hobofan
Especially during the current time of unprecedented pace of security patching, decrying this as "enterprise box-checking" couldn't be be more displaced.
If you use an odd/fringe browser you are more likely to be caught by CF Turnstile and be locked out from websites.
However you also need a few other ingredients to ensure isotropic expansion, or otherwise the expanded sample isn't scaled uniformly in all axis and you get a skewed view of the sample.
As long as that's the case, it's no surprise that there is often a perceived difference of quality between benchmarks and real-world use.
I know that running the full composite benchmark set is probably already quite costly, and also that the benchmarks have to be rotated regularly, but it feels like a significant untackled problem.
At least that's roughly what the hypothesis of https://www.discoveryloop.com/ is.
I think the scarier alternative may be OpenAI forever gating their super-frontier models, capturing a significant portion of the sciences and leveraging it for equity in businesses that build on scientific advances. e.g. "Hey CATL, how about you guve us 5% equity in exchange for a battery chemistry breakthrough our AI has found?".
It's roughly equivalent to the playbook Palantir had for the public sector when they marketed themselves as a company that had cracked data science. At least that's what they've been pitching back then. I can't find a lot on public disclosed deals based on that.
I have some business automation process for some customers that I maintain, where Terra with low reasoning ended up with the best price/performance & latency. With an equivalent Luna with high reasoning, price was usually better, but quality had a higher variance (very much depends on where the thinking takes the model) and latency for high reasoning was worse.
Enterprise doesn't care about marginally better. They care about cost.
Most organizations that run our self-hostable chat platform with cloud models are for most stretches running 6 months-1 year old models, and are strongly eyeing (or have already switched) to more commodity models for most of their workforce. Frontier models are mainly relevant for engineering tasks.
I'm just cautioning other people to put any stakes into a language that's from its organizational bones doomed to fail for any outside party.
Putting stakes into a language that will essentially be DOA, like the author does seems like a crazy decision.
You can also just do "uv run", and it will automatically sync as necessary!
I think that's one of the things that uv does great and often goes unnoticed: It's hard to use wrong for a layman. Forgetting to run the equivalent sync command in most other Python package mangers could have resulted in a myriad of different bugs caused by out of sync packages, leading to hours of wasted debugging.
The only way around that would be to somehow get all world knowledge and tool calls into a audio space, which seems like quite the stretch.
Most of the lessons that make uv good can be directly traced back to Cargo (which in turn can be traced back to Bundler). The main portions from the Python side that helped it have a good foundations were standards work (PEPs), none of which were driven by the people behind any of the three "major" package managers.
rustfmt is what implements Rust formating. However rustfmt is also distributed via rustup (Rust's toolchain manager). There it is also exposed under the alias cargo-fmt, which makes it work as cargo subcommand `cargo fmt` (a mechanism that's available to any crate). So it's technically not "part of cargo".
Of course the nature of all of this is a bit different, as Rust maintains cargo, rustfmt and a lot more dev tooling as part of it's official teams in comparison to other language ecosystems, where focus is on the compiler only.
For things that affect people, I think the impact of the recency axis is significantly larger than the one of the geographical axis. e.g. I feel the effects of the Iran war in my daily consumer prices in my daily life. I don't feel the effects of a famous person being born two doors down from my place 200 years ago in my daily live.
Of course highly local things, like e.g. local politics are also felt, but those are also barely reflected in Wikipedia articles.
It really feels like I'm being gaslight here into believing "durable agents" are novel. All I'm seeing is the API that is behind any Chat Web UI. Persistence, resumability, recovery from errors and branching and forking have been table stakes there since the release of the first ChatGPT.
Maybe I'm biased because we are primarily building a chat interface ala ChatGPT, which isn't anything different than a "remote harness". I'm not sure why one would design a local harness differently.
Let's call it "Let's Decrypt!"
Depending on how the billing engine is deployed, and whether there are adequate controls that it's being deployed correctly, there is nothing wrong with accepting a header like this from an upstream service that produces it or verifies it in the correct manner. It only becomes an issue if the service is directly exposed to potential attackers that could use it for impersonation, e.g. a service directly exposed to the internet.
Parts of the exploit chain that was laid out in the blog posts that claim an RCE were bugs that have previously been reported. Dealing with them in the past in the severity you outline would have possibly prevented the exploit chain.
However, it's specifically the ability to complete this to an RCE what makes or breaks the headlines here.