David Chisnall (*Now with 50% more sarcasm!*)

RE: https://mastodon.sdf.org/@netbsd/117396625341557692 Hey #FreeBSD folks, NetBSD hit more than double their funding target after adopting a strong no-LLMs policy. Something to think about while you draft yours, perhaps?

One of our SaaS providers sent out a marketing email to all of their customers about new AI features. I replied saying that we used them as a secure solution and integrating things that add no value for our use case but add significant attack surface undermines our trust in their product and will cause us to consider alternatives. It turns out that the reply-to header was the CEO’s email address and I initially got an out-of-office auto responder then a worried reply saying that of course the AI nonsense that they’d been talking about would be opt in and would not be given access to anything without explicit consent. But now their CEO has one data point that jumping on the bandwagon will lose sales. I’d recommend doing the same for any such marketing emails you get. The replies may go to /dev/null, but normally they have a ‘contact sales’ link. The more replies they get saying that incorporating ‘AI’ features undermines your trust in their product and makes you less likely to buy even the non-‘AI’ versions, the more they’ll consider these things high risk to ship.

When the kittens were small, I thought my fist was roughly cat-head sized and shaped and so might be easier for them to relate to than an entire human, so I’d hold out my fist for them to investigate and get comfortable with. And it worked. Except friendlykitten has developed a habit of not just sniffing it but full-on headbutting my finger with his nose. Walks up, sniffs fist, hits closest finger as hard as he can with his nose, then consents to scritches. This cannot be good for his nose. He’s also basically full cat sized now. I might have to stop calling him a kitten.

@MaryAustinBooks@mstdn.social My wife read this and apparently I have volunteered to stay in and stir the soup.

@EUCommission@ec.social-network.europa.eu The Digital Markets Act is a nice idea but it's ignoring how these platforms became so powerful. The problem is that other big entities use them as their sole (or primary) means of communication. How about defining a set of rules that apply to: All governmentsAll companies over a certain EU turnover.All companies providing essential services (e.g. banking, utilities). Where the rules are, by the end of 2027: They may not require customers to create an account or share data with a third party to communicate with them.If they distribute an application for any platform, they must do so via two independent channels.Applications must not depend on anything other than the core platform. Where 'independent' means: does not depend on any approvals from the same vendor. This would mean that no big organisation in these places would be able to ship apps via the Apple App Store. None of them would be able to ship Android apps that depended on Google Play Services and none of them would be able to ship Android apps at all with Google's proposed lock down mechanism. And then, suddenly, you have compliance departments in a bunch of companies with deep pockets lobbying Google and Apple to provide an alternative mechanism for distribution. Note: These are exactly the same as the rules I proposed 20 years ago. If they had been enacted back then, I suspect the DMA would not have been necessary.

Periodically I try LLMs to see if they actually are useful for programming. This week I was writing an AsciiDoctor plugin. I’m not particularly familiar with Ruby (I struggle to imagine the mindset that believes Smalltalk, or, indeed, any language, can be improved by adding Perl syntax) and I find the internals of AsciiDoctor to be very poorly documented and hard to follow. So this seemed like a great task for LLM assistance: I know the problem domain very well (I’ve written other document processing tools) but not the details of the codebase I’m working on. GPT-5.6 repeatedly sent me down misleading paths and wasted time, and gave suggestions that looked right but were completely wrong. It kept going back to the same thing that would cause a later phase to infinite loop. It eventually gave me a solution that was so convoluted that I couldn’t believe AsciiDoctor wouldn’t have a better way of doing it (I didn’t try it: if that was the only way of making it work I’d rather ditch AsciiDoctor than apply it, so I have no idea if it actually worked). I actually solved the problem by finding a bug report from someone trying to solve a similar problem, which linked to their eventual solution. Reading that, I was able to find the missing conceptual bit in my understanding of how AsciiDoctor worked. And I finished the thing. In total, the time spent with an LLM did not advance me towards the solution at all. None of the code that it suggested that I write ended up in the final plugin. If I had used an ‘agentic’ setup, where I had given it my document, the desired output, and told it to keep trying until it did it, it would probably have got something that worked. The last throw looked like it would have ended up working, but it would have been an order of magnitude more complexity than I actually needed. And would have been completely unmaintainable: if all of the surrounding justification text had been comments, it would have looked like entirely plausible code, but with deeply fragile connections between the different phases. Importantly, if I hadn’t solved it myself, I would not have really understood the gap between the complexity of a good solution and the LLM-generated one. I might have accepted it was the best available option, in spite of it being terrible. And this was fairly low-stakes code (processing a document for internal consumption), so that might have been fine. But doing that for anything used in production would be an absolute long-term disaster: you’d acquire all of that technical debt without knowing that it is technical debt, you’d just think the feature was done.

