SolarNet

If you read the calif report

> No special harness, or access to models that weren't generally available to everyone were used in the initial bug discovery. I focused on something I had a background in, knew its vulnerability history well, and held a theory that specific bugs lurk within the codebase. This shows that "know your target" is still as applicable as ever, even in the LLM dominated VR age. No model is simply capable of unearthing "all bugs" with simple prompts.

They used a public model as a research assistant and a code assistant. They guided it with expert deep knowledge of the project. OpenAI did not lead this, ChatGPT was not instrumental in this.

It is perhaps at best to say OpenAI made it possible to find the bug more quickly. And on the double edged sword, also made it easier for it to be exploited days ahead of release. So I agree with the original commentator, did they on the balance actually do anything good here?

Speak for yourself. I don't see every model being released under GPL after having read the entire source code as a step of creating their binary artifacts (model files).

The point of the open source I work on is to contribute to a commons, not to have it stolen so that it can be used to destroy those commons, used for the profit of techbros, and used to justify the murder of children.

I am one of those employees who can make architecture decisions, and make them well, and have for decades.

The level of appropriate LLM usage in my opinion? Ask Gemini some questions when you need to search the web then read the sources it gives you.

LLM written code still has the problem IBM identified. A computer cannot be heald responsible, and so it cannot be allowed to make decisions. That applies to executive management AND software engineering.

Of course that requires working in an industry, like aerospace, where engineers are (usually, Boeing not counting) heald accountable.

> what do you say to the fact that Sha1 had a lifespan at design time?

Read the article. SHA1 was chosen for content hashing, not security. Hence the security lifetime doesn't really matter.

The constitution generally, at both the federal level and state levels generally has a clause like "if its not enumerated here then the next division down has the right to regulate it" hence why the feds regulate interstate commerce, but not state internal commerce. This usually stops at the county level, not the city level, but large cities are effectively their own counties so that distinction doesnt matter much.

Its enforceable in that the city has a police department and zoning rights. So they can force businesses out for violating the law, and they have they have the monopoly of violence within the city to make sure you follow their directions. But whether thats funded or practicable depends on other factors.

Tax the rich.

And by that I mean people who "earn" their wealth through mechanisms that aren't direct income. Heck, give an exception to the tax on the first million of non-income based wealth. But something has to change because their money is their power and they deserve less of it.

The actual education can be useful. I dont think my masters degree has ever landed me job. But I would not have been able to deliver many of the things that got me a leadership position, nor be as capable as an engineer as I am today without the experience. The milage obviously varies greatly here based on where one goes.

I mean its as private as VPNs are and people pay for those too.

Its funny because Kagi apparently also uses Google, and Microsoft and other threads were complaining about it.

It sounds like they use everything to give their subscribers good results. Which is what it sounds like I am paying for.

If they notice. Again, a printed version of the contract that is signed has no evidence of the attack. The attack is on getting your legal LLM to hallucinate specific things of what you are signing.

I doubt a judge will look favorable on people saying "but my LLM said it was 1k"... cause they are known to hallucinate.

When every AI company does it from multiple data centers... yes it's distributed.

Land is scarce. Also, generally, property taxes are paid to the city/county that makes that land desirable to live in.

Like usual the answer is it made it easy to use. Think Linux and Windows. You have a customized Linux setup kind of agent. Open claw is the easy install wizard assisted version of that that the masses can easily setup.

It's nothing new, its just the old stuff packaged together and pre-configured.

Cause it was written by AI.the entire mid section is classic AI slop writing. Repeating the same points and numbers over and over, repackaging the same idea with "key takeaway" and shit. The voice of the author is heavily AI coded there.

> I don't know, manufacturing seems to have learned pretty well that they can ship everything overseas and people will eventually accept products just aren't made the same way they used to be.

I mean this is true, but we aren't talking about the consumer here. We're talking about the industry which is to say the powerful people who own and run all these companies.

What has happened is that those overseas countries now have all the experienced engineers over there and they know it. So you see things like the Trump admin begging Korean companies to keep their workers in the US because they understand how to actually do these things. And the reason the Trump admin did that is because they owe favors to the rich people who want to profit off of factories in the US.

> But it clearly doesn't work if you just hand it out and hope for the best.

I actually think if they did just give 100k to homeless people a year that it would actually solve itself.

The problem is they give 100k to grifters who say they'll do something about it.

I feel like you missed the first third of this article that was quite clear they are not saying there are no uses cases. They are saying there doesn't seem to be an economic model that makes sense.

