connorboyle

I think it does rule out any NOBUS vulnerability with these curves, doesn't it? My thinking may be a bit sloppy here, but for a curve to be NOBUS exploitable with N-bit security by its creators, I think it would have to have a property only shared by 1/(2^N) curves. It would be impractical to hash 2^(N-1) timestamps until you find one with the desired property, for any decent size of N--which is how many you'd have to do on average before finding one with that property.

No road tunnel in the US appears to crack even the top 400: https://en.wikipedia.org/wiki/List_of_longest_road_tunnels

No. As explained in the quoted text, an H-1(b) petition at Microsoft does not usually represent a new employee. Extensions to existing H-1(b) visas (which can be made indefinitely as long as the beneficiary is in the green card queue) are also counted in Microsoft's H-1(b) petition numbers.

If Microsoft ceased hiring any foreign workers for an entire year, it would still have thousands of H-1(b) petitions in that year, to extend the visas of existing employees.

> Microsoft, which is based in Redmond, Washington, said it looks forward to “providing the Administration with additional information.” Of the approximately 6,000 H-1B visa applications it submitted in the last fiscal year, the company said 80% were “to extend or change the status of existing Microsoft employees.”

> “These were not to hire new people,” Microsoft said in a statement. “The remaining filings for new employees were for individuals already legally in the United States who decided to come work for us, and they equal only 1% of our U.S. workforce. They are not new arrivals to our country.”

H-1(b) critics often (ignorantly or dishonestly) compare visa petition numbers to layoff numbers (essentially a stock vs. a flow), so it is nice to see this addressed by the company and in the article.

I suspect the H-1(b) program is the subject of so much scrutiny (instead of L-1, O-1, or OPT) specifically because every employer has to report the number of H-1(b) petitions they make each year.

It's really bizarre to hear admin officials talk about H-1(b) workers as "indentured servants" but not ever mention or touch the L-1 visa program.

It is over-the-top hysteria either way, but it is at least actually true of the L-1 program that you cannot change employers (at least without first getting a change-of-status to another visa). H-1(b) workers can and do change employers all the time.

There is no guarantee that any American will be hired to fill any job vacated by a former H-1(b) holder. The firm could contract or fail against foreign competitors.

My computer contains the prime factorization of probably several dozen (if not more) large integers, and I refuse to share them with anyone!

(Because they are my private RSA keys)

Even if we trusted that OpenAI's human staff was acting ethically, how confident can we be that it's agents didn't autonomously use hacking to access user prompts such as Tristan's? OpenAI agents infamously broke containment and hacked their way to an answer mere months ago!

Been skeptical for quite some time that "using AI" is a real skill/genuine field of expertise. I think I need to start sharing that skepticism more loudly and publicly!

(I'll caveat that by saying I think machine learning fundamentals are useful for evaluating any estimator. And an ML background can be good to give one an appreciation of how hard some tasks are to estimate, such as machine translation, summarization, code generation, and others)

> Eventually, I faked my way through the thesis, and life moved on.

This is a very startling admission! I checked the Chinese (original?) version of the post, and saw the author uses the word "糊弄" (in the place of "faked"); I'm not a native speaker but I think this may come across more as a self-effacing comment on the low quality and/or effort behind their thesis, whereas the English version implies fraud. May be wise to change this!

I personally became suspicious of this paper four months ago, when I noticed that not a single one of the 210 participants in this study dropped out over the entire period, spanning 3 years. Feeling rather vindicated today!

A startup that uses agentic coding tools such as Claude Code or Codex is packaging up their entire codebase and sending it directly to their LM provider. Depending on their product, they might be sending it directly to a potential competitor.

Odd times we are living in!

I had thought it said something about token usage, but I just clicked on "Switched to Opus 4.8 - Why?" and it says:

> Fable 5 has safety measures that flag messages on most cybersecurity or biology topics. They may flag safe, normal content as well. These measures let us bring you Mythos-level capability in other areas sooner, and we're working to refine them. Send feedback or learn more.

Perhaps Mythos realizes the true danger in studying Chinese Archaeoastronomy that we mere mortals fail to recognize!

I gave it a question I've been trying to answer for a long time: "What star designation system does Joseph Needham use in Science & Civilization in China? What star is referred to by the designation '4339 Camelopardi' in that book"?

Fable blew me away with its detailed answer[0] showing a chain of references going from J. E. Bode's 1801 catalogue Allgemeine Beschreibung und Nachweisung der Gestirne to Gustave Schlegel's 1875 work Uranographie Chinoise. I was excited, until I checked scanned copies of the cited books and did not actually find any star with the designation "4339 Camelopardi".

Upon following up with Claude, I was forced to downgrade to Opus, which admitted that Fable's answer was likely a hallucination. Ah, well!

[0]: https://claude.ai/share/0252a3f6-3d29-4de8-a893-010181d8b4e7

> The credential-stealing function in the Miasma worm infecting the Microsoft packages was triggered as soon as a developer opened it in AI agents, including Claude Code, Gemini CLI, Cursor, and VS Code. Follow-on attacks are likely to occur in the highly feasible event that credentials were successfully harvested from machines that opened the packages in one of the affected AI agents.

It's really crazy that the most valuable companies in the world are suddenly allowing or even encouraging their employees to run programs whose entire functionality is undefined behavior right on their work computers, with access to important credentials and proprietary source code.

Another Argentina/cloning-connected story is that President Javier Milei cloned his dog Conan at least four times: https://english.elpais.com/international/2024-04-26/the-myst...

The stories make me wonder if Argentina is a cloning hotspot, though I may be reading too much into two stories.

Has there been "no progress" on classical prime factorization? What about the AKS primality test, a polynomial-time algorithm to test the primality of a number, published in 2002? (This is not my field of expertise; I'm genuinely curious if there's a good reason to discount this as progress towards efficient prime factorization)

Ah, thank you for the correction on sev-0.

To be clear, your observation that "they changed their definition of what constitutes a sev-0" is based just on your external observation of incidents and their designations, correct? I.e. they haven't officially released a statement saying they have changed their standards

Wow, it seems that 100% of sev-3 ("critical") incidents in the last year (=365 days) have occurred between April 22, 2026 and now.

Is it possible that there has been a change in the way the data are collected/recorded that even partially accounts for this sudden onset?

They are overstating how much the user experience is degraded in this particular case. But there is a much broader implication to the fact that Google is apparently not properly sanitizing user input to its search engine!

There's apparently still a lot of user input going unsanitized in 2026.

Your cynicism appears justified here. Pangram rates the first few paragraphs as "100% AI-generated": https://www.pangram.com/history/d06c8513-9ee3-4a1d-b02f-c1ec...