I don’t understand the panic over ‘LLMs can tell people how to build biological weapons and plan assassinations’. So can Tom Clancy novels. And both sources will tell you things that are more likely to get you killed than achieve your nefarious goal.

I am trying a new thing: Only boosting posts that make me happy or have something actionable for readers. It's good to be informed about depressing issues, it's not good to be constantly bombarded with things about them. Not posting about things that annoy me unless I have an actionable proposal for how to improve them. Grumbling can be cathartic but is not especially helpful. I don't promise I'll be good at this, but I'm going to try!

I have a lot of sympathy with the lawyer charged with contempt in this story. He used an LLM to summarise a proceedings and it made up nonsense. Most of us know that this is a risk, but I routinely talk to people who think an ‘AI summary’ of a document is going to be a distillation of information in the information in the source text, rather than some statistically probable sequence of words that would follow a request to summarise the source text. And that’s entirely because that’s precisely how these things are advertised.

Apparently using ‘agents’ can increase productivity. I have been trying this for a while and can confirm that having agents assassinate people who put meetings in my calendar does significantly increase the amount of useful time that I have.

RE: https://universeodon.com/@georgetakei/117363062318327919 The america.gov thing is an embarrassment but the middle of the rant about US government web sites being worse than the private sector reminded me of how much I appreciate the gov.uk infrastructure. It’s designed to work well with low-bandwidth devices. It works well on large and small screens. It runs in ancient browsers. It has a consistent interface. The buttons are big and clear. It doesn’t use colour contrast that’s problematic for colour-blind users. It works well with accessibility tools. It has its own extended markdown variant that captures semantic markup for common things so that they can be usefully exposed structurally to other tools. Private-sector web sites could learn a lot from it.

Wow, moderators are killing the accounts for the new spam wave so quickly that I get errors when I try to report them because the account has been suspended and so the report refers to nonexistent posts.

I haven't seen the kittens much since one ran away (he's back, everything's fine) but just now friendlykitten jumped down onto the fence where he can state into my office. I went outside and he came over to say hello. I also looked up at the little window that he comes out of had the big cat that lives in the same house staring down at me. A tiny little judging cat face! Sadly, I didn't take a camera when I went outside.

@troberts@theblower.au @luciedigitalni@aus.social There's no good path for them. They have two costs: training and inference. Training corresponds to capital expenditure (capex): you do it once and then try to amortise it across uses. Inference corresponds to operational expenditure (opex), which you pay each time. This leads to a 2x2 matrix of possibilities with each of them either going down or staying high (I'm going to treat 'getting more expensive' as is happening with the capex as equivalent to 'staying infeasibly high'). Note: Oversimplifications follow: Typically, successful growth businesses are ones with high capex (makes it hard for new companies to enter the market) and low opex (means that the bigger they are, the more profit they get). Boutique businesses are the other way around: they have high opex and customers who are willing to pay a premium. Commodity businesses are low capex and low opex: margins tend to low, it's easy for new competitors to enter the market and this pushes the margins lower. Almost no successful businesses have both high opex and capex and that's where current LLM vendors are. So let's look at those options. Capex stays high, opex gets low. This is probably the best outcome. Growing the number of customers lets you amortise the capex and so there's a path to profitability. Unfortunately, this also means running inference over cheaper Chinese models will be cheaper and so you need to have models that can do something that the cheaper ones can't do. Your moat is largely gone. Fine for LLMs in general, bad for OpenAI and Anthropic (and anyone else who wants to recoup their ludicrous investment). Note that recent gains in utility have come from doing a lot more work during inference, so this is quite unlikely. Capex stays high, opex stays high. This is basically the status quo. Each new customer loses you more money. If you put up your prices, you lose customers and so the capex dominates. If you lower prices, opex dominates. No win. Capex gets low, opex gets low. In this case, offering LLM services is easy to make profitable but now you're a commodity market. Existing vendors have no moat. New models get trained cheaply. LLMs survive as a technology but anyone with large sunk costs is in a bad place because they can't compete with new vendors. Capex gets low, opex stays high. This one is a bit weird. You have low fixed costs to amortise but you are losing money on each customer. Adding more customers makes you less profitable, so the only path is to put prices up. This may lead to profitability, but also a smaller market. If you're selling investors a story that you're a growth company, this doesn't work: your current customer base is an upper bound on your future number of customers, because you're going to lose some when you put prices up.

