10 ms·
Claude Code Found a Linux Vulnerability Hidden for 23 Years
- eichin 6mo agoAn explanation of the Claude Opus 4.6 linux kernel security findings as presented by Nicholas Carlini at unpromptedcon.
- eichin 6mo agohttps://www.youtube.com/watch?v=1sd26pWhfmg https://www.youtube.com/watch?v=1sd26pWhfmg is the presentation itself. The prompts are trivial; the bug (and others) looks real and well-explained - I'm still skeptical but this looks a lot more real/useful than anything a year ago even suggested was possible...
- jazz9k 6mo agoThis does sound great, but the cost of tokens will prevent most companies from using agents to secure their code.
- KetoManx64 6mo agoTokens are insanely cheap at the moment. Through OpenRouter a message to Sonnet costs about $0.001 cents or using Devstral 2512 it's about $0.0001. An extended coding session/feature expansion will cost me about $5 in credits. Split up your codebase so you don't have to feed all of it into the LLM at once and it's a very reasonable.
- lebovic 6mo agoIt cost me ~$750 to find a tricky privilege escalation bug in a complex codebase where I knew the rough specs but didn't have the exploit. There are certainly still many other bugs like that in the codebase, and it would cost $100k-$1MM to explore the rest of the system that deeply with models at or above the capability of Opus 4.6. It's definitely possible to do a basic pass for much less (I do this with autopen.dev), but it is still very expensive to exhaustively find the harder vulnerabilities.
- christophilus 6mo agoThis is where the Codex and Claude Code Pro/Max plans are excellent. I rarely run into the limits of Codex. If I do, I wait and come back and have it resume once the window has expired.
- Jcampuzano2 6mo agoClaude and Codex pro/max subs aren't supposed to be used for commercial/enterprise development so its not really an option for execs in enterprise. They need to take into account API costs. At my F500 company execs are very wary of the costs of most of these tools and its always top of mind. We have dashboards and gather tons of internal metrics on which tools devs are using and how much they are costing.
- petesergeant 6mo ago> Claude and Codex pro/max subs aren't supposed to be used for commercial/enterprise development lolwut?
- blks 6mo agoRead ToS.
- monocularvision 6mo agoI just did. Tell me where it states what you are claiming. Neither my reading (IANAL) nor ChatGPT’s reading could find such a blanket ban: https://www.anthropic.com/legal/consumer-terms https://www.anthropic.com/legal/consumer-terms
- watermelon0 6mo agoFrom your link: > Non-commercial use only. You agree that you will not use our Services for any commercial or business purposes and we and our Providers have no liability to you for any loss of profit, loss of business, business interruption, or loss of business opportunity. There are separate commercial terms for Team/Enterprise/API usage: https://www.anthropic.com/legal/commercial-terms https://www.anthropic.com/legal/commercial-terms
- gmerc 6mo agoYou’d have to ignore the massive investor ROI expectations or somehow have no capability to look past “at the moment”.
- KetoManx64 6mo agoNot really. I'm fully taking advantage of these low prices while they last. Eventually the AI companies will run start running out of funny money and start charging what the models actually cost to run, then I just switch over to using the self hosted models more often and utilize the online ones for the projects that need the extra resources. Currently there's no reason for why I shouldn't use Claude Sonnet to write one time bash scripts, once it starts costing me a dollar to do so I'm going to change my behavior.
- twosdai 6mo agoI also have this feeling. But do you ever doubt it. that when the time comes we will be like the boiled frog? Where its "just so convenient" or that the reality of setting up a local ai is just a worse experience for a large upfront cost?
- iririririr 6mo agoworse. he's already boiled. probably paying way more than that one dollar per bash script with all the subscriptions he already has.
- KetoManx64 6mo agoYeah, the $20 I paid to OpenRouter about 4 months ago really cost me an arm and a leg, not sure where I'll get my next meal if I'm to be honest.
- deaux 6mo ago> Currently there's no reason for why I shouldn't use Claude Sonnet to write one time bash scripts, once it starts costing me a dollar to do so I'm going to change my behavior. This just isn't going to happen, we have open weights models which we can roughly calculate how much they cost to run that are on the level of Sonnet _right now_. The best open weights models used to be 2 generations behind, then they were 1 generation behind, now they're on par with the mid-tier frontier models. You can choose among many different Kimi K2.5 providers. If you believe that every single one of those is running at 50% subsidies, be my guest.
