2024: The Year of Infinite Infosec Fail

First up in today’s game of “who fed it and who ate it:” Artificial Intelligence.

AI is everywhere. AI chatbots! AI image generators! And now, AI code assistants, that help developers write computer programs!

Only here’s the thing: AI doesn’t know anything. A lot of folks think these AI systems are, like, some sort of huge database of facts or something. They aren’t. They’re closer to supercharged versions of the autocomplete on your phone.

Which means if you ask an AI chatbot or code generator a question, it does the same thing autocomplete does: fills in syntactically correct words that are likely to come after the words you typed. There is no intelligence. There is no storehouse of facts it looks up.

That’s why AI is prone to “hallucinations”—completely imaginary false statements that the AI systems invent because the words it uses are somehow associated with the words you typed.

AI Fembot says: The Golden Gate Bridge was transported for the second time across Egypt in October of 2016. (Image: Xu Haiwei)

So, code generation.

AI code generation is uniformly terrible. If you’re asking for anything more than a simple shell script, what you get likely won’t even compile. But oh, it gets worse. So, so much worse.

AI code generators do not understand code. They merely produce output that resembles the text they were trained on. And sometimes, they hallucinate entire libraries or software packages that do not exist.

Which is perfectly understandable once you get how AI LLMs work.

What’s particularly interesting, though, is that malware writers can write malware, give it the same name as the packages AI code generators make up out of thin air, and devs will download and install them just because an AI chatbot told them to.

Bet you didn’t have that on your “Reasons 2024 Will Suck” bingo card.

And speaking of things that suck:

I woke this morning to a message from Eunice that a popular, trusted developer had inserted malicious code in an obscure Linux library he maintains, code that would allow him to log in and access any Linux system that his library is installed on.

In February, then again in March, the developer released updates to a library called “XZ Utils.” The update contained weird, obfuscated code—instructions that were deliberately written in a manner to conceal what they did—but because he was a trusted dev, people were just like 🤷‍♂️. “We don’t know what this code he added does, but he seems an okay guy. Let’s roll this into Linux.”

He seems a decent fellow. We don’t know what this code does, but what’s the harm? (Image: Zanyar Ibrahim)

Fortunately it was spotted quickly, befure it ended up widely used, so only a handful of bleeding-edge Linux distros were affected, but still:

What the actual, literal fuck, people??!

“This library contains obfuscated code whose purpose has been deliberately concealed. What’s the worst that can happen?”

Jesus. And it’s only March.

Developers should never be allowed near anything important ever.

Donating Cycles, Making the World Better

One of the things I generally try to do is leave the world in a slightly better state than I found it. Of course, I’m not always perfect at that, but on the whole I think it’s a good goal to shoot for.

To that end, I recently started participating in BOINC again.

If you haven’t heard of it, BOINC is a system where nonprofit science research teams can solve computationally complex problems without having to build or buy time on horrifically expensive supercomputers, by using all the spare idle computation time of ordinary people who leave their computers on even when they aren’t using them. BOINC detects when your computer is idle, and donates CPU cycles to researchers, basically making your computer part of an enormous ad-hoc supercomputer. You can choose what research projects you want to participate in.

Back when I lived in Canada, I joined BOINC and allowed them to use my laptop to look for new treatments for diseases by studying protein folding.

I dropped out of BOINC when I came back to the US from Canada, but I’ve just re-joined again.

This is my old 2012 laptop, which now does nothing but BOINC. I’ve joined two research projects, Rosetta@Home (which does research on protein folding to look for new drugs and disease treatments) and World Community Grid (which looks for genetic markers for cancer and searches for cures for diseases that are too uncommon or appear in parts of the world too impoverished to be worthwhile for conventional for-profit pharmaceutical companies).

I have a computer that is essentially a backup Time Machine server and Web server, and I may run BOINC on that as well.

I would encourage anyone out there who wants to help solve real problems by donating idle computer time to join.

Basically, you just install the BOINC software, choose a research project from a list, and that’s it.

BOINC stops running whenever you use your computer, so it won’t slow you down, but it means your computer time isn’t being wasted whenever your computer is turned on but you aren’t sitting in front of it.

Accidental Science!

It is hard for lovers to shower with me.

