throwawayffffas

As the days pass the probability of it being actually used is increasing. The EPSS score is clearly just an estimate, and according to the nist cve database, attack complexity is low so I would take the EPSS score with a grain of salt.

> I read the whole post and still don’t have any idea what it is and how severe it is.

From the article the bits you need to know:

1. CVE-2026-98432 is a critical (CVSS 9.8) bug.

2. Anthropic says it built a working exploit that gets root on a server.

This is a major failure on Ubuntus part. The constructive feedback they deserve is literally the title of the article.

The post gives enough detail, there is a vulnerability that allows root access on servers on the TCP stack, so literally accessible if you are running any service. There are exploits in the wild. Debian has the patched kernel, Ubuntu does not 2 weeks after the CVE is known.

> how critical it is,

9.8 out of 10 btw.

> how it is impacting them personally,

They are clearly rather upset by the lack of an appropriate response.

> how vulnerable their servers are,

They are literally open to anyone with an AI subscription.

> how they are working around it.

They are migrating off Ubuntu.

Surprisingly few pictures of the facilities interiors.

Hates users who are not total normies and designed explicitly for normies are not opposite. In fact an app that hates not normies would be designed for explicitly for normies.

> Easily? There's no easy in maintaining and releasing two different versions of your app, especially for a small non-profit.

It's literally just another job on your CI. They got a 50 million seed donation in 2017 and reported almost 30 million in revenue in 2024. They are not exactly small. If they were VC founded and not a non profit they would be a unicorn.

I remember SO answers almost always looked superficially correct but were almost always wrong in a nuanced way that required experience to divine. Kind of like circa 2025 chatbots.

But at least we had fun who can forget stacksort.

Because they are swamped and want to automate some of the process.

The way I see it the devs that put that in place are saying, listen before even reading your contribution I am going to feed it to a LLM with these instructions and see what it spits out. Now I will extricate my self from being the LLM proxy so you deal with this output and when it's okay I will look at it.

Same as "listen bud until it passes linting I won't even look at it." Just a much more flexible and fuzzy linter.

Eh, you read compiler and linter output don't you? Nobody read that before you did.

Sure LLMs are not nearly as rigorous about their output but that doesn't mean it's entirely not useful.

At a minimum you can have your LLM summarize the other LLMs output and go from there.

I don't know what you have to do in terms of letting the grid know. But local authorities have stringent regulations about installation and almost definitely require permits and installation or inspection from vetted electricians.

The question is not around classification but of ownership and especially of the ownership of the documents after the president leaves office. The argument is that the documents generated during the presidency are the personal property of the president.

My hypothesis is not that the AI is going to eat up that 12T dollars. But there will be additional investment to provide AI tools to the workers to the tune of 10% to 20% of their salaries.

I think the market has the potential to be 1 or 2 trillion in the US, 10% to 20% of labor costs. I say this because I believe most companies would not blink at spending that money to supply their workforce with AI tools assuming the AI actually did the work.

The winner take all network effects are probably not there in this case, but still if Anthropic is a large player and has 20-30% of the market they could have a revenue in the hundreds of billions.

Double the size of the market to include most of the rest of the world and the 500B is suddenly under 20% market share.

The money is not on the casual users, the money is on the lawyers and accountants, and consulting specialists that have actual business use cases.

If you are spending 50 - 60 grand a year on a paralegal will you balk at another 5 or 10 that will allow them to do double the work?

I think you are underestimating the market for AI. The better it gets the more the market expands.

The total amount spent on salaries in he US alone is over 12T dollars.

Assuming AI becomes ever more useful and is widely adopted 500B in revenue is not that crazy.

The way I read it, it does. It looks like total revenue vs total compute expenditure.

Just renting them out as hardware is close to 12 months.

> Will future cheap compute power be able to overcome this? I'm not betting on it.

Famous last words. https://en.wikipedia.org/wiki/Bitter_lesson

Also did you not see the quoted post at the end, they are already training ai on running material science labs so we are quickly moving away from the non-expert.

Given the interest rates a valid explanation is that we are not done with the employment contraction still.

But it looks to me that the layoffs are due to AI but not because the positions are replaced, because capital is flowing to hardware instead of new hires. The growth engine of the tech industry used to be people, now it is clearly gpus. If you have 10 billion in the bank you are not going to aggressively expand your workforce, you are going to build datacenters.

He is surprised because he has misunderstood the bitter lesson.

The bitter lesson tells us that general _approaches_ outperform domain-specific understanding.

That doesn't mean a general model will outperform a domain specific one.

https://en.wikipedia.org/wiki/Bitter_lesson

Ok first of all. benchmaxxing, is not a well defined term. It's a word made up by the twitter/reddit crowd to describe overfitting.

That is not overfitting, that is training for a specific task. The measure for overfitting is how well it works on previously unseen data, hence the 200 test images removed from training and validation. That set serves as a second order of validation for the researchers to check themselves they have not overfit the model to match only the training data.

How are you going to get people to care if you are barred from sharing it on reddit?

It's not self correcting indeed because there is no correct state.

Sure the preindustrial environment was cozy for cute and fuzzy things and ourselves.

But you are greatly underestimating life if you think we can kill it all off. Sure it might be slimes and jellies and fungi for a while but life has been there before.

They don't care at all. For her it's potentially six years in prison, for the cops, and the prosecutor it's a small potatoes case on a random Thursday.

The plea deal offer kind of says it all, if this reaches the court it will either very quickly be thrown out or they may drop it because it's not worth the time.

The problem has always been that code is malleable for all including those that think that have great code comprehension but actually don't.

The main difference is that most of the big players have physical presence in the UK. You can't argue British law does not apply to you when you have a campus in Kings Cross.

> Without further sandboxing, it would execute as the user with access to everything for that user - which in practice means mostly everything.

Which is fine and the reason behind qubes OS decision to have passwordless sudo enabled on qubes.

Just use qubes OS.

It's above reckless, in other legal systems there is a level above gross and reckless negligence where the prosecution argues not only they should have known, in fact they did know and chose to proceed anyway.

From Jehovah's witnesses to Scientology, and certain strains of evangelical Christianity. God (and aliens) is still a very export oriented industry in the US.

It's more like if you think Trump is likely to say, actually that's my gold.