Notices by Mark T. Tomczak (mark@mastodon.fixermark.com), page 2

One of the more interesting aspects of the Ukraine war was the revelation of how badly compromised Russia's defense assets were. It was, honestly, a little startling to the public to learn that the feared Former Soviet State still had size on its side, but not a modern military; their tech was either out-dated or had been pillaged by corruption so badly that it couldn't be deployed as intelligence analysts had assumed it could be.

It is extremely fair to argue that Russia's greatest state-defense asset was perception and that the war in Ukraine damaged that and, in so doing, materially threatened the country's safety---that if they had simply never started a war, everyone would still perceive them as unassailable and incredibly dangerous to engage in combat and nobody would even think to try stochastic attacks, asymmetric drone warfare, or any other modern tactics under the assumption that such a grand superpower had a solution for all of that.

In short, all they had to do to keep everyone's perception of their strength was literally not start a war to test it.
Just a thing I'm thinking of right now for some reason.

https://www.cnn.com/2026/03/18/politics/us-ford-carrier-fire-iran-war

@thomasfuchs Ah, I don't disagree with this criticism, but I am old enough to remember that the reason half of us went to work at a place called Google or Grammarly or Amazon is that we already knew IBM, Microsoft, General Motors, Morgan Stanley, Boeing, Monsanto, etc. were stupid or evil or both.

... but yes, we were naive enough to think that it was because of the people, not the system itself, and this time... This time would be different.

@thomasfuchs It feels like there's a meme in here.

Small brain: yell at people making requests to do it themselves.

Galaxy brain: "That's an interesting idea and I can see why you would want that! Unfortunately, I think it ends up in the priority queue somewhere around the year 2039. We are willing to review pull requests though!"

@soatok I'm curious your thoughts on usability in the space. You've shared some of them, but I tripped over something this week and I thought you might be interested.

I tried adding scope to an API token I had Atlassian generate for me, and the scoped token wouldn't work. I bashed my head against the problem for awhile: peeled apart the library I was using to find the actual URLs it was hitting, confirmed the scopes I'd assigned should match that URL, confirmed an unscoped token worked... It finally turned out that the issue was if you're using a scoped token, you have to hit an entirely different hostname and top-level path in the URL; they have a slightly different API for the requests with scoped tokens.

At that point I gave up and used an unscoped one because nobody in IT was forcing me to use scoped, I just liked the idea that my token intended to read JIRA tickets couldn't also delete them, but I don't care enough to rewrite my API library.

How do we balance security and usability? Is there even a rule of thumb?

(Also, if you ever hear what the first twelve characters in an Atlassian API token mean, I'd love to find out. I had to generate five tokens while testing this problem, and they all started with the same twelve characters... My guess is it's a customer-identifier specific to my company, but I haven't had time to pin down a coworker long enough to have them generate a token to compare with).

@skinnylatte Y'know, I never thought about it until you said it, but probably same. I never screamed for fun as a kid, and I also don't like loud noises in general. Never occurred to me the two might be related.

@soatok Wait... Are people complaining that you published the exploit list now so now they're going to have to work over the summer to fix issues in their Matrix deploys?

Wow. Unless I've misunderstood you, that's.... That's something is what that is.

@david_chisnall There is a hilarious possible future where the government fails to do anything about monopolies but Cloudflare has a de-factor competition increase effect because it makes it so onerous for everyone to use one site that people start self-selecting to use other sites.

@david_chisnall I like this one specifically because the Cloudflare gate is there to address the problem of "Too many visitors."

@thomasfuchs Yep, this is pretty SOP for autonomous systems in uncontrolled environments (or controlled environments, for that matter... All of the rail switching in Pennsylvania's main lines is controlled and monitored from two redundant switch houses, if memory serves)

@dalias @lauren Unfortunately, that process is extremely broken because it results in us only having access to truth proportional to the integrity of our peer groups.

If I, the ignorant, have to evaluate which of my peers has domain expertise (and, more importantly, a compulsion to be correct, not just seem correct)... Well actually, that explains a lot about where we are now, does it not?

