orf

That’s ridiculous.

Someone made a good point on a previous comment like this: the main selling point is the public can’t destroy them

> Instead, labor and computing power are being diverted toward a singular “frontier-model effort” led by Pieter Abbeel

Strange headline given that it seems they are actually just refocusing resources to train a frontier model?

The language forum is the place to start- you should already have a thread there gathering feedback before writing a pep?

anyone who has ever worked at a large non-technical company can tell you exactly where these requests came from

It then wouldn’t be the most secure consumer phone then, would it?

It’s crap, sorry. It’s an inconsistent mess. Having come from iOS it’s as clear as night and day.

It doesn’t really matter to me if there’s some other specific version of Android that fixes some issues if I install it. As a user that’s not something I care about.

Having been given an android work phone, I can’t understand why anyone would use this willingly.

The desirable outcome for most people doesn’t seem to be the ability to run android on an iPhone, let’s put it that way.

So it indeed wasn’t the point then?

Could you point to the part where I said revocation as a principle is a bad idea? Rather than what I actually said, which was that untraceable random third parties revoking your keys without any involvement likely isn’t a good idea.

Also GitHub doesn’t revoke the keys. The providers of the key take provider-specific actions, which may or may not be revocation.

So… yeah.

I agree, but that wasn’t the point at all was it

Can you point me to where I said I had an alternative? Or any rules that say you can’t discuss an ideas flaws if you don’t immediately have an alternative?

The status quo is clearly the local minima, given the myriad of trade offs and different parties involved.

This is so stupid. It’s pretty simple: malicious actors will use it to do all of those, plus now they can unilaterally bring down a system via revocation.

Non-malicious actors using it to bring down a system via revocation are therefore indistinguishable from malicious actors. It’s by definition a malicious act.

That’s why it’s a stupid idea. Non-malicious actors should just contact the company and let them take action. It’s not for an outsider to decide the impact of a leak.

Credentials published on GitHub are not automatically revoked - what happens is at the discretion of the provider, for precisely this reason.

For example AWS applies a “quarantine” policy that prevents some specific actions[1].

Allowing anyone to report a potentially compromised key is one thing, but allowing anyone to unilaterally revoke a token is another.

1. https://docs.aws.amazon.com/aws-managed-policy/latest/refere...

Read the thread?

> I think every API key system should have endpoint "invalidate_api_key"

Not this.

Are you really unable to imagine a situation where financial or physical harm is caused by a system abruptly being shut down by a credential revocation, triggered by a random person on the internet?

Be serious.

And the whitehack hackers finding keys should do what, exactly?

Unilaterally decide they should be revoked, without contacting the owner?

And that’s not malicious?

Think that through - the person who stole the key has the decision to use it or revoke it through this hypothetical system.

If they are acting maliciously, they will take the choice that most hurts you and/or benefits them.

If the key is useless to them and revoking it hurts you, then they would do that.

If the key wasn’t useless to them, then… they would just use it and not revoke it?

How does that make any sense?

Of course it is? A key for some weather API getting leaked isn’t the end of the world, but having it revoked and breaking your weather app is.

That just turns a credential leak into a denial of service - one that can be triggered from anywhere.

This is an amazing site

> Pascal’s Mugging and Why I Gave an Escort My Son’s College Fund

https://morewrong.lol/?post=pascals-mugging-college-fund

Rather than post incessantly about the vague “across the board data” and “probably X and Y” you could always cite a source.

Just a thought.

Industrial usage fell about 100k TJ, household fell ~110k TJ since the peak.

The linked numbers are not per-capita, they are absolute.

That’s a different metric - “million tonnes of oil equivalent”. That’s not the same as electricity consumption - that’s the total amount of energy used in all kinds of industrial processes.

That’s both not what you said, and not how energy generation is measured.

> Chernobyl failed when operators attempted to raise the generator output from 4 kw/h per capita to 5.7 kw/h per capita

How silly

> Probably less than 20% of that curve is 'green good news'

I would call this a basic misrepresentation, but you just pulled that number out of thin air. Or somewhere worse?

50% of the decline is from industry, 50% from residential[1]. During that timeframe, industrial output increased.

1. https://www.iea.org/data-and-statistics/data-tools/energy-st...

Interesting - I had never associated the rate of energy consumption with jingoism, but based on some of the comments here it clearly is.

I guess it’s sort of a “I drive a large inefficient car and that’s a good thing” kind of situation? Excessive unnecessary production and consumption is a positive trait?