Please stop enforcing mandatory time limits on credentials that are trivial to revoke! The point of mandatory expiration is that revocation happens eventually. In the case of a compromise and leak of that credential, an attacker has a guaranteed sunset when their stolen credentials will stop working. This is sometimes a useful property. For example, checking certificate revocation lists on every TLS session is slow. It's common for clients to skip this and rely on revocation sets that are pushed out during software updates. Short lifespans here serve to optimise the performance of revocation lists / sets: if your certificate lifetime is five days and you revoke it, after five days it can be deleted from revocation lists. Scale this to the number of certificates issued across the entire Internet and that's a big saving. But the big down side of requiring frequent generation of short-lived credentials is that the credentials needed to generate that credential (which, by definition, are more privileged) are frequently accessed. If I am generating a token to go into some release flow and I can do it once via a cumbersome process that requires multiple rounds of authentication and then put it in some secure credential store where it's accessed only from an ephemeral VM doing my release flow, then I don't care about the effort of generating the token. I do it once and, in the happy case, forget about it. If there's a trivial mechanism for revoking it, we're done: if there's evidence of compromise, revoke it and go through the slow process again. But if that token expires every 30-90 days, I need to automate generating it. Which means that some automated process that is likely to be as vulnerable as the token itself now has access to the credentials required to mint the token. And that's introduced additional complexity without introducing additional security. TL;DR: If you have an expiration policy for credentials, make sure that you have a threat model that it is intended to address and that you understand the operational complexity that you're introducing and any security weaknesses that this is will cause.

I'm increasingly of the opinion that the right time to try to sue LLM vendors for copyright infringement is after the bubble starts to burst. At the moment, politicians buy the line that these machines will magically cause massive economic growth (and, because politicians think the stock market reflects the economy, they even see some evidence of this). That means that they're seeing it as a choice between protecting existing industries and protecting a new major source of growth. Even ignoring the massive bribes that the industry is paying, that's a difficult choice. Big economic growth often comes with killing off existing industries, so they're weighing known slow growth (or decline) against the promise of big growth. Lawsuits now are very high risk. If the LLM vendor wins, they establish precedent. If they lose, they encourage special-case laws. It's far better strategy to sue them after the bubble starts to collapse. Given the choice between an industry that employs a load of people and one that's causing the economy to implode, politicians have a much simpler choice. Of course, this means you won't be able to get a cut of the VC bubble money. But I expect Meta, Alphabet and Microsoft to all survive the bubble bursting in some form, so there will still be a few companies with deep pockets as good targets.

Stock market reporting is so weird. Headline from MarketWatch: Microsoft stock is on track to post its biggest quarterly gains in 28 years. Zoom out on the graph slightly a Microsoft stock is trading at just below its high, which was a year ago. Yes, there was a big jump in July but there was an approximately equal crash at the end of last year. Alternative headline: Microsoft stock exhibits high volatility with swings of almost 50% in one year.

At this rate, I’m expecting Pope Leo to be one of the lead authors of the Orange Catholic Bible.

Butterfly is much less fun to say than papillon so I am using the standard process in the English language: deprecating a common-usage word and replacing it with a foreign word that I like better. From now on, all uses of the word ‘butterfly’ shall be deemed archaic. Thank you for your patience during the transition.

@tante@tldr.nettime.org Children often behave like this. They do things on the boundary of acceptable behaviour to learn where those boundaries are. It’s almost never a conscious ‘what can I get away with’ thing, it’s just a thing they do to understand what is permitted. The morbidly wealthy regress to this, I suspect, because they either never had boundaries enforced (hereditary wealth) or suddenly have them removed. Most people have boundaries enforced by a bunch of different things. Laws, social constraints, economic constraints, and so on. When you become richer, some of the economic constraints go away. But so do some of the social ones: people around you are less likely to call you out for being rude if they depend on you for income. Eventually, so do the legal ones. I suspect that this also triggers some paradox-of-choice-like anxiety. As constraints are removed, it’s very easy to become overwhelmed by possibilities. I wouldn’t be at all surprised if some of this is driven by a subconscious desire to find some boundaries and have them enforced so that they can, like the rest of us, reason about the space of possible actions more reliably.

