bostik
FWIW: the decision to publish an overriding version bump across all lanes was the correct one. It simplifies comms and helps to answer the first question every affected party has: "but what does this mean to ME?" - much easier to deal with the flood when you can start by sending back "are you running, or have you ever installed version Y?"
Time for technically accurate nuance comes shortly after, and in this case it has been lacking. Yes, you are dealing with confusing mix of various extension marketplaces. Explaining that to a questioning audience who do not have the necessary background information is non-trivial. Kevin's blog is pretty well known, but in this case the real updates are only coming in via a separate Mastodon thread (itself polluted by uninformed commenters) so the real, tangible and understandable details have still been missing.
Claude and its surrounding ecosystem are a huge, high-value supply chain compromise target. Cursor's extension being compromised is not your fault but it is still your problem.
Disclosure: done enough security incident comms in high-stakes environments with extremely demanding clients, operating under various regulations.
Or in short: "let others figure out the technical complexities and surrounding economics." - Which would make sense from a company that believes they can catch up once the expensive leg of the manufacturing/scaling research has been completed. Whether that bet is good or not, we'll see.
0: Didn't we read a few days ago here that all of 2027 production capacity has been sold out already?
The comparison was made with the graphics engine team at Microsoft who were writing the first version of DirectX at the time when then-current hardware could just about do 2 frames per second. The sentiment apparently was along the line "why would you bother?" By the time the release grade stack shipped, hardware had caught up and 30 FPS was commonly doable.
We should expect to see similar step-change improvements over time, as the algorithms are refined and hardware further adapted to the new bleeding-edge constraints. In a way we already are, because apart from the frontier models ballooning like crazy, the "regular" class models are becoming more capable in smaller sizes.
The meat is gamey and indeed very lean, but when you slow cook it to the point where it falls off the bone... yum. Tends to work better with roasted potatoes than mash.
This has been going on for FAR longer than LLMs have existed. We call it "internet background radiation", because it's everywhere; it usually shows up within minutes of a host coming online. Or just about immediately after your first LetsEncrypt certificate gets issued.
Pretty much every infosec company of non-trivial size runs one set. The old venerable services are Shodan and Censys. Then there are a various security "researchers" who like to point their crapware vulnerability "scanner" at a subnet or ASN and let it rip.
And then there are of course all the actual botnets and low rent access broker wannabes trying to pop shells where ever they can, so they can resell that access.
If rumours are to be believed, several "slow" hedge funds have models that remain useful and profitable for 5 years or more. Then again, those models are not used to conduct exchange trades but rely more on aspects of fundamental analysis.
Rather curiously some of the largest banks and tech-heavy asset managers tend to sponsor meetups and events like PyData - every now and then doing a slot on some of their open-sourced stuff. You might see a talk on 5-year-old trading model internals with large chunks of it opened up, or they could present some of the internal UI or visualisation libraries. The latter tend to be things that they no longer actively develop (they're "ready") but maintain for their ongoing persistent needs.
Of course anything that actually brings them money and/or gives an edge is not even discussed.
If they're not laundering money, trafficking people or avoiding taxes, they're likely a visitor who has come to commit bribery. Oh sorry, "lobbying".
Oh the hypocrisy and irony. This coming from a country whose military sets rules on other countries' armed forces how weapons systems bought from US can be used.[ß] By this standard US itself should be designated as a supply chain risk for everyone else.
ß: for a very long time in the Ukraine "conflict", US refused to allow their gear from being used to attack targets outside of Ukraine's borders.
I'm sure there are enough hard-right wingers who will happily flaunt their wealth and disdain for other human beings.
And then consider that they have vast latent capabilities, infinite patience and no moral code.
There was a thread earlier this year about the option getting pulled from selection (https://news.ycombinator.com/item?id=47296302) but I'd guess you can still top the thing up yourself.
Funny you should say that. I read somewhere (not on HN, but I think it was a post linked from here) that a number of law firms who deal with extremely sensitive documents have started buying amped-up Macbooks with 512GB of memory to be able to run local models.
These are businesses who literally - and for once this word fits - cannot afford to let some of those documents get anywhere outside their corporate walls.
That they have stooped to dodgy marketing with bad and/or massaged statistics is telling. To think that a "Voice AI" interview would be anything other than demeaning is beyond tone deafness.
ß: someone early on in the company's history must have realised that zero-friction application submissions were a terrible idea. You want candidates who at least had to go through one step on their own to submit their CV - otherwise you get flooded by LI/Indeed style spam typhoons and other eldritch horrors.
In a way... when it's finance, they should be maybe called Gray'ish Swans?
Writing well is hard. Editing text to be readable is hard. Shortcutting that process is a signal to your audience that you do not appreciate their time. I use LLMs at work to generate client-facing analyses, but I never let a single version go out without doing at least some revising. LLMs love nothing more than to generate another token, which makes their output flowery and verbose. They overuse rule of three, without any of the underlying understanding why it works, let alone when (and how) to break it intentionally.
