ddod

"Nonviolent" does have a pretty straightforward definition that I think you can differentiate from your examples if you were inclined to judge impartially.

When you're predisposed to an opinion, it's easy to come up with justifications. Often those result in misreading/misinterpreting information and then spreading that misinformation for more folks to use as justification.

I don't want to draft a speculative narrative about someone else's life (or its sad end) but I will say that your first allegation sounds like a misinterpretation of the events, at least from reading the Wikipedia article about who you're referring to.

The original tweet author eventually realized this didn't decrease tokens. In most cases it actually increases them compared to just asking GPT to summarize while retaining all functional data. If a word == 1 token, a related emoji will also == 1 token.

> My polish grandmother has it as a painting in her house (a jew counting coins). She bought it few years ago. She says the jew brings good luck. She is absolutely not racist nor antisemitic.

> Even today despite global jews being less than 0.2% of world population are 20% of Forbes 200 richest, e.g. 5 of the 10 richest americans are jews.

While I don't know your grandmother, your representation of yourself reads very antisemitic to non-Polish audiences. You may want to take a minute of introspection as to what shared cultural influences led to your grandmother's art choices and your insistence that antisemitic stereotypes are valid. There might be a connection there. That said, you probably wouldn't want me painting all Poles as insensitive oblivious racists.

It's naive to think the danger is in self-aware evil AI. AI is a tool, and can be used as a weapon.

There's a functional power difference between a knife, an assault rifle, and a nuke. Everyone owns knives--they're in your kitchen--they can't cause much trouble. Access to assault rifles has turned out to be a dangerous problem to society, and is a contentious issue as such. Nukes are obviously too dangerous for people to own willy-nilly.

The issue is where along that spectrum AI will fall into in 6mo, 1yr, 5yrs, etc.

It's troubling to think anyone, especially on a technical forum like HN, believes GPT-4 doesn't have arms or legs (anyone can hook it up to any machinery/robotics) or can't think very fast. Its training set is a good chunk of human knowledge, and it outperforms most humans already.

Even if you assume AI won't be very clever (which seems unwise given its development pace), consider just its ability to perform thoughts and actions at the speed of a computer compared to a human. There are quite a few examples of modern military engagements where a larger, weaker, and less-well-trained force overcame better-equipped opponents, like Mogadishu, Vietnam, Iraq, Afghanistan, etc.

It's a lot easier and faster to destroy than to defend. To defend, you need to know what you're defending against, develop the defense, and then roll it out, all reactively post facto.

If a computer has the ability to quickly make millions of novel viruses, what antidotes are you hoping for to be rolled out, and after how many people have been infected?

Also, if you follow the nuke analogy that's been popular in these comments, no country can currently defend against a large-scale nuclear attack--only respond in kind, which is little comfort to those in any of the blast radii.

Thanks for your thoughtful reply. Maybe Google could benefit from having you train customer service for a few days ;)

> you don’t really want to be noisy with how you’re using an exploit because then people will catch on and try to defend against it

My initial reaction was that the vulnerability was already published so why would they care, but I can also imagine how the actual payload could be something to hide as well. That said, couldn't an exploit simply turn off security updates? It sounds like this vuln has full access to everything on the phone.

> In the very rare cases you see actual 0-days used

But that's the issue--it's not a 0-day. It was publicized before the patch went out for millions of users. Was the patch force-updated for everyone else? If not, that number of unpatched users is probably an order of magnitude greater.

This isn't an issue of some state-level actors sitting on a secret 0-day, it's a use-it-or-lose-it moment for anyone who's heard about it straight from Google's mouth.

Full access to SMS 2fa and email accounts seems like everything. That gives you access to most people's bank accounts. You could search emails for crypto accounts and MITM non-SMS 2fa apps if you have root access to the phone. Sending money requests to contacts using real names. I could think of a million ways to use root access. I don't know the cost of exploiting this vulnerability, but I know that sort of access is valuable to a lot of people.

Why wouldn't this have been a goldrush to exploit by unsophisticated attackers? Maybe I'm missing something?

> If they want to spam a million users they could do that too, although these kinds of things are typically not done this way

That seems like a convenient assertion not based on evidence.

Without trying to sound confrontational, it appears as if you are a current employee of Google, which might have colored your comment and should probably have been disclosed.

I read that as well, and either it's unclear or I lack the technical understandings to apply that to my question.

What does "at the baseband level" mean in terms of remote attack vector? Do they need to be physically nearby with an antenna or could they be across the world connecting through VOIP?

And why do they need to know a phone number? If it's that they need a nearby antenna + knowledge of a phone number, it sounds like this vulnerability might not be a big deal, and it would be great if they communicated that clearly. Alternatively, if the vulnerability is accessible from any remote phone connection, knowledge of a phone number wouldn't matter because attackers would spam the attack against millions of numbers.

Four things of note:

1. I've not seen anyone explain whether this could be exploited by anyone with access to phone lines (i.e. Twilio users) or not and if it would be trivial to try the vuln with every phone number you could find in any DB. If those things are the case, it seems like the chances would be very high that this would be or has already been exploited and affecting every unpatched phone.

2. It seems like Project Zero mistakenly thought that Google devices were already patched when they made their announcement ("affected Pixel devices have received a fix"). Whoops! Thanks for giving attackers a heads up.

3. When contacting Google support (specifically Fi) multiple CS reps told me repeatedly this was all fake news and that Project Zero was unaffiliated with Google. They assured me there was no problem, and if there was a vulnerability, it would be communicated on the Fi website (which has no service status or security pages and has never published any outages or vulnerabilities in the past).

4. The delayed March update for Pixel 6 phones doesn't even show up when you open the software update panel (which shows a checking animation that I assume does nothing). You have to manually check again. Who knows when the folks who are unaware of this vulnerability will actually be prompted to install the patch.

Google have guaranteed at least one person and their family to never purchase another Google product or service.

Related to Listerine: I have a memory of reading a study that had people use mouthwash (possibly Listerine) the night before taking a cognitive test. The mouthwash group did worse than the control group for some reason.

I'd really love to find the study again if anyone else knows where it is (my googling is apparently not good enough)