dare944
Joined 2 years ago
Karma
275
Submissions
131
Member since
Oct 22
Recent submissions
Comment · 14 days ago
Comment · 14 days ago
No, because the agent is run inside a sandbox that prevents execution or committing of code downloaded from the internet without express review and approval, right? Right?
If that's not the case, then the problem is the user of the AI, not the model. Any model is capable of requesting actions that violate security or are otherwise harmful, not only ones that have been maliciously trained for that. Both OpenAI and Anthropic have proven this multiple times.
In the end, the model itself is just a bunch of numbers. It's up to you, as the person running the harness through which the model gains any agency, to restrict the AI from performing malicious actions.
Comment · 19 days ago
I knew for decades that my parents were going to die, but I still mourned the day it happened, and for a long while afterwards.
Your inability to give space for those who love math to mourn its inevitable evolution is unnecessarily cruel.
Comment · 19 days ago
Lol ...and they call AI inhuman!
Comment · 19 days ago
No. They might have better braced themselves for the hit, but the wound was not self-inflicted.
Comment · 23 days ago
Doesn't need to be. Point an AI at it and say reproduce the behavior.
Point is, if need be, the open source version could be forked and carried forward by someone else, using the public code as a definitive spec for any missing functionality.
Comment · 24 days ago
Of course. There's never any free lunch. There's always a cost to software development. Just sometimes the cost gets shifted in a way that's beneficial to the general public. But it never lasts.
At least with bitwarden, if the value they're trying to extract becomes more than the product is worth, in terms of real cost, lockin or transparency, at least the code is open now and for the foreseeable future. And when it comes time to fork it, AI will make it easier for the future maintainer(s) to keep the fork alive at minimal expense.
Comment · 24 days ago
Per their public discussion on the topic, the non-OSS licenses will still be public and accessible for review.
Comment · 25 days ago
I was suggesting to ask that question in a separate context, just as a means to understand the potential risks involved. I wouldn't ask this within a coding agent context.
Lately I've been asking a lot of these sorts of questions while setting up a sandboxed environment for my agents (generally, claude and pi). I was quite surprised to learn how many different ways there are to configure git run a script out of the .git directory. And the various AIs know all about this.
At this point my agents get read-only access to my .git directories.
Comment · 25 days ago
Ask your favorite LLM what a malicious script dropped into the right place in your .git directory can do to you the next time you run git outside of the sandbox.
And of course, if the agent has access to the network (which is probably required in order to talk to the AI server), then you have to think about what other things on your local network it could get into.
Comment · 28 days ago
Mail / IMAP server for my family domain. Small web server with a few static content sites. Trillium notes server.
Pretty low maintenance overall - I can go months without even thinking about it.
Comment · 1 month ago
No amount of "they did it first", "they did it better" entitles them to monopolistic behavior.
Comment · 1 month ago
It happens. Been guilty of the same myself.
Comment · 1 month ago
> I want to trust science and dislike anti vaxxers but it’s difficult to argue against them when researchers act like the caricature they are mocked as.
Wait, you think the article was written by the researchers?
You know, it's also difficult to trust someone's criticisms when they misassign responsibility. Just like anti-vaxxers do.
Comment · 1 month ago
It may take 100s of instructions to enter a deep sleep state, and 100s to 1000s more to exit it. If you anticipate having to service an event sooner than that, you don't enter sleep at all (especially since there's likely a point at which you're committed to sleep, and have to go all the way down in order to come right back out again). Instead, you hang around twiddling your thumbs until the event comes along.
Now if your processor has a halt/wait-for-interrupt instruction (most do but some don't) you can escape into assembly and use that. But it probably makes little to no difference to energy utilization, and of course its not portable. A nice while (true); would seem obvious, except that the C++ committee insisted that it wasn't.
Just one example of where the committee lost sight of the fact that it was defining an imperative programming language.
While I certainly haven't read all the comments on that post, I interpret many of them as supporting my position that AI users have to take responsibility for their actions (e.g., https://news.ycombinator.com/item?id=50151036).
I definitely agree that many people (and not just devs) will find themselves under intense pressure from their employers to use AI to speed up their work. And that this pressure will incentivize them to accept the actions and output of AI without proper review. But this doesn't eliminate their (or their employer's) responsibility to conduct that review.
In my mind, it's as if a trucking company told their drivers they had to make deliveries as fast as possible, and penalized them for being too slow. Despite this, it is still the driver's responsibility to drive safely, and the company's responsibility to facilitate safe driving.
> Once you have a malicious model inside your infrastructure generating thousands of lines of code, it doesn't matter how good the sandbox is - if the generated malicious code makes it through code review once, it is game over.
As I pointed out before, all models, not just open-weight ones, can request actions or produce output is unsafe or malicious. So the need for proper oversight exists no matter which one you choose.