- ThePowerOfFuet 6mo ago>$0.001 cents $0.001 (1/10 of a cent) or 0.001 cents (1/1000 of a cent, or $0.00001)?
- Pikamander2 6mo agoOh no, here we go again https://youtube.com/watch?v=MShv_74FNWU https://youtube.com/watch?v=MShv_74FNWU
- zozbot234 6mo agoAgentic tasks use up a huge amount of tokens compared to simple chatting. Every elementary interaction the model has with the outside world (even while doing something as simple as reading code from a large codebase) is a separate "chat" message and "response", and these add up very quickly.
- epolanski 6mo agoI don't buy it. Inference cost has dropped 300x in 3 years, no reason to think this won't keep happening with improvements on models, agent architecture and hardware. Also, too many people are fixated with American models when Chinese ones deliver similar quality often at fraction of a cost. From my tests, "personality" of an LLM, it's tendency to stick to prompts and not derail far outweights the low % digit of delta in benchmark performance. Not to mention, different LLMs perform better at different tasks, and they are all particularly sensible to prompts and instructions.
- simplesocieties 6mo ago“Thing x happened in the past, therefore it will continue to happen in the future” is perhaps one of the most, if not the most pervasive human-created fallacies anywhere.
- NitpickLawyer 6mo agoTokens aren't more expensive than highly trained meatbags today. There's no way they'll be more expensive "tomorrow"...
- bigbugbag 6mo ago[flagged]
- skeledrew 6mo ago> they are and they will be Calculate the approximate cost of raising a human from birth to having the knowledge and skills to do X, along with maintenance required to continue doing X. Multiply by a reasonable scaling factor in comparison to one of today's best LLMs (ie how many humans and how much time to do Xn, vs the LLM). Calculate the cost of hardware (from raw elements), training and maintenance for said LLM (if you want to include the cost of research+software then you'll have to also include the costs of raising those who taught, mentored, etc the human as well). Consider that the human usually specializes, while the LLM touches everything. I think you'll find even a roughly approximate answer very enlightening if you're honest in your calculations.
- Synthetic7346 6mo agoBut companies don't have to bear the cost of raising a human from birth, or training them. They only pay the cost of hiring them, and that includes cost of maintenence. Add to that the fact that we can't blindly trust LLM output just yet, so we need a mearbag to review it. LLM will always be more expensive than human +LLM, until we're at a stage where we can remove the human from the loop
- skeledrew 6mo ago> But companies don't have to bear the cost of raising a human from birth, or training them. The costs do exist somewhere though, and must be paid by someone. There's no free lunch, and the human lunch is very likely far more costly than the LLM lunch. > Add to that the fact that we can't blindly trust LLM output just yet Can't blindly trust human output either. That's why there are various tiers in roles, from junior-equivalent to senior-equivalent, and the actual user of the product is always the final arbiter. There's ultimately nothing different, except that the LLM iterates on issue resolution in seconds to minutes, whereas the human equivalent takes hours to days.
- qingcharles 6mo agoI'm thinking about how much money Anthropic etc are making from intelligence services who are running Opus 4.6 on ultra high settings 24 hours a day to find these kinds of exploits and take advantage of them before others do. Expensive for me and you, but peanuts for a nation state.
- up2isomorphism 6mo agoBut on the other hand, Claude might introduce more vulnerability than it discovered.
- yunnpp 6mo agoCode review is the real deal for these models. This area seems largely underappreciated to me. Especially for things like C++, where static analysis tools have traditionally generated too many false positives to be useful, the LLMs seem especially good. I'm no black hat but have found similarly old bugs at my own place. Even if shit is hallucinated half the time, it still pays off when it finds that really nasty bug. Instead, people seem to be infatuated with vibe coding technical debt at scale.
- Serberus 6mo ago[dead]
- qsera 6mo ago> Code review is the real deal for these models. Yea, that is what I have been saying as well... >Instead, people seem to be infatuated with vibe coding technical debt at scale. Don't blame them. That is what AI marketing pushes. And people are sheep to marketing.. I understand why AI companies don't want to promote it. Because they understand that the LCD/Majority of their client base won't see code review as a critical part of their business. If LLMs are marketed as best suited for code review, then they probably cannot justify the investments that they are getting...
