sandeepkd

How would that change when support teams themselves are replaced by LLM agents

I think this is the key to some of this debate.

Management/Product/Product Engineer - When you are responsible for getting the work done then you look for any and every option to speed it up.

Owner/Platform/Senior Engineer - When you are responsible for ensuring it works and can be maintained then you have to pay attention to how to build it, aka the trade offs

You are running a machine with tons of vendor provided agents/scripts to do god knows what on a cloud provider which itself runs tons of agents/scripts to manage that infrastructure and then you expect to be secure.

And no, before the labs there was a degree of fear for everyone to hack into some one else system. With the labs changing the narrative, anyone can just blame the agents for the breach, whoever did it would only get fame and no blame

NK seems to be /dev/null for unresolved issues. Wonder if they receive any monetary assistance for taking all the blames

At this point it feels like they have made it a /dev/null for things which are not easy to resolve and one is still on the hook to provide some answers

It pretty much applies to everything, going along the tide is always easier

This is an interesting take, however from what I seen its other way around. Most security conscious operators would only allow IPv4 instead of IPv6. Your ACL rules and tools are still better at handling/managing IPv4 compared to IPv6

My working theory is that being able to understand a detail answer itself requires a certain level of understanding for that topic. In that absence of that it would throw off a big crowd which was hoping to find something simpler, something that aligns with their existing understanding easily.

There is a cost to produce something based on raw materials and then the possible price you can charge from the customer based on demand and supply.

The term Value is pretty vague here. Its more of a perceived value so its hard to put a number against it, there is no direct way to translate it to something more concrete.

May be bit orthogonal, one way I can think of it is to map to physical needs like clothing, housing, food and medicine?

In a company as big as Anthropic, moving at current pace, the person/team writing this article and the team(s) collecting data would be way distant. It should be more than obvious that the data is being collected in not just one place but many (different teams are looking for different gems in that data). What part is used for training, how and when would be spread across the company way too wide for anyone to confirm with certainity.

  On the IP side, About 6 months ago I used Claude to help me draft a patent application for something which I believed was novel, I verified in the USPTO as well. Then out of being busy I dropped that idea. Couple weeks ago I picked up the work again, verified with Claude for the problem statement to see if there is any existing solution. It suggested my own solution back to me which was surprising since I only use in browser and delete the history explicitly. I asked it for references or resources and it could not find any. That helped me to understand the boundaries bit better.

As of today the eco-system favors a VC backed company for visibility and more. Building a company itself is hard, bootstrapping it when there are VCs willing to fund you feels like an unnecessary risk.

For good or bad, thats by design. These is a significant portion of physical infrastructure associated with internet data flow. The only challenge governments face as of now is being able to segment the traffic to their wishes in its entirety.

Companies already control all the traffic flow on their infrastructure using end-point security solutions, the same can be extended at ISP level, and then Country level

Yes and NO. These are intermediate CA's and for them to be recognized by your browser or system, they need to be signed by another CA or root certificate that your system already trusts.

SO, not all CA's are signed by root certificates already on your machine

Its infeasible to have a test environment with 1:1 mapping to production for everything in any big enough company. Most of the times people practically aim only for certain critical components to ensure coverage.

On the contrary I have personally seen the attacks and the impact. My understanding was that CAs are required to do that by spec and Let's Encrypt already does that.

The Use case - Lot of SAAS based products allow/require the administrators to prove the ownership of a domain via ACME methods. The administrators then are allowed to manage the profiles for users that have email address with same domains in the SAAS product.

Ironically the testing setup itself used the network hack for the successful ACME challenge

I feel sorry for the teams at this point. These kind of incidents at this scare and frequency are bound to create an acrimonious environment where everyone would be looking for scapegoats on the pretext of finding root causes.

Feels good to see some one is enjoying and having fun with the tech

I read it and my chain of thought drifted in a different direction altogether.

Nothing exists in vacuum, the training data for the scenario came from somewhere. Its scary to think how many personal real world emails the model has been trained on.

Training on literature is one thing, but using the personal communications for training is going to open another pandora's box. Its just a matter of time when the guardrails fail and the sensitive data from those training emails start spilling in the output

Cloudflare is probably one of the most popular, reasonably priced for general public. You have fastly, akamai, cloudfront as other proxy providers and CDNs with similar capability but higher price point mostly catering to enterprise customers.