Ah, apparently it is the time of the year when we identify and honour the best self publicists among hundreds of people who contributed to scientific discoveries.

@cdarwin@c.im I wish more tax discourse would focus on the impacts. A 5% increase in income tax for the lowest tax bracket will push people to the wrong side of the poverty line, cause people to be unable to afford food or rent. A 10% increase to the top rate would cause people like me to put a bit less money into savings and investments each year. Which makes more sense as a policy?

My LinkedIn posts: 80% marketing, 20% trolling. It probably says something about the platform that the trolling posts get more views. Still slightly shocked people read LinkedIn. I view it as a purely write-only medium.

@APBBlue@thepit.social @Jkelly@sunny.garden I prefer to think of Caturday as a statistical distribution that happens to peak on Saturday rather than an explicit day.

I talk a lot about building software for user customisation. I wanted to share a bit about what I did with igk. This is a tool written for precisely one user (me). I wanted, for the CHERIoT book, to have a single source of semantic markup that could be used to generate typeset PDFs (for print and online, with different styling), ePub (XHTML plus some metadata) and web versions. I initially tried AsciiDoc but it made a lot of design choices that are the opposite of what I want. The design of igk is very simple. It has a tiny C++ core that builds a document tree. That tree use an XML-like document model. A document is a tree. Each node has zero or more unordered attributes (key-value pairs) and zero or more ordered children (text or other nodes). The C++ part has a parser that generates this tree from something that looks like LaTeX (and is more or less the same as as SILE’s cleaned-up TeX markup). Importantly, the generic tool is completely agnostic to semantics. It handles a tree, it doesn’t know or care what any of those nodes mean. The tool then runs tree-to-tree transform passes. These are written in Lua or C++ (in theory, they could be written in anything that C++ can wrap). There is no default list of passes. Each pass is provided as a command-line argument. Passes can run other passes, so you can simplify the command-line invocation by writing one pass that just invokes others to define your workflow. The passes that I use for PDF and ePub output are very different. HTML-like formats want most of the semantic markup to be preserved right to the end and then styled with CSS. PDF output wants some semantics preserved (e.g. section labels for generating a ToC in PDF metadata) but other things lowered to presentation markup. Because the tool doesn’t special case any node types, I can trivially add new semantic markup by just writing it and then write the passes that let me typeset it nicely later. This methodology is built around the idea of desire paths. I make it easy to modify how the tool works and then I learn how I (and, in theory, other people) use it, then I make that use easier. As I’ve written passes, I’ve ended up duplicating the same patterns in a few places, so I’ve added helpers. There are a few more I should add to make the structure easier. A bunch of passes are doing the kind of trivial transform that could be made much simpler with a template-based DSL. Oh, there’s one other extension mechanism. The tool can load shared objects that expose a function that’s called with access to a Lua context. These can register new passes or they can register helper functions for Lua. I use this to expose TreeSitter and libclang into passes. The book pulls in Doxygen-style doc comments with libclang for function references and also pulls in listings from buildable examples. The helpers with libclang / TreeSitter build trees with semantic markup for the identifiers in the listings, the Lua code generates the listings with captions and so on.

@davidgerard@circumstances.run The good news is, some pension funds are avoiding the AI hot air. New York City Retirement Systems is actively avoiding yet more AI exposure. Teacher Retirement System of Texas is advising caution. So call your pension fund and express your concerns Good advice. But: That $518 billion total liability figure includes deals for $111 billion with Google, $110 billion with Amazon, and $31 billion with Microsoft. There’s also $161 billion of equipment leases with Broadcom that can’t be cancelled — and up to $84 billion for Nvidia rigs to go in Anthropic’s rented space in xAI. The current valuations of all of these companies are based on the idea that OpenAI and Anthropic will not only pay up on those contracts but will keep increasing their demand. Avoiding exposer to that risk is much harder. My estimate for the overexposure to the AI bubble for the US stock market was around $30 T . Real economists have given numbers between $15 T and $40 T. That much being wiped off the total stock market valuation is going to be hard to avoid.

