mbac32768

Can't tell if Ubuntu is smart for deferring this patch until a bigger periodic release because there's no evidence it's been exploited and its exploitability is quite limited or if Ubuntu is dumb because there's a lot of publicity around this CVE and it comes off as failing to read the room.

Re: footnote 5

> This technically also means we have to trust the hardware, OS, OCaml compiler that the Rocq proof checker relies on.

It just so happens Claude and I recently did an independent implementation of OCaml and ruled out malware in the compiler bootstrap via DDC (and also by achieving byte identical outputs).

https://discuss.ocaml.org/t/ocaml-compiler-implemented-in-c-...

So, we can at least rule out "trusting trust" malware in the OCaml part of the stack and up. (Rocq does not have trusting trust concerns since it's implemented in OCaml and C)

Couldn't this be enforced at the router? Intercept outbound TLS. If the client hello is to a new domain, hold it and start a new outbound connection and see if the server responds with a certificate on the CRL. If so, ban it. Otherwise let the original TLS connection proceed.

Claude please rewrite my entire WordPress site as an OCaml Mirage Unikernel that runs directly on bare metal, no Linux.

I bet that takes a week at most.

It is using the search engine. The AI summary is run over the top 100 results for your query (or something)

The problem is they're just running a very dumb, cheap model on the results because running a smart model on every search result page would cost them infinity money.

These are great points. I would add that part of societal buy-in might involve driving the cost of hiring cars down by automating them, though I realize at the moment Waymo can charge a premium because people prefer to not have a human driver. Over the long term autocars should be cheaper than either Uber or owning a car yourself.

For starters, how bad do you think it would be to unplug all datacenters? How many people starve?

Yes. AIs are a lot better at coding than they are at writing. I author less than 1% of the code I push these days, but still write the grand majority of emails and posts. Probably I would do it 100% human if it was high stakes and I expected it to be read by millions.

Yes some of us are having a hard time with it.

All of the years we've spent on immutable by default, strong types and dreaming about the lambda has to matter! The AI that just rips out thousands of lines an hour of imperative and weakly typed code just has to be leading organizations to ruin! You'll see!

We worked hard at honing our craft. It's still meaningful, damnit!

Shouldn't tons of applications linked against musl be crashing all over the Internet if it can express this kernel bug?

Actually, if you implement a JavaScript runtime at all your choice is either too slow for modern web users or `unsafe` everywhere. Runtime values are often simultaneously either words that encode immediates or pointers to heap blocks and doing this the proper way blows up time and space. Doing it the fast way means you have `unsafe` everywhere and Rust's lifetime model can't help you at all. Everyone chooses the fast way.

Maybe Rust let's you encapsulate the unsafe a little better than C++ but the wins are going to be surprisingly small. If you had to build it today you'd maybe use Rust but the case for rewriting an existing C based runtime in Rust is not that strong.

Also for things like interpreter loops the absence of computed goto in Rust stable is a real performance killer. Explicit tail calls (the `become` keyword in nightly) work but maybe you don't want your big rewrite to rely on that.

> It’s there every time you meet someone new and one of their first questions is, “What do you do?” They’re not asking about your passions, your hobbies, or the mundane human tasks that take up most of your time. They’re asking how you make money. How you turn yourself into income.

For the longest time whenever I'd meet someone at a party I would ask "so, what do you spend your time on?" because I specifically didn't want to box them into asking how they make money. I wanted to hear about their passions or hobbies or even the mundane tasks.

Instead, pretty much everyone told me about their jobs.

GitHub is the worst place to host your code. Except for all of the other places.

I wonder if bong hits ever helped him with his Makefile.

Sounds a bit like surrender here.

There's no reason to read the code anymore.

The LLMs produce it inhumanly fast.

They can usually debug and fix problems faster than Haskell can compile the project.

Meanwhile the open source communities are in basic denial about AI, so trying to change things by making compilation faster or advancing a Haskell interpreter are going to meet with fierce resistance.

