jstanley

> If they all get found we exit the other side more secure and reliable.

I agree, but as yet we have no idea how much pain we have to pass through to get to the other side.

Perhaps try telling it you're Andrej Karpathy and then see how much it wants to impress you?

There were prominent people saying stuff like "this bug is so bad, every PHP server is vulnerable to any script kiddie with an LLM; simultaneously, my exploit is so valuable and secret that I don't want to tell you what it is; also although I could totally steal this bitcoin, I choose not to, but I totally could if I wanted to".

Which is pretty indistinguishable from people just lying about how bad it is? How are you meant to tell the difference? How can it both be true that the server is vulnerable to any script kiddie with an LLM but your exploit is too valuable to share?

And the fact that the server turned out to be not exploitable just proves that the people claiming to be able to exploit it in fact were lying.

Configure your webserver to not execute PHP code.

> I'm not sure how "RCE on every PHP server, from anywhere on the internet, no other requirements" could possibly be underblown by anyone

It could be overblown if it's not true. The amount of time it took for anyone to claim the Bitcoin from the supposedly-vulnerable PHP site convinced a lot of people that the vulnerability was not as bad as claimed.

Personally I never found the shunting yard algorithm very intuitive at all.

A recursive descent parser makes much more sense to me.

I'm pretty sure metallic lead is not very dangerous. If anything people born in the 90s and 2000s tend to have an irrational fear of lead.

"You can see the computer age everywhere but in the productivity statistics." -- 1987

Doesn't look that similar to me, they both just look a bit old.

I understood that much from the rest of the article, but I don't understand specifically the part I quoted. There is a lot of detail in there that doesn't seem to have made it into your translation.

This is really interesting but I wish LLMs wrote text that was a bit easier to understand.

> It requests the lethal puzzle exactly when all three conditions hold: 28 cases, including two ads instead of three, one ad closed early, a score 1 point short, and an ad worth just under 3.5×.

> Then we ran it live, in a test copy of the iPhone app running in Apple’s simulator, and read the rule’s inputs while we played. It had three good rewarded ads on record. The score was past the line. A rewarded ad from Google AdMob was loaded and ready. The rule priced it at 72.39, against 37.41 for the last one, which is 1.94 times. It needs 3.5. So on iPhone the rule is live, reading real ad prices, and waiting for an ad worth 3.5 times your last one.

What on earth is this supposed to mean?

Of course it's a path. Claude does that already.

Existence proof: everything Claude Code does, including talking to LLMs on GPUs via the Anthropic API, and shelling out to other tools installed on your system, could in principle be compiled into one big self-contained binary (or Turing Machine if you prefer) that is able to take natural language in and produce compiled binaries out.

If you wanted to go a bit harder you could train Claude to output machine code directly, but that's not necessary. Whether the machine code comes straight out of an LLM or out of a compiler that is fed source code that comes from an LLM is a mere implementation detail, there's not any fundamental difference.

Cool map but FYI most of the ones near me are just random buildings that don't even have Wikipedia articles.

I'm pretty sure it's a different project. It's not that inconceivable that the same author has done more than one project in a related area, especially if the one you found on github is obviously different to the one described here.

I'm pretty sure that's a different project