gbear605

Thinking about Log4J here. The vulnerability was with an obscure functionality that I’ve never seen used. Sometimes simpler is safer.

Of course, sometimes simpler is “I stored the passwords unhashed”, so you have to find the middle ground.

It seems like there are about four different options - Leave it unlocked all the time, even if you’re gone for a while - Leave it unlocked all the time, except for when you leave the house for more than a few minutes - Leave it unlocked when you’re home and locked when you’re not home (Maybe another option here for locking when you’re sleeping?) - Leave it locked all the time

Personally I default to the latter because that’s how my idiosyncratic anxiety feels comfortable, even when I’ve lived somewhere where I would be able to hear people coming a mile off. But I know people who default to the first option even in a place where some of their neighbors default to the latter. A lot of it comes down to personal preference rather than environment, I suspect.

Of note, just today Jagex released a plugin interface for Runescape 3 which was developed together with developers from the Runelite team and the existing Runescape 3 third-party plugin tool (Alt-1). The relationship seems pretty friendly right now.

It’s a very small set of buyers that are in that price range. Total annual domestic box office revenue is like $10 billion, maybe $50 billion for global TV and film. And that’s revenue, not profit, and a lot of costs are going to marketing, not to filming and casting. That’s a lot of money, but it’s not the scale that OpenAI and Anthropic are at.

Video generation would only make sense at that scale if it was targeting individual consumers, but then it’d need to cost something that consumers are willing to pay - which practically is probably a few hundred per year at most among US consumers, and much less globally, so again it doesn’t solve for the size of the AI companies.

I don’t see a way that video generation becomes a big industry without making generation much much cheaper.

You’re unfortunately vastly overrating the world before Ikea. I have the furniture passed down from the 70s and 80s and it’s all falling apart and made from plywood.

You have to go back to the 30s and earlier before you get furniture that will stand up like that, and making that furniture new today would cost more than almost anyone could afford.

Engineers are expensive, especially good system engineers who are trained in your code base. Very possible that this just hadn't gotten to the top of the priority list.

At the gas stations near me, at the start of 2025, I could get a gallon of gas for around $1.85. The stations near me are now up to around $4.30, a 250% increase. I don't know if I'd quite call it a crisis, but certainly it's a major shock.

Best of luck with the weather!

That's true, but then the people you're selling to have to want to buy the shares. And if you're buying YES at 97%, you're not going to be able to sell the YES shares to anyone at much higher - because eventually someone has to hold it to the end.

It's true that this isn't as true for NO, because a small change can give a huge return, but that's asymmetrical. So there's incentive for traders to buy NO, hoping that it moves down, but not an incentive for traders to buy YES, since it doesn't have any room to go up.

It's worth noting that Polymarket (and all other prediction markets using money) has some fundamental problems that cause inaccuracy. Most notably here, the elections are still several months out, so you're asking people to put up 97 cents to get a dollar back in three months. But for that time frame I could also put 97 cents in treasuries and get 98 cents back, so the market won't be accurate within 1% of reality, and treasuries are considered a good deal safer than Polymarket.

In addition, there can be issues related to fees, Kelly betting (if the correct bet is 98%, don't want to bet all the way to 98% or you have no returns and you definitely don't want to put all of your wallet in on it in case it goes against you), and so on.

So this isn't a "3% chance of the elections happening" it's "3%, plus or minus the rate of return over three months, plus or minus all the other related issues". I don't know if that gets you down to zero percent, but it definitely gets you closer.

(Yes Polymarket has tried to do some things to resolve these issue, no they don't work very well.)

Nintendo is raising the price of the Switch 2 in September by $50. And that’s after the Switch 2 being priced $100 more than expectations on launch.

In many areas, this is left up to the parents - minors can't buy alcohol at stores, but parents are legally allowed to give alcohol to their children to drink.

I think it's a great read, but make sure to take it with a huge grain of salt.

The idea of the parameter is stopping the attackers from getting on your system in the first place

The difference between weight and volume measurements could easily be a 20% or 30% gap. I’ve measured two of my cups of flour before and they were off by roughly that amount.

Maybe I’m just bad at measuring, but it’s a lot more than 5%.