@lauren Turns out AI is more an existential threat to traditional news than I had considered.

Ultimately, if the news professional cannot tell AI editing from an authentic article... What use do we, the audience, have for the professional? Because I can get doctored images of what's going on in Minneapolis from my uncle for free.

@thomasfuchs Interesting. "Preannounced revolutions are not taking place" sounds awfully similar to "The revolution will not be televised."

@thomasfuchs The VR one is my favorite because that's heavily capped by actual limitations in human sensory wetware and the way we bind our senses into a notion of what's going on in the world.

In my lifetime, I've watched some real impressive leaps and bounds to work through the nausea issue.

The nausea issue is still there.

@soatok I've been quietly beating the drum for awhile now that a lot of the anti-AI rhetoric is medium- and long-term moot because the cat. Is. Out. Of. The. Bag.

Yes, OpenAI are fascists and a problem and down with them.

Smaller models already run on a Raspberry Pi, and there's no particular reason to believe at this time that the next iteration of the raw research won't make training or cross-training them better / faster / cheaper. Most of the anti-AI arguments I see don't stay relevant when it becomes "A thing you slap on a shelf PC and have running in your own closet," and I don't think a lot of people are talking about what that world looks like.

@soatok Incidentally, catching up on your blog:

If that doesn’t make you feel all warm and fuzzy, remember that many industries still use FTP to transfer encrypted ZIP files back and forth in 2026.

I worked as liaison between my company and a company they'd acquired for about nine months. The acquiree's entire business niche was something that really reframed my understanding of where I set the bar for technical literacy and competency in general industry; I just flat-out thought we were training more software engineers than we were, and I was wrong.

This company's business model was that they did high-touch data massaging between

• Big online retail search engines like Amazon, Baidu, and Google Shopping

• Manufacturers who (a) made really high-quality products in their niche and (b) had an IT team that would celebrate with a pizza party if they could successfully implement one new data pipeline end-to-end. Per quarter.

The job was literally "You FTP us your inventory in whatever format you were able to conduct enough black-arts rituals to get the internal tracking system that someone else built for you to spit out, and we'll turn it into the right formats for these online retail markets." The mechanics of the job were a lot of "Take this not-actually-compliant CSV file and build heuristics to guess which commas were column separators and which were a place where their system had left out quotation marks."

... the company grossed past $1 million annually.

Those FTP'd files aren't even encrypted ZIPs. Encryption is way outside the problem domain. 😉

@kims There's a wild bit of videogame trivia attached to that movie. In the original Pokémon game and a couple subsequent ones, the TV in the player's house is playing Stand By Me.

Why this movie of all movies?

Apparently, it's a bit of a cultural touchstone for a generation of Japanese people because it was used in a fairly popular "Learn English" module, with the module capstoning at watching Stand By Me in English (I assume because the reproduction rights were reasonably cheap and the protagonists are about the age demographic of the students in the curriculum, but that's just guessing).

Where am I going with this? I think it's interesting that we can't ever really know where the things we put into the world are going to go. Might as well try to predict the path of one gust of wind. Or the eventual resting place of a sunbeam.

In the Starfleet Technical Manual, there is a throwaway detail of the LCARS user interface that when it is upgraded, users can still utilize the previous several versions. This is because their work is mission-critical and it is unacceptable to compromise the mission by forcing unfamiliar changes; eventual retraining is part of their job, but the flexibility allows them to take the retraining at their own pace.

I think about this from time-to-time and how this is still a sci-fi idea that is seen all too rarely in how we do actual computer UIs.

#StarTrek #LCARS #UI

@kims I think my TODO tracker is ready to upload to my sandstorm server tonight.

Feeling pretty good about it; haven't prototyped something just for myself in a while.

TIL: matplotlib supports specifying colors using standard X11/CSS4 names, but also supports the names from the xkcd color survey if you prefix the string with "xkcd:".

(While looking this up, I also learned about the full-on xkcd mode, but different topic!)

#python #matplotlib

@thomasfuchs For those of us not in the know: what's the issue?

Is it microplastics or is it "The print is too porous and lets bacteria hide?"