xmprt

You can argue that correlation doesn't imply causation, but typically more contributors means more people who have played a part in the code and so more eyes on the project to catch issues as well as a higher bus factor and less key person risk.

And larger community means there's more rewards for a successful attack and therefore fewer latent security issues (ie, obvious ones are more likely to be caught).

I think companies considering building in-house packages are just trading one risk for another. Especially with LLMs, it's going to be a lot easier to find vulnerabilities in your internal dependency than it would be in a battle hardened dependency used by 100s of others.

I didn't mention the code once in my reply. Code is only one aspect of reviewing a dependency. Much more important is the community and support around the tool/dependency.

When dealing with LLM output, you're getting a 1 of 1. There's no way to measure the community, number of contributors, or how maintainable it is.

This joke is made a lot but I think most good developers take care in considering the npm dependencies they install. You can get a ton of dependencies pretty easily by just installing very popular ones like react, tailwind, nextjs, etc. If there's ever a dependency that I'm not familiar with then I make sure to take at least a cursory look over the repo to make sure it has a decent number of stars/community, is well maintained, has multiple contributors, etc.

Could be? Yes. But I don't know if it's super clear that any existing technology would solve the problem without also introducing new process changes. For example, I can imagine a world where the laws are just a bunch of text files and instead of using git to make changes, we just add a new text file and there's a preamble that says that the law is superseded by any future laws. Laws also aren't as clear cut as code. We have tons of contradictory laws on the books today.

What I'm getting at is that, if we need to make process changes anyway in order to actually make the technology work for us, then the real solution is in the process and not in the technology.

There already is a papertrail. It's just that it's extremely convoluted to navigate. This isn't a technology problem.

If you're like most Americans and pay taxes on time then there's absolutely no reason to be audited. The two possibilities are:

1. You are taking a lot of special deductions and not providing all the required documentation.

2. Or you're not reporting things accurately because there's some edge case in the tax code that you didn't understand but is easy for the IRS to catch (eg. sales of stock without cost basis reported).

Simplifying the tax code and funding the IRS more solves both of those because then they can focus on the real whales who are abusing the tax code the most.

If you've dealt with the American medical system then stories like this aren't very surprising. I'm not going to act like this is everyone's story (a lot of people have pretty smooth experiences) but it happens a lot more often than it should.

Money doesn't mean anything if you don't have a case to begin with. More money/time just makes the lawyers win because they end up siphoning most of the settlement. And more money with crappy lawyers will always lose to less money on smart lawyers who are able to use AI to find 100 examples of prior cases going your way. That's the whole point of AI disrupting the field.

And most of the leverage you have in negotiating a settlement is by referencing prior case law. If something is novel, there's too much variance to get a good settlement.

I've used chargebacks much more often because of services not rendered than because of a lost card or because of stolen credentials.

$59.5 million seems like a drop in the bucket compared to the rent that these middlemen are taking. And was the COVID-tracking app an abject failure because it didn't get public adoption or because the technology wasn't fundamentally sound. Because if it failed because of the former, then simply regulating companies to use it (or even just putting it out there as a cheaper option to outcompete Visa) would solve a lot of those adoption problems.

"I wish more knowledge bases realized their barrier to entry."

I think of it kind of like how Chess AI make "mistakes" which are unrecognizable to humans but a stronger AI would be able to pick them apart. That's kind of scary...

Not really ironic. They even say it here:

> Not anti-AI. Pro-giving-a-damn.

AI isn't the problem. The problem is that people are sending text without proof reading.

> OpenAI's ad collector at bzr.openai.com sets a cookie called __obi, scoped to .openai.com

This sentence is way too much detail and it's literally the first thing you read. I can pick apart most of the sentences in the article. Another one:

> Across 932 decoded sync tokens, 736 carried subject_type: account_user and 196 carried anonymous

This sentence is pointless. What matters to proving that "It works when you are logged out" is to show that the identifier is stable. Why does the reader care about the actual counts.

