kbenson
They are the premier manufacturer of electronics that power all the current AI. Why wouldn't they be contributing heavily to the space?
Finding an exploit and publishing is is not against the law. In some cases, publishing immediately is the responsible thing to do. For example, when it's actively being exploited in the wild, and waiting just puts people at risk that don't have any recourse to protect themselves, since they don't know they're at risk. There can be nuance to that as well, but in general, as soon as it's being exploited, anything that makes it harder for end users to a) know there is an exploit, or b) tell if they're susceptible to it (e.g. through a POC) is just taking away people's ability to take the action they deem appropriate.
This is one of those things that might be best solved through policy and law. There probably will be some changes to policy and law to help, eventually. That stuff usually takes a while, and that's always been a problem for those suffering in the interim.
If you're aiming for the top, sure. There are plenty of people who make a living doing stuff like that and are happy because they enjoy it. You're unlikely to be one of those people if you move to an area where there's an extreme over-supply and try to "make it big", or try to be "pure" to the art and eschew commercial options. e.g. An actor in LA, the starving artist in a loft in NY.
> Therapist might make out well for a bit, but it seems like a loaded term these days .
Loaded how? I was thinking of psychologists, licensed mental health professionals, physical, occupational, and speech therapists.
I don't think you and GP are actually saying anything different. I interpreted their statement 'The researcher should first ask "would I feel comfortable testing this in a voluntary human test subject?"' not to mean don't test on animals if you wouldn't on a human, but to use your reaction and feelings to that to guide your judgement, and help judge what type of animal testing you're at, not to be a binary switch of whether any animal testing at all should be done.
> Did someone not understand what went in?
Unlikely, from the context.
> Might someone have offloaded their thinking to some external tool?
No, according to the author, since the features predate most current LLM assisted coding.
> Did people stop caring?
I'm not sure what this means. Presumably things were reverted because people cared enough to make sure it was good quality before being released.
> Did someone not plan or design a feature in full?
An admitted possibility
> Were the timelines unrealistic?
Depending on what you mean, that may be correct according to the article, but I suspect not in the way you mean.
> Maybe with so many reverts timelines should be revised?
It sounds like there was a very large increase in load in some of the people that would commonly review during this time period, and that may or may not continue to happen to a greater or lesser degree in the future, it depends on how LLMs advance in finding bugs and if there are other large waved of bugs reported.
I doubt most people will be developing a rapport with an AI agent trying to sell you that contract at work, or helping you when you're irate and have escalated a problem a few times.
It's the trivial cases that are compile time. The interesting templating is done with input that isn't defined within the source, and those can't be run entirely at compile time.
> And you automatically get things like safe SQL queries with parameter binding instead of injection vulnerabilities.
That's been solved for decades with parameterized queries (binding variables), and doesn't require interpolation in any way (at least not in the context we're using it here, but probably not at all in most DB drivers and engines). In fact, I would go so far as to say if someone is trying to use string interpolation instead of parameterized queries to avoid SQL injection, they've fundamentally misunderstood the problem and are trying to solve it at the wrong layer.
Also, if the string interpolation for the query is done at compile time, what type of content known at compile time is something that we'd be worried about SQL injection being in?
phpBB will assign you a randomized session if if you visit it anonymously (without logging in), and will serve the page to you with that sid param added to all links. Using that link will load a page without the sid param appended to links, because the system assumes you have a session I'd saved in a cookie since it saw you have a sid, even I'd you don't have/didn't send a cookie with it. Following any of those links starts the chain over if you aren't sending a cookie along with a sid, which the AI scrapers never do so they can't easily be blocked by that, and a new unique sid is generated, and all the links have the new sid appended.
Every page with a unique set of params and values needs to be investigated, because it can be an entirely different page, so AI scrapers will scrap forever, always finding more and more URLs to harvest, even though they're all duplicates of what they already have. It's easy to have multiple scrapers stuck going through a very small bulletin board continuously.
Maybe they've gotten smart enough to deal with this situation in the last few months, or maybe they put in a specific workaround. I ended up just throwing the site behind cloudflare because spending time trying to outsmart AI agents in a battle of escalation doesn't seem like an effective use of my time.
Any answer to that along the lines of "do something more complex" or "optimize your site for load" to be able to deal with the rampant bad behavior of multi-billion dollar companies is unpalatable to most.
grammar IniFile {
token key { \w+ }
token value { <-[\n;]>+ }
token pair { <key> \h* '=' \h* <value> \n+ }
token TOP { <pair>+ }
}
my $text = "user = alice\nrole = admin\n";
my $match = IniFile.parse($text);
if $match {
say "Parsed successfully!";
}
If you're not looking for that, and more specifically what you have shown above, there are often ways to accomplish that in certain languages. In Perl it's easy because you can use regex cars in a regex, so you can just assign `my $digit = qr/(? :0-9)/;` and then use it in the regex as you did (and Perl already supports non matching whitespace with a flag). For that matter, Perl regexes allow you to define chunks purely within the regex to be reused in a DEFINE block, so possibly that is a feature other regex engines have as well.
Also, I imagine some dentists might decide for their patients benefit (as long as there's no pain reported) to let a couple develop to a level is there's a few in various stages of development, so they can do them all at once with a single procedure.
I don't know how likely or accurate those are, but those are some of the obvious ways that came to mind that dentists might be seeing the same thing and suggesting different actions that don't boil down to them wanting to fleece a customer.
...but, if your goal is really verifiable state, why don't you just use image mode linux with bootc, since it provides much of what you're looking for, except to a higher level. All your arguments for NixOS so far apply to that as well, but there's even more immutability and verifiability.
