dns_snek

13 ms·

121.
by dns_snek 4mo ago
> Its extremely difficult to build a clearly logical structure where a company that made a wildly successful product needs to hand half the value to the government. I think it's rather simple. If they don't do that, does the
122.
by dns_snek 4mo ago
> they're not sandboxes Yes they can be, and Codex offers one. It uses Bubblewrap and seccomp on Linux which are perfectly capable of restricting filesystem access. In a default setup every command is executed inside a restrictive s
123.
by dns_snek 4mo ago
> does the state have a fair claim to €5B of it when the company at most with the most generous possible estimate (and then double it for good measure) used €50M of state services? Yes, it does. Quite simply because that's the law,
124.
by dns_snek 4mo ago
The marginal cost of nuclear energy is 14-20% of the total cost according to pages 39,40 of [1]. The point I'm making is that claiming that AI labs would be profitable if only they could stop spending money on the only thing that makes
125.
by dns_snek 4mo ago
Those are 2 big "ifs". The incentives are completely misaligned and the platforms work for the companies. They would now have an even bigger incentive to stonewall and close valid issues than they did before. They already like blu
126.
by dns_snek 4mo ago
Response: https://www.wheresyoured.at/anthropics-profitability-swindle...
127.
by dns_snek 4mo ago
Nuclear energy is really cheap too... as long as you ignore CapEx, would you like to invest?
128.
by dns_snek 4mo ago
> A least-cost combination of all the technologies has also been identified (shown in Fig. 3 as Least Cost Mix). Under the IEA/WEO 2023 cost assumptions, the least-cost solution comprises a combination of offshore wind power (66%),
129.
by dns_snek 4mo ago
> It means they are agents of the corporations, not agents of the users. Of course they are, assuming otherwise has always been naive.
130.
by dns_snek 4mo ago
> If you want to have one-time JWTs you need to maintain a revocation list. No, you always need a revocation list if you want to handle user sessions in a secure manner. What claims do your tokens contain? If it's anything other tha
131.
by dns_snek 4mo ago
> by revoking network you don't lose privacy Be careful, apps can still communicate with other apps, e.g. revoking the network permission doesn't stop apps from fetching and displaying ads over the network. I don't know en
132.
by dns_snek 4mo ago
RAM prices, surely?
133.
by dns_snek 4mo ago
> Sure you do. You just don't have a society that looks like ours does. You've skipped a few steps, until you overthrow the government all you have a broken society with a system of governance that's deemed to be illegitim
134.
by dns_snek 4mo ago
> unless you presume government is beneficial That's the constitutional bedrock of our societies. That doesn't mean it's always true but if you denounce that as a legitimate and achievable goal then you don't have a s
135.
by dns_snek 4mo ago
There's no reason to believe that [0] has anything to do with WASM, [1] and [2] are runtime implementation bugs, [3] is a vulnerability in a "weak" sandboxing library VM2 - it has nothing to do with WASM as such, and [4] is a
136.
by dns_snek 4mo ago
> Have you rolled the numbers, vs all of the high-pri security updates that will be missed on day one, and exploited? (Different person here) I don't have data and I don't think I need it. You either have a process to push secu
137.
by dns_snek 4mo ago
Unsurprising, agents' solution to everything is writing more code . They'll happily reinvent the universe (a really crappy one). Bug? More code . Unexpected behavior - read the docs? Couldn't find anything . Let's tr
138.
by dns_snek 5mo ago
Malware running on your computer can engineer a situation where you would naturally press that without suspecting anything. 1. Malware logs you out of github.com 2. It waits for you to navigate to the login page 3. It initiates an SSH/
139.
by dns_snek 5mo ago
As long as you're fine with the types being semantic gibberish because all agents I've used take the lowest effort approach to make the error go away. You probably have the same logical type duplicated in 3+ different places (at l
140.
by dns_snek 5mo ago
More generally you can use "no-restricted-syntax" rule to forbid almost any type of syntax by matching AST against CSS-like selectors. https://eslint.org/docs/latest/rules/no-restricted-syntax http
141.
by dns_snek 5mo ago
Do you update your dependencies and push to production every single day? Saturdays and sundays too? What are the chances that your code is using a vulnerable dependency AND doing so in an exploitable manner AND the vulnerability being serio
142.
by dns_snek 5mo ago
A keyboard doesn't "do" the work. In other words, the more work you outsource to AI, the lower your value-add becomes, the easier your are to replace by someone doing the same thing for cheaper.
143.
by dns_snek 5mo ago
It doesn't matter how much of the package you use. Here, you can use literally 0% of Koa and get pwned by one of its transitive dependencies (koa > cookies > keygrip > tsscmp) by simply importing the parent package: mkdi
144.
by dns_snek 5mo ago
Most of them? Ruby gems have hooks, Python has setup.py, deb, rpm have them too (relevant if you're installing from 3rd party sources). Elixir/Mix doesn't technically execute code on install, but your language server builds t
145.
by dns_snek 5mo ago
> but NPM makes it dangerous to merely open a project up in an IDE. It does not. Opening a project in an IDE has always been dangerous because there are about a thousand language server and analysis tools that run in the background. This
146.
by dns_snek 5mo ago
> since a bunch of people responding with "every package manager can be hit!!!" npm, by design, allows all packages to run package supplied arbitrary code as the logged-in user after an update completes. This is semi-common and
147.
by dns_snek 5mo ago
Now factor in number of copies sold, distribution costs, additional revenue sources...
148.
by dns_snek 5mo ago
Agents should make better use of OS sandboxing facilities with finer-grained ACLs. Less: Do you want to run "npm run build"? More: "npm run build" tried to read your Chrome cookie database, do you want to allow that? Som
149.
by dns_snek 5mo ago
That's a great example of how dangerous actions are perceived as innocent. The entire model of approving specific commands is absolutely bonkers. npm run build = run an arbitrary shell command written in package.json Meanwhile the agen
150.
by dns_snek 5mo ago
You misunderstood and it's really simple. Implying that on-device scanning makes it impossible for them to access any information is misleading. Just drop that faulty reasoning because it creates a dangerous misunderstanding of how tec

More ›