AI has a tendency to do this which makes AI generated text a lot harder to read. The raw prompts likely don't have the specific websites and cookie names because that's not relevant to the reader or writer for that matter - it's a footnote at best.

The goal for most of these vertical shorts is soap opera so this is a feature and not a bug. Also, in order to maintain engagement, they often need to have continuously escalating plots which makes for bad writing (typically in good plots you have dips in action before the next climax). The problem isn't what AI can generate and rather what people are asking for (both the audience and the producers).

Valve is working on supporting apks for their new VR operating system. If this goes anything like Proton then I'm hopeful for the future of Android without Google.

Google is starting to turn into early 2000s / late 90s Oracle.

Many lawyers are owners/partners compared with software engineers who are more like cogs in the machine. They also bill hourly/contingency per case compared to engineers who are salaried. If a partner in a firm thinks they can take on more cases because of AI assistance then they will because that's just more money in their pockets.

> We fund astronomy well beyond the solar system despite there being no real prospect of practical applications

There are a lot of immediate practical benefits to learning more about the physics and chemistry of the universe beyond our solar system.

Also it ignores the fact that the core of calculus and the idea of dealing with infinitesimal quantities was independently discovered for many centuries. eg. Archimedes use techniques that were eerily similar to integrals.

The work that Newton and Leibniz did was in formalizing it and coming up with the notation that would end up being more widely accepted and applicable. It's very likely that the techniques would have been developed later to solve a practical problem.

> The biggest wallet wins

This was already always the case. If anything, making this more accessible will reduce the barrier to entry for whether or not it's worth your time to take on a case. Instead of 50 lawyers spending 100s of hours on a case, you can have 1 or 2 lawyers + Astra working on it and if there's a case you can add more real lawyers.

If there are no incentives for mathematicians to work on and share progress in tough problems because they will get scooped, then they will end up quitting and in net we will see less progress overall.

reddit used to shared how much gold purchases went towards their server costs (pretty sure it wasn't 100% accurate but at least good to an order of magnitude). It was approximately $1/hour and they served ~100M monthly active users. So I don't think those metrics would demonstrate how wasteful traditional data centers are like you think it would.

> your average Smart TV buyer is prepared to sign into Netflix, Disney+, Hulu, Prime Video, Crunchyroll, Youtube etc

I think this is starting to change a bit especially as companies crack down on password sharing. Once the dam breaks, there's gonna be a pretty drastic and unstoppable migration towards the "dumb" TV products + more open alternatives. I'm already seeing a lot of families start to move to DVDs and Blurays for kids who just watch the same 5 movies on repeat anyway.

This migration is already happening away from Windows. Gaming was the big moat that Windows had but now with Steam Proton and better Linux alternatives, a ton of people are starting to move away and while it's not a significant majority yet, I think the tides have already turned and there's not much Microsoft can do to turn it back.

Why are you acting like there isn't a definition of inefficient. I think "underutilized" is a pretty good definition.

The fact that every single person has a small private park in their front and backyards that's enjoyed maybe a couple hours per day at most is pretty wasteful - if it was shared the utilization would go way up and space used would be way down. Same goes for all the parking lots needed to facilitate car traffic - if we used more efficient/shared options like buses or trams then the parking lots that sit empty most of the day could be replaced with more businesses or houses that allow people to live closer to the services that they need every day.

Meanwhile, we have big bottlenecks in our city downtowns where all the density is packed. Spread that out and things get a lot more efficient - your commute probably goes down too because you can live closer to work. Suburbs don't work without a productive city near them - otherwise they're just rural areas.

Bigger "guns" diplomacy. They don't need any legal basis for a C&D. Just depends on whether you have enough money to fight it in court.

Not much to see here. Crowd sourced, vibe coded app. Not sure what "verified" means because the only verification they did was require a checkbox that "I confirm this is a genuine experience"

> Yes that's been obvious since the beginning

But if it's so obvious, then why are we still relying on it in the system prompt. It's just wasting context at this point.

You can brush that $177M fine aside but I'm almost certain that none of the Chinese companies above with these security vulnerabilities will pay even $1 in fines.