joatmon-snoo

Unrelated, the Nodejs patch is to strip the emudhra certs, which is its own separate security incident.

… do you know what the difference between potable and non-potable water is?

AOC is fantastic, but her name doesn’t automatically lend credibility to an argument, certainly not one backed by actual primary sources.

It’s not: the datacenter likely consumes less.

Datacenters (1) use non-potable water during normal operation and (2) return most of the water they use to the water system, instead of consuming it (as opposed to, say, a golf course).

I have yet to read anyone more compelling than Andy Masley on this: https://blog.andymasley.com/p/empire-of-ai-is-wildly-mislead...

(This isn’t a topic I know much about personally, so am open to being persuaded otherwise!)

The evidence that proves a model is actually a step function change is these benchmarks.

If a model isn’t a step function change? Welcome to research.

An example I ran into recently: I wanted to scrape pricing data for used cars, to better inform a friend's decision about what to purchase.

I know there's a relationship between mileage and depreciation, but wanted to have a better sense of what that relationship is to know whether a given car was over or underpriced.

Similarly, if I was pulling that data to build a service of my own to offer to users... is that unethical?

It’s really one of those things that you have to see in person and walk up and down along to understand. The scale of it alone is a huge part of what makes it so memorable.

Well, is Pixar’s Toy Story a work of art? Or what about Julia set renderings, where people make choices about the colors? ;)

Tongue-in-cheek aside, I do think I agree with you in that (1) art, as perceived by us human meatbags, is art because of the human element of it (if not in creation, then in perception), and that (2) AI absent explicit steering trends towards a rather bland medium.

But there’s art in everything from the blurry, out of focus, disposable film cameras, to a 5-year-old’s crayon scribble scrabbles, to the neon glitter themes we used to copy-paste over our geocities and xanga pages, and as frustrating as it is to our own sensibilities, an AI prompt “draw a pink elephant” isn’t all that different.

Hmm: can you elaborate?

I've never been on a security-specific team, but it's always seemed to me that triggering a bug is, for the median issue, easier than fixing it, and I mentally extend that to security issues. This holds especially true if the "bug" is a question about "what is the correct behavior?", where the "current behavior of the system" is some emergent / underspecified consequence of how different features have evolved over time.

I know this is your career, so I'm wondering what I'm missing here.

That's called a compromised account, not Facebook sharing the email with a third party data broker.

Breaking something is easier than fixing it.

Humans + LLMs are really good at producing enough spam to overwhelm anything like this. There’s a reason curl bans LLM slop reports now.

The argument for not using electric sharpeners is that they (1) cut down the lifetime of your knife substantially and (2) they do a mediocre job of sharpening.

Mechanically, it's just high-abrasive motorized spinning discs at preset angles. So rather than getting a good edge by taking a few microns of material off by doing it manually, you get an OK edge by taking 0.2mm off at a time. (If 0.2mm doesn't sound like a lot, think about how many mm wide your knife is.)

---

I'm personally 50-50 on this advice: most people don't sharpen their knives at all, and I think people are better off getting 10 OK years out of a knife than 50 terrible years out of it.

I'm also not willing to learn how to use a whetstone, so I landed in the middle on this: https://worksharptools.com/products/precision-adjust-knife-s...

There's a lot of tooling built on static binaries:

- google-wide profiling: the core C++ team can collect data on how much of fleet CPU % is spent in absl::flat_hash_map re-bucketing (you can find papers on this publicly)

- crashdump telemetry

- dapper stack trace -> codesearch

Borg literally had to pin the bash version because letting the bash version float caused bugs. I can't imagine how much harder debugging L7 proxy issues would be if I had to follow a .so rabbit hole.

I can believe shrinking binary size would solve a lot of problems, and I can imagine ways to solve the .so versioning problem, but for every problem you mention I can name multiple other probable causes (eg was startup time really execvp time, or was it networked deps like FFs).

(author here) To be more specific, here's a benchmark that we ran last year, where we compared schema-aligned parsing against constrained decoding (then called "Function Calling (Strict)", the orange ƒ): https://boundaryml.com/blog/sota-function-calling

This setting is new and was introduced in response to the first round of shai hulud attacks.

Google never asked a volunteer for a fix.

This is part of Google’s standard disclosure policy: it gets disclosed within 90 days starting from confirmation+contact.

If ffmpeg didn’t want to fix it, they could’ve just let the CVE get opened.

They do.

No, this is the unfortunate reality of “ffmpeg is maintained by volunteers” and “CVE discovered on specific untrusted input”.

Google’s AI system is no different than the oss-fuzz project of yesteryear: it ensures that the underlying bug is concretely reproducible before filing the bug. The 90-day disclosure window is standard disclosure policy and applies equally to hobby projects and Google Chrome.

This is great to see, much appreciated for the disclosure!

We’ve had a lot of success implementing schema-aligned parsing in BAML, a DSL that we’ve built to simplify this problem.

We actually don’t like constrained generation as approach - among other issues it limits your ability to use reasoning - and instead the technique we’re using is algorithm-driven error-tolerant output parsing.

https://boundaryml.com/

For folks who don't know what Magic Lantern is:

> Magic Lantern is a free software add-on that runs from the SD/CF card and adds a host of new features to Canon EOS cameras that weren't included from the factory by Canon.

It also backports new features to old Canon cameras that aren't supported anymore, and is generally just a really impressive feat of both (1) reverse engineering and (2) keeping old hardware relevant and useful.

Strings are like time objects: most people and languages only ever deal with simplified versions of them that skip a lot of edge cases around how they work.

Unfortunately going from most languages to Rust forces you to speedrun this transition.

nit: Colossus* for Google.

> if you proceed with care

Yes, but that is _incredibly_ time consuming. You have to set up asan, msan, tsan, and valgrind. If you want linting you need to do shenanigans to wire up clang-tidy.

I also like simple mental models. I like not having to figure out the cmake modifications to pull in a new library. I like having a search engine when I need a new library for x. I like when libraries return Result<Ok, Err> instead of ping ponging between C libraries which indicate errors using retval flags or C++ libraries that throw std::runtime_error(). I like not dealing with void* pointer casting .

An unfortunate problem with using awk: there are three different versions of awk, and it is frighteningly easy to use a feature that exists on one but not other.

(source: I have written unit tests against different versions of awk. That was... unpleasant.)

Pretty sure dedupe is done manually by u/dang.