foundry27

Me too lol.

It was only at question #8 that I realized there was a third option, and while I’d love to say that accounts for how I got a 1/10, after reviewing the third options I doubt it would’ve made a difference.

DO NOT INSTALL THIS VIA NPX OR OPEN THIS REPO IN VSCODE. This repo has been infected by malware.

It seems like it was added in commit 74f317d at 11:06 UTC today, with five new hidden files being added under .claude and .vscode that together seem designed to either a) autorun a vscode tasks.json entry, or b) run a Claude session start hook, that will execute a large obfuscated payload. The payload looks like it will fingerprint your system and try to exfil your GitHub tokens.

Edit:

- It also exfils your AWS credentials (~/.aws/credentials, ~/.aws/config), named AWS profiles, and AWS secret managers and SSM parameter store contents

- Same with K8s secrets, with specific searches for GitHub and npm tokens, AWS keys, GCP keys, Azure keys, Stripe keys, Slack tokens, and Twilio keys

- Same with HashiCorp vault contents

- It will try to use your GitHub tokens (if they have the workflow permission) to run actions on your repository and try to exfiltrate secrets from there

- It will try to read a whole bunch of files from your local environment. I didn’t manage to extract the exact file list, unfortunately.

- If the normal C&C server is not available, it tries to create / select a GitHub repo, and commits your data as results-*.json files 100kb at a time

- It also has a bunch of stealth and persistence measures that I’m not qualified to really analyze. Don’t assume that deleting the files is necessarily enough.

Rotate your keys, folks.

I like this idea. This might be one of the more effective social pressures available for getting inference providers to fix long-standing issues. AWS Bedrock, for example, has crippling defects in its serving stack for Kimi’s K2 and K2.5 models that cause 20%-30% of attempts to emit tool calls to instead silently end the conversation (with no token output). That makes AWS effectively irrelevant as a serious inference provider for Kimi, and conveniently pushes users onto Bedrock’s significantly more expensive Anthropic models for comparable performance on agentic tasks.

I’m not sure if this is just an “on mobile” thing, but I can’t find any reference to ISO 27001 or SOC2 at that datacentres URL. Taking your word for it being there previously, this seems like a major red flag! Faking these certs is no joke, and silently removing references to that after being called out would be even more of a bad look.

@ybceo you seemed to represent this org based on your previous comments, is the parent commenter missing something here?

I get it, really I do. But do the HOAs really need financial enforcement mechanisms intended to seriously harm people, and to punish them as judge, jury and executioner? A HOA’s legal job is to maintain the common-interest property and enforce the CC&Rs. It is not a HOA’s job to extract enormous sums of money out of its members, even annoying ones. The right lever to pull to get some rich person partying at 4am and trashing the place (for example) to stop is for the HOA to file for a court injunction after repeated violations; once a judge orders “no loud music 10 pm - 7 am”, the next 4 am party will become contempt of court, which is a problem for the cops, not the HOA. Hell, 4 a.m. noise is a municipal nuisance and probably a crime; people should be calling the cops every time it happens. Individual members could even sue the owner in small-claims court for private nuisance, where judges can issue even more injunctions or award damages. All this to say, you don’t need to take people’s money to get them to stop doing bad stuff. But you do need to take people’s money to get rich, and to hurt people. This new legislation should be deeply concerning to people interested in the latter, and IMO shouldn’t really be a concern to people interested in the former.

It’s easy to be fooled, myself included it seems :)

For context, here’s a handful of the ChatGPT cues I see.

- “wasn’t just my backup—it was my clean room for open‑source development” - “wasn’t standard AWS incompetence; this was something else entirely” - “you’re not being targeted; you’re being algorithmically categorized” - “isn’t a system failure; the architecture and promises are sound” - “This isn’t just about my account. It’s about what happens when […]” - “This wasn’t my production infrastructure […] it was my launch pad for updating other infrastructure” - “The cloud isn’t your friend. It’s a business”

I counted about THIRTY em-dashes, which any frequent generative AI user would understand to be a major tell. It’s got an average word count in each sentence of around ~11 (try to write with only 11 words in each sentence, and you’ll see why this is silly), and much of the article consists of brief, punchy sentences separated by periods or question marks, which is the classic ChatGPT prose style. For crying out loud, it even has a table with quippy one-word cell contents at the end of the article like what ChatGPT generates 9/10 times when asked for a comparison of two things.

It’s just disappointing. The author is undermining his own credibility for what would otherwise be a very real problem, and again, his real writing style when you read his actual written work is great.

I started doing some experimentation with this new Deep Think agent, and after five prompts I reached my daily usage limit. For $250 USD/mo that’s what you’ll be getting folks.

It’s just bizarrely uncompetitive with o3-pro and Grok 4 Heavy. Anecdotally (from my experience) this was the one feature that enthusiasts in the AI community were interested in to justify the exorbitant price of Google’s Ultra subscription. I find it astonishing that the same company providing free usage of their top models to everybody via AI Studio is nickel-and-diming their actual customers like that.

Performance-wise. So far, I couldn’t even tell. I provided it with a challenging organizational problem that my business was facing, with the relevant context, and it proposed a lucid and well-thought-out solution that was consistent with our internal discussions on the matter. But o3 came to an equally effective conclusion for a fraction of the cost, even if it was less “cohesive” of a report. I guess I’ll have to wait until tomorrow to learn more.

I couldn’t even make it past the onboarding! There didn’t seem to be an option for the single most common pay schedule, bi-weekly

Did you just use a LLM to write this reply?

I find it amusingly ironic how one comment under yours is pointing out that there’s a mistake in the model output, and the other comment under yours trusts that it’s correct but says that it isn’t “real reasoning” anyways because it knows the algorithm. There’s probably something about moving goalposts to be said here

What kind of focus do biopharma companies put on their stock prices? If a company like the one you described had a great treatment option that could genuinely help people and was raking in money by the boatload, is that “enough” for them as a “winning” business strategy regardless of how outside investors might perceive it?

I find the situation the big LLM players find themselves in quite ironic. Sam Altman promised (edit: under duress, from a twitter poll gone wrong) to release an open source model at the level of o3-mini to catch up to the perceived OSS supremacy of Deepseek/Qwen. Now Qwen3’s release makes a model that’s “only” equivalent to o3-mini effectively dead on arrival, both socially and economically.