minimaltom

Tailscalar!

Another fun fact: there’s a list of things with tails.txt and scales.txt (see GitHub) and that list is used to generate the random tailnet name :)

(Or at least it used to, it’s been years)

I'm with you- the attack surface of openssh (and my trust in damien) is a better match imo

Do you use tailscale ssh but either dont have sudo, or don't permit login as root?

If all your tailscale-ssh ACLs allow you into an account with sudo, or allow you into root, theres no impact (you cant do anything with these vulns you couldnt do a month ago). Thats the nuance I'm trying to get across (admittedly my english is bad).

If you use Tailscale SSH with headscale you are also affected. The vuln is in tailscaled, not the control plane / netmap.

Former tailscalar here and now someone managing tailscale at an org.

Having done my own review of the vulns and the fixes as they are landing in github, its pretty clear to me that this only affects situations where you use ACLs to permit ssh into a node (via tailscale ssh, not via opensshd), but dont give a path to sudoers/root.

If a user had no SSH access and/or connectivity to a vulnerable node, none of these vulns give them access.

However, if you have a vulnerable tailscaled and you give ssh access as some non-root account/privs, then yes, these vulns are relevant as theres now known privilege escalations that give access beyond some specific user account.

Not trying to play down the vuln (its important), but its not a free-for-all RCE that some ppl are acting like it is.

Thank you for such a detailed explanation! I was wondering why we don't see MD everywhere and things like protein folding are all based on ML.

Is there anything like a getting-started for working with MACE or orbmol, a 'hello world'? Like maybe simulating Allolactose binding to lac1 ?

Wait _how_

Very cool

Hell yeah, whats your thoughts on doing it for like a whole city?

This is beautiful! I would love if we could model out a whole city, ideally using a much cheaper model.

You can have a prediction be specific and falsifable while inside the system, its just then riskier (and less useful).

For example, that french dude that bet on a prediction market what the temperature would be, then broke into the weather station at the airport with a hair dryer. The prediction was still specific and falsifable!

Its a fair question to ask! and ive landed on the opposite answer lol

Indeed!! It was an example of an utterance that wasnt falsifiable to illustrate what falsifiable means.

That’s the crux of it!! You don’t have to agree but people do care, and I think (ignoring the obvious partisans) that’s the two dominant camps of commenters on this thread.

One pony’s trash is another pony’s treasure, so I guess here one persons pedanticism is another persons hobby.

Take a look at the thread below yours, but basically if the prediction has to be wishy-washy or just interpreted as 'direction', theres way more noise and way less signal. Why not just state the underlying trend/forces instead? Why lean into the online culture of predictions and do it badly.

Bad (form) prediction: OAI is gonna be wobbly in a bit Good (form) prediction (could be totally wrong): OAI as we know it today is going to collapse due to running out of money around/at 20xx.

And sure we can be pedantic about detail, but the litmus test is: is the prediction useful if you had a crystal ball and you could know if it was true/false a priori?