New paper: LLMs don’t do formal reasoning.

Well, of course.

LLMs don’t do informal reasoning, either.

Humans are great at pattern recognition. We even recognize faces in clouds and tree trunks. We recognize wheelbarrows, bears and crabs and archers in the stars. We make things that have meaning, and we communicate through speech and text and art.

LLMs are great pattern-generators. They are extremely well-tuned to make patterns that look like they might have meaning. A human trying to communicate may be bad at it, but they have an underlying model of the world that they are referencing and updating. An LLM is not trying to communicate anything. An LLM has a model of language, not a model of the world.

The map is not the territory. All models are wrong, but some are useful.

The situations in which it is reasonable to use an LLM are exactly the situations in which it is reasonable to roll some dice and use that to read the table of random monster encounters; to pull a card from an Oblique Strategies deck; to twirl the knobs on the synth and see if you can get a cool sound. In years past, you could type in a good list of keywords to Google and hit the I’m Feeling Lucky button.

Attempts to use LLMs for more than this fail. Often they do not fail in such an obvious way that the results are immediately discarded, which is where most of the danger resides.

-30-

The Linux kernel doesn’t consider routing to be a separate process, so it can eat lots of CPU capacity and still be at a load average of 0.

Load averages are calculated as the number of running and uninterruptible processes, sampled every 5 seconds, and then displayed as an exponentially decaying average, optionally per core (or SMT “core”). A process actively computing stuff is counted the same as a process that has an outstanding I/O request, which can be a source of excitement.

The act of routing packets (as opposed to working on a routing protocol exchange) is handled by the kernel, so it does not have a countable process identifier, so it does not count for load averages.

-30-

Self: you have managed to make some cert renewals dependent on IPv6 connectivity through to the main server. This is not bad, but it is odd.

-30-

Many organizations claim to be following Agile in some way. The vast majority are wrong, and most of them should not be Agile anyway.

You will recall that the Agile Manifesto, in total, is this set of four guidelines and an interpretation:

• Individuals and interactions over processes and tools
• Working software over comprehensive documentation
• Customer collaboration over contract negotiation
• Responding to change over following a plan

That is, while there is value in the items on the right, we value the items on the left more.

That’s a recipe for making certain customers happy with your perpetual engagement. But:

Repeat the following metaphor until you internalize it:

Security is the skin of an organization, IT infrastructure is the bones.

Everything else is the digestive system or the nervous system. Breaking the skin is a bad idea. It needs to be done for certain specific reasons, but all of those holes need good defense systems including real-time sensors and reflexes. Repeatedly stressing parts makes them tired and calloused, not more flexible. Careful and deliberate exercise builds strength and flexibility.

If I had less integrity and more time I could spin this out into a 140 page business advice book.

-30-

There’s a game which you have probably played in some form, possibly not even knowing that it was a game. It goes like this: an author writes fiction, and the reader comes across an interesting element and asks how it works, in-universe.

And people come up with answers…

My RSI prevention strategy involves change: I use three different keyboards, four or five pointing devices, and move around to different places. On my main desktop, I mostly use a thumb trackball, with a mouse in second place and a drawing pad in distant third.

On Friday the trackball died in a peculiar way.

I have almost 30 years of professional experience as a sysadmin.

Failure is inevitable. Hardware will fail, software will be discovered to have flaws, reconfiguration will be mistaken.

The antidote is to have reliable recovery mechanisms: everything will eventually break or need to be changed, so in turn you need to be able to recover back to a stable position, so you can try again.

Recovery mechanisms are not all-purpose. I usually describe them in three phases:

I had thought that ‘pareidolia’ referred exclusively to the human tendency to see human faces everywhere – any time you see two dots or circles and a line below them, boom :) it’s a face. It can be triggered by rocks, clouds, shadows, uneven browning on a tortilla or a pancake.

It turns out, though, that pareidolia covers any kind of overactive pattern matching. Humans look for meaningful patterns all the time, without thinking about the search, and when something trips the right thresholds in our brain, we seize upon it. The result can be faces, voices, music or just a cloud that looks like a moose.

Here’s my thesis: the large language models (LLMs) and similar generative software processes that people currently refer to as “AI” – those are exceptionally well-tuned to produce patterns that will trigger threshold recognition in human brains. Not by accident – that’s the goal. They are pareidolia-circuit stimulators.

The problem is that LLM output is exactly as meaningful as any other kind of pareidolia. Every well-formed paragraph is a false-positive error.

And when people repeatedly mistake their overactive pattern recognition for reality, we call that a mental disorder: psychosis.

-30-

Some people play Wordle to get their brains moving in the morning. I find one of Linked-In’s incredibly stupid “AI”-driven “articles” where they limit you to 750 characters of commentary (times 5-7 article segments) and write a cohesive answer to the whole thing in one block.

Herewith: “How Do You Work With Other IT Departments To Manage Security Risks”

Either your company understands that security is the prime risk assessment and management tool, or it does not. Figure this out first.

Assuming your company cares, get an executive mandate. Bring the IT, Ops, Network Engineering, Security, Software Development, Hardware Engineering, Legal, and all other relevant groups together. Establish a common vocabulary, write a policy, and appoint a committee that has the authority to approve exceptions and change policy.

Policy is implemented in plans, and if your company is large enough, some groups will need their own plans. Write them to a common skeleton, and publicize them internally.

Include Business Continuity and Disaster Recovery as subsets of Security: that’s where they belong. Done in 750.

-30-

This is what I would like you to know about my mother:

She didn’t like what people were doing to the world; she found some ways she could be effective at making things better; she did them.

It is not required of us that we fix the world, but it is required that we try to leave it better than when we came into it. Mom succeeded.