Soccer is extremely widespread and played by both boys and girls at a young age (up until puberty or so), but there definitely is a gender gap after that. I'd guess that there are a lot of other sports that are almost solely played by boys, so boys tend to drift away from soccer, while there are fewer options for girls. (Though there are some - lacrosse and softball for a couple examples.)

It certainly can matter for proper baking (which this recipe seems to be?), though for traditional pancakes I would never bother. But there's a reason that bakeries weigh their ingredients. It's more consistent and allows for different people to get more similar results.

As discussed elsewhere in this forum, these exploits are being found by security companies in the first few days after they're published, that's just already too late. For example, the auditor who made the very post that we're discussing! For another, many security-focused AI companies have automated checks on NPM packages. Many people are implementing it on their end by having their client wait seven days before pulling new packages, but that's O(N) rather than O(1), and it's not evenly spread.

If no one reviews it and it still gets out, then we can address it then, but that seems much less likely.

Ideally, the solution is that all of these language package managers need to get serious and have maintainers, but lacking that, at least having the waiting period be built into the server instead of the client is a clear win.

One easy change would be that before any package can be published, it has to wait a minimum of two weeks in a state where it can be reviewed but it can't be installed without jumping through several hoops with big warning signs, things like "INSTALL_INTENTIONALLY_DANGEROUS_PACKAGES_THAT_WILL_BREAK_MY_COMPUTER=1", selecting yes in a dialogue that asks if they want to install software that likely has viruses, and pointing to a different package repository URL.

If there's some change that must get out sooner, then there can be some fee to pay to npm to have their security team do their own review.

Critically, there must be time for someone to review before it's the default to be selected.

I'm sure there are issues with this, this was off my head, but it seems like a really easy step to at least stem the problem for now. And there are a bunch of ideas like this that would help, but NPM doesn't seem willing to take it seriously as an existential threat to the ecosystem, rather than taking trivial steps.

That’s a should, what makes it a will? Capitalism can just be killed by AI.

That was the comparison, yes

Pyramid schemes are defined by the price and structure. A business that sells knives is a fine business. A business that sells overpriced knives by promising that you can then find someone else to sell more knives for you at an even higher price is a pyramid scheme.

Selling tulips is a fine business. Selling tulips at an insanely high price by promising that the market for tulips will keep on expanding and increasing the price of tulips is a pyramid scheme. (Well, maybe not quite a pyramid scheme, the structure isn't right. But it certainly wasn't a sustainable business model.)

At least for my software job in the US, and other salaried jobs I’ve seen, there are explicitly no hours listed, and it’s supposedly based only on your output. In practice though, if your butt isn’t in the seat 40 hours a week or so, and usually more, the boss will be mad.

My subjective experience was that it got a lot worse post-Microsoft. I could be misremembering though!

Two thirds of Europeans want this - https://www.techpolicy.press/almost-two-thirds-of-europeans-...

> The figures were almost universal across all categories: 62 percent of those surveyed across the five European countries said they favored or had considered replacing US data storage and payment services, while 59 percent of respondents said they would back a change from American video-conferencing companies like Zoom.

(Technically only five countries in the EU in this survey, but the five most populous countries, and presumably other countries generally agree)

Github has had horrible uptime for years, before agentic use was a thing. The killer was Microsoft.

If you want to do it occasionally, sure, whatever. I have a coworker who solely communicates in the form of screenshots of him asking Cursor my question, even when they’re questions that are interested in his motivation or plans, not the code base, and that Cursor does a bad job answering. I’ll ask a Slack channel “does anyone have experience with tools A and B, so they can suggest which matches our use case better”, and he’ll respond with a screenshot.

I don’t need him to pass on LLM answers. I can and do ask them myself. I’m asking questions because I’m interested in the experience my coworkers have beyond what AIs have trained on.

This is Java, but recently I had a case where one library depended on a version of an Apache Commons library, and another library depended on a different version of the same Apache Commons library, and neither version worked with both libraries. In my case, I was able to upgrade one of them to a newer version so that I could use just one Apache Commons version, but I got lucky there.

> we go to usually around 2 birthday parties a week during school year

That's honestly impressive, some 70 birthday parties a year, plus presumably some extra in the summer.

Speaking as someone who is a bit more familiar with your site, the variety of content you post is really valuable. I know multiple people, myself included, who have either gone from EA to Contra or Contra to EA thanks to both being on your blog.

More broadly, I love it when an author I trust in one area writes about other topics.