- up2isomorphism 6mo agoReal deal in this case or not does not necessarily mean the Claude code usage is a positive net gain to the software security overall. In fact it is likely the opposite. It will hurt some CC heavy user’s feeling but that’s a different thing.
- khalic 6mo agoGuys please read the article before commenting...
- userbinator 6mo agoNot "hidden", but probably more like "no one bothered to look". declares a 1024-byte owner ID, which is an unusually long but legal value for the owner ID. When I'm designing protocols or writing code with variable-length elements, "what is the valid range of lengths?" is always at the front of my mind. it uses a memory buffer that’s only 112 bytes. The denial message includes the owner ID, which can be up to 1024 bytes, bringing the total size of the message to 1056 bytes. The kernel writes 1056 bytes into a 112-byte buffer This is something a lot of static analysers can easily find. Of course asking an LLM to "inspect all fixed-size buffers" may give you a bunch of hallucinations too, but could be a good starting point for further inspection.
- NitpickLawyer 6mo ago> This is something a lot of static analysers can easily find. And yet they didn't (either noone ran them, or they didn't find it, or they did find it but it was buried in hundreds of false positives) for 20+ years... I find it funny that every time someone does something cool with LLMs, there's a bunch of takes like this: it was trivial, it's just not important, my dad could have done that in his sleep.
- userbinator 6mo agoRemember Heartbleed in OpenSSL? That long predated LLMs, but same story: some bozo forgot how long something should/could be, and no one else bothered to check either.
- dlopes7 6mo agoHey we are the bozos
- braiamp 6mo agoLets all get together and self-reflect on the bozos way.
- sam_bristow 6mo ago
- dist-epoch 6mo ago> "given enough eyeballs, all bugs are shallow" Time to update that: "given 1 million tokens context window, all bugs are shallow"
- riffraff 6mo ago..and three months to review the false positives
- 112233 6mo agothis is always overlooked. AI stories sound like "with right attitude, you too can win 10M $ in lottery, like this man just did" Running LLM on 1000 functions produces 10000 reports (these numbers are accurate because I just generated them) — of course only the lottery winners who pulled the actually correct report from the bag will write an article in Evening Post
- red75prime 6mo ago> these numbers are accurate because I just generated them Is it sarcasm, or you really did this? Claude Opus 4.6?
- summarity 6mo agoAlready happend: https://arxiv.org/abs/2407.08708 https://arxiv.org/abs/2407.08708
- bigbugbag 6mo agomore like some bugs are shallow and others are pieced together false-positives from an automated tool reliable in its unreliability.
- _pdp_ 6mo agoThe title is a little misleading. It was Opus 4.6 (the model). You could discover this with some other coding agent harness. The other thing that bugs me and frankly I don't have the time to try it out myself, is that they did not compare to see if the same bug would have been found with GPT 5.4 or perhaps even an open source model. Without that, and for the reasons I posted above, while I am sure this is not the intention, the post reads like an ad for claude code.
- mgraczyk 6mo agoNo the title is correct and you are misreading or didn't read. It was found with Claude code, that's the quote. This isn't a model eval, it's an Anthropic employee talking about Claude code. So comparing to other models isn't a thing to reasonably expect.
- mtlynch 6mo agoOP here. I don't understand this critique. Carlini did use Claude Code directly. Claude Code used the Claude Opus 4.6 model, but I don't know why you'd consider it inaccurate to say Claude Code found it. GPT 5.4 might be capable of finding it as well, but the article never made any claims about whether non-Anthropic models could find it. If I wrote about achieving 10k QPS with a Go server, is the article misleading unless I enumerate every other technology that could have achieved the same thing?
- eichin 6mo agoAlso, he did compare with earlier versions that, before 4.5, were dramatically worse at finding the same problems. There's even a graph. That seems to pretty solidly support the idea that this is "gain of function" as it were...
- weird-eye-issue 6mo ago> You could discover this with some other coding agent harness. And surely that would be relevant if they were using a different harness.
- jason1cho 6mo agoThis isn't surprising. What is not mentioned is that Claude Code also found one thousand false positive bugs, which developers spent three months to rule out.
- addandsubtract 6mo agoOn the other hand, some bugs take three months to find. So this still seems like a win.
- mtlynch 6mo ago> What is not mentioned is that Claude Code also found one thousand false positive bugs, which developers spent three months to rule out. Source? I haven't seen this anywhere. In my experience, false positive rate on vulnerabilities with Claude Opus 4.6 is well below 20%.