Whatever. Give up. Just ship Python.

I sympathize.

Lyme disease is not the only tick disease.

There's alpha gal (red meat allergy ) and also ascending paralysis. And more.

My child almost died from a tick. Other children do die.

I would gladly kill every tick on Earth and whatever relies on eating them so no human has to lose a kid to this again.

At the minimum I might say you only allow Chrome to access Google Workspace/SSO, which is needed to access like 95% of company resources. This is, in fact, the topic of the OP.

You can do additional device management to lock down the rest of the machine. You can force Chrome and restrict Safari/Firefox/etc on Mac just fine. Same for Windows.

It's possible some people thought they were there to move zines. But then there's this.

> In addition to the encrypted messaging group chats, Song, Arnold, Morris, and others met in person on July 3 at a "gear check" at Morris and Arnold's residence. There, Arnold asked Song whether they would be bringing guns to the July 4 action. Song replied that they would because he would not be going to jail. Song repeated words to this effect multiple times throughout the evening, putting everyone there on notice of his intent to shoot at police rather than be arrested.

Some of these people had to know they were entering an armed conflict. The fact that their leader went on to shoot a cop looks real bad for the rest of them tagging along.

This is the correct answer. Having your users run multiple browsers by default (instead of with whitelisted exceptions) is now multiple attack surfaces the org has to manage.

It's incredible how hard it is for firms to migrate away from platforms. Clearly you could just give something away for nearly free for 20 years and then jack the price up and make bajillions.

Even better if you can charge a mildly high license fee for 20 years first and then jack it up to something outrageous and still have customers who just can't drop you.

> Dr Newman showed that the highest rates of achieving extreme old age are predicted by high poverty, the lack of birth certificates, and fewer 90-year-olds. Poverty and pressure to commit pension fraud were shown to be excellent indicators of reaching ages 100+ in a way that is ‘the opposite of rational expectations’.

Blue Zones absolutely destroyed.

After spending years on end doing functional programming I used to stumble when looking at for loops until I got used to thinking that way again. It's funny how different the skills are.

Lisp actually kind of sucks and the community is insufferable but a lot of good things in computer science are unachievable without lambda calculus. Compilers, type inferencing, Rust's borrow checker, some parts of React, async/await desugaring all flow from monk-like practice of the lambda calculus.

You could possibly invent these things as a Turing machinist but it'd be by stumbling backwards into them and likely doing a shitty job.

probably the best use of s-expressions is as an alternative to json which you can implement in 50 lines of code

e.g. pretty good for config files or basic serialization

We're so close to realizing the answer was with us the entire time.

midwit meme template

guy on left: katie u want meet 3pm discuss project

midwit: Hi Katie, I hope this message finds you well and that your week has been off to a productive start. I wanted to reach out and proactively touch base regarding an opportunity to align on some of the ongoing project-related workstream...

guy on right: katie u want meet 3pm discuss project

The irony of these fancy FP languages that were designed to develop compilers or to get PL academics off is that they're actually also really good at the most mundane code imaginable.

Being able to minimize boilerplate and have strong refactoring and bug resistant types is a huge edge.

The only problem is their ecosystems are limited so you might spend more time than you like implementing an API or binding a system library.

Given this is "BBC Future" let me guess, barely above significance and n=16?

Yes, chronically disturbed sleep is the obvious confounder and is well known to drop T and explains the observed small changes a lot better.

> Not only does the US not respect the commitments it already agreed to, it hasn't done so for the past 10 or years.

These commitments were commitments by the administration in the White House at that time. They were not accords or treaties ratified by Congress. Agree with them or don't, they should have been understood as what they were: limited in legitimacy and free to be canceled by the next administration with no discussion.

This isn't a matter of arcane political skullduggery, it's spelled out in the US Constitution's definition of treaty, Article II, Section 2, Clause 2. The people were not formally heard.