blcknight

The risk here is wildly overstated, prompt injection risk is becoming vanishingly small with the latest frontier models.

I would not run an OpenClaw with full access to my bitwarden, but it certainly has some logins available to it, and can make purchases with link-cli which has human-in-the-loop.

Ah sorry, for OpenAI it does seem automatic with ID verification. Anthropic's seems more picky.

Apply, not sign up. It is not automatic and most will be refused.

$80 sounds extremely low for what you're describing - are you on API token plans?

I have had some $3,000 token days - even without Fable. I don't see how this is sustainable.

My personal 20x plans get so much usage for so cheap. The consumer subsidies are crazy, but alas I can't use them for work.

Pi is ok, but I dislike needing plugins to do anything useful. Subagents, MCP, /goal ... none of these things should be plugins.

My comment about legal reasons was legal reasons surrounding employee law suits from being laid off. At will employment in most US states allow you to state no reason, that's safer than offering any reason at all. A specific reason for a layoff can be litigated.

> I hope the big labs will start using this benchmark in their RL pipelines.

Labs do not train on benchmark data (allegedly). They can train on similar problems, but benchmarks have specific strings in them that labs are supposed to be aggressive in filtering out of their training corpora.

I assume it is legal reasons.

I know tftp is still in wide use, I wonder if there's things out there looking for stuff that's less common like NNTP, finger servers, etc

Oh I didn't hear about this. That sucks. The stock firmware is terrible. CrossPoint makes it usable.

I adore my XTEink 4 with the crosspoint firmware. Best small form factor ereader

Elon's rhetoric doesn't really match the model's behavior. It is willing to criticize Elon and argues against many of the insane right way points he tries to make.

The gulf is bridgeable. The problem is that a lot of people are building agents without strong enough judgment layers around them. Work that can be verified with reasonable accuracy are the sweet spot right now.

No need to be defensive. If you ask an epidemiologist, they would almost certainly agree that it is essentially a marker of sexual activity at this point. It is transmissible even with condoms, it has many strains, it is widely prevalent, and the WHO states that basically everyone is sexual active will get one strain. Guardrail prevents against 9 - the ones we were able to create vaccines for and we know have negative effects.

There's also not really great tests for it, so you do not know if you have it or not.

I guess you'd rather downvote than answer the question.

Chinese models are almost certainly cheating on benchmarks, I would bet if you saw the training data that the benchmark canaries are in there.

GLM may be a good model in general but it s benchmaxxed and definitely not as good as Opus 4.8.

You realize that the companies listed employ many of the core open source maintainers for large projects? It is project-specific, but 80% of Linux kernel development is from paid corporate employees. Similar for kubernetes. All the load bearing infrastructure is already handled by these companies... literally no one else is going to have the resources or experience to redirect large efforts on securing F/OSS.

What would you propose otherwise?

For some reason not really talked about in mainstream medicine for straight men. It makes no sense. Very safe vaccine and you're eligible into your 40's to get it. Everyone sexually active probably has some strains but not all.

I hear a lot of complaints about bun but nothing concrete about what broke in the migration.

You are also assuming one prompt, and then arguing against your assumptions with zero evidence. It is lazy arm chair criticism.

How can an agent use these tokens then? If it sources the file can't it just read the env?

It also sounds like it is missing the important step of keeping the LLM credentials from the agents themselves. For example my GCP creds have access to far more than Vertex. This is solved by OneCLI and OpenShell via MITM proxies which seems more elegant to me. The tools live in containers and can't see anything but can use everything.

It also allows finer grained access controls, rating limiting, and there's talk of scanning for destructive actions.

There's a new standard in progress for skills over MCP

https://modelcontextprotocol.io/community/working-groups/ski...

I like my Nespresso thank you very much.

"Review" them how? Read every single line of code before installing something? If it's a binary package, how do you do that? Make reproducible builds for everything you install? Move to from source distro? Putting this on users is not a tenable solution. There's room for common sense, but blaming the users for this is ridiculous

One bad npm package can really ruin your day. These things for me only run in their own VM with it's own GitHub account and basically nothing else

The fallback doesn't seem to be working for me, I haven't scanned a project in it immediately booted me when it found a security bug even though I didn't ask for it

Kube play and quadlets are cool

The vast majority of kobo books are still ACSM protected.

It hasn't changed, and I don't know why people are saying that most books don't have DRM. It is only a small minority.

Tor books is the largest publisher without it (owned by Macmillan). Otherwise everything is truly hard DRM either ACSM with epub or Kindle's. They are both more or less easily defeated though.

All kinds of tools make it really difficult to not make a URL clickable and even if it wasn't clickable they might still put it in address bar...

I am not sure anyone knows what a harness is at this point. I've heard 17 different definitions of it at this point. It's almost like a buzzword in search of a problem.