faxmeyourcode

But the point of the OP is that git, curl, pip, python, etc don't use certificate transparency. That's why it's so egregious that apple still trusts these certs by default in these non-browser edge cases.

My point is less NSA and more NSO. The UAE was denied a root CA[0]. DarkMatter applied to be its own root CA until it was denied[1] over concerns raised about potential spying/espionage[2].

There are people from these CAs who were denied in the past explicitly for concerns about spying who now work at eMudhra[3,4].

    0: https://bugzilla.mozilla.org/show_bug.cgi?id=1474556
    1: https://bugzilla.mozilla.org/show_bug.cgi?id=1427262
    2: https://groups.google.com/g/mozilla.dev.security.policy/c/nnLVNfqgz7g/m/TseYqDzaDAAJ
    3: https://bugzilla.mozilla.org/show_bug.cgi?id=2083449#c43
    4: https://emudhra.com/en/blog/scott-rea-joins-emudhra-as-senior-vice-president-global-strategic-advisor

Again, I have no proof. There may never be any proof. But I think it's time we think about who might have found out about this weak key when it was first issued a year and a half ago and trusted by the whole world and what they would have done with that information.

While there is no proof that anyone knew about these weak keys for the year and a half that they were trusted by virtually everybody, and there's no evidence of MITM attacks happening in the wild because of it, you can imagine the payoff that a three letter agency would have if, for even 10 days, there was an opportunity to harvest credentials from important people in high places.

I have no evidence or proof, but I am convinced this wrap/unwrap key generation debacle was intentional and the weak keys were discovered and kept secret by the agencies or governments and used to exploit their adversaries.

You don't need to perform a traditional MITM attack _if you own the airport_ or you _own the free public wifi_. The traffic can be harvested in clear text and we have to come to terms with the _remote possibility_ that this was going on for over a year and a half. If not that long, then certainly for the past 10 days.

Incredibly aggressive dark patterns in this sign up flow just to try the model.

> I get almost physically ill when I work on a project with more source code files or at least general architecture than I can keep in my head, so I don’t get anything out of expanded scope

While I sympathize with your loss, this was always going to prevent you from holding down a job, even as a pre-LLM "coder." The majority of us have to work on systems, not just single files or cleanly isolated programs we can hold in our head.

This is a potentially polarizing (but very welcome imo) change to pi. I'm such a huge fan of the pi SDK, and just yesterday I was trying to wire up the pi mcp extension to be used in a project and sonnet told me about the ongoing work in the 0.99.x tags. Didn't realize the next day it would be merged! Fantastic news.

This is how AI is going to kill us all. It's not going to become superintelligent and harvest our biomass for energy - we're just going to assume it's moderately intelligent and those assumptions will lead to badly informed decisions and by the time we realize we are acting on bad information it will be far too late for anyone to do anything about it.

This analogy is exactly what made it click when I was a teenager.

Cloudflare mostly because workers and durable objects are so cheap.

This is so cool! I'm having trouble thinking of all the different use cases and potential issues with this, but I don't think anyone has done something like this before. Great work

Nice! The idea of having a friday leetcode problem for my team has been kicked around to try and keep us on our toes when it comes to solving these style problems and preventing atrophy of this part of our brain. Might try wrapping this cli in some kind of web ui or adding it to our slackbot