ctoth

21 ms·

361.
Andrej Karpathy – It will take a decade to work through the issues with agents(dwarkesh.com)
1212 points by ctoth 1y ago|1115 comments
362.
by ctoth 1y ago
The only cargo cult behavior I see here is Tett's own journalism! She casually drops that same debunked "95% of companies see no AI revenue gains" figure[0] without tracing it to source, performing the ritual of citation whil
363.
by ctoth 1y ago
And yet... > maybe my project is a toy (it is) or you think it's poor quality (it's not) but i'm able to do things in minutes that used to take days Just consider what this will be like as it gets better? Remember we'
364.
by ctoth 1y ago
You got me there for a minute. Pitch-perfect satire.
365.
by ctoth 1y ago
Let's say that they are 100% correct, we parse the subtext as text, it was totally him. We still do not know the critical details of how (and when) he stored the root password he copied out of their password manager (encrypted in his
366.
by ctoth 1y ago
Only management events, see https://news.ycombinator.com/item?id=45532772
367.
by ctoth 1y ago
CloudTrail's 90-day immutable Event History only logs management events (IAM changes, instance launches, bucket creation). It does NOT log: * S3 object reads/writes (GetObject, PutObject) - these are "data events" requir
368.
by ctoth 1y ago
So you almost certainly know that a lot of IaC tooling has terrible defaults like enable_log_file_validation being set to false. Based on the quality of their credential management and what else you can read from this blog post, how much wo
369.
by ctoth 1y ago
So the attacker turns logging off (was log file validation enabled? usually isn't in Terraform ) which does not fire an alert because there is no alerting. Then does their bad stuff ... Then modifies the logs (which are in an S3 bucket
370.
by ctoth 1y ago
Thinking about this a bit more... it sure is interesting that around the time of a competing project launch that something just happens which might reasonably completely compromise trust in the previous incumbent, isn't it? Odd!
371.
by ctoth 1y ago
So you would expect people to accept that the entire root chain of custody for the Ruby supply chain is attested by ... A guy saying he didn't do anything bad? I have a cool cryptocurrency you might wanna check out that I definitely do
372.
by ctoth 1y ago
AWS account root access on a language package registry for 11 days. Not EC2 root - AWS account root. Complete control over IAM, S3, CloudTrail, every-damn-thing. They're claiming "no evidence of compromise" based on CloudTrai
373.
by ctoth 1y ago
You can directly use Claude Code via its scriptable API (things like --verbose --output-format json --input-format json --include-partial-messages and then use your existing Anthropic plan. Otherwise yeah you'll have to start using AP
374.
by ctoth 1y ago
I've been using AI coding agents since the very early days of Aider and I think this is not quite true. There's a place for async agents. There's a place for collaborative agents. Collaborative agents may even soon be delegat
375.
by ctoth 1y ago
That's why I wanted to share that session specifically -- usually I provide a heck of a lot more context than that. But ... They were so well-known in personalityspace that that's all it took, which was its own funny.
376.
by ctoth 1y ago
I have been strongly-tempted to make Zitron and Marcus GPTs... But every time I think about getting started I realize a simple shell script would work better. Oh wait Claude did a better job than I would have: https://claude.ai&#
377.
by ctoth 1y ago
Plan mode (shift-tab twice) might be what you want.
378.
by ctoth 1y ago
Did this change since Uber was created? Did Uber previously, back when people were making their "Uber is Doomed" comments pay to maintain drivers' cars? If not why bring it up? This is a pattern where people have their pre-lo
379.
How Claude Code is built(newsletter.pragmaticengineer.com)
3 points by ctoth 1y ago|1 comments
380.
by ctoth 1y ago
Ah, it's the same playbook as their "free SSL for everyone" move years ago - take something that should be a commodity, offer it for "free," but make sure you're the chokepoint. Except this time they're tr
381.
by ctoth 1y ago
> There are lots of providers where I can buy a VPS somewhere and be in charge of configuring and patching it, but if I just want to hand someone a set of HTML files and some money in exchange for hosting, not many hosts fit the bill. Dr
382.
Autonomous robots are much closer than you think(dwarkesh.com)
2 points by ctoth 1y ago|0 comments
383.
by ctoth 1y ago
Yes. I am also blind. Blind people can use the word "see." Or ... did you have an actual point?
384.
by ctoth 1y ago
"Why wouldn't a locksmith make copies of all their customers' keys? They're a fucking locksmith company!" Having technical capability doesn't create ethical permission. The distinction between "can" a
385.
by ctoth 1y ago
The article states that the "attacker" downloaded the software via a Google ad, not deployed by their corporate IT. I'm also slightly curious as to if you might be associated with an EDR vendor? I notice that you only have th
386.
by ctoth 1y ago
A lot of us are missing what actually happened here. Some random person downloaded Huntress to try it out. Not a company. Not through IT. Just clicked "start trial" like you might with any software. Were they trying to figure out
387.
by ctoth 1y ago
https://www.etsy.com/market/malware_stickers or https://www.zazzle.com/alert_malware_detected_avoid_clicking...
388.
by ctoth 1y ago
I don't think anyone is unfamiliar with the consequences of installing potential malware. I think people are surprised that a seemingly? legit company is going off and having a little pokeabout on arbitrary computers based on nothing m
389.
by ctoth 1y ago
This makes total sense.. Except who is the SMB in this case? It sounds like the person just downloaded this off the Internet, it wasn't pre-installed by IT. So it sounds like Huntress has full and complete access to whoever downloads t
390.
by ctoth 1y ago
What is weird to me is that you have access to this information at all? It would make sense for the people who use your software ... the IT departments or whatever to have access but why on earth do your engineers need access? What gates ac

More ›