kbenson

You're mistaking what a company started as for what it is now. Nvidia hasn't just been a video game card manufacturer in well over a decade, and hasn't been primarily one for quite a while now.

They are the premier manufacturer of electronics that power all the current AI. Why wouldn't they be contributing heavily to the space?

What are these "rules" you speak of? There's usually nothing binding in these agreements. It's just groups either trying to do the right thing by end users or trying not to look like assholes, get a better payout, or some combination thereof.

Finding an exploit and publishing is is not against the law. In some cases, publishing immediately is the responsible thing to do. For example, when it's actively being exploited in the wild, and waiting just puts people at risk that don't have any recourse to protect themselves, since they don't know they're at risk. There can be nuance to that as well, but in general, as soon as it's being exploited, anything that makes it harder for end users to a) know there is an exploit, or b) tell if they're susceptible to it (e.g. through a POC) is just taking away people's ability to take the action they deem appropriate.

If you think your only tool is a hammer, everything indeed starts to look like a nail.

This is one of those things that might be best solved through policy and law. There probably will be some changes to policy and law to help, eventually. That stuff usually takes a while, and that's always been a problem for those suffering in the interim.

> All of those except for therapy are awful career fields. Musicians, actors, artists (outside the tip top of the field) are all the butt of jokes about how broke they are.

If you're aiming for the top, sure. There are plenty of people who make a living doing stuff like that and are happy because they enjoy it. You're unlikely to be one of those people if you move to an area where there's an extreme over-supply and try to "make it big", or try to be "pure" to the art and eschew commercial options. e.g. An actor in LA, the starving artist in a loft in NY.

> Therapist might make out well for a bit, but it seems like a loaded term these days .

Loaded how? I was thinking of psychologists, licensed mental health professionals, physical, occupational, and speech therapists.

> The problem is: how do you as a researcher become comfortable testing on a voluntary human test subject?

I don't think you and GP are actually saying anything different. I interpreted their statement 'The researcher should first ask "would I feel comfortable testing this in a voluntary human test subject?"' not to mean don't test on animals if you wouldn't on a human, but to use your reaction and feelings to that to guide your judgement, and help judge what type of animal testing you're at, not to be a binary switch of whether any animal testing at all should be done.

GP is referring to the submission, in case that wasn't obvious. It's opining as to possible reasons, given the author is one of the people who had a feature reverted.

> Did someone not understand what went in?

Unlikely, from the context.

> Might someone have offloaded their thinking to some external tool?

No, according to the author, since the features predate most current LLM assisted coding.

> Did people stop caring?

I'm not sure what this means. Presumably things were reverted because people cared enough to make sure it was good quality before being released.

> Did someone not plan or design a feature in full?

An admitted possibility

> Were the timelines unrealistic?

Depending on what you mean, that may be correct according to the article, but I suspect not in the way you mean.

> Maybe with so many reverts timelines should be revised?

It sounds like there was a very large increase in load in some of the people that would commonly review during this time period, and that may or may not continue to happen to a greater or lesser degree in the future, it depends on how LLMs advance in finding bugs and if there are other large waved of bugs reported.

There are actually a lot of professions that either directly or indirectly rely on that. For example, therapists and social workers of many stripes, actors, writers, musicians, etc benefit directly from that, for at least some sub-disciplines/genres. Indirectly, almost every job where you interact with others directly to provide a service or sell a product (which is many, many things, and more than might first come to mind).

I doubt most people will be developing a rapport with an AI agent trying to sell you that contract at work, or helping you when you're irate and have escalated a problem a few times.

> The point of (sane) string interpolation is that it runs at compile time, which helps prevent people from inventing crazy template systems at runtime.

It's the trivial cases that are compile time. The interesting templating is done with input that isn't defined within the source, and those can't be run entirely at compile time.

> And you automatically get things like safe SQL queries with parameter binding instead of injection vulnerabilities.

That's been solved for decades with parameterized queries (binding variables), and doesn't require interpolation in any way (at least not in the context we're using it here, but probably not at all in most DB drivers and engines). In fact, I would go so far as to say if someone is trying to use string interpolation instead of parameterized queries to avoid SQL injection, they've fundamentally misunderstood the problem and are trying to solve it at the wrong layer.