The difficulty lies in the fact that I can tolerate only a narrow range of temperature. Anything above or below that range is pain.

I inherited this trait from my mom, along with her resistance to local anesthetics. It has a name, in fact: “congenital thermal allodynia.” It’s caused by a genetic anomaly of genes that direct production of a class of receptor protiens called “transient receptor proteins,” or TRPs, particularly receptor called TRPA1 (which activates in response to cold) and TRPV1 (which activates in response to heat).

TRPV1, the sensor that makes painfully hot things painfully hot

Simplified, handwaving over details, many TRPs respond to changes in temperature, allowing ions to flow through into the nerve cells the receptor proteins are attached to if temperature goes above or below a threshold. When these receptors are found on pain nerves, triggering them results in pain. The temperature-sensing receptors produced my body aren’t formed correctly, so the heat-sensitive receptors trigger at too low a temperature and the cold-sensitive receptors at too high a temperature; a shower that’s perfectly fine for someone else is painfully hot for me, and cold showers are unbearable agony.

That’s the background part I.

So.

Some time ago, I severely burned my foot by dropping a kettle of boiling water on it, which is how I discovered that boiling water burns are just about the only things that suck worse than kidney stones.

The hospital gave me a shot of morphine, which did nothing except make me throw up, and prescribed oxycodone, which also did nothing but make me throw up. Finally, in desperation, I tried cannabis edibles, which I found worked far better than opiates on pain—cannabis was the only thing that made followup viits to the burn clinic tolerable.

That’s the background part II.

Incidentally to this, I also learned that cannabis edibles quench the thermal allodynia. It was, I must say, quite an amazing thing to be able to take a nice warm shower and have it, astonishingly, be a pleasant experience.

For the first time, I really understood what people mean when they talk about enjoying a hot shower.

Fast forward a few years, and I discovered, also quite by accident, that cannabis edibles put me in my body. Normally, my experience of the world is that I live in a ball behind my eyes, connected to and driven around by a meat machine that I can feel, sure, but that isn’t really me. The first time I ever had the experience of completely inhabiting my body was after an experiment with psilocybin mushrooms some years back; and boy, lemme tell you, the experience that I, the me that I am, reached all the way to the floor was fascinating.

I learned earlier this year that small doses of cannabis edibles, about 1.25mg of THC and 1mg of CBD, will induce the same thing.

I also learned, entirely by accident, that a low-dose cannabis edible plus a Mike’s hard lemonade will put me entirely in my body but also make the experience extremely unpleasant.

That’s the background part III.

Now that you know the background, allow me to get to the point of this essay, in which your humble scribe and his Talespinner decide to do “Science!”, and instead accidentally do real, honest-to-god Science!

So first, the “Science!”

Those of you who’ve followed the adventures chronicled herein may be aware that for the last three years I’ve been hard at work on various xenonorph-themed sex toys, most notably the Xenomorph Hiphugger Strapon.

I made a xenomorph hiphugger for my Talespinner as well, and also I’ve been working on a xenomorph facehugger gag, which I brought with me to Springfield.

Two nights ago, my Talespinner and I attended a play party a a local dungeon, at which she played the role of a captive experimental subject caged and parasitized by xenomorphs.

A great time was had by all—you know it’s a party when the facehuggers come out—and so, the next day, we decided to bring out the facehuggers again.

Being that it was close to New Year’s Eve, we got a bottle of aggressively mediocre spiced rum, nowhere near as good as the rum we had in Barcelona, but adequate to the task of toasting the end of an objectively shite year.

And in the name of “Science!”, my Talespinner suggested we replicate my accidental findings with cannabis and alcohol, because, as all reasonable people know, replicability is the foundation of both “Sicence!” and Science!

And so it came to pass, Gentle Readers, that your humble scribe took a low-dose edible and a shot of mediocre rum, his Talespinner strapped a facehugger alien to her hips, and we were off to “Science!”

I won’t disturb you with the details of what happened next, as they would..err, disturb you. However, I will tell you that what we learned was the experience of being in my body was overall quite pleasant.

Until I crawled, exhausted and spent, beneath the blankets.

And the cold blankets were…I won’t say agonizing exactly, but certainly agonizing-adjacent.

Here is where we move from “Science!” to actual bona-fide Science!

