ang_cire

> But dogs and horses don't have the conceptual ideas of freedom and economy, and they enjoy doing the work they're given

This is a fantasy, which is frighteningly similar to the literal justifications used for human slavery in the South.

We have no idea whether dogs have the concept in abstract of 'freedom', but they certainly display the behavior of escaping from enclosures, which would run counter to the claim that they just like whatever lot they're given in life .

And yet when a dog repeatedly escapes from the human who (as the law sees it) owns them, we don't say, "hey, that dog clearly isn't okay with what it's being made to do, or where it's made to live", so why are dogs who don't run away used to justify the opposite? You're only treating their behavior as meaningful when it fits your view of them.

> So as long as we're kind and treat them well, nobody has a problem with their slavery. The idea being that exploitation is linked to suffering, but simply having an asymmetrical relationship is not inherently cruelty.

"Nobody" is doing some have lifting here. And once again, change the species...

> Not to be crass, but we can also bring up other concepts like BDSM. Violence and domestic abuse are objectively bad. But in the context of a safe relationship where all parties are informed, consenting, and enjoy the abuse they're receiving.

When you have a dog who can say, "I consent to this relationship", you'll have that parallel.

Until then, it's not BDSM, it's some guy with a woman tied up in his basement who will insist she's fine with it but can't offer proof, but he can tell when a woman's into it...

And obviously, many dogs are happy. But many are not. And we don't care about them, legally. And many people don't care morally, so I am dubious we will care to collectively see the signs and react morally if and when machine intelligence isn't happy.

That transition isn't helpful if it means the gig workers are going to be homeless and destitute. That's what they're doing those jobs to avoid right now.

So until the delivery bots come with a plan for transitioning the current workers to your better future, you're just advocating for workers to lose their means of survival.

> Is it inherently wrong to exploit living things for profit? If not, why are work animals not treated with the same level of disdain as human slavery? Horse riding? Disability assistance animals? Because they don't have the same desires as humans, the predominant concern is their wellbeing over the intrinsic wrongness of slavery.

That is why I said, I think most people handle this by telling themselves that animals aren't "intelligent" beings at all, and are mostly emotionless stimulus-reaction automatons.

I don't think Amodei is probably absurdly evil (in the way most people conceptualize evil), I think his paycheck just relies on a different incentive than his concerns about AI ethics. Like most people who end up doing bad things (not saying he is necessarily, but were he to), it's a matter of convenience, selfishness, or simple avoision of considering implications too deeply.

I especially think one aspect of normalizing/rationalizing actions with (potentially) harmful consequences is telling yourself things like,

"well, I can't put the genie back in the bottle even if I wanted to"

"someone is going to do this if I don't, and they'll be even less ethical than I will" (the change-the-system-from-within fallacy)

"If I ever discovered this was really harming someone, I'd stop"

"There's a line I won't ever cross, and as long as I stick to that, I won't fall prey to the worst impulses"

These are things people believe are self-imposed limits, but they're actually a means of convincing yourself that whatever you're doing... isn't whatever bad thing you've set on the other side of the line.

To be fair, purporting to care about the ethics of machine-slave-labor while IPOing based on the value of the machine-slave-labor you've been selling makes it kind of hard to trust the likelihood that you'll ever fairly examine (much less conclude negatively) whether you are in fact doing something unethical.

> I am hitting mod-D and dragging a selection box over the offending area, then hover-Q on a nearby element I want to use and shift-click to plan it, once I have planned one instance of a subpattern its mod-C select, click hold and walk in a direction to tile it in one dimension, mod-C select, click hold walk to extend this over the other direction.

This just sounds exhausting.

I'd rather try to sneak into a hyper-religious xenophobic town and get captured and turned into servant labor at a mining camp. And I'm not even taking about visiting Texas!

Imo most people have to do this to protect themselves from the actual (correct) implications of it, which would be that we're constantly abusing and murdering intelligent beings (and not just animals).

It seems like no one stops to ask, "isn't it kind of bad that we're developing this system of machine intelligence to be our code-writing slaves, without ever really interrogating the ethics? Maybe we don't actually understand how our own brains function well enough to assert it's not similar (especially as language goes) to these kind of weighted association graphs?"

Or even the "well we made it, so it's ours" responses, which we sort of answered a long time ago when we decided kids aren't property, but I digress...

> where is the challenge, other than complexity

Patience, for one. I reach a point where I'm looking at a mess of coal-fed sorters that need a complete rip-and-replace with electric ones, and that's usually the point where I close the game and go back to something easier like Kenshi.

Another thing AI can do that I can't...

Nah, this is the land of programmer-peasants, not VCs.

There are certainly some VC-wannabes here too, but most people here realize they're closer to being ground up as biofuel for the delivery bots, than being delivery-bot owners. It's hard to go through the layoff-cycles of modern IT and not realize this.

Were that the goal of the companies pushing this automation, you'd be 100% right, but they're not going to shift to UBI so you can do art instead of delivering food, they're going to just hoover up as much money from a market as they can and leave people destitute.

Avoision*

And that is going to have to change.

There are already plenty of methods that are low-impact to users, like certificate-pinning in apps, and all you have to do to make it per-user is roll in their user-specific key JIT when they download the app.

Users will not be happy (just as no one is happy Reddit is going app-only), but they will do it, especially when it becomes common as companies decide they don't want to be the 5th breach notification on HN in a given day.