As the article itself describes, programs that expose kids to fields they might otherwise not have a chance to interact with. A field trip for kids that focuses on creating more people in the future who are interested in the field from more diverse background.

Tell me you haven't read the article (or used racket) without telling me.

> I believe that an intro course should get students coding since the first major hurdle is learning how to construct any kind of program at all. The switch to a more "employable" language isn't going to make education worse.

None of this is the issue at hand. The switch to python is because industry uses it. The article correctly makes the point that racket was intentionally designed to get students coding as easily and quickly as possible. It has multiple steps of teaching languages for exactly that purpose, introducing concepts in ways that let students grapple with them one at a time in an interactive environment.

Meanwhile in python complex topics like duck typing, object oriented methods, exceptions, the distinction between iterables and lists, how to use a command line/terminal or how to configure an IDE, and so on must be covered before people can start writing code for the exercises. Racket is streamlined for beginners.

I think the argument the poster is making is as root cause analysis.

The root cause of the messenger failing was the missing nail. Sure it could have been many other things, but in this case it was the nail. And if it was a pitched battle that was narrowly lost by one message, sure, they could have won or lost because of a dozen other factors, but in this case it was the missing message. There are likely many other important things to worry about, but in the system as it is today, it failed for want of a nail.

Plenty of large engineering outages were because of single keystroke typos. Should these systems be less prone to human error? Of course. Are they? Some of them are, but right now some of them aren't.

The point being made is that small things can be important if other things go wrong. We should fix the other things, but often they are much harder to fix than the small thing. And really, we should care about both, since humans are capable of that.

From an ergonomics perspective big-endian is the little-endian of stack based machines. Register truncation is the big reason why from an ergonomics perspective we prefer little-endian, but in stack based machines the equivalent is pop truncation. But the behavior between these is reversed between the two machine types. Big endian is the layout by which pop-ing one byte off the stack gives you the truncated number.

Co-routines can be a nebulous sort of concept because it means different things in different places and not all of them have the same features. But some of the big points are:

- Heap allocated call frame. Instead of being pushed onto the stack, co-routines tend to have their call frame (local variables, arguments, etc.) placed into heap memory (or at least may be place-able into heap memory). This often enables the other features.

- Control can leave co-routines in more ways than standard function calls. Generally this means returning (often called "yield") to the caller without completing the whole function. It can then be later resumed, returning to where the function originally left off. Generators are a common pattern enabled by co-routines that rely on only this part (and so many systems can optimize out the heap usage, for example).

- A co-routine is usually an object with an interface that allows you to move it around and resume it in different places than it was originally called. This can include on different threads, or depending on the sophistication of the system, different processes or machines.

Those are the three big points in my mind. I'd recommend trying lua coroutines, personally (I like minmalist engines like defold to use it in) to really get a feel for how these are on the edge between "language feature" and "library feature".

I think you are misapplying that paper? This as a library is the "batteries" to C++'s no-batteries-included standard library which does not implement asynchronous coroutines at all.

The paper is much more on the side of application and system performance. But you couldn't even write such a system without a library like this providing you the tools to do so. This is much more in the domain of "basic tool for ecosystem" than "library for specific tasks". It's on the user of the tool to address the paper's question, not the builder of the tools.

I mean yea, I read this as an idiom for "went to do something wholly unrelated to programming". Not as "I literally am going to begin farming". Like I would read anything from "restaurant owner" and "artist" to "flight trainer" and "corporate DJ" as all fitting under that.

To be fair, I suspect they meant it in a more idiomatic sense. Not that they literally went farming. Sort of like when one says "water under the bridge" they aren't commenting on bridges, nor water.

Eh, calling on a company to do a thing is some mix between public fact finding and threat here.

It allows the public to comment and maybe the senator will like the public support they are getting. Alternatively a pharma lobbyist will show up and toss them a few hundred thousand in campaign contribution promises. And they'll weight the relative value of those things. Depending on how that goes they (or another senator seeing this play out) will actually make an issue of it and it will start the more formal processes.

And of course an attacker like this has a high likelihood of being a state actor, comfortably secure in their native jurisdiction.

I mean you can just not use iostream? A lot of modern C++ projects just ignore it. For either C style IO or more C++ -y IO.

> Unity isn't close to profitable, and never has been

This isn't really true though, their core business is and was profitable if you exclude all the of acquisitions junk, stock shenanigans, and loans to pay for it they have been doing.

It just didn't have the margins expected of a public company and so they did all that other junk to pump those numbers.

You should be though. Without evidence, raw skepticism is a valid argument. My prior beliefs were not updated by either statement.

Though I agree the polite/generous version of this is asking for source rather than just posting "No".