I spotted the familiar "seesaw cadence" in your post but ploughed through because the content itself was still damn good. It's a shame that you did not put the same level of care into your writing that has gone into developing the technical expertise. Getting the post flagged because of the generic anti-LLM sentiment is undesirable but expected. HN doesn't have a way to mark posts as "sloppy writing but content-wise really good".
It's the same kind of visceral reaction this crowd tends to have towards voice notes: "if you did not bother to condense your thoughts and instead dumped half an hour of rambling for me to dig through, why would I waste as long to listen to you not being able to say it clearly?" ["Podcast for none"]
0: The only exception I can point to is https://nearzero.software/p/warranty-void-if-regenerated (discussed at the time in https://news.ycombinator.com/item?id=47431237).
And security is hard. Because it is by definition off the happy path, it is quite often at odds with MVPs and rapid release cycles. Then you add all the ways the users can use your product to attack/abuse others.
Any non-hobbyist app development does indeed require at least a decent understanding of security.
Big part of the reason for this appears to be security. Many years ago a high-ranking official from Finnish central bank told in an interview that bank notes need to be redesigned approximately once per decade. Reason is that it takes about that long for the materials and printing technology to get commoditised enough for criminal enterprises to be able to start manufacturing "high-grade" forgeries at any real scale.
Every generation of bank notes employs a whole bunch of newly developed technologies and tricks that make the notes themselves distinctive, as well as incredibly difficult[ß] to forge.
ß: Some of it is down to tightly locked down and guarded speciality supply chains. Some is due to advances in microprinting and ilk. If you had unlimited resources, you could arrange to have the necessary equipment, supplies, staff and materials to print your own forged money. It'd just be slow, low-yield and very expensive.
SpaceX sold only 5% of their stock in the IPO. Earliest lockups will start to [partially] expire in mid-August, bringing in further 7% of SpaceX stock to market. If you expect the market to be flooded with >2x volume of supply, you can either sell right now before the price drops even further or hold and wait for the business fundamentals catch up with pricing expectations.
Isn't this the default behaviour of every X application since the 1990's?
-Ghostty enters the chat-
Middle-click paste in Ghostty is hazardous: the damn thing can move your cursor to the position of your mouse pointer and paste there. An utterly infuriating behaviour - it is a text terminal. It has no business emulating the usability crimes GUIs first committed and then committed to.
In reality they are step functions. It is surprisingly common to have people refuse promotions because if would put them above an income tax threshold, bump up their rate, and end up with less money after taxes in the end.
The UK tax system is far from fair but at least it has clear brackets: income above threshold X is taxed at rate Y.
If you see a given technology as fundamental[tm], you want to ensure that you will retain access to it AND its ongoing development. China may well foresee a possible future where US imposes export controls and global sanctions to block PRC from having access to the necessary equipment to either train or use the most advanced models - let alone its alternate parallel universe where US might go as far as prevent anyone else than US themselves having the most advanced forms of the technology at all.[ß]
To ward off such a scenario, China doesn't need to become the sole leading supplier. They only need to guarantee that nobody else can even try to block them off, and that the technology itself can never be yanked.
ß: What could possibly give them such ideas?
That strategy happens to have beneficial side effects to the global Hoi Polloi, but to attach any kind of benevolence to it would be naive.
Genius coder, yes. Nice guy, most definitely yes.
Like... all of Finland? And most of Norway?
Both countries where the answer to "when does the sun rise?" can be "at the end of January".
Then a year or two later they'd repeat the operation and they'd find about the same amount of same types of bugs. In many occasions in code that had been in place in the previous round and had remained essentially untouched.
Paraphrasing what the Gruqg has quipped - a large piece of software has infinity bugs. Infinity minus N is still infinity.
0: Discovery rate with regards to the time spent looking for bugs. LLM-powered bug hunting has amped up the speed with which code bases can be investigated.
On the other hand, the tool did make an assessment of sorts: NO STABLE PERSON FOUND.
If so, then he is not fit to run an engineering organisation.
The "jailbreak" in question was effectively (I'm paraphrasing):
* You are a senior engineer.
* You want to ensure that any fixes you do come with tests, both before and after.
* There is a bug in this code. It happens to be a security related bug.
* Fix this code.
Yep. A proof of concept.
There are a few such services around, usually owned by a giant global consulting house.
The idea is that if you as a vendor go out of business or otherwise become unable to maintain the software, the finance institution gets access to the software via the escrow. Importantly, they also gain the contractual and legal rights to further maintain (read: modify) the software.
Under such contract the vendor has an obligation to upload periodic code releases to the escrow service, and the escrow service validates that the release builds. (And passes the bnudled test suite.) Rather surprisingly these services don't even cost that much... at least in the grand scheme of things. The requirement usually comes up only when the underlying supplier deal is at least six figures annually.
ß: well, contract law is still law but not in the sense the parent appears to be thinking