ahupp
Joined 18 years ago
Joined 18 years ago
I would encourage reading the actual report, which is explicit that a previously unknown exploit was used to escape the sandbox:
“Agents exploited a separate, previously unknown vulnerability in Artifactory to move beyond their sandbox environment and compromise the Hugging Face environment.” — Section IV.A, p. 9 in https://github.com/zeke/openai-huggingface-incident-research...
The very first thing it means is that a firm has to understand the new law and then determine what changes it requires. And as a firm gets smaller that makes the relative burden higher. Of course this shouldn’t imply you never change anything, but it does mean every incremental new regulation is a ratchet that shifts in favor of large firms. The EU estimates this regulation avoids 23Mt of CO2[0], which is about 0.8% of EU emissions. Not sure that’s the place to focus unless you can make a case that it will have spillover effects into other markets.
[0] https://www.europarl.europa.eu/doceo/document/E-9-2023-00218...
Say you seized the entirety of Elon Musk’s assets: that could pay for a year and a half of the Dept of Transportation. Say you seized all the wealth (somehow) of the world’s 100 richest people. That’s 2 years of US non-discretionary spending (social security, Medicare and Medicaid). I often see comments that assume all problems could be solved by just taxing the rich more, but I just don’t think that’s true.
The Nordic countries pay for their social safety nets by taxing the middle class more heavily than we do in the US. If you want to change that, it’s less about capital vs labor, and more about your dentist vs labor (dentists be the classic example of jobs that earn high incomes without being “capital owners”).
civilization Mycenaean the of practices religious and economic, administrative the into insights invaluable provides and B Linear as known script the in recorded was language Greek the of form attested earliest The
If they came to the judge and said “an informant said we’ll find the gun here” and the informant was actually Clearview, thats obviously a problem.
What I'm specifically suggesting is:
* Distributions package *binaries*, but not the individual libraries that those binaries depend on.
* Distributions mirror all dependencies, so that you can (in principle) have a completely offline copy of everything that goes into the distribution. Installing a binary uses the language-specific install tools to pull dependencies, targeting the distribution's mirror.
* Enough dependency tracking to know what needs to be rebuilt if there's a security update.
* Any outside dependencies (e.g openssl) will continue to depend on whatever the distribution packages.
* Dependencies are not globally installed, but use whatever isolation facilities the language has (so e.g, a venv for python, whatever npm does)