scandinavian

I'm not a big user, but I have been doing some vibe-ish coding for a PoC the past few days, and I'm astonished at how bad it is at python in particular (Opus 4.6 High).

* It likes to put inline imports everywhere, even though I specify in my CLAUDE.md that it should not.

* We use ruff and pyright and require that all problems are addressed or at least ignored for a good reason, but it straight up #noqa ignores all issues instead.

* For typing it used the builtin 'any' instead of typing.Any which is nonsense.

* I asked it to add a simple sum of a column from a related database table, but instead of using a calculated sum in SQL it did a classic n+1 where it gets every single row from the related table and calculates the sum in python.

Just absolute beginner errors.

Just look at the commit cadance, the bulk of the 8k lines of code was added in a couple of hours. Most commits 2-4 minutes apart. This is 100% vibe coded and it's pretty obvious.

> It doesn't show any obvious indications of being AI.

I agree that he probably asked the AI to omit some common AI tells, like excessive comments, verbose readmes etc.

I did a cloc check on it and it does seem to have 800k lines of typescript. So unless they are vendoring dependencies it's actually as insane as it sounds.

5 day old repo, 2000 stars on GitHub, 400 total weekly downloads on npm. Frontpage of hacker news with a bunch of weird comments. Moderation has been lacking recently.

I don't read a lot of papers, but to me this one seems iffy in spots.

> A1 cost $291.47 ($18.21/hr, or $37,876/year at 40 hours/week). A2 cost $944.07 ($59/hr, $122,720/year). Cost contributors in decreasing order were the sub-agents, supervisor and triage module. *A1 achieved similar vulnerability counts at roughly a quarter the cost of A2*. Given the average U.S. penetration tester earns $125,034/year [Indeed], scaffolds like ARTEMIS are already competitive on cost-to-performance ratio.

The statement about similar vulnerability counts seems like a straight up lie. A2 found 11 vulnerabilities with 9 of these being valid. A1 found 11 vulnerabilities with 6 being valid. Counting invalid vulerabilities to say the cheaper agent is as good is a weird choice.

Also the scoring is suspect and seems to be tuned specifically to give the AI a boost, heavily relying on severity scores.

Also kinda funny that the AI's were slower than all the human participants.

> Otherwise please use the original title, unless it is misleading or linkbait; don't editorialize.

https://news.ycombinator.com/newsguidelines.html

I think a case can be made for it being slightly misleading. Also there is not mention of title length that I can see.

Denmark has several oil and gas fields. It's tiny compared to Norway but not completely insignificant.

That requirement was removed in 2017 by the right wing government at the time. It was a populist move to secure the elderly vote.

He's not helming javascript in any way or form or even contributing to the standard to my knowledge.

> Stop branding not willing to take a drug that did not go through standard vaccine approval process as anti-vaxx.

That's not why he's anti-vax, I never said that.

He's also an avid anti-vaxer and covid conspiracist. Does it matter? Not sure. I will personally not touch anything he is helming (brave).

> Even the infotainment system, which a blind person might want to use, for example when waiting for a sighted acquaintance in the car, does not have a screen reader and is not in any way usable.

It has really excellent voice commands for pretty much any function though. Sadly it can only be triggered by pressing the right scroll wheel on the wheel. While possible to just reach over, it's probably not optimal for your suggested use case.

wss://sydney.bing.com/sydney/ChatHub

This is using Chrome.

Yes, there's a websocket that contains all bing chat communication.

> (On a side note, Bing chat already knows now that she won the prize. Color me impressed.)

It actually doesn't. Bing searches for your query and uses plain old search results as extra context for the actual LLM. GPT-4 still has the same knowledge cutoff as when the model was last trained.

Here's what it feeds to the model when searching for "nobel prize in physics 2023":

https://pastebin.com/raw/MhW4EmTx

Here's a chart per capita, which is often more interesting:

https://ourworldindata.org/grapher/solar-electricity-per-cap...

You can just use LD_PRELOAD to load your own version of ptrace. Not as stealthy though.

Airlock is not using anything as far as I can tell, they are warning their customers that if they are using old binaries, that are signed with the revoked key, that airlock or windows (unsure) will now complain about it.

> Over the coming months Airlock Digital customers may notice an elevated occurrence of files reporting ‘(invalid certificate chains)’ over the coming months, for software that was signed between 2006 – 2017 with revoked certificate chain.

As Airlock seems to be software intended to allowlist the execution of binaries, it would make sense that they pick up on the user running binaries signed with revoked certs.

> Taking measurements on the "12V" line and seeing voltage dips as low as 2V. Watching this voltage-dip propagate over to the 1.65V reference voltage used by the TI and STM32 chips's ADC.

Did we read the same paper? He takes no measurements, everything is based on theoretical assumptions, schematics and the three youtube videos he mentions in the beginning of the paper.

