sammorrowdrums (u/sammorrowdrums)

sammorrowdrums commented on ReMarkable Paper Pro Move remarkable.com/products/r... · Posted by u/ksec

I took the plunge, I loved my RM2 but about a year ago I fell down stairs and landed on it.

I’ve ordered refurbed Paper Pro and Move.

Things that excited me about the device:

- with significant AI use I feel I need this more than ever. Drafting, thinking, note taking, annotating etc. - it looks wonderful for todos, shopping lists etc. - width designed to work with Paper Pro (and the landscape mode experience seems solid from reviews), so I will try the dual device setup - I didn’t always have RM2 with me, and I’m hoping this will now change to genuinely always. - I learned to love the constraints and for example I’ve discovered a love of Brandon Sanderson, Liu Cixin, Cory Doctorow, and countless other authors precisely because I went all in on DRM free ebooks, I want to expand that to graphic novels also hence the paper pro. - I do get random inspiration and obsidian has been my powerhouse for oh the go notes but I’m hoping scrybble.ink will now let me bring remarkable documents into obsidian. - very un-invasive to take notes in conversations etc.

Sure it’s a complete indulgence, but it helps me to enjoy note taking, being my library with me etc. and I find constraints foster my creativity and exploration and I lean into them.

sammorrowdrums commented on My Lethal Trifecta talk at the Bay Area AI Security Meetup simonwillison.net/2025/Au... · Posted by u/vismit2000

simonw · a month ago

> if an LLM is allowed to read a field that is under even partial control by entity X, then the agent calling the LLM must be assumed unless you can prove otherwise to be under control of entity X

That's exactly right, great way of putting it.

sammorrowdrums · a month ago

I’m one of main devs of GitHub MCP (opinions my own) and I’ve really enjoyed your talks on the subject. I hope we can chat in-person some time.

I am personally very happy for our GH MCP Server to be your example. The conversations you are inspiring are extremely important. Given the GH MCP server can trivially be locked down to mitigate the risks of the lethal trifecta I also hope people realise that and don’t think they cannot use it safely.

“Unless you can prove otherwise” is definitely the load bearing phrase above.

I will say The Lethal Trifecta is a very catchy name, but it also directly overlaps with the trifecta of utility and you can’t simply exclude any of the three without negatively impacting utility like all security/privacy trade-offs. Awareness of the risks is incredibly important, but not everyone should/would choose complete caution. An example being working on a private codebase, and wanting GH MCP to search for an issue from a lib you use that has a bug. You risk prompt injection by doing so, but your agent cannot easily complete your tasks otherwise (without manual intervention). It’s not clear to me that all users should choose to make the manual step to avoid the potential risk. I expect the specific user context matters a lot here.

User comfort level must depend on the level of autonomy/oversight of the agentic tool in question as well as personal risk profile etc.

Here are two contrasting uses of GH MCP with wildly different risk profiles:

- GitHub Coding Agent has high autonomy (although good oversight) and it natively uses the GH MCP in read only mode, with an individual repo scoped token and additional mitigations. The risks are too high otherwise, and finding out after the fact is too risky, so it is extremely locked down by default.

In contrast, by if you install the GH MCP into copilot agent mode in VS Code with default settings, you are technically vulnerable to lethal trifecta as you mention but the user can scrutinise effectively in real time, with user in the loop on every write action by default etc.

I know I personally feel comfortable using a less restrictive token in the VS Code context and simply inspecting tool call payloads etc. and maintaining the human in the loop setting.

Users running full yolo mode/fully autonomous contexts should definitely heed your words and lock it down.

As it happens I am also working (at a variety of levels in the agent/MCP stack) on some mitigations for data privacy, token scanning etc. because we clearly all need to do better while at the same time trying to preserve more utility than complete avoidance of the lethal trifecta can achieve.

Anyway, as I said above I found your talks super interesting and insightful and I am still reflecting on what this means for MCP.

Thank you!

sammorrowdrums commented on We all took the DVD boom era for granted filmstories.co.uk/feature... · Posted by u/thunderbong

retrac · 9 months ago

> a generation of people is growing who got used to watching digitally compressed audio and video

It is unfortunate how today phone calls are often heavily compressed. Back in the 80s, 90s, 00s the digital phone network would stream uncompressed PCM audio at 64 kbps and the rest was analog; calls often sounded better back then than they do today. Once we accepted the heavy compression necessary to make early digital mobile phone networks work at 10 kbps or so, we never got the quality back, even though devices have a thousand times more bandwidth available now.

sammorrowdrums · 9 months ago

Mobile voice call compression sucks so much that about a decade ago, in order to play a live drum audition remotely, I once had to find a space with a landline and printer that would also let me play loudly drums to do it.

As a student I had none of those things.

In the end I concocted a successful scheme where I would buy a series of phone extension cables, convince my university bar to allow me use their landline for a while, book a drum practice room and wire the cables in a long chain carefully to it, using duct tape to keep the cables safe and above door frames etc.

Then I had to join the call, and when it was sight reading time run to the library to print out the sheet music, run back down and play it down the phone.

It was intense, but I got the gig and flew off and sailed around the Baltic gigging for a few months in the orchestra/show band which was awesome.

I really wish that a mobile phone would have worked, it would have saved me a huge amount of stress.

sammorrowdrums commented on Yes, social media is a cause of the epidemic of teenage mental illness afterbabel.com/p/phone-ba... · Posted by u/throwup238

eviks · a year ago

It restricts free speech in the most direct, literal sense - by... restricting your ability to freely speak.