- r9295 6mo agoIn my experience, the issue has been likelihood of exploitation or issue severity. Claude gets it wrong almost all the time. A threat model matters and some risks are accepted. Good luck convincing an LLM of that fact
- j16sdiz 6mo agoIn TFA: I have so many bugs in the Linux kernel that I can’t report because I haven’t validated them yet… I’m not going to send [the Linux kernel maintainers] potential slop, but this means I now have several hundred crashes that they haven’t seen because I haven’t had time to check them. —Nicholas Carlini, speaking at [un]prompted 2026
- mtlynch 6mo agoThose aren't false positives; they're results he hasn't yet inspected. I wrote a longer reply here: https://news.ycombinator.com/item?id=47638062 https://news.ycombinator.com/item?id=47638062
- cookiengineer 6mo ago> Nicholas has found hundreds more potential bugs in the Linux kernel, but the bottleneck to fixing them is the manual step of humans sorting through all of Claude’s findings No, the problem is sorting out thousands of false positives from claude code's reports. 5 out of 1000+ reports to be valid is statistically worse than running a fuzzer on the codebase. Just sayin'
- dist-epoch 6mo ago> On the kernel security list we've seen a huge bump of reports. We were between 2 and 3 per week maybe two years ago, then reached probably 10 a week over the last year with the only difference being only AI slop, and now since the beginning of the year we're around 5-10 per day depending on the days (fridays and tuesdays seem the worst). Now most of these reports are correct, to the point that we had to bring in more maintainers to help us. ... Also it's interesting to keep thinking that these bugs are within reach from criminals so they deserve to get fixed. https://lwn.net/Articles/1065620/ https://lwn.net/Articles/1065620/
- cookiengineer 6mo ago> https://syzbot.org/upstream https://syzbot.org/upstream I stand corrected.
- tptacek 6mo agoWhat's your point?
- mtlynch 6mo ago> 5 out of 1000+ reports to be valid is statistically worse than running a fuzzer on the codebase. Carlini said "hundreds" of crashes, not 1000+. It's not that only 5 were true positives and the rest were false positives. 5 were true positives and Carlini doesn't have bandwidth to review the rest. Presumably he's reviewed more than 5 and some were not worth reporting, but we don't know what that number is. It's almost certainly not hundreds. Keep in mind that Carlini's not a dedicated security engineer for Linux. He's seeing what's possible with LLMs and his team is simultaneously exploring the Linux kernel, Firefox,[0] GhostScript, OpenSC,[1] and probably lots of others that they can't disclose because they're not yet fixed. [0] https://www.anthropic.com/news/mozilla-firefox-security https://www.anthropic.com/news/mozilla-firefox-security [1] https://red.anthropic.com/2026/zero-days/ https://red.anthropic.com/2026/zero-days/
- LeonTing1010 6mo ago[flagged]
- lnkl 6mo ago[flagged]
- FromTheFirstIn 6mo agoEvery single post here these days. “Startup founder of Communality.ai says ai good for people” and then the comments are AI bros declaring that all work can end, the good times are here at last
- summarity 6mo agoRelated work from our security lab: Stream of vulnerabilities discovered using security agents (23 so far this year): https://securitylab.github.com/ai-agents/ https://securitylab.github.com/ai-agents/ Taskflow harness to run (on your own terms): https://github.blog/security/how-to-scan-for-vulnerabilities-with-github-security-labs-open-source-ai-powered-framework/ https://github.blog/security/how-to-scan-for-vulnerabilities...
- cesaref 6mo agoI'm interested in the implications for the open source movement, specifically about security concerns. Anyone know is there has been a study about how well Claude Code works on closed source (but decompiled) source?
- skeledrew 6mo ago> Claude Code works on closed source (but decompiled) source Very likely not nearly as well, unless there are many open source libraries in use and/or the language+patterns used are extremely popular. The really huge win for something like the Linux kernel and other popular OSS is that the source appears in the training data, a lot. And many versions. So providing the source again and saying "find X" is primarily bringing into focus things it's already seen during training, with little novelty beyond the updates that happened after knowledge cutoff. Giving it a closed source project containing a lot of novel code means it only has the language and it's "intuition" to work from, which is a far greater ask.