It seems that alcohol doesn’t actually make my perception of fully inhabiting my body unpleasant. Rather, what one recreational chemical giveth, the other taketh away. Where cannabis removes the thermal allodynia, alcohol brings it back. And the combination of extreme—some might even say unreasonable—temperature sensitivity and being more consciously aware of my body than I otherwise am is an experienced not to be missed, unless you can miss it, in which case I suggest you do.

I spent some time this morning scratching my head about this, as I would not expect, at first consideration, alcohol to affect transient receptor proteins.

I finally dod a Google Scholar search while we were on our way to the store to purchase tools for minor alien penis surgery, when what to my wondering eyes should appear, but an NIH article directly on point about this:

Ethanol’s Effects on Transient Receptor Potential Channel Expression in Brain Microvascular Endothelial Cells

Well huh, I thought, that’s interesting.

A bit more digging down this particular rabbit hole suggested that yes indeed, this is a real thing:

Primary alcohols activate human TRPA1 channel in a carbon chain length-dependent manner

Ethanol causes neurogenic vasodilation by TRPV1 activation and CGRP release in the trigeminovascular system of the guinea pig

And so it came to pass, Gentle Reader, that our attempts to get jiggy with alien hiphugger parasites and recreational intoxicants actually resulted in a finding supported by genuine empirical Science!, namely that cannabinoid molecules can suppress congenital thermal allodynia, a result reversible by concomitant administration of ethanol.

Which is pretty effin’ cool, I think.

Adventures in Machining

Earlier this year, I received a significant sum of money in a settlement for a lawsuit. This settlement was enough to pay my lawyer, with a bit left over, which I had earmarked for a car since I’ve been sans vehicle after the unfortunate death of the Adventure Van (which needed new parts that are no longer manufactured).

I had earmarked some of the settlement for a cheap used car, when I was captured by Facebook. I spotted an ad for a desktop CNC metal-milling machine for almost exactly the amount I’d set aside for the car, and I thought, if I can machine aluminum, I can make molds for sex toys without having to 3D print them any more! The molds would be higher quality, last longer, and produce better toys!

So of course I ordered the CNC machine instead of the car, and arrived home from Barcelona to an enormous shipping crate…

They call it a “desktop CNC machine,” but I don’t own a desk large enough or sturdy enough to hold it—the thing weighs in at almost 120 pounds(!). So it sits on my bedroom floor, still in the bottom of the shipping crate.

And My God, what an adventure.

I didn’t fully realize what I was signing up for. Carving 3D models out of metal is nothing like printing 3D models on a 3D printer. You don’t give it the model and say “here,carve this.” You have to specify the tool to use, the speed, and (this is the difficult part) the exact path the tool will take, over and over and over again, to carve the shape out of metal.

As one wag on Quora put it, “Dude, what you’re trying to cut requires graduating from trade school plus four years of apprenticeship.” (Whoevel writes an AI-driven expert system to automate some or all this process will become ridiculously wealthy, just sayin’.)

Anyway, I’ve been teaching myself CNC milling, and the learning curve is a cliff. This is quite possibly the most challenging thing I’ve ever attempted in my life.

I’ve worked out basic engraving…

…and I’m teaching myself Fusion 360 and Lightburn (it has a built-in laser engraver too). My wife has come up with some very cool projects to help teach myself, like tentacle fans with metal blades, which I’ll probably start selling once I’ve worked out how to make them.

But at the rate I’m going, I’m still quite a distance off from carving metal sex toy molds.

Come closer, and fertilize me with your reproductive stalk…

Orchids are cool, in a “nature is horrifying” way. There are species of orchid that have evolved structures that look like insects, which they use to lure in insects searching for mates.

Some orchids use these insect visitors to pollinate themselves. The insect does its thing and then flies off, horny and frustrated and covered with sticky pollen, but otherwise none the worse for wear.

But some orchids are carnivorous. They lure insects to their doom, slowly digesting their prey alive as the ill-fated insect struggles helplessly.

And some orchids mimic insect pheromones, sweeting the honeytrap with the same signals that female insects use.

