justonenote

> None. Explicitly banned. ... I can't blame them. If some idiot roots their phone and downloads malware, the bank may be responsible for refunding them. I can see why they don't want that headache.

I mean this is the whole reason GrapheneOS does not ship a rooted version that they attest to. I doubt they are explicitly banning GrapheneOS, what they are doing is only trusting Google attestation.

The reason some banks explicitly allow GrapheneOS is because its easy for them to also trust GrapheneOS attestation, because it is not a rooted OS, and sensible security teams in banks can see that its more secure than any other Android phone including Pixels.

I wish people would understand this better, its what gives GrapheneOS a fighting chance of becoming a legitimate open source mobile OS that is accepted as secure for consumer use and that is not controlled by Apple or Google.

The solution here is interchange formats. These do exist but are generally never _that_ succesful because vendors of apps have to be differentiated in some way.

There are tons of examples of this, Blender cant open Maya or 3dsmax projects, because each vendor has their own differentiating features, their USPs and they have not zero, but negative incentive to help competing Apps easily support them. So we land in some middle ground where FBX or OBJ and JPG and BMP are widely supported and are the formats we can interchange between apps.

I think with all due respect what you are asking for is an impossible goal because it would require complete central co-ordination, which would remove competition and innovation, and I'm not even talking about this in a capitalist vs socialist economic frame, just in the co-ordination sense, how does the precise data model get decided, who does it and how long does it take for me to get my experimental dog poop tracking app approved and folded into the unified model? Forget about dogs I'm tracking ant movements and reproduction across seasons while recording moisture levels within the colony, does this central database have a schema for that already? if not, how can I get it in , and what if someone else was working on a similar app but was tracking reproduction of the ant colony with relation to nutrient levels and soil composition.

Strict global co-ordination is not possible, fundamentally, there is endless examples of this at whatever level you want to look at.

I clicked into this hoping this would be about moving towards proper app isolation rather than make things look pretty stuff (bit of oversimplification).

I mean especially in the age of AI agents, two things are true, first, customizing your desktop, tiling manager, monitoring widgets, shortcut keys, hooking up hand gestures, eye tracking, foot pedals, whatever, to workflows is now so much easier and accessible to completely non-technical users, especially in open source desktop environments.

This is undoubtedly a good thing and many of the responses here are along the lines of 'I like to customize it like this' but I'd bet a lot here also know completely non-technical users who have setup their own weird ass workflows using excel and autohotkey or whatever just to get shit done.

The second thing that is true, is that increasingly we are handing control of apps to AI agents, or even just whole desktops, which is just greaaat (tm). but also incredibly risky since our desktop environments are built on 1970ish era unix multi-user mainframe system design, where one app you install has access to every single other app in the same user space, which is basically root, since you hold everything in one user login anyway. So all it takes is one supply chain attack, one malicious package take over, one zero-day prompt injection against a popular app in a certain segment and then your entire user profile and all your data is exfiltrated.

There are people working on this, Flatpack, Wayland, Fedora. But I think it needs a lot more attention. Android has got this model right for the most part despite the friction it sometimes introduces.

Also I would say this is not just about ai agents thing, but I don't want to install a desktop meme generator program (or pick your thing) and then have it be able to monitor the entire rest of my user profile. This problem existed before AI agents, its just maybe more relevant now.

> have a tool call that gives the customer a discount, without it getting used when it shouldn’t?

without comment on the rest of your post, a lot of discounts are just dark patterns, buy 2 for $10 or one for $6 is one of the oldest dark patterns around, and a lot of people fall for it, when they really didn't need that much whatever it was they were buying. In fact there are laws outlawing these practices coming into force for various types of products (alcohol, sugar) .

Other types of discounts like loyalty are more vague personally I think are a minor dark pattern. Negotiated discount on bulk purchases b2b are a different class, but it could be argued that you should only get the discount that the seller saves on logistics.

I'm just pointing this out because its very normalized, 'signup and get 3 months free', 'buy 2 get one free' etc, people dont bat an eyelid at, the same as advertising , but they are all just the earliest versions of dopamine hacking and dark patterns that consensus now is coming around to say probably isn't the best thing when scaled beyond a simple one to one interaction. Why are snapchat dopamine hacking with streaks but your local coffee shop stamping your card for your 10th coffee free different?

this is reductionist to the point of absurdism.

It can be true that using cloud storage, using managed services, and paying a premium is still worth it for a lot of people and organizations, and while not perfect, still a hell of a lot better compared to the fully in your control tape backups that you distribute to different physical locations every week.