- kasey_junk 6mo agoI’m not a security researcher, but I know a few and I think universally they’d disagree with this take. The llms know about every previous disclosed security vulnerability class and can use that to pattern match. And they can do it against compiled and in some cases obfuscated code as easily as source. I think the security engineers out there are terrified that the balance of power has shifted too far to the finding of closed source vulnerabilities because getting patches deployed will still take so long. Not that the llms are in some way hampered by novel code bases.
- skeledrew 6mo agoMany vulnerabilities aren't just pattern matching though; deep understanding of the context in the particular codebase is also needed. And a novel codebase means more attention than usual will be spent grepping and keeping the context in focus. Which will make it easier to miss certain things, than if enough of the context was already encoded in the model weights. Same thing applies to humans: the better someone knows a codebase, the better they will be at resolving issues, etc.
- mattbee 6mo agoPasting a big batch of new code and asking Claude "what have I forgotten? Where are the bugs?" is a very persuasive on-ramp for developers new to AI. It spots threading & distributed system bugs that would have taken hours to uncover before, and where there isn't any other easy tooling. I bet there's loads of cryptocurrency implementations being pored over right now - actual money on the table.
- dvfjsdhgfv 6mo ago> Pasting a big batch of new code and asking Claude "what have I forgotten? Where are the bugs?" It's actually the main way I use CC/codex.
- petesergeant 6mo agoI find Codex sufficiently better for it that I’ve taught Claude how to shell out to it for code reviews
- linsomniac 6mo agoDitto, I made a "/codex-review" skill in Claude Code that reviews the last git commit and writes an analysis of it for Claude Code to then work. I've had very good luck with it. One particularly striking example: I had CC do some work and then kicked off a "/codex-review" and while it was running went to test the changes. I found a deadlock but when I switched back to CC the Codex review had found the deadlock and Claude Code was already working on a fix.
- motbus3 6mo agoYeah and it comes with the blood of children included
- cmrdporcupine 6mo agoI think OpenAI has actually released an official version of exactly this: https://community.openai.com/t/introducing-codex-plugin-for-claude-code/1378186 https://community.openai.com/t/introducing-codex-plugin-for-... https://github.com/openai/codex-plugin-cc https://github.com/openai/codex-plugin-cc I actually work the other way around. I have codex write "packets" to give to claude to write. I have Claude write the code. Then have Codex review it and find all the problems (there's usually lots of them). Only because this month I have the $100 Claude Code and the $20 Codex. I did not renew Anthropic though.
- adamsilvacons 6mo ago[flagged]
- misiek08 6mo agoDo not expect so many more reports. Expect so many more attacks ;)
- pithtkn 6mo ago[dead]
- alsanan2 6mo agomaking public that AI is able of founding that kind of vulnerabilities is a big problem. In this case it's nice that the vulnerability has been closed before publishing but in case a cracker founds it, the result would be extremately different. This kind of news only open eyes for the crackers.
- roach54023 6mo ago[dead]
- rixrax 6mo agoI hope next up is the performance and bloat that the LLMs can try and improve. Especially on perf side I would wager LLMs can go from meat sacks what ever works to how do I solve this with best available algorithm and architecture (that also follows some best practises).
- DGAP 6mo agoI replicated this experiment on several production codebases and got several crits. Lots of dupes, lots of false positives, lots of bugs that weren't actually exploitable, lots of accepted/ known risks. But also, crits!
- sbuttgereit 6mo agoI think this really needs to be party of the message. It's great that Claude found a vulnerability that apparently has been overlooked for a long time. It's even proper for Anthropic to tout the find. But we should all ask about the signal to nose ratio that would have been part of the process. If it only was successful... That would be worth touting, too. But I expect there was more noise than they'd care to admit. Or put another way, the context matters.
- jakeasmith 6mo agoI have to agree with you. We don’t talk nearly enough about the real signal to nose ratio. (Sorry. I couldn’t resist lol)
- desireco42 6mo agoA developer using Claude Code found this bug. Claude is a tool. It is used by developers. It should not sign commits. Neovim never tried to sign commits with me, nor Zed.
- igravious 6mo agoShould not Is that your new law? The non-agentic “Neovim and Zed *never tried to sign commits [for]~~with~~ me” therefore no tool ever no matter how advanced is not allowed to sign a commit. Did it ever occur to you that for whatever reason you just might not be cut out for the software treadmill?
