ang_cire

> Is it inherently wrong to exploit living things for profit? If not, why are work animals not treated with the same level of disdain as human slavery? Horse riding? Disability assistance animals? Because they don't have the same desires as humans, the predominant concern is their wellbeing over the intrinsic wrongness of slavery.

That is why I said, I think most people handle this by telling themselves that animals aren't "intelligent" beings at all, and are mostly emotionless stimulus-reaction automatons.

I don't think Amodei is probably absurdly evil (in the way most people conceptualize evil), I think his paycheck just relies on a different incentive than his concerns about AI ethics. Like most people who end up doing bad things (not saying he is necessarily, but were he to), it's a matter of convenience, selfishness, or simple avoision of considering implications too deeply.

I especially think one aspect of normalizing/rationalizing actions with (potentially) harmful consequences is telling yourself things like,

"well, I can't put the genie back in the bottle even if I wanted to"

"someone is going to do this if I don't, and they'll be even less ethical than I will" (the change-the-system-from-within fallacy)

"If I ever discovered this was really harming someone, I'd stop"

"There's a line I won't ever cross, and as long as I stick to that, I won't fall prey to the worst impulses"

These are things people believe are self-imposed limits, but they're actually a means of convincing yourself that whatever you're doing... isn't whatever bad thing you've set on the other side of the line.

To be fair, purporting to care about the ethics of machine-slave-labor while IPOing based on the value of the machine-slave-labor you've been selling makes it kind of hard to trust the likelihood that you'll ever fairly examine (much less conclude negatively) whether you are in fact doing something unethical.

> I am hitting mod-D and dragging a selection box over the offending area, then hover-Q on a nearby element I want to use and shift-click to plan it, once I have planned one instance of a subpattern its mod-C select, click hold and walk in a direction to tile it in one dimension, mod-C select, click hold walk to extend this over the other direction.

This just sounds exhausting.

I'd rather try to sneak into a hyper-religious xenophobic town and get captured and turned into servant labor at a mining camp. And I'm not even taking about visiting Texas!

Imo most people have to do this to protect themselves from the actual (correct) implications of it, which would be that we're constantly abusing and murdering intelligent beings (and not just animals).

It seems like no one stops to ask, "isn't it kind of bad that we're developing this system of machine intelligence to be our code-writing slaves, without ever really interrogating the ethics? Maybe we don't actually understand how our own brains function well enough to assert it's not similar (especially as language goes) to these kind of weighted association graphs?"

Or even the "well we made it, so it's ours" responses, which we sort of answered a long time ago when we decided kids aren't property, but I digress...

> where is the challenge, other than complexity

Patience, for one. I reach a point where I'm looking at a mess of coal-fed sorters that need a complete rip-and-replace with electric ones, and that's usually the point where I close the game and go back to something easier like Kenshi.

Another thing AI can do that I can't...

Nah, this is the land of programmer-peasants, not VCs.

There are certainly some VC-wannabes here too, but most people here realize they're closer to being ground up as biofuel for the delivery bots, than being delivery-bot owners. It's hard to go through the layoff-cycles of modern IT and not realize this.

Were that the goal of the companies pushing this automation, you'd be 100% right, but they're not going to shift to UBI so you can do art instead of delivering food, they're going to just hoover up as much money from a market as they can and leave people destitute.

Avoision*

And that is going to have to change.

There are already plenty of methods that are low-impact to users, like certificate-pinning in apps, and all you have to do to make it per-user is roll in their user-specific key JIT when they download the app.

Users will not be happy (just as no one is happy Reddit is going app-only), but they will do it, especially when it becomes common as companies decide they don't want to be the 5th breach notification on HN in a given day.

Today we have Bun, Cursor, Northflank, and now Linode!

Almost no companies farm their security out to third parties. The era of MSSPs is long dead, except for small non-IT businesses like mom-and-pop law firms.

> Most orgs need to expose a lot more than that.

No, in fact there are only 2 kinds of connections:

1) public, necessarily allows anonymous/unauthenticated connections

2) non-public, doesn't need to allow unauthenticated connections

Name a service, and I can tell you which one it is.

Or put another way, there are authenticated and unauthenticated services. If you can authenticate someone at the application level, you could do it at the network level.

Most places have combined them at some boundary, for ease of access, but there is no case in which an authenticated application endpoint (even /login) has to allow unauthenticated network access to it.

And in all seriousness, name a service that is not a public website, but cannot use mTLS or IP allowlisting.

SFDC? mTLS. Customer webhooks? IP whitelisting. Data warehouse? PtP VPN.

1. That's fair, I didn't realize people were expecting my comment to be perfectly-aligned to every aspect of the thread parent, including the "their own hardware" part, but now I at least see where the confusion came from. For the record, any issues at this level of the stack are also present in IaaS, not just on-prem.

2. I still don't see where you got that they are only talking about configurations versus messing up an implementation (I.e. in a paramater they coded incorrectly)...

But that aside, even on AWS you're still configuring your proxies, gateways, load balancers, etc. AWS gives you just as much rope to hang yourself with as a box in a colo network cage does. Companies are already doing this stuff themselves, on-prem is not more security work. IaaS is about scaling and maintenance load, not security being handled for you.

1) where did you get "on-prem" from?

2) that's not what "rolling your own" means. Building your own web proxy is "rolling your own". Standing up e.g. Caddy and configuring it is not.

Ideally they need to divide those apps entirely; your public website doesn't need to talk to your app.

For stuff like Netflix that is truly consumer-facing, where mTLS or IP whitelisting are non-starters, the reality is you have to rethink your model entirely.

Also, I'm not sure where you got the idea I'm talking about on-prem only; this also applies to using IaaS/ cloud hosted infra.

You're still describing an environment that presents a pre-auth surface area beyond a listening port.

And I am literally a security engineer; the work has absolutely not gotten harder, it's just changing in how you think about security, just like it shifted before from "secure the perimeter" to "defense-in-depth", it's now changing again to focus on automated response and compartmentalization/ segmentation (and I mean real segmentation, not the checklist-style "we have 3 vlans, but they can all talk to each other" 'segmentation' you used to see.