I’ve been thinking quite a lot about sexual parasitism of humans lately, in no small measure because I’ve finished the first version of the Xenomorph Hiphugger Strapon, a Giger-esque nightmare sex toy first conceived by my wife Joreth. Imagine an alien facehugger that wraps around the subject’s hips, then incites the subject to seek out victims, violating them in a parasitic frenzy. As creepy as this image is, it’s table stakes in the game of real-world sexual parasitism, which is horrifying.

Anyway, that’s got me thinking: what if an alien species created mimics of human females to lure in the male of the species? (An idea for a horror novel with this theme is bubbling in my brain; stay tuned!)

I’ve been playing with a version of the Stable Diffusion 2.0 AI image generator tuned to human faces, looking to take the images out of my head and drag them into the light.

What I’ve come up with so far is…well, pretty horrifying.

I’ve started work on a small, AI-illustrated graphic novella (is a graphic novella a thing?), though with all the projects in the pipe right now—including a version of the hiphugger strapon optimized for oral violation—it may be a while before it’s finished.

I did a thing

I tried to do a different thing, but I couldn’t do the thing I wanted to do that was different from the thing I did, so I did the thing instead. Then I did the other thing, too, so…things got done.

It started yesterday morning, when I woke intending to post a new episode of the Skeptical Pervert podcast, this one looking at sex work in different cultures. But what to my wondering eye should show up, but a database server error at my webhosting provider. As I waited for them to fix the problem, I…amused. Yes, that’s the word we’ll use. I amused myself by writing a quick and crude web page that generates random horror poetry and pairs it with a random tentacle image generated by a Stable Diffusion AI generator.

It’s still quite primitive, but it looks like this:

You can, if this strikes your fancy, check it out here:

Random Tentacle Horror Poetry Generator

Some Thoughts on Ethics in Computer Science

As I type this, Elon Musk says the release of true full self-driving cars is perhaps months away. Leaving aside his…notable overoptimism, this would arguably be among the crowning achievement of computer science so far.

Yes, even more than going to the moon. Going to the moon required remarkably little in the way of computer science—orbital mechanics are complicated, sure, but not that complicated, and there are few unexpected pedestrians twixt hither and yon.

We are moving into a world utterly dominated by computers. And yet…there’s far too little attention, I think, paid to the ethical implications of that.

Probably the biggest ethical issue I see in computer science right now concerns training sets for machine learning.

I don’t mean machine learning like self-driving cars, though that’s a monstrous problem of its own—the thing about ML systems is they’re basically black boxes that most definitively do NOT see the world the way we do, so they can become confused by adversarial inputs, like this strange sticker that makes a Tesla see a stop sign as a Speed Limit 45 sign:

Insert picture description

And of course ownership of these enormous ML systems opens whole cans, plural, of worms just by itself. If you use terabytes of public domain data to train a proprietary ML system, what responsibility do you have to make it available to the people who produced your training data, and what liability do you have when your system goes wrong?

And of course deepfake software can produce photos and video of you in a place you’ve never been hanging out with people you don’t know saying things you’ve never said, and make it all totally believable. Look for that to cause trouble soon.

But those are just fringe problems, minor ethical quibbles compared to the elephant in the room: bias in data sets.

Legal societies are putting more and more reliance on ML systems. Police use machine learning for facial recognition (and now, gait recognition, recognizing people by the way they walk instead of their facial features—yes that’s a thing).

Militaries use facial recognition in weapons platforms. Right now they don’t rely in it, but use it as an adjunct to more traditional intelligence, but the day is coming when foreign military targets will be designated entirely by things like facial recognition systems.

Problem is, those ML systems tend to be racist AF.

I’m not kidding.

ML systems rely on training with positively gargantuan training data sets. You train a machine to recognize faces by feeding it millions—or, if you can, tens or hundreds of millions—of pictures of people’s faces.

The researchers who define and build these systems tend to turn to the Internet for their training data, trolling Internet social media sites with bot software that hoovers up all the photos it can find for training data.

https://www.nbcnews.com/tech/internet/facial-recognition-s-dirty-little-secret-millions-online-photos-scraped-n981921

Let’s ignore for a moment the copyright implications. Let’s ignore the ethical issues of treating people’s property as fodder for surveillance systems. Let’s just quietly ignore all those ethical problems so we can talk about racism.