I'm not a particular fan of relying on one provider or vendor lock in, but to pretend they don't provide a service with failure rates that are low enough to be very useful is a very short-sighted take.

You'd be shocked at some of the punishments handed out from various empires over history for offences as minor as stealing an apple. Whether they can claim the moral high ground is not question of ethics but a question of power.

and hook up a Bluetooth sensor so when you walk into the office it prints them off in individual sticky notes and assigns one of the humanoid robots to collect them and stick them on the monitor or cubicle walls of your chosen work desk.

what a time to be alive.

Its all brute force. This was how the pyramids were built too. Verifiable goal and a lot of energy expended aiming toward it. It wasn't aliens then and its not super intelligence now.

All of these breakthroughs are in verifiable brute force domains, and some of them are probably wrong because of a typo in a lean specification or just a base level axiom being incomplete.

I think the better the way to think about LLMs is like they are new substances, like when we first discovered clay or bronze, but confined to the digital realm. Previously we were chipping away at stones trying to make to things as close to useful as possible, then we found a step change. LLMs are like clay but they have their limitations. Wake me up when they are proposing new, { conjecture: interesting|useful|new } and not as a side effect of trying to get to a goal.

Religion

It doesn't need need to be tied to some mystical god, "music is my religion" is a phrase that has been used and is understood easily, and you can replace music with many other nouns, games, science, family, dog grooming, whatever.

You can kind of see this in the rise of weird internet cults around celebrities and obviously many IRL cults over the years, and I don't know if the frequency of weird cults has increased in the last 3 decades but I would take wild guess and say it has.

"Make religions cool again" is a bit of a hard sell considering worldwide events but unless we can come up with a better word for a shared value system where people sacrifice things they can gain, for the good of the group, I don't think there is a stronger word.

Astra is incredibly dumb and annoying to work with on "high" reasoning, for doing fairly well known distributed systems things, nothing majorly exotic, it still makes absolutely braindead decisions like deciding to re-use a random nonce field which I've already discussed with it that has a very particular temporary purpose and will probably be removed later, but it still thinks its a great idea to re-use that field not only as a different id in the same message, but to re-use it as the only semantic id for one particular type of sub message. This is when I'm walking it through an api design document and it has plenty of documentation plans it can pull in and a very clear direction of the project. If it was a junior engineer I was trying to get to help out I would probably get brain damage from the amount of times I'm face palming myself and I definitely would not hire them, and this is a small greenfield project with me going through it step by step. I did try giving it longer horizon tasks and had to throw out the entre work.

I mean maybe its a skill issue on my part, and I'm sure astra will get much better at coding but at the moment its useful in that I don't have to write the code or setup the build scripts or test fixture boilerplate but there is absolutely no way I can just give a (fairly well specified) goal and let it run and expect it to make good design and implementation decisions. Fable probably better but doing something outside of their training distribution that's not the equivalent to cloning an example unreal project or whatever is pretty disastrous unless you are directing it very closely.

The exception of course is, cyber , and its very obvious why. Its trivial to create RL environments that create bugs and then have an isolated environment and let the models try break it. This is not at all surprising, finding vulns and exploits IS just brute force work. That's why so many (blackhat/hardcore/unicorn-colored/greyish alien) hackers are basement dwellers. Its just a matter of putting in the time and mashing every combination until you find something that looks weird, spending days on that and then rinse repeat. It's brutally exhausting work that requires a certain level of knowledge and a shitload of determination and stamina and for humans, almost always an external source of motivation to keep going.

For humans that has always been a respected thing, dedication, determination, persistence, these are words we use for humans brute-forcing solutions and not giving up until they find the solution or die trying.

Personally I'm yet to see any evidence of LLMs doing anything interesting but (heuristically) brute-force problems and be very good at text and natural language to a level that is very very useful. I've no doubt that what we discovered with Auto Regressive LLMs is incredibly important so I'm not a skeptic, but I think its very hard to measure where we are with so much subjective information around.

I realize posting youtube videos that appear to be about 'creator beefs' at first glance may be considered low brow content for all the Jane Street or Palantir aspiring employees around here but such is life, you can lead a horse and all that. The world is made up of a bigger bubble than you are in but its still just a larger bubble with a lot of symmetries

We really need a change in mindset around what success means. Concentration of power, concentration of resources, concentration of market share are some measures of success. Out competing your rivals until you grind them into dust is some measure of success. This is the Peter Thiel and Bezos and to a large extent the ycombinator and PG philosophy of success. It's dressed up as "just innovation bro" whereas the truth is, innovation in a rapidly increasing technological society is certainly both broadly useful to everyone, but also, left unchecked, just a tool to be successful in ways that are, sometimes extremely, detrimental to society as a whole. "Disruption and Innovation" could go well past the lines that AirBnb and Uber crossed and achieve a lot more success.

