amouat

Right, you mean it didn't go through a gateway? But would that actually have helped? The requests all went through jfrog didn't they? I guess it depends on the level of filtering at the gateway?

Whilst it might not be JFrog's threat model, I wouldn't assume it can be used as a full internet proxy.

I don't really mean to defend OpenAI here, but they did make some attempts at sandboxing. Although it does seem that they didn't really know what they were doing.

Isn't that exactly what they did? The bots could only access the jfrog instance, so they hacked jfrog?

I don't disagree, except that you've taken ambitious to mean climbing the corporate ladder, which is a relatively narrow reading.

It can also mean wanting a achieve a large dream or goal e.g. writing a book.

Yeah. But it's 10 paragraphs of AI nonsense that barely mentions the actual story.

Who could have thought this was a good idea? It literally reads like "ai security is important, btw we're the reason hugging face got hacked, we're awesome at securing things"

So they are the proxy in the hugging face hacking incident?

Way to bury that lede.

No, not really, and I don't think you need to be snarky.

It may be an industry body, but it runs multiple community conferences and projects which support Open Source. A notable example in this case being the OpenSSF https://openssf.org/

The LF is not perfect, but I would expect them to come from an OSS and community angle on this.

My best understanding from reading this is a) where possible and b) where necessary. This is the Linux Foundation, so it must put OSS and community first, surely.

People talk about contributing financially, but how and to what end? Most projects aren't set up to accept or utilise donations. That said, I would say we should be providing all OSS projects with significant access to AI in order to review their codebases and PRs and hopefully relieve some of the maintenance burden. I know there are some initiatives in this area already.

I stopped reading in anger at "That’s not an accident; it was the point."

It's pretty disrespectful imo -- it feels like the reader's time is worth less than the author's.

That's what I thought, but in the 2nd para:

> No Roman numerals. No Arabic numerals. No left-to-right reading direction. No assumed orientation. Something that works in a mirror, in zero gravity, in any language spoken on Earth or beyond it.

As other comments have pointed out, base 10 is a pretty big assumption though.

I noted "warfighter" as well. Never heard that before.

I played with some of these tools 12 years ago and created "dim", but it was really just Vim with limelight and goyo in a Docker container.

https://github.com/amouat/dim

There is something nice about having the editor as a separate command especially for writing.

I assume they just pretend to be the Googlebot so the site just gives the text.

Personal blog: adrianmouat.com

Seems to be England only. No results for Edinburgh.

It's all the same people. If you really don't know, a few of the incidents are here: https://www.bbc.co.uk/news/videos/c6299nrj76yo

The ladder is still there! See that pile of wood there? That's where we put the rungs. And if dig in that hole over there you might even find the extension we removed last week...

I'm pretty sure that's in development, it's just more difficult.

Also traksy e.g: https://traksy.uk/live/T+EDB+KGX+d+@2024-07-10T13:00/M+1+EDI...

Just wanted to say that I appreciate how well written this is. It does make a difference when an author can clearly and succinctly state their case.

I wrote a similar program once. To get it to be efficient I had to use a bunch of heuristics including scrabble scoring words, so it would prefer words with low scrabble scores which were more likely to fit in with other words.

The declining share price and profits is exactly what made it possible for IBM to buy Hashicorp. The license change didn't juice things -- it watered down the price. $6 billion is a snip compared to the $14 billion IPO valuation.

Fintan Ryan has a nice write-up here: https://medium.com/@fintanr/on-ibm-acquiring-hashicorp-c9c73...

From @stefantalpalaru (comment dead)

> The software being used to illustrate an unrelated song: https://www.youtube.com/watch?v=L7UsnI_HQYM

Support him? Start by talking to him and seeing what he thinks is fair.

I'm using this quote:

"I love it but sometimes it feels like being a Morty on Rick’s adventure to the compilerland."

Sort of.

A few things though:

- we don't use scratch. Our base image is chainguard/static which includes certs and a few other things typically needed by apps.

- we have our own Linux distribution called Wolfi

- we don't "defeat scanners". We work with scanners and publish security advisories. They recognise Wolfi. You can definitely find some images of ours that have CVEs (especially if you have an old image lying around).