whizzter

The internet will be around, it just won't be open anymore.

Already the trolls,etc were a nuicance enough that anonymous social-media,etc is starting to become outlawed. Sure people will hack,etc but the easy exploitation of today will be a fleeting thing once we patch the fundamentally broken stuff.

Remember how Windows machines were wormed in the early 00s? MS got their act together and today the primary target is via browsers or Excel-files,etc. The recent Linux RCE while bad and probably not alone, is still not the common case.

It's a scale of convenience/shittyness.

TV manufacturer OS < Apple/Google OS < user OS

Most people don't really care for their TV being a computer display even if you do.

Even if I never connected my TV to WiFi , Windows and my iPhone can find it somehow and connect, so there's other protocols that are exposed and probably vulnerable without updates.

That kind of stuff is why the film industry has cycles of actors starting production companies, overturning the hierarchy with their money and successes, followed by them getting bored, selling out, the business becoming more businesslike until they start forking enough money to actors again that they again can produce their own stuff.

Netflix and co, might upend or stall that cycle, same as Steam/MS/etc can stagnate the games business.

I think games still has a cycle or two before being totally stagnant though, but regulators are working hard to fix that.

Indie games often cater to whatever the devs found fun as kids, that kind of creates it's own kind of stagnation.

The indie boom of the late 00s and early 10s was to a certain degree the result of odd creatives working the Flashgame community (cut-throat in itself) being forced out onto other platforms as it died combined with other platforms providing monetization possibilities.

As with everything, once there was money to be found the vultures moved in.

Right, I can agree to a certaint extent that the model itself can be equated to storage.

I think you misjudged my intent with that initial comment, it was mostly that I'd be feeling easier about AI usage if I knew the models WEREN'T trained on GPL'ed code, people producing GPL'ed software has historically been quite profilic in certain areas and the odds of copyrightable parts of GPL'ed code not showing up in AI code managing certain fileformats is definetly nonzero.

Ie, I'd be happier using Claude Code-nogpl, I'd be fine with adding BSD,etc copyright notices if given provenance information from the model, being in the GPL minefield because they don't really seem to track inputs is another.

Maybe maybe not, something interesting popped up reading the currently top-of-HN article on the GHC policy is that OpenJDK currently forbids AI contributions.

From the page, https://openjdk.org/legal/ai

--------------------------

What are the intellectual-property risks of using generative AI tools?

The Oracle Contributor Agreement (OCA) requires that a contributor own the intellectual property rights in each contribution and be able to grant those rights to Oracle, without restriction. Most generative AI tools, however, are trained on copyrighted and licensed content, and their output can include content that infringes those copyrights and licenses, so contributing such content would violate the OCA. Whether a user of a generative AI tool has IP rights in content generated by the tool is the subject of active litigation.

--------------------------

But they're just Oracle lawyers so it's baloney right?

Not more than accidentally or when actually interested in something that pops up, but as a friend said, I'm not a usual core customer so I've never been the baseline.

The thing they're doing correctly right now imho, is that AI mode is mostly toggled for things that passes a quick questions filter (probably low probability of a purchase, like "global illumination methods" giving a decent overview of the field) while if you just type green shoes it'll put out an assortment of online and local shopping options.

Now if as someone said in the sibling comments, Google is gouging their customers with the new auction model that's another problem, but if I was a shareholder I'd be less worried about an exodus of end users to OpenAI,etc than I was a year ago.

For me Google has stayed as the default interface, if I need to ask a basic query (probably searches that don't yield much revenue but keeps me on Google), the results were becoming worse a 1-3 years ago but now the AI parts of Google is now good-enough(TM) that I mostly don't need to go to a separate interface, as long as users aren't fleeing they can probably continue to get paid for ADs (also the if YT ads are included, those have really become obnoxious but probably well monetized).

Where does it say that it's carrier configuration? Looking through the page it mentions WAP and PDU, seems PDU from my skimming is just a part of encoding WAP messages, so basically anyone being able to send WAP messages onto the network will have the carrier happily retransmitting it unless carriers starts blocking them/filtering these incorrect ones?

Apple knows how much of a premium they can charge vs other manufacturers, if everyone else starts dropping they will as well.

Yes, but the irony here is that Apple used to (or perhaps still has) forbidden using other HTTP(S) clients in iOS apps (or perhaps Appstore in general) than the built-in out of security concerns like this would address by using 1 central storage instead of multiple ones were one won't get timely updates.

Ah, so I might end up not looking like a fool for marking it green, good to know! :)

A while back I was thinking it wouldn't be enforced, but the entire Craft-clones and REA tools usage explosion kinda hints that disassembling/rebuilding the source is cheap enough that LLM's(ironically) could probably quickly find culprits if you had suspicions about certain apps.

You mean as in binning? High defect rates for chips but they're burned to disable non-working parts and sell them as non-pro chips and accumulate the good ones ?

This caught my eye, remember how the eMudhra certificates had weirdly low parameters, like 4 and others in the single digits?

"Mbed TLS - Medium, CVSS 5.9 - A buffer-length typo reduces a 2048-bit DH modulus to one byte. TLS 1.2 DHE_RSA sessions are decryptable when the client accepts the broken parameters. GOAHEAD-SA-2026-0005."

Not familiar with those implementation details but was this the root cause?

No, the question is, if the GPL'ed code/structure is more or less recovered during inference, would a court rule the result to be covered by the GPL?

I know there was some cases in the past where people swapped licences and changed variablenames,etc but the essential code clearly remained.