From the paper:

> The enclosed paper proposes a simple test that can be done to prove or disprove the explanation provided. This test has not been done by the author because of the cost involved with acquiring the needed Tesla Model 3 inverter PWB.

> The details of Tesla's Model 3 inverter design as revealed by Irish engineer Damien Maguire have been presented. These details were used to construct *a hypothetical model* of all hardware and software operations performed on the two accelerator position sensor (APP) sensor signals inside the inverter as they pass from the APP sensor to the electric motor controller.

He doesn't have access to the parts in question nor the car in question.

Also of interest is the authors own comments on his previous papers about sudden unintended acceleration:

https://www.autosafety.org/wp-content/uploads/2022/01/Note-t...

That's my fault for writing minor, as that's what it would be in semver. I should have written feature release.

You can read the release process here.

https://docs.djangoproject.com/en/dev/internals/release-proc...

Not sure how this conversation is productive, but there's never been a X.Y release of django without noted backwards incompatible changes to my knowledge. Just imagine that djangos X.Y releases are semvers major releases, not much more to it than that.

The application is not distributed via pypi, nor is it installed as a package and thus have no setup.py file.

> A requirements.txt file is for "freezing" and fully reproducing an environment (ie. in a virtualenv or docker container).

No, it's just for specifying which versions of packages should be installed by pip. There's no such concept of a lock file with pip. Poetry and the likes have lock files though.

> How do transitive dependencies in the Python ecosystem work, then?

Not very well.

> how do you prevent everything from grinding to a halt?

I don't have a good answer for you.

> Is there no semantic versioning?

You can read django release process here [1], not sure how it's relevant. I'm not the maintainer of django, but of a project using django. Would it be better if all software was perfect, had no bugs and used perfect semantic versioning? Yes, I would say so. Is that a requirement for using nixpkgs?

> Nixpkgs has its reasons for minimizing redundant packages, however it is certainly possible to package your app with Nix and use the exact specified dependencies.

I'm not packaging it, someone else is, it breaks and they come to the project to raise invalid bug reports.

[1] https://docs.djangoproject.com/en/dev/internals/release-proc...

I get what you are saying, but nothing you said works in practice for python packages, so not sure that I actually learned anything.

Is it fair to summize that python applications with python dependencies do not really work well as nix packages and shouldn't be used?

Now that we have another Nix post, maybe someone can enlighten me about something I've been wondering about.

I'm one of the maintainers of a popular django application. Someone made a nix package of the project, but we've now twice gotten invalid bug reports from people using the package because the package depends on "django_4" and whenever someone updates that nix package, the package for our project breaks.

Of course we, like all other python projects, don't support using other dependency versions then the ones in the requirements.txt file. So when someone just uses a different minor version of django, stuff breaks. What's the disconnect here? Why does all nix packages that use django_4 need to use the same version, that seems super prone to breaking all kinds of stuff. Same for the other 35+ dependencies that run arbritrary versions instead of the ones defined in the requirements.txt file.

I really think they are just misunderstanding something. When I look at my profile, there's no comments, but I know there should be some. Isn't it more likely that when a subreddit you posted in goes private, the comments don't show up. The people in the linked thread ran the delete script after some subreddits went private. Now when some are made public again, so are their comments. Comments that were never deleted with the tool as they were hidden because of the subreddit being private.

CS:GO and other source games have had loads of serious vulnerabilities. I've found a few myself just by looking at the leaked source code:

https://github.com/perilouswithadollarsign/cstrike15_src

The engine code is very old, and CS:GO itself was not developed by valve but by Hidden Path Entertainment initially as a port of CS: Source to consoles and they didn't really do a great job.

I've been on adalimumab since I was 19, I'm 34 now. Treatment for Crohn's disease. I've had the talk with my doctors multiple times about what we do if the treatment stops working, and they always reassure me that there's multiple other options these days.

It has not been available, it was just released, hence the news being submitted here. Before this the only way to use it was to just take the dll from Portal RTX and try to throw it at old games hoping it would work.

I think it works something like this:

* A search query is generated from the input question.

* A standard bing search is made in the background and the resulting search results will be used as context.

* Pass context and question to GPT-4 and generate the answer.

An example of what the query generation looks like (the "searching for" line):

https://i.imgur.com/mj6ogdg.png

> OK, so if google is training bard in real time

Is that what is happening here? I assumed that both bing and bard worked something like this:

* Take the user question and run it through a GPT like model to generate a search query.

* Search google/bing with the search query and get the top-x results.

* Take the results and append the original user question with some additional prompt glue like "Given the following search results: SEARCH_RESULTS - Generate an answer to the following question: ORIGINAL_QUESTION.

I'm not sure it's technically feasible to live-train any of these models.