Also, if the string interpolation for the query is done at compile time, what type of content known at compile time is something that we'd be worried about SQL injection being in?

Wow, I had forgot that Rin Tin Tin is something I can recall from my childhood. I'm not even sure I remember how I know about him, other than hearing the name and seeing random bits of media (maybe even stuff in advertisements or posters). Maybe one of the shows or movies was still played in the 80s when I was a young child, or perhaps the 80's were soon enough after some of the popularity in the 60's that it was still in the public consciousness, and the turnover cycle of pop culture wasn't as aggressively fast.

There are also some pathological bad use cases out there that are caused by the combination of trying to scrape all the content, a randomized param, and the scrapers trying to be anonymous. The one I've encountered is pbpBB.

phpBB will assign you a randomized session if if you visit it anonymously (without logging in), and will serve the page to you with that sid param added to all links. Using that link will load a page without the sid param appended to links, because the system assumes you have a session I'd saved in a cookie since it saw you have a sid, even I'd you don't have/didn't send a cookie with it. Following any of those links starts the chain over if you aren't sending a cookie along with a sid, which the AI scrapers never do so they can't easily be blocked by that, and a new unique sid is generated, and all the links have the new sid appended.

Every page with a unique set of params and values needs to be investigated, because it can be an entirely different page, so AI scrapers will scrap forever, always finding more and more URLs to harvest, even though they're all duplicates of what they already have. It's easy to have multiple scrapers stuck going through a very small bulletin board continuously.

Maybe they've gotten smart enough to deal with this situation in the last few months, or maybe they put in a specific workaround. I ended up just throwing the site behind cloudflare because spending time trying to outsmart AI agents in a battle of escalation doesn't seem like an effective use of my time.

The issue is that a dynamic site that can serve the traffic that generates 10MB of logs a week might be very performant on the smallest and cheapest of virtual servers, but one that generated a GB daily might find itself very slow and sometimes crashing because of load depending on spikes, unless they opt for a server with more resources, for more money.

Any answer to that along the lines of "do something more complex" or "optimize your site for load" to be able to deal with the rampant bad behavior of multi-billion dollar companies is unpalatable to most.

Pretty sure they're referring to their usage as a potential content consumer, not content creator. You don't need a cloudflare or AWS or any other service account (usually) to be an end user of a site that utilizes those. Increasingly it's hard to view any content on the social media platforms without an account.

What you want is something akin to a Raku (perl6) grammar, which was their enhancement to matching they developed to go beyond regular expressions.

    grammar IniFile {
        token key   { \w+ }
        token value { <-[\n;]>+ }
        token pair  { <key> \h* '=' \h* <value> \n+ }
        token TOP   { <pair>+ }
    }

    my $text = "user = alice\nrole = admin\n";
    my $match = IniFile.parse($text);

    if $match {
        say "Parsed successfully!";
    }

There are various libraries for other languages that try to accomplish something similar or Port the concept, so if this interests you, maybe you can find one. Or in this day and age, maybe you can have some VC (and much of society) subsidize the fairly quick creation of a library for you language of choice through AI.

If you're not looking for that, and more specifically what you have shown above, there are often ways to accomplish that in certain languages. In Perl it's easy because you can use regex cars in a regex, so you can just assign `my $digit = qr/(? :0-9)/;` and then use it in the regex as you did (and Perl already supports non matching whitespace with a flag). For that matter, Perl regexes allow you to define chunks purely within the regex to be reused in a DEFINE block, so possibly that is a feature other regex engines have as well.

Honestly, I still write a lot of perl, and while interpolation is nice and good to have for simple things, I find myself using sprintf more and more in production code, especially in the cases the examples always show off, such as needing to alter the variable, add two together, etc. I assume those are just shown to illustrate you you can do that, and not imply you should, because commonly using arbitrary code execution within interpolation is something I'd feel compelled to beat out of my coworkers if I encountered it regularly.

There's actually a few ways it could have been meant, or it could have been meant to convey all of them. We all have a pretty good idea in the general sense what they meant, but that amusing reply is also an invitation for the person to elaborate and add nuance.