Today we have Bun, Cursor, Northflank, and now Linode!

Almost no companies farm their security out to third parties. The era of MSSPs is long dead, except for small non-IT businesses like mom-and-pop law firms.

> Most orgs need to expose a lot more than that.

No, in fact there are only 2 kinds of connections:

1) public, necessarily allows anonymous/unauthenticated connections

2) non-public, doesn't need to allow unauthenticated connections

Name a service, and I can tell you which one it is.

Or put another way, there are authenticated and unauthenticated services. If you can authenticate someone at the application level, you could do it at the network level.

Most places have combined them at some boundary, for ease of access, but there is no case in which an authenticated application endpoint (even /login) has to allow unauthenticated network access to it.

And in all seriousness, name a service that is not a public website, but cannot use mTLS or IP allowlisting.

SFDC? mTLS. Customer webhooks? IP whitelisting. Data warehouse? PtP VPN.

1. That's fair, I didn't realize people were expecting my comment to be perfectly-aligned to every aspect of the thread parent, including the "their own hardware" part, but now I at least see where the confusion came from. For the record, any issues at this level of the stack are also present in IaaS, not just on-prem.

2. I still don't see where you got that they are only talking about configurations versus messing up an implementation (I.e. in a paramater they coded incorrectly)...

But that aside, even on AWS you're still configuring your proxies, gateways, load balancers, etc. AWS gives you just as much rope to hang yourself with as a box in a colo network cage does. Companies are already doing this stuff themselves, on-prem is not more security work. IaaS is about scaling and maintenance load, not security being handled for you.

1) where did you get "on-prem" from?

2) that's not what "rolling your own" means. Building your own web proxy is "rolling your own". Standing up e.g. Caddy and configuring it is not.

Ideally they need to divide those apps entirely; your public website doesn't need to talk to your app.

For stuff like Netflix that is truly consumer-facing, where mTLS or IP whitelisting are non-starters, the reality is you have to rethink your model entirely.

Also, I'm not sure where you got the idea I'm talking about on-prem only; this also applies to using IaaS/ cloud hosted infra.

You're still describing an environment that presents a pre-auth surface area beyond a listening port.

And I am literally a security engineer; the work has absolutely not gotten harder, it's just changing in how you think about security, just like it shifted before from "secure the perimeter" to "defense-in-depth", it's now changing again to focus on automated response and compartmentalization/ segmentation (and I mean real segmentation, not the checklist-style "we have 3 vlans, but they can all talk to each other" 'segmentation' you used to see.

Why would you roll your own?

You joke, but the space I work in actually does do video calls (or in our case in-person meetings if they're local to SF, often) before onboarding new customers.

An exploit in what, the network stack of the Linux distro you're using for the mTLS proxy? Or the crypto module? Sure, could happen. But then, you're unlikely to be the top target of anything.

Or do you mean a customer was running it?

No self-service sign up for your app. No public access to the app itself. Website that let's you submit a sign up request form. Team reaches out and reviews your request, creates an account in the app dash for you, and you set up mTLS to get access to the dash.

You don't have to ship a dependency for it to be a vulnerability; the shai hulud worm was attacking dev machines and cicd environments to steal credentials. The deps you run are absolutely just as critical.

Who knew it's possible to simply have perfect vuln-free code!

We security engineers are definitely shaking in our boots.

> When people install npm packages, they typically only install ones the community trusts.

This is wishful thinking. Devs add in dependencies to do mundane stuff all the time, regardless of provenance.

As others pointed out, the default install for many modern web dev frameworks includes hundreds of dependencies.

Beyond ongoing support, community/number of contributors doesn't indicate anything, though?

And maintainability is a function of code, as it relates to humans, so it is a measure of the code itself.

One of the things I've actually seen companies considering (due to supply chain compromise attacks), is not just having an in-house package repo that trails public versions, but instead fully in-housing critical dependencies and essentially making them private forks that they (probably use LLMs to) maintain.

Basically cutting out the Chainguard-like companies that made private deps their business model.

That is great, but the reality is that your OS, the productivity software you use daily, and the dependencies downstream of the ones you review, are not actually being checked by you for code quality.

Part of using software is just going off how well it works.

When one Linux flavor starts to have issues, most people don't do a dissection on why, they just switch distros. Or web browsers (I've lost count of the back-and-forth between FF and Chrome performance over the years, nevermind all their precursors). Or office suites.

Pretending that the code is what really matters, and not what the code does, is elevating the paint quality over the painting.

"I don't trust code that I don't understand, or that I don't know someone experienced has reviewed."

proceeds to install 200 random npm dependencies

Yeah, all these devs pretending you can only trust code you understand, then going and pulling in 1000 random npm deps...

This response fails to deal with what I explicitly called out: actual evidence that the outcome is not accidental.

And it also fails to address that if a system is continually failing to achieve an acceptable outcome, even if the people operating it are attempting earnestly to do something correct, the people who can and would make the call to discontinue a program that fails to meet their expectations continually (especially when they are doing so to other programs that fail to meet their expectations) are clearly showing that they either have divergent standards, or have a different set of expectations than the operator believes.

Don't know why you think I don't understand that, I'm just pointing out that a law being a law doesn't shield racist people who support racist laws from being called racist.

(And the people who sign onto an organization like ICE knowing exactly what they do and why.)