saurik

15 ms·

241.
by saurik 1y ago
Let's say I use the Supabase MCP to do a query, and that query ever happens to return a string from the database that a user could control; maybe, for example, I ask it to look at my schema, figure out my logging, and generate a calend
242.
by saurik 1y ago
FWIW, I don't think you can enforce that correctly with human code either, not "in between those contexts"... what are you going to filter/interpret? If there is any ability at all for arbitrary text to get from the one
243.
by saurik 1y ago
(EDIT: THIS WAS WRONG.) [[FWIW, I definitely can imagine that (and even described multiple ways of doing that in a lightweight manner: pattern whitelisting and fine-grained permissions); but, that isn't what everyone has been calling a
244.
by saurik 1y ago
You said you wanted to take the one agent, split it into two agents, and add a third agent in between. It could be that we are equivocating on the currently-dubious definition of "agent" that has been being thrown around in the AI
245.
by saurik 1y ago
Adding more agents is still just mitigating the issue (as noted by gregnr), as, if we had agents smart enough to "enforce invariants"--and we won't, ever , for much the same reason we don't trust a human to do that job,
246.
by saurik 1y ago
Ruby is complex as it does the thing I said: 1) return is bottom, and so you can't have return "statement"--most people call it a statement even though it is a "void value expression"... but, like, once the type of
247.
by saurik 1y ago
It wasn't just one model that was broken--though the one you are thinking of was particularly bad--but of course it is a combination of bad design and a defect... what else could it be?... the batteries somehow revolting?... a coordina
248.
by saurik 1y ago
We already did migrate to that license: (A)GPLv3+. You can use my code if-and-only-if you won't then hoard your own changes from the world and lock users of your derivative software away from having the same empowerment you did. It isn
249.
by saurik 1y ago
But when the batteries fail, do they catch on fire? That's the problem with Samsung, lol :(.
250.
by saurik 1y ago
This is the problem that AI solves, though: rather than steal our code directly, now the thieves will just ask their favorite AI to generate a new project that does exactly what our (A)GPLv3+ projects did, which it will be able to do only b
251.
by saurik 1y ago
I might be missing it, but, after going through that entire page, the only things I am seeing that are relevant are the following four sentences, and none of them provide a rationale? > Currently the Debian armhf port requires at least a
252.
by saurik 1y ago
The original two generations of iPhone were armv6 with hardware floating point, so that always felt to me like the sane baseline. Android wasn't using hardware floating point on armv6, but I think that was only because the compilers th
253.
by saurik 1y ago
I almost never see people "handle" errors and actually add value, though... it feels a lot like how people sprinkle timeouts throughout their logic that just serve to make the system less stable. Almost all of the time--like, seri
254.
by saurik 1y ago
> Governments don't run CAs, and even then, a single browser had to amass so much market power that they could dictate terms to the CAs (and, in the process, kill some of the largest CAs) in order to make CT happen. If we accept thi
255.
by saurik 1y ago
Well: 1) it isn't always the case that the people who develop a system in the center of an ecosystem are actually the people who know best how the entire ecosystem should work (and in fact there is an entire trope of second system effe
256.
by saurik 1y ago
And yet, abandoning X for Wayland --not to start developing Wayland, but to actually stop using X and start using Wayland--is MUCH easier to do now than it was to do five years ago, despite all of the people (maybe including yourself) who
257.
by saurik 1y ago
This is really brittle, though, and in a way that matters a lot more than reproducible builds. Like, sure: a slightly different compiler might cause a slightly different bug to be introduced into the code, but here a slight bit of non-deter
258.
by saurik 1y ago
I mean, does it? I was under the impression that it enforced double- or even triple- buffering, which is NOT what you want in "here is my output, put it on the display plz" situations. Maybe you are implying that they finally fixe
259.
by saurik 1y ago
I know about XWayland, but trying to go to war to modify an infinite number of random window managers and the ecosystem of tools that plugged into the X backend is, to me, the thing which should have been avoided by thinking about the proje
260.
by saurik 1y ago
> ...people who get used to "everything is an expression" languages tend to prefer it, I've found. This feels awkward as my mental model is that in "everything is an expression" languages you simply DO NOT offer
261.
by saurik 1y ago
This just feels like the kind of thing the people who built Wayland should have focussed on for their first real release, as that would have allowed them to simply deprecate X11 immediately with a "better" architecture rather than
262.
by saurik 1y ago
As someone who once worked on a product that had to carefully walk the line of legality, I haven't found any mention in this discussion of what I imagine is a key problem for qemu, that doesn't face other projects: as an emulator,
263.
by saurik 1y ago
> It is a valid bug. But is it a high-severity security bug?
264.
by saurik 1y ago
FWIW, if you are cross-compiling, while you might get a vaguely usable result by ignoring all of the warnings and letting worst-common-denominator defaults get applied, you absolutely should be paying more attention and either manually prov
265.
by saurik 1y ago
It isn't at all obvious to me that the LLM can decide to blur their vision, so to speak, and see the tokens as tokens: they don't get to run a program on this data in some raw format, and even if they do attempt to write a program
266.
by saurik 1y ago
It is frustrating that this article just throws out that WebRTC is somehow a non-starter without any attempt to explain why.
267.
by saurik 1y ago
This seems like the wrong trade-off; and, if it really mattered, we--including you--should be working to push DNSSEC/DANE to improve, not for people to double down on WebPKI. Maybe we need to be advocating for DNS transparency, for exa
268.
by saurik 1y ago
> ...you'd still be contending with a "personal CA" that in most cases would have its root of trust in a PKI operated by world governments... WebPKI is already making this mistake (due to ACME). DANE at least is honest abo
269.
by saurik 1y ago
(Click the comment to bring it up to the top-level; AFAIK, the "rate limit" you are talking about is more related to tree depth.)
270.
by saurik 1y ago
DANE.

More ›