The historical existence is simply irrelevant. Just like existence of pre-TV/newspaper speech is not a relevant factor in determining whether banning all TV/newspapers in 1950 restricts free speech

sammorrowdrums · a year ago

Making publication easy on social media has certainly had an impact on public speech, but private platforms do not offer free speech by design.

Naomi Klein went into this in No Logo with shopping malls replacing public spaces where you also don’t have a right to free speech and can be evicted arbitrarily at the owners discretion.

You’ll find virtually all of social media platforms have moderation, usage policies and user banning practices that go well beyond allowing the fully legally protected free speech you are afforded in a public space (in many countries).

sammorrowdrums commented on Hidden GitHub commits and how to reveal them neodyme.io/en/blog/github... · Posted by u/chuckhend

lol768 · 2 years ago

Why does GitHub provide no way for a repository administrator to self-service a git gc? I seem to recall reading a blog post that suggested GitHub had invested a bunch of engineering resource in making cleaning up unreachable objects much more scalable.

sammorrowdrums · 2 years ago

I haven’t reached out for internally (and I’m not on a related team), the following is my own understanding.

The blog post was most likely this one: https://github.blog/2022-09-13-scaling-gits-garbage-collecti...

And I think it answers the product vision for it well (why it’s automatic):

> We have used this idea at GitHub with great success, and now treat garbage collection as a hands-off process from start to finish.

GitHub also provides these docs for what to do if there is sensitive data in your repo, which is quite involved and (given the huge amount of knowledge internally of both GitHub internals and git internals), I would trust their advice:

https://docs.github.com/en/authentication/keeping-your-accou...

You can also contact support or create/join a community discussion: https://github.com/orgs/community/discussions

If you feel strongly that a feature you need is missing, by adding your voice, you increase visibility of the request. I think GitHub does offer solutions to this problem though, including eventual GC automatically.

sammorrowdrums commented on Hidden GitHub commits and how to reveal them neodyme.io/en/blog/github... · Posted by u/chuckhend

Sohcahtoa82 · 2 years ago

This highlights why it's so important that any secret that gets committed must be rotated. Simply removing it from the git history isn't enough, because it can still linger, it's just harder to find.

sammorrowdrums · 2 years ago

Full disclosure, I work for GitHub, but push protection from Secret Scanning is awesome for this because your nearly leaked secret doesn’t make it to the remote, and it gives you instructions on how to fix your local repo!

sammorrowdrums commented on Apple has not fixed the macOS audio left/right balance bug for nearly 10 years twitter.com/ffaebi/status... · Posted by u/faebi

madaxe_again · 2 years ago

The audio balance on Apple computers changes randomly, and has done so for at least a decade.

https://apple.stackexchange.com/questions/79384/audio-balanc...

sammorrowdrums · 2 years ago

Yep, I’ve very much discovered and confirmed this behaviour independently, I was so shocked to learn that it was a known issue.

I know it’s silly but it helped me with imposter syndrome to see such a major OS that prides itself on seamless “it just works” experiences tolerate bugs like this.

That and the fact if you airplay a movie to Apple TV it thinks you want it to cast over the top of it with random advert videos in your web browser, so you can’t watch and browse.

We’re all human I guess ;)

sammorrowdrums commented on Reorient GitHub pull requests around changesets mitchellh.com/writing/git... · Posted by u/jamesog

da39a3ee · 2 years ago

No, it is not a misconception. How do I apply a patch from gmail to a specific git repo on my computer? (I would genuinely like to know the answer, but it must not involve mutt, gnus, or dovecot!)

sammorrowdrums · 2 years ago

In the worst case you can copy paste a patch into a new local file in the repo and then apply it with git from there. I’ve had somebody slack me patches before and it is not a big lift.

sammorrowdrums commented on Why does the USA use 110V and UK use 230-240V? (2014) electronics.stackexchange... · Posted by u/dilawar

jhoechtl · 2 years ago

> Really all residential connections in the US are 220V split phase

Really all modern residential connections in Europe are 400V three phase electric power, capable to immediately power an electric motor without the need of capacitors.

No matter how you put it, the US residential power grid is conceptionally lagging.

sammorrowdrums · 2 years ago

Good induction cookers and electric car chargers, heat pumps and things really do often require the high voltage for best function so this high voltage three-phase is also becoming standard for the energy transition.

I had to upgrade my electricity meter and switch box (even though as mentioned three-phase to the house is already standard) recently in order to accommodate planned environmental upgrades.

sammorrowdrums commented on Common mistakes in salary negotiation interviewing.io/blog/sabo... · Posted by u/eamonnm

UncleMeat · 2 years ago

This is more "job cannon" stuff.

This works well if you don't urgently need income and have significant additional job prospects. The power imbalance between employers and employees means that "just avoid the businesses that exploit you" is not an option for a large number of workers.

The only way to actually defeat exploding offers is collective action.

sammorrowdrums · 2 years ago

Perhaps you’re correct, but I’m not saying don’t take an offer from the company. More an advice to accept a little risk that the exploding offer won’t explode and carry on with your job hunt. My advice above was to keep as many cards in play as you can, and recognise where you have leverage (which includes sunk cost of qualifying you as a candidate to hiring company), and try to maximise that leverage as it normally gives you a better return than any in-role pay rise and promotion prospects once you start new role.

Recognising you don’t have much leverage and have no option but to be exploited is a sad reality to have to accept, but of course if your job prospects are not great then that can be the case, and then maybe at least you can wait until the last day before you accept an exploding offer, where you have more knowledge of how the rest of your interview pipeline is progressing.