- jeremie_strand 6mo ago[dead]
- skeeter2020 6mo agoAnd with AI generating vulnerabilities at an accelerated pace this business is only getting bigger. Welcome to the new antivirus!
- bitexploder 6mo agoThere will always be more bugs than we can fix. AI can patch as well, but if your system is difficult to test and doesn't have rigorous validation you will likely get an unacceptable amount of regression.
- claudexai 6mo ago[dead]
- dfir-lab 6mo ago[flagged]
- PeterStuer 6mo agoThose 3 letter agencies are going to see their stash of 0-days dwindle so hard.
- jeremie_strand 6mo ago[dead]
- skyskys 6mo ago[flagged]
- yunnpp 6mo ago[flagged]
- CaptainFever 6mo ago[flagged]
- tosti 6mo agoMore like, if you pay a fee to use a service, you can find the bombs already hidden somewhere in your premises.
- tptacek 6mo agoAnd? They didn't put the bombs on your premises. Before "the service", you had bombs you didn't know about; after, you get to know about them.
- par1970 6mo agoBut the service also tells criminals and adversaries about the bomb locations.
- tptacek 6mo agoAnd? So do a variety of other services. Was it your impression that the criminals and adversaries were behind the 8 ball on this? AI is reviving debates about vulnerability research that we thought we killed off in the 1990s.
- tosti 6mo agoPerhaps the argument isn't about the ethics of security research, but rather the divide between those who can afford non-free software licenses and those who ethically or circumstancially can't.
- e12e 6mo agoI wonder about the "video running in the background" during qna of the talk: https://youtu.be/1sd26pWhfmg?is=XLJX9gg0Zm1BKl_5 https://youtu.be/1sd26pWhfmg?is=XLJX9gg0Zm1BKl_5 Did he write an exploit for the NFS bug that runs via network over USB? Seems to be plugging in a SoC over USB...?
- fguerraz 6mo agoInterestingly, I think 3 or 4 out of the 5 bugs would have been prevented / mitigated quite well using https://github.com/anthraxx/linux-hardened https://github.com/anthraxx/linux-hardened patches... (disabled io_uring, would have crashed the kernel on UAF, and made exploitation of the heap overflow very unreliable)
- redoh 6mo ago[flagged]
- altern8 6mo agoEvery time I read these titles, I wonder if people are for some reason pushing the narrative that Claude is way smarter than it really is, or if I'm using it wrong. They want me to code AI-first, and the amount of hallucinations and weird bugs and inconsistencies that Claude produces is massive. Lots of code that it pushes would NOT have passed a human/human code review 6 months ago.
- themafia 6mo agoIt's always the inconsistencies which amaze me, from the article: > I have so many bugs in the Linux kernel that I can’t report because I haven’t validated them yet You have "so many?" Are they uncountable for some reason? You "haven't validated" them? How long does that take? > found a total of five Linux vulnerabilities And how much did it cost you in compute time to find those 5? These articles are always fantastically light on the details which would make their case for them. Instead it's always breathless prognostication. I'm deeply suspicious of this.
- pixl97 6mo ago>And how much did it cost you in compute time to find those 5? This is the last thing I'd worry about if the bug is serious in any way. You have attackers like nation states that will have huge budgets to rip your software apart with AI and exploit your users. Also there have been a number of detailed articles about AI security findings recently.
- jakeasmith 6mo agoYeah, this was one of my first thoughts too. It’s impossible to know but I wonder how many of these “unknown exploits” have been in use by government agencies for years already. Or decades, apparently.
- spzb 6mo agoI'd be interested in how it compares (in terms of time, money and false positives) with fuzzing.
- 6mo ago
- Serberus 6mo ago[dead]
- simplesocieties 6mo agoSupposedly humans have become “100x”™ more productive with these AI tools, but nowhere to be seen are the benefits for the wielders of said tools. Is your salary 100x higher? Are you able to spend more time with your family/friends instead of at the office? Why are we still putting up with these outdated work practices if LLMs have made everybody so much more productive?
- becquerel 6mo agoAre you aware of how productivity has increased over the past century in general? That didn't lead to 100x wage increases or more free time. Labour is a market commodity and follows market rules. Increased productivity means more gets done in less time. It doesn't mean you spend less time working
- simplesocieties 6mo ago[dead]
- noritaka88 6mo ago[flagged]
- helenazdenova 6mo ago[dead]
- Srinathprasanna 6mo ago[dead]