Bunny.net is another one that I find similar to Cloudflare from pricing and functionality perspective

I agree finding out who is writing that 10% of the code in the AI company is important. Maybe time to identity them and put them on PIP since they are slowing down everyone else and giving a bad name to the AI company

How does publicly published PGP based login sounds?

I am afraid there is no winning in either direction, you have to accept the plausible trade offs. Though on high level I do agree that it should not be centralized with one country at least. Then again the whole setup is based on mutual trust.

I do not want to be cynical, yet my reading is that they are most likely doing it already. This is to provide a legal cover to it.

You sold a tool to the user with a claim on how it would work. If the tool behaves wrong or does not works as intended then as a manufacturer you are liable for the defect/damage not the end user who used the tool.

Some how the Passkey topic comes up again and again. There is not much of a background information about the Author so its really hard to take that into context. Without knowing the agenda its hard to say anything concretely however most of the information presented is twisted in certain ways

A lot of people are aware of public key cryptography or asymmetric encryption, its already supported as identification & authentication method in sensitive places via MTLS. The whole idea of MTLS is about the server verifying the identity of the client and one of the core concepts is validating that the client certificate is issued by some Certificate Authority that can be trusted by the server. Its Phishing resistant, meaning some one cannot trick you into giving them the your credential that they can use by accident. The client certificates could be baked into physical devices (PIC, CAC cards) or Digital certificate on your machine. MTLS is used universally for machine to machine communication, however there is a certain degree of complexity so its not used everywhere for user identity.

1. FIDO is trying to leverage the same concept and trying to make it bit easier for use compared to MTLS. The core idea is to just use it for authentication not identification. It allows the user to authentication as long as the client can prove that they have the private key for a corresponding public key

2. Passkeys were/are target for Enterprise/Workforce users. When a consumer account is hacked the impacted user is just the consumer, whereas when an Employee account is hacked the entire company is at risk.

3. Passkeys/ (WebAuthn+CTAP) have been there for a while. Its still still evolving and everyone (platforms, Browsers, OS, Password managers, IDPs) wants to get something out of it which keeps on making it more complex

Since the client/authenticator is storing the private key, its important to ensure that they are doing it in a uniform and secure way. The authenticator implements a protocol called CTAP and they are supposed to conform to certain tests. The attestation is a means to ensure that the authenticator is doing the least minimum from security perspective.

Personally I do not like the idea of centralization, however as long as the path to attestation for different passkey providers is not locked I would say the attestation is a part of security.

At the same time the things I would worry about would be if the Authenticator provider starts generating a unique attestation for every user in customer identity space (its almost 0 cost in case of software based authenticators). A unique certificate for every authenticator instead of a batch one is where the privacy would be leaked, its akin to fingerprint. Some big companies are already doing it for their employees, thats a valid use case, employees unfortunately do not have a privacy when they are acting on behalf of the company

so the grapes are sour for some after all

Its interesting to learn them trying to implement the open vSwitch in python. I worked on implementing the open vSwitch in Java some time in 2014ish too. Open Stack had a lot of push back then. It was fun to gather the requirements by reverse engineering the original product based on the network traffic for something which is a middleware and has a state of its own

I agree thats more appropriate. There is nothing AI here, its just simple automation. Couple things that are probably applicable in this case or cases like this where royalties are earned based on assumed advertising traffic

1. There is no way he the the only one or first one. Chances are that more than likely he was subscribing to some third party services which were offering this feature.

2. He probably took it too far to get noticed and get in limelight

Of course not, guess you meant that as a satire

> https://www.githubstatus.com/ Their status page records the outage anywhere between 6 to 17 minutes across the different features. The detailed status page clearly has recorded time of when the errors were escalated, when the fix was applied and when it was assumed that the system has recovered. Its clearly a lot more than 17 minutes, infact its more than an hour.

Unless there is something more to it, these status pages feel like a blatant lie, wondering how long before some one actually sues them cause they are publishing/advertising wrong SLAs.

Another example

> https://www.githubstatus.com/incidents/0rn90wk115q9

> On September 13, 2026, between 08:43 and 10:44 UTC

The status page records the incident outage duration as 1 hour 12 minutes

My hunch is that in the long run its going to be net negative in software. A lot of companies exists as of today cause a lot of people were able to just focus on building without constantly worrying about the fear of lay off. With the concept of job security based on talent and effort being dismantled, everyone would always be in a constant look out mode now.