joatmon-snoo

Unrelated, the Nodejs patch is to strip the emudhra certs, which is its own separate security incident.

… do you know what the difference between potable and non-potable water is?

AOC is fantastic, but her name doesn’t automatically lend credibility to an argument, certainly not one backed by actual primary sources.

The evidence that proves a model is actually a step function change is these benchmarks.

If a model isn’t a step function change? Welcome to research.

An example I ran into recently: I wanted to scrape pricing data for used cars, to better inform a friend's decision about what to purchase.

I know there's a relationship between mileage and depreciation, but wanted to have a better sense of what that relationship is to know whether a given car was over or underpriced.

Similarly, if I was pulling that data to build a service of my own to offer to users... is that unethical?

It’s really one of those things that you have to see in person and walk up and down along to understand. The scale of it alone is a huge part of what makes it so memorable.

Well, is Pixar’s Toy Story a work of art? Or what about Julia set renderings, where people make choices about the colors? ;)

Tongue-in-cheek aside, I do think I agree with you in that (1) art, as perceived by us human meatbags, is art because of the human element of it (if not in creation, then in perception), and that (2) AI absent explicit steering trends towards a rather bland medium.

But there’s art in everything from the blurry, out of focus, disposable film cameras, to a 5-year-old’s crayon scribble scrabbles, to the neon glitter themes we used to copy-paste over our geocities and xanga pages, and as frustrating as it is to our own sensibilities, an AI prompt “draw a pink elephant” isn’t all that different.

Hmm: can you elaborate?

I've never been on a security-specific team, but it's always seemed to me that triggering a bug is, for the median issue, easier than fixing it, and I mentally extend that to security issues. This holds especially true if the "bug" is a question about "what is the correct behavior?", where the "current behavior of the system" is some emergent / underspecified consequence of how different features have evolved over time.

I know this is your career, so I'm wondering what I'm missing here.

That's called a compromised account, not Facebook sharing the email with a third party data broker.

Breaking something is easier than fixing it.

Humans + LLMs are really good at producing enough spam to overwhelm anything like this. There’s a reason curl bans LLM slop reports now.

There's a lot of tooling built on static binaries:

- google-wide profiling: the core C++ team can collect data on how much of fleet CPU % is spent in absl::flat_hash_map re-bucketing (you can find papers on this publicly)

- crashdump telemetry

- dapper stack trace -> codesearch

Borg literally had to pin the bash version because letting the bash version float caused bugs. I can't imagine how much harder debugging L7 proxy issues would be if I had to follow a .so rabbit hole.

I can believe shrinking binary size would solve a lot of problems, and I can imagine ways to solve the .so versioning problem, but for every problem you mention I can name multiple other probable causes (eg was startup time really execvp time, or was it networked deps like FFs).