Does it matter? Lawyers don't know either since most majorer cases are still in progress.

So far it seems more cases that have been decided in lower instances or has been settled or gone in the direction of the party with most money for lawyers, still even in those cases there seems to be a slight tilt towards rightsholders.

I'm not saying anything categorically, but if some cases go all the way and towards rightsholders, it could become a real shitshow in the software industry since we've adopted AI so heavily and the non-significatng portion of public GPL licenced code could bite people in the ass.

I think technically such a model should abide by the licence of the inputs, hence all models would probably be GPL if the FSF had resources to fight it and the legal profession had an inkling of the processes involved.

Or maybe the FSF is just waiting for everyone using AI code to become hooked and then subpoena every Antrophic/OAI/Codex customer and force the most massive source release in history (If Adobe/MS would file lawsuits vs the Craft apps and with their resources create legal precedent it could create chaos, maybe the only part stopping them right now from filing lawsuits is them realizing it could backfire since they're heavy AI users themselves).

Aaron Swartz pulled down by the legal system for trying to get things accessible for people instead of being blocked by profit requirements.

Companies copying things to make profit for themselves not being held accountable.

Progress is one thing, injustice is another.

It's a community site, first model I looked at (Tanya by Shrimport) is under CC-BY-ND-NC licence (Creative Commons, By attribution, No-derivatives, Non-commercial).

AI training by definition is derivative, and Roblox not using it for commercial purposes if used in production is practically nil.

This is a huge part of why AI upsets people, we can't have nice things such as communities where people are sharing 3d models without it being feeding ground for commercial companies that has little intention to ever honor any licences or compensate authors.

I was thinking the same thing when another PDF library popped up in the .NET subreddit a few hours before this post.

I'm not really in that camp, but I'm still in the camp of "will they survive long-term if good enough open models trickles down to commodity hardware" (in a way the opposite camp perhaps?).

Sun made bank 25 years ago because their servers was needed for websites, today we run larger workloads on 5$ VPS servers (well maybe the VPS servers has gotten more expensive due to HW shortages but they're not intrinsically expensive anymore).

Oh my, here I'm looking like a fool, literally gave a talk on the new <meta>/Reflection feature on Thursday and doing it assumed that it was more or less a lock (Well I guess the refl feature will come out if contracts can be dumped and the standard gets out even if it won't technically be in C++26 anymore :P )

The reflection feature is good, I would've settled for less but there's some pretty cool stuff enabled by it.

- direct to struct JSON parsing with property-name aliasing via annotations

- field creation/renaming, I've made a make_named<"a","b">(1,"hello") to create an object with fields named a and b (think of std::make_tuple on steroids)

- I'm basically halfway done with a DB abstraction that can be used similarly to C#'s Linq.

struct [[=sql26::name("posts")]] post { int id; std::string name; };

dbcontext<post> dbctx;

for(auto post:dbctx.posts.where([](auto post) { return post.id>100; }) { ... }

^- in the above example the template inclusion of post creates the posts-field in the context, the where predicate lambda gets a decorated variant of the post type members that are then deferred until execution (starting iterating the itererable).

It's dangerously powerful though since all of this is enabled by consteval, so any IDE support will need to be running the consteval code continiously in these scenarios to update type-info before being able to do code completion (even if people are probably way into LLM's to bother anymore?).

The talk isn't online yet since they haven't had time to edit the videos.

The JSON and make_named example/code can be found in my repo, haven't pushed the SQL feature yet as I'm not happy with some other parts of the API surface yet (aggregation is hard to express/translate compactly and unambigiously).

https://github.com/whizzter/ret26

I think the big contention is yet-another "optional" feature you cannot rely on when C++ security record is so-so with regards to memory safety, and if you for "elegance" put predicates for such into contracts.. it can all go out the window even if you intended for it to be strict.

I think defaulting all assertions to enforce would've been better with an optional soft modifier (ie "soft pre(foo)" ), as it is now it's just always assert in a trenchcoat.

Lovely, I remember the first cracktro that blew my mind long before I actually got in touch with the demoscene.

It was an ACE cracktro for International Karate that was putting huge things in the borders, something about it stuck to my mind.

https://www.youtube.com/watch?v=2ODIb5r_fS8

That's why it's built on SEPA instant that is written into EU law, requiring 10 second transfer times, and the banks have incentives to support these things (they often own it, but also because it creates lock-in effects of focusing business in one bank).

Like someone else who made the "SEPA in trenchcoat" comment, it's all built on tying phonenumbers (universally available and easily connectible) to bank accounts and relying on SEPA instant for the money.

The only thing to make sure is that QR-codes,etc that are often tied to apps will be supported for routing/connecting between different apps.

Like the Swedish Swish app when asking for money produces a QR-code that says, A+(my-phone-number) , if that's universally recognized by the apps as an ask-request then an Italian app scanning my QR code will be prompted send money and the Italian system will query the Swedish counterparts what account is registered to that phone and then just send the money over SEPA when the request finishes.

Depends on the API? Considering how much Chinese actors rumored to be spending on straw owners buying for them to then distill information out of OAI/Anthrophic, I'm sure any OAI/Antrophic keys in the wild gets bought up quickly.

I'd say yes-ish, the 9.2 rating hints that it's not a straight to-shell exploit, but still serious enough that the step is probably easy enough, imagine the DB connection string or similar leaking through the working memory leak.

The reason it's so bad is because the multipart/form-parsing by the accounts I've read happens- or begins before the PHP code is actually run, ie it's in the initial runtime stage of a request.