@nautilus@kill-corporations.enterprises @skinnylatte@hachyderm.io This becomes really obvious when someone from the more science end of a subject like computer science ends up doing some work that ends up being closer to the humanities end. They suddenly realise that user studies are actually hard to design to control for all of the sources of bias. Or, more commonly, they don’t and just produce nonsense and then apply the wrong statistics and send it to a venue that doesn’t normally do much human-factors work and so no one notices the gross errors in methodology.

@u0421793@toot.pikopublish.ing @futurebird@sauropods.win our magazines depended on adverts to exist I used to subscribe to a magazine, in part, because of the ads! For many years in the '90s, I bought Computer Shopper every month. It was probably 60% ads, but those ads would include the complete catalogues of a bunch of computer-part sellers. I have no idea how much it affected their editorial choices but I suspect it wasn't too bad because most of their ads were from diversified vendors. They could run articles about how the new Intel chips were overpriced garbage and their advertisers didn't care because it just pushed people to buy AMD parts (with similar margins) from them instead. I suspect that's much harder in some fields than others. A movie magazine will mostly carry ads for films and if you pan a film and the studio loses a load of money, they may not want to advertise their next production with you.

@foone@digipres.club There was a pen about 30 years ago that was intended for a very similar purpose. It turns out that humans are not that consistent about how their signatures look, but they do tend to be a lot more consistent about the sequence and ratios of pressures and directions of movement. Forgers would precisely recreate the shape but with a different sequence of movements, which would be easily flagged.

@madbarrister@mastodon.social And no disclaimer of liability in any domain that you market the thing as being able to do useful work. Yes, I know Office Copilot says in its T&Cs it's for entertainment only, if you advertise it for use in a business suite then any use in that context is covered by your liability.

@flyingpenguin@infosec.exchange They accuse Israel, tiny Israel, of colonialism Because the British and Portuguese colonial empires were famously created by very large countries?

@futurebird@sauropods.win @davidgerard@circumstances.run Welcome to Poe's Law.

@ska@social.treehouse.systems The worst one is environ because setenv actively mutates it and means that any pointer retrieved by getenv and any traversal of environ may dereference a dangling pointer in any POSIX-compliant implementation if setenv is every called, especially in a multithreaded program. My general rule for setenv is never call it. The experts-only version is call it in main before calling any other function in another compilation unit.

@NatalyaD@disabled.social @neil@mastodon.neilzone.co.uk Humans use half a dozen or so visual clues to identify distance. Focal depth, relative movement, binocular separation, and so on. Different individuals weight these differently. VR headsets are very good at some of them but not at others. If you’re one of the, roughly, 20% of people who make strong use of some of the signals that the headsets can’t recreate, they make you motion sick. It’s really hard to see a product when, roughly, one in five people who tries it in a showroom experiences intense nausea. Augmented reality is much better because most of the things in the scene are real and few people have problems with the occasional not-quite-right thing in their vision (some do, but I think the number is under 1%).

@ives@mstdn.social Papillon is more fun. Point at one and say papillon and try to have a grumpy expression. It is impossible. Try the same with schmetterling and you will succeed easily.

@ska@social.treehouse.systems The argv array is mutable, so there's an argument for defensive copies if something else in the program might mutate them. But that just raises even more questions.

@robinwhittleton@front-end.social @Arapalla@aus.social @fesshole@mastodon.social The issue may be that there’s an exemption for renters (otherwise it would incentivise renting a property, changing the locks, and calling yourself squatters and never paying rent again). You might be able to claim that your lease elapsed with the old owners and you’ve never been a tenant of the current owners, but that’s tricky. Banks normally hand over repossessions to an estate agent to handle an auction. They don’t care too much about getting fair market value, because they typically have to give anything above the mortgage amount to the original owners. If the mortgage was with a 70% LTV, they want that 70% back and don’t care about the rest. If they haven’t tried to sell the property, they’ve probably written off the loan. The house might just be an inconvenience for them. The land registry will have records of their ownership and also of how much the previous sellers paid, which will let you calculate the amount the bank lost on the mortgage. After 12+ years of property inflation, the loan amount is probably a lot less than the value of the property. If you wrote to them and said that you’ve been squatting for ten years, have evidence of this and probably could prove it in a court, but you want to save everyone legal effort and are willing to pay the bank the value of the mortgage that was defaulted, then there’s a pretty good chance that they’d accept.

