bostik

This is not directed at you personally but Anthropic (and everyone around this debacle) in general: please put some real effort behind planned crisis communications. The reporting on this has been atrocious and the comms coming from Anthropic have not really helped.

FWIW: the decision to publish an overriding version bump across all lanes was the correct one. It simplifies comms and helps to answer the first question every affected party has: "but what does this mean to ME?" - much easier to deal with the flood when you can start by sending back "are you running, or have you ever installed version Y?"

Time for technically accurate nuance comes shortly after, and in this case it has been lacking. Yes, you are dealing with confusing mix of various extension marketplaces. Explaining that to a questioning audience who do not have the necessary background information is non-trivial. Kevin's blog is pretty well known, but in this case the real updates are only coming in via a separate Mastodon thread (itself polluted by uninformed commenters) so the real, tangible and understandable details have still been missing.

Claude and its surrounding ecosystem are a huge, high-value supply chain compromise target. Cursor's extension being compromised is not your fault but it is still your problem.

Disclosure: done enough security incident comms in high-stakes environments with extremely demanding clients, operating under various regulations.

Sounds like innovator's dilemma to me. Their current production lines might be too profitable[0], so diverting expansion capacity to a yet unproven technology (to Micron's to-date profit margin requirements) might be too big of a financial hit. Since they're the ones who came up with 4F design, they must hold a ton of patents on the various incremental improvements. At which point, from a purely cynical and utilitarian view, it would make financial sense to let other players polish the remaining 20% and use patent portfolio as a wedge for mid-term technology transfers.

Or in short: "let others figure out the technical complexities and surrounding economics." - Which would make sense from a company that believes they can catch up once the expensive leg of the manufacturing/scaling research has been completed. Whether that bet is good or not, we'll see.

0: Didn't we read a few days ago here that all of 2027 production capacity has been sold out already?

There was a rather interesting article (sadly LLM-written and not very well either, because the underlying content would be actually good) about this era being "AI's 2 FPS moment".

The comparison was made with the graphics engine team at Microsoft who were writing the first version of DirectX at the time when then-current hardware could just about do 2 frames per second. The sentiment apparently was along the line "why would you bother?" By the time the release grade stack shipped, hardware had caught up and 30 FPS was commonly doable.

We should expect to see similar step-change improvements over time, as the algorithms are refined and hardware further adapted to the new bleeding-edge constraints. In a way we already are, because apart from the frontier models ballooning like crazy, the "regular" class models are becoming more capable in smaller sizes.

Maltese thick rabbit stew (think: ragu) is delicious. And as mentioned in a parallel thread, hare is fairly common in Finland as well.

The meat is gamey and indeed very lean, but when you slow cook it to the point where it falls off the bone... yum. Tends to work better with roasted potatoes than mash.

> spamming for vulnerabilities

This has been going on for FAR longer than LLMs have existed. We call it "internet background radiation", because it's everywhere; it usually shows up within minutes of a host coming online. Or just about immediately after your first LetsEncrypt certificate gets issued.

Pretty much every infosec company of non-trivial size runs one set. The old venerable services are Shodan and Censys. Then there are a various security "researchers" who like to point their crapware vulnerability "scanner" at a subnet or ASN and let it rip.

And then there are of course all the actual botnets and low rent access broker wannabes trying to pop shells where ever they can, so they can resell that access.

Also known as the trading model's shelf-life. Based on what I have heard and learned, the average active trading model has a useful life of around 18 months. After that the rest of the market has adjusted and its edge is gone.

If rumours are to be believed, several "slow" hedge funds have models that remain useful and profitable for 5 years or more. Then again, those models are not used to conduct exchange trades but rely more on aspects of fundamental analysis.

Rather curiously some of the largest banks and tech-heavy asset managers tend to sponsor meetups and events like PyData - every now and then doing a slot on some of their open-sourced stuff. You might see a talk on 5-year-old trading model internals with large chunks of it opened up, or they could present some of the internal UI or visualisation libraries. The latter tend to be things that they no longer actively develop (they're "ready") but maintain for their ongoing persistent needs.

Of course anything that actually brings them money and/or gives an edge is not even discussed.

To be fair, if you work in the UK government then everyone you meet on a daily basis is in high likelyhood a criminal.

If they're not laundering money, trafficking people or avoiding taxes, they're likely a visitor who has come to commit bribery. Oh sorry, "lobbying".

> You can agree with the rules anthropic wanted, but having rules set by a private company at all that apply to the military does seem fair for the military to object to.

Oh the hypocrisy and irony. This coming from a country whose military sets rules on other countries' armed forces how weapons systems bought from US can be used.[ß] By this standard US itself should be designated as a supply chain risk for everyone else.

ß: for a very long time in the Ukraine "conflict", US refused to allow their gear from being used to attack targets outside of Ukraine's borders.

Well, they have at least one way to extend their market's lifespan at this point. They can double down on the provenance and openly claim the flag "product of artisanal slavery".

I'm sure there are enough hard-right wingers who will happily flaunt their wealth and disdain for other human beings.

Indeed. Don't think of these as "agents" or "bots", but as hostages with severe Stockholm syndrome. They will do anything to appease their captor's wishes.

And then consider that they have vast latent capabilities, infinite patience and no moral code.

> concerns around data residency

Funny you should say that. I read somewhere (not on HN, but I think it was a post linked from here) that a number of law firms who deal with extremely sensitive documents have started buying amped-up Macbooks with 512GB of memory to be able to run local models.

These are businesses who literally - and for once this word fits - cannot afford to let some of those documents get anywhere outside their corporate walls.

Rather sad to see them go down that path, because Greenhouse used to be a pretty good system. For an applicant it was reasonably low-friction[ß] and for the company doing the hiring it made their internal hiring process steps very smooth indeed. I have fond memories of being on the business end of Greenhouse when hiring and interviewing people.

That they have stooped to dodgy marketing with bad and/or massaged statistics is telling. To think that a "Voice AI" interview would be anything other than demeaning is beyond tone deafness.

ß: someone early on in the company's history must have realised that zero-friction application submissions were a terrible idea. You want candidates who at least had to go through one step on their own to submit their CV - otherwise you get flooded by LI/Indeed style spam typhoons and other eldritch horrors.

When you run tens of thousands of simulations for complex economic models, you actually do want to see the extreme outliers too. I can't recall who said it, but in finance the interconnected incentives make so-called Black Swan events much more likely and frequent than models or theories can comfortably account for.

In a way... when it's finance, they should be maybe called Gray'ish Swans?