New paper: LLMs don’t do formal reasoning.

Well, of course.

LLMs don’t do informal reasoning, either.

Humans are great at pattern recognition. We even recognize faces in clouds and tree trunks. We recognize wheelbarrows, bears and crabs and archers in the stars. We make things that have meaning, and we communicate through speech and text and art.

LLMs are great pattern-generators. They are extremely well-tuned to make patterns that look like they might have meaning. A human trying to communicate may be bad at it, but they have an underlying model of the world that they are referencing and updating. An LLM is not trying to communicate anything. An LLM has a model of language, not a model of the world.

The map is not the territory. All models are wrong, but some are useful.

The situations in which it is reasonable to use an LLM are exactly the situations in which it is reasonable to roll some dice and use that to read the table of random monster encounters; to pull a card from an Oblique Strategies deck; to twirl the knobs on the synth and see if you can get a cool sound. In years past, you could type in a good list of keywords to Google and hit the I’m Feeling Lucky button.

Attempts to use LLMs for more than this fail. Often they do not fail in such an obvious way that the results are immediately discarded, which is where most of the danger resides.

-30-

The Linux kernel doesn’t consider routing to be a separate process, so it can eat lots of CPU capacity and still be at a load average of 0.

Load averages are calculated as the number of running and uninterruptible processes, sampled every 5 seconds, and then displayed as an exponentially decaying average, optionally per core (or SMT “core”). A process actively computing stuff is counted the same as a process that has an outstanding I/O request, which can be a source of excitement.

The act of routing packets (as opposed to working on a routing protocol exchange) is handled by the kernel, so it does not have a countable process identifier, so it does not count for load averages.

-30-

Self: you have managed to make some cert renewals dependent on IPv6 connectivity through to the main server. This is not bad, but it is odd.

-30-

Many organizations claim to be following Agile in some way. The vast majority are wrong, and most of them should not be Agile anyway.

You will recall that the Agile Manifesto, in total, is this set of four guidelines and an interpretation:

• Individuals and interactions over processes and tools
• Working software over comprehensive documentation
• Customer collaboration over contract negotiation
• Responding to change over following a plan

That is, while there is value in the items on the right, we value the items on the left more.

That’s a recipe for making certain customers happy with your perpetual engagement. But:

Repeat the following metaphor until you internalize it:

Security is the skin of an organization, IT infrastructure is the bones.

Everything else is the digestive system or the nervous system. Breaking the skin is a bad idea. It needs to be done for certain specific reasons, but all of those holes need good defense systems including real-time sensors and reflexes. Repeatedly stressing parts makes them tired and calloused, not more flexible. Careful and deliberate exercise builds strength and flexibility.

If I had less integrity and more time I could spin this out into a 140 page business advice book.

-30-

A nominally 8-wide LEGO Speed Champions vehicle is actually 8.5 studs wide, due to the overhang of the wheel arches. Said arches are 4 studs long. The space between them can reasonably range from 6 studs (very short) to 9 studs (very long) and is typically 7 studs long; sometimes 8.

The rear overhang is generally 1 to 2 studs long. The front overhang is 1 to 4 studs long. This gives an overall length for the car ranging from 1+4+6+4+1 = 16 studs to 2+4+9+4+4 = 23 studs long.

The Mercedes AMG G63 is an outlier and should not be counted.

-30-

There’s a game which you have probably played in some form, possibly not even knowing that it was a game. It goes like this: an author writes fiction, and the reader comes across an interesting element and asks how it works, in-universe.

And people come up with answers…

About two weeks ago I decided to use parts from a suddenly unused desktop to upgrade the living room media server. The initial plan was to keep the disks, power supply and case of the media server, and use the motherboard, CPU, RAM and video card from the desktop.

Things did not go to plan, of course…

My RSI prevention strategy involves change: I use three different keyboards, four or five pointing devices, and move around to different places. On my main desktop, I mostly use a thumb trackball, with a mouse in second place and a drawing pad in distant third.

On Friday the trackball died in a peculiar way.

I have almost 30 years of professional experience as a sysadmin.

Failure is inevitable. Hardware will fail, software will be discovered to have flaws, reconfiguration will be mistaken.

The antidote is to have reliable recovery mechanisms: everything will eventually break or need to be changed, so in turn you need to be able to recover back to a stable position, so you can try again.

Recovery mechanisms are not all-purpose. I usually describe them in three phases:

I had thought that ‘pareidolia’ referred exclusively to the human tendency to see human faces everywhere – any time you see two dots or circles and a line below them, boom :) it’s a face. It can be triggered by rocks, clouds, shadows, uneven browning on a tortilla or a pancake.

It turns out, though, that pareidolia covers any kind of overactive pattern matching. Humans look for meaningful patterns all the time, without thinking about the search, and when something trips the right thresholds in our brain, we seize upon it. The result can be faces, voices, music or just a cloud that looks like a moose.

Here’s my thesis: the large language models (LLMs) and similar generative software processes that people currently refer to as “AI” – those are exceptionally well-tuned to produce patterns that will trigger threshold recognition in human brains. Not by accident – that’s the goal. They are pareidolia-circuit stimulators.

The problem is that LLM output is exactly as meaningful as any other kind of pareidolia. Every well-formed paragraph is a false-positive error.

And when people repeatedly mistake their overactive pattern recognition for reality, we call that a mental disorder: psychosis.

-30-

If your Debian system is suddenly very slow to login – like, 25 to 90 seconds of apparent inactivity on every new ssh – it’s not DNS.

Check to see if your elogind or systemd/logind is actually running. Look for a log entry in auth.log along the lines of

dbus-daemon[4501]: [system] Failed to activate service 'org.freedesktop.login1'

right after an SSH attempt.

If so, restart the daemon.

-30-

Some people play Wordle to get their brains moving in the morning. I find one of Linked-In’s incredibly stupid “AI”-driven “articles” where they limit you to 750 characters of commentary (times 5-7 article segments) and write a cohesive answer to the whole thing in one block.

Herewith: “How Do You Work With Other IT Departments To Manage Security Risks”

Either your company understands that security is the prime risk assessment and management tool, or it does not. Figure this out first.

Assuming your company cares, get an executive mandate. Bring the IT, Ops, Network Engineering, Security, Software Development, Hardware Engineering, Legal, and all other relevant groups together. Establish a common vocabulary, write a policy, and appoint a committee that has the authority to approve exceptions and change policy.

Policy is implemented in plans, and if your company is large enough, some groups will need their own plans. Write them to a common skeleton, and publicize them internally.

Include Business Continuity and Disaster Recovery as subsets of Security: that’s where they belong. Done in 750.

-30-