I would not like a JIT to be embedded in python for one reason. The sole reason why Python didn't have all the security related bugs of other languages (just think about all the exploits in JS engines, as well as the recent PHP vulnerabilities) is sorely because it's an interpreted language, that is python is compiled in a bytecode that runs in a VM.
Under these premises is very difficult that something not implemented correctly is really exploitable, and moreover it's simple to verify the security of the whole thing.
Opening a JIT, that would mean mapping memory pages as RWX, would open the door to all soft of exploits that now are not really possible.
While I don't disagree with you in principle, the context for JS JIT vulns and potential Python JIT vulns is pretty different and worth taking into consideration.
For JS, your machine running untrusted JS code is the intended use case. In this scenario the JS is sandboxed in whatever JS engine (V8 etc) and does not have access to "dangerous" methods, and the main use case for a JIT vuln is to escape this sandbox to execute code on the host. This applies to regular internet browsing (and visiting potentially malicious sites) and also, e.g., using the built-in browser in a locked down device (such as game consoles) to gain arbitrary code execution.
For Python, this security boundary doesn't exist. I can't really think of a scenario where you would be running potentially malicious Python code in CPython that would need a JIT vuln to escape whatever sandbox it is in instead of, say, calling the functions in Python directly (or using the C FFI to do whatever). I'm sure that in some niche use cases, this scenario might exist, but to me, it seems like the potential attack surface is fairly minimal.
EDIT: Also, I'm pretty sure that Python's copy-and-patch JIT writes code to a writable mapping and then mprotects it to W^X? I don't think it leaves RWX pages lying around at all.
I would want a python implementation with a JIT and the ability to choose JIT or no-JIT when defining a python environment. And I want all my libraries to work either way.
I'll get what I want eventually but I might be retired by then.
Yes of course your employer is fine with you going walking barefoot on a beach instead of being in the office working, and it's happy to pay you the same money. Come on...
Also, you are telling me that you can get only with voice interaction an AI to write well engineered and maintainable code, something I've yet to see an AI be able to do, to me the result that they tend is at best the same of a junior developer, except that the junior developer learns, the AI continues to make the same mistakes (because it's context is limited, when it's full it's full).
React ruined the web, and the mobile development too.
Now to load a simple website that in the past was a few kB of HTML, CSS and JS you need to download Mb of JS code. Now the browser needs to use Mb of RAM just to display a stupid webpage.
For what? It was better when we had PHP pages that did produce HTML on the server side.
Another thing to me that we have to get Meta discredit for, not something good in any way.
The web was broken long before React came along. Or have you forgotten about Angular, incompatibilities between JS engines that required hacks like jQuery, the Internet Explorer monopoly, and those who gave up on the stagnating specifications from w3c entirely so wrote their sites in Flash? Or worse, JavaApplets. Or even worse yet, ActiveX (it took a decade for South Korea to undo that latter mistake)
Let's stop saying that open weight models are open source. They are just a software that you can run on your own hardware (if you have a ton of money to spend to get it anyway) but they are not open, they are as open as any proprietary software that you can run on your PC is.
You can't study them, you can't modify them, you can't improve them, you can't look into how they are built etc.
I never said they were open source. Everything else you wrote is factually incorrect.
When you run a proprietary program (like Adobe Photoshop or a closed-source game) on your PC, you get a compiled binary of machine code. The high-level logic is stripped out, variables are obfuscated, and the EULA legally forbids you from decompiling, reverse-engineering, or modifying the binary.
With an open model, you get the actual Python/C++/CUDA code defining the exact mathematical structure of the model. And you get a weights file, which is an unencrypted, open array of floating-point numbers representing every synaptic strength in the network.
So you can inspect the exact mathematical state of the model at any arbitrary moment during inference -- in other words, you can study open models. You can fine-tune or quantize them -- in other words, you can improve them quite significantly! And much much more.
The amount of AI slopped code is infesting even the hobby communities. If you search something online you only end up in AI slopped blog posts that doesn't explain the actual thing. If you want to contribute to an open source project you now can't because the pull requests are full of sloppy AI generated code and the maintainers can't keep up reviewing or closing them.
It still doesn't make sense. That pages are probably built from an internal repository/database where that information is in a human readable format (e.g. Markdown or some sort of CMS) that is then processed by a CI to produce the public static HTML pages.
It would be more efficient to give the chatbot context the source files, in a format that is more efficient for that (Markdown documents, for example) and that will of course contain the internal notes, that are stripped during the build of the public HTML version.
Why a chatbot should waste resources in parsing a public webpage for the same information that you have internally in possibly a more appropriate format?
Also having a check for user agent/IP to do so is still inefficient, because you can't serve static HTML/CSS/JS and thus you have to do processing work on each request, a thing that doesn't make a lot of sense for static content of this kind.
Nobody said it's efficient, welcome to the modern IT landscape. The docs are surely some SaaS with a WYSIWYG editor, access controls and analytics. Every page probably does a dozen database lookups and involves 3 mixroservices and 4 external providers minimum.
To me computers doesn't really have an effect on the data (for how much a computer costs, and how little time in the past it was used, considering the internet was dial-up and was the real cost of using it that made sure you weren't always online).
To me the difference is that we moved to more efficient ways to generate heat, more specifically from electric resistive heating to heat pumps. Both in home heating but also appliances (e.g. cloth driers).
And of course there is climate change, not only we generate heat more efficiently (an heat pump uses at least 1/3 to the power to generate the same amount of heat) but also the climate is less cold, thus less heat required. That is the big difference, not bulbs or computers.
Of course for nations that are more hot in the summer (e.g. my, Italy) the reverse applies, that is more power used because of air conditioning, that 30 years ago nobody had and now it's required since last summer was 25/38C outside for 2 months straight.
Depending on the quality you can get a LED bulb ranging from 1 euro to 5 for the best one. The incandescent bulbs did not cost much lower, and adjusted for inflation, did cost almost the same, but you had to replace them much more often.
Reason why I consider BTC to not have sense, it makes sense only compared to cash, and when you want cash? Illegal activity or tax evasion.
A person that doesn't have anything to hide is happy to leave it's money in a bank where, under EU legislation, it's guaranteed up to 100k euros per account (so you can have multiple accounts in multiple banks so you are safe), that is no matter if the bank goes bankrupt, the money is stolen, or whatever else you will have your money back.
Under these premises is very difficult that something not implemented correctly is really exploitable, and moreover it's simple to verify the security of the whole thing.
Opening a JIT, that would mean mapping memory pages as RWX, would open the door to all soft of exploits that now are not really possible.
reply