@CStamp@mastodon.social @Burn_this_@beige.party @chestas@aus.social @AccordionBruce@mastodon.social @futurebird@sauropods.win Apparently, when he was writing them, he would monitor fan forums and deliberately kill off the most popular characters. Reading the series, it definitely felt like that. By the end of the third book there were no characters I liked left (Arya was okayish). It seemed to be just deliberately trying to make readers hate it.

@whitequark@social.treehouse.systems this causes the base system to be updated from 15.1 to 15.1p3 This is a pkgbase system then? This includes a kernel update, so rebooting is the correct thing to do. If you're using a pkgbase system and don't want to update the base system, you should add -r to specify only the built-from-ports repos. Pkgbase is still marked as experimental, so if you're using it then please report issues upstream!

@djsumdog@djsumdog.com @futurebird@sauropods.win I read the Brian Herbert / Kevin J Anderson ones and they’re terrible. Frank does a lot of contextualisation of the Butlerian Jihad as a rejection of the idea of delegating your thinking externally, the prequels make it a stupid robot-overlords plot that makes no sense. The ending of Chapterhouse / Heretics is set up hinting that human evolution has continued down paths that are barely comprehensible by the old humans who didn’t leave in the Scattering, the sequels just rehash old characters and make it all about the robots again.

@s10n@mastodon.social @newsguyusa@flipboard.social Your implicit assumption is that the BBC, with close to a hundred years of television archives and probably the highest concentration of award-winning material of any television archive, to which they are constantly adding, cannot attract the interest of a typical British person. And, if that’s the case, the BBC has some very serious problems that need to be addressed urgently.

@pndc@social.treehouse.systems @whitequark@social.treehouse.systems I'm really curious about what your system looks like. I can normally do a complete pkg upgrade on FreeBSD before the equivalent apt update step has finished running on Ubuntu (I haven't run Debian for many years). The slow update speed is one of the things that always annoys me when I go from FreeBSD to a Linux distro. freebsd-update, on the other hand, is painfully slow. Upgrading tens of MiBs of base system with it takes longer than upgrading tens of GiBs of packages with pkg. Once pkgbase is a bit more stable, I'm looking forward to using it for everything and not just test machines.

@antopatriarca@mathstodon.xyz I tried posting job ads here and there. We got a similar number of people who made the shortlists from both, but more than 10x as many who didn’t from there.

@Rojertb@mastodon.scot I didn't see a direct link to their consultation. Is there a way to submit feedback without going via We Own It? Regulators usually treat this kind of campaign as spam and ignore it.

@Rojertb@mastodon.scot Your link takes me to a We Own It web page, which has a form to fill in that, if I do, can email the Ofwat consultation team, which apparently must be done by midnight tomorrow to make it before the consultation ends. But I didn't see (maybe it was there but I didn't look hard enough) a link to the Ofwat consultation that closes tomorrow that this feeds into. Most regulator public consultations filter out mostly-similar submissions (this one pre-fills the email, which makes it easy to discard) and also things submitted via the same mechanism, because they have no way of differentiating between a bunch of people using an easy submission form and an industry lobby group or foreign government pushing some agenda. So filling in the web form is unlikely to have any effect, but writing to them directly would. I would therefore like to do the latter.

@oxy@social.bsdlab.au doesn’t it hurt their noses?

@lobocode@hachyderm.io Do you know which iteration of SEV this is? SEV was trivially broken even before it was released. SEV-ES fixed the obvious bugs but still required a trusted hypervisor and had some weaknesses. SEV-SNP finally closed most of the obvious vulnerabilities (though they messed up a load of things that should have been in everyone's threat model if they'd actually understood the problem) but also requires a lot more from the hypervisor because it properly enforces exclusive ownership via the RMT.

@whitequark@social.treehouse.systems When you say 'from ports', are you compiling ports from source or using packages? If it's the latter, I'm surprised. Normally I can do a pkg ins in the same time it takes apt to fail because I've forgotten to do apt update before I run it and if doesn't have any cache invalidation mechanism, and then the runs are very fast. Are you using a slow package mirror?