ori_b

7 ms·

91.
by ori_b 6mo ago
https://www.businessinsider.com/jensen-huang-500k-engineers-...
92.
by ori_b 6mo ago
LLMs can't count well.
93.
by ori_b 6mo ago
If Uber is like most other companies, there's a leaderboard for AI tokens consumed. If maximizing your token usage is going to get you to the top of the leaderboard, and therefore promoted for "productivity", people are going
94.
by ori_b 6mo ago
Yes, and just because someone else has been dumping trash in the woods doesn't mean you should. That said, the social media feeds are so trash filled that I avoid them; it's extremely depressing opening up an incognito youtube and
95.
by ori_b 6mo ago
No . Both are offensive denial of service attacks on people's limited attention.
96.
by ori_b 6mo ago
Yes, if you release the vulnerability as soon as possible, that's a good choice. If you have an embargo and make sure that fixes get out to users in a timely manner before ending the embargo, that's also a reasonable choice. If yo
97.
by ori_b 6mo ago
I'd also prefer immediate disclosure, but I don't get how waiting a month without telling anyone is good regardless of which side you land on.
98.
by ori_b 6mo ago
I see, may the people who are responsible for the infrastructure you depend on be less concerned about shifting blame than you are.
99.
by ori_b 6mo ago
I'm confused. Can you explain how this applies to the current situation, where no vuln reports were submitted to the groups responsible for distributing patches?
100.
by ori_b 6mo ago
Mind explaining how sitting on it a month after the patch landed is 'faster'? To my mind, that's a month where attackers could analyze commit logs, but maintainers are not acting with urgency to ship fixes.
101.
by ori_b 6mo ago
Really? It seems very odd to not check in on the status of the fixes, even if it's technically possible to pass the blame to other people. Even if the only purpose of looking at the status to make yourself look good in marketing materi
102.
by ori_b 6mo ago
...no shit? Why do you think people care about this issue?
103.
by ori_b 6mo ago
Yes, it's just incompetence from everyone involved, not malice. The company making the disclosure doesn't actually care, and the kernel processes are ineffective.
104.
by ori_b 6mo ago
If the maintainers were unresponsive, sure -- but it seems slightly hard to buy that a responsible reporter trying to make a big splash and a good impression wouldn't first check "did this make it out to the distros?" before
105.
by ori_b 6mo ago
But they didn't release immediately -- they waited a month, but forgot to tell the distros, and forgot to check if waiting a month had actually lead to distros picking up the patches and shipping them.
106.
by ori_b 6mo ago
Imagine how much quicker the distros would have reacted if they were given a heads up a month ago. But, sure, I guess kudos to this company for not being actively criminal, and merely bumblingly incompetent and overly eager to get their mar
107.
by ori_b 6mo ago
Patches are still in the process of landing in most major distros as of the time of this writing. Most users are not able to get an update through their distro's packaging mechanisms.
108.
by ori_b 6mo ago
Basic care would involve making sure the patches had made it into the wild before ending the embargo, and nagging the relevant parties if not. Edit: As of this writing, most distros including Redhat, Fedora, Debian Stable, do not have patch
109.
by ori_b 6mo ago
Or a/b testing.
110.
For Linux kernel vulnerabilities, there is no heads-up to distributions(openwall.com)
601 points by ori_b 6mo ago|548 comments
111.
by ori_b 6mo ago
It's not. Invariably, the code is locally fine and globally nonsense.
112.
by ori_b 6mo ago
What does your investor expect as far as returns, and how are they going to get it?
113.
by ori_b 6mo ago
https://en.wikipedia.org/wiki/Generic_you
114.
by ori_b 6mo ago
Note the lack of concrete numbers on how much they have scaled. Somebody may have just asked an LLM for projections.
115.
by ori_b 6mo ago
You can cancel the migration, no need for sunk cost fallacy.
116.
by ori_b 6mo ago
Slop
117.
by ori_b 6mo ago
I don't think it should be socially acceptable to perform a denial of service attack on people's attention.
118.
by ori_b 6mo ago
I genuinely find chess pretty uninteresting. I kill some time with it occasionally, I guess, but like gaming in general, I could never get into it, not when there are puzzles with unknown answers out there.
119.
by ori_b 6mo ago
Because it's already doing an OK job. Like it was coding 2 years back. I'm not optimistic enough to say that it'll never get better.
120.
by ori_b 6mo ago
Chess is boring; it's been solved. I'm not really looking forward to a future where the only thing I get to do is play with toys while waiting for the AI to refill the cat food bowl.

More ›