Also, are you pinning your package versions in your config? For every single case of that, is the original package still available? Were they coming from remote sources which may not keep prior versions always available?
Did you build anything from scratch? Did you supply a source or binary archive to install from? Is that source still available, of the exact same version?
There are numerous things you need to worry about when rebuilding from what the state should be based on a description of that state (which may include arbitrary actions), as opposed to restoring from a recorded state that includes everything needed in the recorded data.
The more you can record the better. Should you also record nix configuration state and use that to restore when it makes sense? Sure! If it's simple and easy and doesn't use an inordinate amount of space, why wouldn't you? Just don't confuse nice to have with sufficient based on the specific requirements and goals your backup system needs to meet.
We have entire system images in an immutable remote store, but that's not what we go to first, it's what we go to when our quicker and easier systems are insufficient. If we were running NixOS, we'd probably keep everything we're doing now, and then also just add the NixOS state as a separate thing that's backed up and saved on every change (and in fact, along these lines, we also run etckeeper on every host and track all changes to /etc with daily commits if something is changes but also an automatic commit at the beginning and end of every ansible run we do that applies our host configuration).
More is better. If I want to see configuration changes, I can usually just look in etckeeper on the box, if I want to restore a tree to the exact state it was at a specific point that a backup was made through rsync, I can do that easily enough (or just navigate the directory tree on the backup server, if I just want to see what it was, or diff between different states at different times). If I need to restore the whole system image from a known good backup, I can use Veeam and the local repository for that. If the local repository is dead, I can use the replicated off-site repository. If an attacker has destroyed both those, I go to the immutable off-site backups, which I'm probably doing to use after rebuilding my backup infra from scratch to restore from. Each of these protects from slightly different scenarios, and offers different trade-offs for security and integrity and ease of use.
I too can entirely rebuild many systems simple from kickstarting a new one and applying an ansible playbook. Do I want to? No, that's too slow, and I might be doing this operation for tens or hundreds of systems.
We have multiple levels of backups. We use veeam for VM and physical backups of the entire system to a disk store that's also shipped off-site to an immutable store, but we also run an older system based on rsync which rsyncs the system to directory on a server (sans some data directories) that uses snapshots to keep space usage minimal for the purpose.
In many cases, if we want to restore we can literally just rsync data back to the host, whether one or a few files or most of the system.
I can restore many types of failures within seconds or single digit minutes at most, and the time required is mostly unattended time. Time to restore is often an important and overlooked metric, until you've been bitten by it and realized that an hour or more of work from a person to restore something doesn't scale well in some scenarios, and those are often the most important ones.
Being accidentally correct is only barely better than being wrong, and for many uses (such as when the reasoning is extrapolated and used elsewhere) is no better at all.
That may sound reductive and dismissive, but I think that's actually pretty cool and likely to make some things a lot easier.
I see this all the time now with LLM generated output. It's easy to have an LLM generate a chunk of content that can be dropped into a chat or comment, and when it took you 20 seconds to have something written up based on the shared understanding you and an LLM have about the context of the situation, but it takes other people 3-5 minutes to read and understand that content, that fundamentally doesn't scale. It's bad enough when one or two people are doing it, but if the whole team is doing it, the only way to keep up with the stream of information is to also consume it through an LLM. At that point you're likely to be missing much of the nuance, and the amount of errors will explode.
This can be alleviated by people reviewing the output of an LLM and making sure it both includes fundamental information that might be assumed by context and reducing it to the parts that are essential for the new context it's in. This takes time, but is extremely important.
Having an LLM write gobs of text to send to other people instead of doing it yourself is the equivalent of a low yield cognitive zip-bomb. Don't do it.
I don't have too much experience with them, but I thought the ultrabook category was the answer of the rest of the market to the Air, at least.
I'm not sure the problem is that nobody makes the quality hardware, but that maybe it's just as pricey and that nobody trusts the companies that do the same as they do Apple to buy it at a large premium. Many companies have the ability to put together something of a similar quality and sell it (even if not at quite the profit, still probably some profit), but are you going to trust an Asus or MSI product that costs the same as the equivalent Apple product to have the same quality? Perception is important here. MSI or Asus could put out something better than Apple if they wanted to and didn't care about the cost, but I doubt anyone would actually believe that it was better even if they did (and even if they like it initially, they may suspect it won't hold up over time). Such is the power of the brand Apple has built, and that's in many ways more important than the actual quality they provide.
I'll admit, it never once occurred to me that people might be using censored characters to provide more emphasis that a word is a swear, but I guess it does indeed do that, at least to the writer. Whether that comes across to the reader, and whether the writer cares that their intention was understood... I'm not so sure.
Step 2: Open source projects implement whatever they want. Preferably, they provide a framework that allows high extensibility, if the software provider didn't already.
Step 3: People download and install open source plugins that violate stupid patents. It's still a patent violation, but as long as the people providing it aren't profiting monetarily, the ability to recoup damages from lost profits or royalties is very hard.
There's some nuance there, and different ways it could (and should) be done to avoid most consequences, but not so long ago (maybe still?) people commonly combined codecs and software from different parties for ffmpeg, which to get around some issues with distribution refused to compile the source and provide a binary, because that would make them a target, but just the source didn't (to a greater or lesser degree).
Where there's a will there's a way, and if a company is going to obtain stupidly simple patents which they often claim is to keep other companies at bay, we can put that to the test. If they go after individuals for usage, pressure them.
If we're lucky, what we're seeing is an ebb and flow between open source and the companies that capitalize on it, and we're in the ebb. I'm hoping for the flow.