tptacek

7 ms·

151.
by tptacek 1mo ago
Wait, I must be misunderstanding you, because if you're resolving off Quad9, they can definitely poison your DNSSEC-signed records. Between a stub resolver and a recursor DNSSEC collapses down to a single "yes it was signed&quot
152.
by tptacek 1mo ago
That's a weirdly confident prediction. Why do you think 309 isn't going to fall in our lifetimes? "SHA2 will never be broken in our lifetimes" is something I've heard JP Aumasson say many times, but that's base
153.
by tptacek 1mo ago
Google directly competes with the grey market for vulnerabilities. They are competitive in a bunch of different directions: * They pay for vulnerabilities without reliable exploits (more for vulnerabilities that are demonstrably reliable).
154.
by tptacek 1mo ago
If the vulnerability is already being exploited in the wild --- as in, it's a vector people already know about and are tracking --- it's possibly not worth much at all. Vulnerability valuations depend heavily on the lifespan of th
155.
by tptacek 1mo ago
For the last 2 years, I've tracked the Tranco Top 1000 sites, continuously checking DNS to see if any major sites have turned on DNSSEC (6% of the Top 100 do --- many of them government sites). Over those last 2 years, a total of 8 sit
156.
by tptacek 1mo ago
Because they need it medically.
157.
by tptacek 1mo ago
Hard to imagine a diet of cultural significance that would put people into lifelong dialysis, at an epidemic scale.
158.
by tptacek 1mo ago
No, we wouldn't, you're right. We'd just replace LetsEncrypt and the ISRG with the security track records and policy integrity of the major DNS providers, many of which are state-controlled, and the largest of which are too i
159.
by tptacek 1mo ago
Nobody's denying this, but the interesting story about GLP-1s is that after you control for fat loss (for instance, by taking cohorts of patients that aren't losing weight ) you still get evidence of these off-target effects.
160.
by tptacek 1mo ago
I’m sure you can just look up the studies, but note that GLP1s are widely prescribed to people without weight issues —— weight loss itself was originally an off-target effect. I have friends who run marathons who are on semaglutide.
161.
by tptacek 1mo ago
I don't know that anyone really pays list price for injectables, because the vendors do discount programs. Without insurance coverage, tirzepetide via Amazon Pharmacy is something like $450/mo.
162.
by tptacek 1mo ago
Generally studies showing off-target effects with GLP1s are at least attempting to control for this.
163.
by tptacek 1mo ago
Unlikely, but not implausible.
164.
by tptacek 1mo ago
Go ahead, make an inbound connection to my dev laptop. I'll even give you the IP address: it's 192.168.8.21.
165.
by tptacek 1mo ago
I know that's an article of faith among networking people but it's not actually true.
166.
by tptacek 1mo ago
I cofounded a company that ultimately got rolled up (Matasano, into NCC Group US) and think this is not a really good summary of the article. Rollup strategy is interesting!
167.
by tptacek 1mo ago
"Saying Zitron is wrong because XYZ made $2 instead of $1" is not a reasonable summary of the post we both just read and I don't think there's a point in trying to hash this out further if you disagree with that.
168.
by tptacek 1mo ago
That's a gross mischaracterization of what Dan Luu demonstrates in this piece as anybody can see for themselves simply by clicking on it. But the radical divergence of our premises (mine: based on the actual article; yours: unclear to
169.
by tptacek 1mo ago
You keep saying this. It doesn't mean anything to "directionally agree with Zitron" in the context of this Dan Luu piece. All you're saying is "you're skeptical of AI and the AI business model". Bully for
170.
by tptacek 1mo ago
Zitron gives timelines, and they don't come true --- in fact, the opposite thing happens. You can't come back to that with "well, it hasn't happened yet". By that logic, no prediction is ever wrong; wait long enough
171.
by tptacek 1mo ago
I don't care whether he believes his own predictions, only that they're so frequently incoherent and false.
172.
by tptacek 1mo ago
When you predict a company is going to fail and instead it sets revenue records you're not "dramatic and exacerbated". You're refuted. Luu's post includes a (long!) list of specific predictions that aren't &quo
173.
by tptacek 1mo ago
Dan Luu's piece talks about this! He gives the example of Ray Kurzweil, who is similarly catastrophically wrong about everything, just in the opposite direction as Zitron. Luu's point isn't that anti-AI analysis is bad; it&#x
174.
by tptacek 1mo ago
Luu is pretty specific about the predictions Zitron is making, has taken the time to pull them out and date them, and they're both risible and not rescuable with vibes. His point isn't that Google or Meta are doing well or have br
175.
by tptacek 1mo ago
Why not? The code is famously convoluted and slow (see: dfhack). It's still an amazing accomplishment, but that doesn't make the code itself a challenge frontier models today aren't up to.
176.
by tptacek 1mo ago
I say this with all possible respect, reverence even, for what Tarn Adams has accomplished and what continues to work on, but there may be no worse messenger for the problem of disintermediating game designers and creators from actual code
177.
by tptacek 1mo ago
Instantly one of my favorite comments this year. Nicely done.
178.
by tptacek 1mo ago
This is a fantastic comment that I don't deserve for making fun of the complexity of Dwarf Fortress in comparison to the space alien technology we're building elsewhere. I come from a place of love (and fear --- I refuse to instal
179.
by tptacek 1mo ago
Yes when has a security mechanism ever pissed off Unix-on-the-desktop nerds like us before.
180.
by tptacek 1mo ago
So what we're saying here is that personal computers can run open weights models that can literally code earlier versions of Dwarf Fortress all by themselves, but handling lines of sight for a 101st dwarf in a mountain fortress remains

More ›