unddoch

I want to first say thanks for engaging with me on this issue so directly, much appreciated.

As I said earlier - validating that the customer controls an azure user doesn't necessarily mean that they have permissions to grant admin consent.

Further, I think you perhaps kind of implicitly assume that when I authenticate users I do that by their Azure identity. In practice that can be a whole spectrum - whether I have my own user management system, and whether I couple it to Entra or not is not something you can rely on. Customers expect their preferred IdP to work with your service.

Btw, I just found a short article referencing this issue, offering the same solution with the same "vulnerable to inside org privesc" gap: https://medium.com/@dipakkrdas/microsoft-adminconsent-can-le...

Making this inherently secure is just not that hard here - you could easily make this a bit more PKCE like with an additional service->azure call before redirecting the user to the flow or by adding a symmetrical signature to the callback and a new API to verify the signature.

I am a service provider. I have an Azure app registered so that clients can connect my app to their Azure environment.

Client A connected their Azure env to my service. Now an attacker creates a different tenant at my service and goes through the integration flow. Then he sends a request to my callback that says "admin consent configured for client A's tenant" and wants to steal Client A's data. How do I protect against that? Should I validate that the user who started the flow belongs to the same Azure tenant id? In itself it's not enough, what if it's just a random user without actual permissions to go through admin consent? What if a client legitimately has multiple tenants in my service that need to connect to the same azure tenant?

If anyone from Microsoft security reads this, could you please do something about login.microsoftonline.com/XXX/v2.0/adminconsent?

The callback you're redirecting the user to at the end of that flow is forgeable if an attacker knows an azure tenant ID of a different customer, and putting a "Never use the tenant ID value of the tenant parameter to authenticate or authorize users" warning in the docs is only helpful as long as a way to authenticate users exists.

It needs to gather a bunch of inputs and feed into the remote GPUs correctly and as efficiently as possible. Lots of room to optimize under the constraints that users love cheap tokens, demand a fair billing structure, and want responsiveness and low latency.

They literally proved the UGC?

Being of the opposite chirality doesn't magically make antibodies pass through you. Antibodies can and do bind molecules of all sizes and chiralities.

I find it really hard to believe that you can make a whole organism that doesn't have any molecules that can be targeted by an antibody. And if you can do that then why go through mirror life anyway?

A reasonable argument is that mirror proteins will evade the usual degradation+antigen presentation pipeline and this will make efficient adaptive response more difficult, or that the innate immune reaction will not be enough to recruit adaptive response. But surely it's not impossible. And if we ever get to this point I'm very optimistic that we would have a good way to vaccinate against this.

I really doubt a "mirror life" bacteria would be "hidden" from the immune system. Antibodies should have enough search space to be able to detect and neutralise such bacteria?

Knowing is the easy part. An effective cure for cancer will probably be a procedure where you get your tumors sequenced, an AI model considers the unique genetic context and creates a specific treatment. Think CAR-T cell therapy or mRNA vaccines. Then this needs to be manufactured.

All of this means you will need to be rich or have your country invest lots of money into health care systems. In a world where humans don't provide economic value anymore, why would that be?

Similarly, data center loans are starting to make cheap mortgages disappear.

Related: https://www.nature.com/articles/d41586-023-01313-5

If you don't like what humans are doing to each other using 20th century warfare methods, consider what they might do with superintelligent AI? Worst places to live in are usually countries fighting civil wars.

If youre going to spend 10 million dollars on 10000 agents trying to solve some important maths problem I think it's reasonable to ask for some grants to help digest whatever they came up with. Or you could hire mathematicians and do it in-house, but I guarantee you grants to PhD students are cheaper than silicon value salaries.

For every important match problem solved by AI, without mathematicians we wouldn't know about the existence and importance of the problem.

Famous mathematical conjectures are social constructs, formed by decades of even centuries of attention given to them by members of the math community. Without it, the danger is that future math "progress" will be reduced to generating tables of Lean statements and a probable/unprovable bit generated by AI.

I think they are trying now to to bake CI awareness into Claude Desktop, didn't use it yet.

But meanwhile we also have the scripts - one script to watch CI, one script to fetch comments (without dumping raw graphql into the agent), etc etc. Can't wait for this phase to end already

I'm still so mad about Intel and AMD and Microsoft colluding together to remove sleep mode. Horrible for battery life, unfixable, but Microsoft says they need to be able to wake up your laptop every hour.

It is hilarious to me that in the examples they show side by side Opus 5.5 still uses 4 times more words than it needs to use. IME, if you eyeball how many words the thing they're trying to say actually needs, and tell them to use only this many words, they become excellent communicators. I assume something about Anthropic's grader for writing just really wants to tick all its tidy tiny boxes of information the models need to cite. It's terrible.

Yes. Much more than a bioengineered virus or an out of control terminator, I'm just worrying that governments will feel forced to direct their money to AI capital and away from humans. Why invest billions in undergrad programs when you can build a new data center? Why increase teacher wages when you can buy electricity for better ROI?

Your local American tariffs can hardly explain a global rise in long term yields. The Iran war isn't going great economically but doesn't explain thks. If anything the Russia-Ukraine war has had a bigger influence.

It becomes clearer to more people that it's impossible to predict the future shape of the global economy due to AI.

The more clear it is, the cheaper 30 year bonds become.

Theoretically, can Nvidia direct Hugging Face to sue OpenAI now for the hack? Surely they could find some interesting stuff in discovery :)

> I'd like to see references to those claims and experiments, size of the codebase etc. I find it hard to believe the figures since the bottleneck in large codebases is not a compute, e.g. headers preprocessing, but it's a memory bandwidth.

Edit: I think I misunderstood what you meant by memory bandwidth at first? Modules reduce the amount of work being done by the compiler in parsing and interpreting C++ code (think constexpr). Even if your compilation infrastructure is constrained by RAM access, modules replace a compute+RAM heavy part with a trivial amount of loading a module into compiler memory so it's a win.

Yes, some phages are very specific - but not all of them! And we're slowly getting better at this: https://www.nature.com/articles/s41564-024-01832-5

I wrote a little GCC plugin for compile time tracing/profiling, if that's something you're interested in: https://github.com/royjacobson/externis

I guess it's better, but with C++ being C++, you will then need to decide if you consider

struct A { A(const volatile& A); };

as a class with a const copy constructor. Maybe someone cares?

Proper templated classes don't behave like this. If you manually define a copy constructor in a template class it has to work. And if it works only conditionally (like in many container classes) you need to add constraints on your constructors (>C++20) or derive from appropriately specialized base classes (e.g. std::_Optional_base in libstdc++).

It sucks to tell users "you're holding it wrong", but I don't think there's a way to make it simpler without breaking everything written since C++11.

It wouldn't be the same trait, for example

https://stackoverflow.com/questions/43606777/why-is-class-wi...