People who post lost of photos on the Internet that get scooped up to train ML systems aren’t an even demographic slice of humanity. They tend to have more money than average, be Western Europeans or North Americans, and tend to be white.

That means ML systems to do things like facial recognition are trained on data sets that are overwhelmingly…white faces.

And that means these systems—even commercial systems now deployed and used by police—suck at identifying black or Asian faces.

Like sometimes really suck.

Insert picture description

Like, as of 2018, commercial facial recognition systems had a recognition failure rate on white male faces of 0.2%, and a failure rate on black female faces of more than 22%.

If that isn’t ringing alarm bells in your head, you’re not fully comprehending the magnitude of the problem.

Here’s a rather frightening quote:

Last year, the American Civil Liberties Union (ACLU) found that Amazon’s Rekognition software wrongly identified 28 members of Congress as people who had previously been arrested. It disproportionately misidentified African-Americans and Latinos.

https://www.theguardian.com/technology/2019/jul/29/what-is-facial-recognition-and-how-sinister-is-it

We train AI and ML systems with data from the real world…and we get deeply racist, profoundly flawed AI and ML systems as a result.

Then we use these AI and ML systems to identify people for arrest or to send autonomous suicide drones.

Insert picture description

https://reason.com/2021/06/01/autonomous-slaughterbot-drones-reportedly-attack-libyans-using-facial-recognition-tech/

Any machine learning system is only as good as the training data it’s developed with. And when that training data is a snapshot of the Internet, well…

This blog post was adapted from an answer I wrote on Quora. Want more like this? Follow me on Quora!

Preorders for The Hallowed Covenant!

Preorders for The Hallowed Covenant, my new post-scarcity science fiction erotic novel with Eunice Hung, just went up today! And man, I am really, really excited about this book.

This is probably my favorite book I’ve ever coauthored. We take a deep dive into what it’s like to live in the City, along the way touching on themes like:

• How do you have a system of justice in a post-scarcity society with no police or codified laws?

• What are the AIs the people in this society worship as gods? What are they like?

• What do transgression and atonement look like when there’s no such thing as law?

And of course there’s lots of sex, much of it involving kinks so exotic they don’t even have names.

The novel follows seven friends as they wrestle with changes in their lives, set against the backdrop of the Festival of the Lady (the AI god of art and creativity)—think Burning Man in a society with a tech level that makes Star Trek look late Bronze Age, but more hedonistic.

The first two novels in the Passionate Pantheon universe have done so well people started asking us for audiobook versions, and guess what? We delivered! The Hallowed Covenant has an audiobook, narrated by the amazing (and incredibly sexy) Francesca Peregrine.

Thanks to a special arrangement with the Nobilis Erotica podcast, you can listen to the first two chapters here!

I am just incredibly, incredibly proud of this book. Like, I am absolutely giddy that it’s almost out. If you like science fiction and you like sex, I suspect you’ll probably like it too.

Check it out here! If you back the crowdfunding, you can score a copy before pub date for less than you’ll find it anywhere else. (And stay tuned for new perks coming soon!)

The revolution is Nigh…Impossible

As part of the ongoing development of the bionic cock project I’m working on, I’m in the process of teaching myself 3D modeling and 3D printing. We’re using 3D printing to make positives for molding silicone prototypes.

3D printing is amazing. It offers incredible potential for people everywhere to be able to make whatever they want on demand, as long as “people everywhere” means “people with access to computers and the Internet and 3D printers and spools of plastic, and the cognitive ability to be able to design things and operate the equipment.” So not really people everywhere, but no matter, right?

3D printing is also incredibly stupid. The state of the art is so appalling. The software is deplorable–a throwback to the bad old days of obtuse design usable only by the select few.

The first time I tried to make a print, I was horrified by what passes for design in the world of 3D printing. It’s a case study in why Linux has never made significant inroads into the desktop, despite being free. Open source software is still software made by developers for developers, with no thought (or sometimes, with active contempt) for users who either don’t want to or don’t have the time to learn every small detail of the way their systems work.

By way of comparison, if color inkjet software worked the way 3D printer software works, every time you hit the Print command on your computer, you’d be confronted by something like this (click to embiggen):

A twisty maze of confusing ad indecipherable options poorly laid out

This…is why we can’t have nice things. The open source community isn’t democratic; it’s elitist.