Just on PG as a persona, I was never a fan or non fan I've barely read his blogposts and only know of him incidentally from knowing this forum, but on the general area of "thought leaders" and the increasingly asymmetry one-to-many relationships we have been getting used to for decades I came across this very interesting and well put together video here: https://www.youtube.com/watch?v=Dqh17U3tymU , give it 15 minutes if you do decide to watch it its a bit of a slow burn.

appreciate the input from someone who works in the codebase, but ok maybe tmux is openbsd secure, but it still has quirks and combined with agent harnesses not understanding them its a large attack surface Imo, what may be in inconsequential rendering artefact in tmux or inconsequential behavior on user input like scroll back or pane focus or whatever convinced with bad parsing from "acme client" program cant result in RCE, Id be more surprised if this _wasnt_ the case and tmux+acme clents have no bugs that can be chained, no matter how battle tested tmux itself is.

that just furthers my point, i was vaguely aware that it wasn't a full proof, but I'm not a mathathician, and that detail just re-enforces my point we are proving against human made axiom (certainty of numbers) which are almost certainly not fully correct, if what you are saying is accurate its less of a proof of navier-stokes and more of a proof that our base axioma are not able the model the output of a real physical process and are therefore incomplete or wrong.

also realized i posted this under the wrong story since the OP/story is mostly about human politics.

Who cares. the biggest thing about this is that its still brute force in a verifiable domain, and that it was still a human set goal.

I also don't believe it much practical use, unless I'm mistaken, approximations of Navier stokes have been available for a long time to whatever precision you need.

I'm not a complete disbeliever by any stretch , and also a complete amateur, but it was inevitable that these problems would be solved under the axioms that again, are human defined, under brute force. The real question is, are those axioms the bottom level, and if they are not, who is going to set the new aximons and can we understand them.

I've no doubt there's useful breakthroughs that will happen, but I think it should be remembered that the method being used is still a heuristic brute force approach is being very narrowly applied against axioms and math and physics which humans described in the first place, and almost undoubtably has errors and/or is not complete.

Its a great example of the power of LLMs but its not 'we've solved science now just pour more tokens in'

as I mentioned in another sibling, its because it's a very common denominator in high value targets. I didn't know its legacy was from OpenBSD but I really doubt that that helps it much in this scenario, when I say LPE I'm not talking about user to root elevation, I'm talking parsed text/control sequences to arb code execution in the user context. These will slip past llm classifiers as safe and I'm fairly sure that they are extremely common in codebases like tmux, despite them having strong security posture its just a threat that was previously a bit outlandish and not accounted for.

persisted malicious code running in your tmux process that you don't know about is probably not where you want to be, for obvious reasons.

the point is tmux is being used by many developers working in high value targets to automate long running unsupervised agent tasks. you don't need the user to execute code, you need _their agent_ to stumble on the wrong search result or github repo and it wont be noticed for hours that they loaded a persistent threat into your environment.

Whatever about the specifics of this bug and whether its a useful vector, this is not surprising even in the slightest?

My current opinion on LLMs is that they are superhuman in that they lack fatigue, they have close to full knowledge across all subjects which are known to humans at least publicly, and the fact that you can vibe code a harness to look for bugs in a famously complicated C codebase is intern level stuff and hardly news.

Smart aspiring blackhats will be targeting tmux next, both with light llm jailbreaks, light supply chain attacks (web search results) and LPEs within certain environments which weren't particularly useful before but with agents running on auto mode for hours become a very valuable springboard. I'm not sure on the quality of tmux code but I know its written in C and is very complex and was not at all designed to defend against this type of threat.

If you are technical and want root its very easy to patch a build of GrapheneOS to include whatever mechanism you want. You can even automate this to continue to receive updates.

I think the decision of GrapheneOS to maintain the attestation features and not providing user root is what gives it a fighting chance of being accepted as legitimate 3rd choice. See: Revolut and others adding GrapheneOS keys and trusting their attestation

Like or not, for most users, having root access is a liability, especially with more and more important things being held on phones . Someone downloading a photo editing app and then having a rootkit installed in the background that waits to empty their bank account is not a workable situation.

