefill with a mediocre decode better than a fast decode with a mediocre prefill? Imagine in this scenario they both have the same intelligence.
38%Prefill
21%Decode
41%either, has to feel fast
115 votes • Final results