It's not circular, its just basic grammar, smooth, smoothly, spice, spicy.

the examples I used were not generalized in any way at all. They were specifically picked examples that were at or approaching the limit of the definition, which is is a well known way of examining things in order to model them better.

if you want a more specific and narrow definition for certain classes of XYZ, you can do that, I wasn't trying to do that here.

this is a willful misreading of the dictionary. you are pointing to habit being used colloquially as a short hand for addiction , which of course it is, as demonstrated through this thread, and is plainly obviously used that way to anyone who has lived in the last 50 years.

if you want to play pedant paddle, explain the relationship between the words habitual and habit, write an essay, and submit to webster, to oxford and any of your favorite dictionary and try and get them to change the the top definition of habit to be a synonym for addiction.

In the meantime I'll get on with my life because I know what I said was perfectly clear and accurate.

it absolutely is a habit, the fact that it affects you physiologically via pharma does not make it not a habit. a habit is something you do habitually, that is the exact definition of the word, and the reasons people do them vary wildly. I used heroin as an an extreme example.

Going for a 5k jog every morning is also a habit that affects your brain chemistry, through different mechanisms, and can also be addictive. It's obviously much healthier, but its still a habit, that is reinforced via brain chemistry rewards etc (addictive in some people). It's not as widely seen or known but there is a small cohort of people who exercise becomes a problematic habit and ends up being detrimental to their health.

I suggest you check the definition of the words. I specifically wasn't talking about addiction because that is just one axis of what can make up a habit. Drinking water is a habit that is not addictive but pretty hard to quit. If you take a wider view there are tons of habits that are either harmful or positive, but have no addictive component, and have no chemical component, and are either hard or easy to pickup / drop.

Agree with most everything and will check our that interview, that attitude is how I try and live, but the last sentence is obviously not true. Taking heroin is a habit, going to a gym is a habit, and obviously one is much easier to stop whether either willfully or not.

I'd say the ease which you can pick up habits or drop them is extremely variable across the specific habit and person. (as a different example, someone with less social awareness will find it harder to pick up the habit of being a hospitable host than someone it comes naturally to, but once learned its probably fairly easy to maintain)

One of my favorite quotes is, "first the man makes the habit, then the habit makes the man" , and it works both ways, good and bad. I really think this is something that should be taught much more explicitly in school to everyone, rather than leaving it only in places like sports and the military.

The mental model of how the law works that most people have is wrong.

The law does not, by default, prosecute all crimes. There is no country in the world that has even close to the law enforcement capacity to investigate and prosecute all crimes. What tends to happen instead is crimes that to put it colliquially, "piss off the wrong people" get prosecuted. ie, crimes that draw attention of either the general public or specific people in power.

A reasonable approximation is single digit or less of crimes get investigated and prosecuted, with it obviously being high for violent and visible crimes like murder and lower for less violent and visible crimes like stealing the office paperclips.

Another way of looking at this is, in the current system, if your house get burgled, you need to report it to the police if you expect anything to happen, whereas one could imagine another system where the police already know your house has been burgled and you don't need to report it.

my comment was tounge-in-cheek, pointing out that its essentially eugenics which is a controversial topic. although apparently less so when its applied to "Y chromosome holders" as you can see in a sibling reply where this particular group of people are deemed problematic and something that should be got rid of.

cool idea. once we have mandated ivf as the only way of conception we can probably start selecting sperm from populations with higher than average iq too.

gawd this is so misogynistic, some women like having men around, for whatever reason. perhaps we can keep a few around for women into that.

> it all rests on (relatively) simple mathematics. We know this is true. We also know that means it has limitations and can't actually reason information.

This was the statement I was responding to, it is stating that because it's built on simple mathematics it _cannot_ reason.

Yes we don't have a complete mathematical model of human intelligence, but the idea that because it's built on mathematics that we have modelled, that it cannot reason is nonsensical, unless you subscribe to a non-materialist view.

In a way, he is saying (not really but close) that if we did model human intelligence with complete fidelity, it would no longer be intelligence.

I mean some people have a definition of intelligence that includes a light switch, it has an internal state, it reacts to external stimuli to affect the world around it, so a light switch is more intelligent than a rock.

Leaving aside where you draw the line of what classifies as intelligence or not , you seem to be invoking some kind of non-materialist view of the human mind, that there is some other 'essence' that is not based on fundamental physics and that is what gives rise to intelligence.

If you subscribe to a materialist world view, that the mind is essentially a biological machine then it has to follow that you can replicate it in software and math. To state otherwise is, as I said, invoking a non-materialistic view that there is something non-physical that gives rise to intelligence.