oofbey

Lots of things bother me about my terminal emulators, and it's almost always in the category of "things don't work right". It's never "I wish my terminal emulator ran faster." Ghostty seems hyper focused on speed, with the negative side effect that compatibility breaks - in practice. I get that it's following all the newest standards or whatever it's doing, but in reality it always needs custom setup to work right. And for me the net effect is that it's always creating problems, not solving them.

You’re right I’m overly dismissive. But there are dozens of papers like this showing some more efficient alternative to attention. There is plenty of evidence pointing to this paper going nowhere.

Efficient alternatives have been coming out for 10 years now. Flash attention is the only one that has really moved the needle - because it’s not an algorithmic compromise. It’s just a smarter way to put the parentheses around the linear algebra operations.

They only demonstrate this idea on a laughably small toy problem. An 18M parameter model (which they call “moderate”) on an ancient dataset proves exactly nothing. Plenty of bad ideas appear to work at trivial scale.

Arguably the most important aspect of transformers is that it allowed easy training of arbitrarily large models.

> a fundamental misunderstanding of the economics at play

I’d say you’re the one who doesn’t understand the economics at play here. To me and I’m guessing the OP it’s quite simple. Have the exploits become common/simple enough to be worth $500 yet?

Why are you hoping for an RCE PoC? Curiosity's sake? Or because you'd like to use it offensively? The existence/publication of such a PoC makes the world less safe.

I’d say this is reasonably severe. For a decently large class of servers exposed to the internet there’s a pretty simple way to RCE them. The actual set of vulnerable servers isn’t nearly as big as many would like to suggest. But if you’re running a node/express server, you should really be in panic mode right now.

I hear you in terms of how these kinds of mistakes typically happen. But why did the script ever produce two sets of keys? The initial root cause was somebody picked the weak key not the strong key. But what was the reason for ever producing a weak key in the first place? They say the script produced two outputs - what on earth for??

The key generator is a FIPS certified HSM that created a strong key. They ran the key through some stupid script that zeroed out all the bytes except the last one. The point of a full FIPS audit is to check that you don’t do anything stupid with crypto like try to implement anything yourself and that you only use certified implementations. But that standard apparently doesn’t apply to CA’s. They only have to use FIPS modules to generate the keys but can do whatever idiocy they want after that. Therein lies the real problem.

Competence is difficult to check systematically. The problem is in the auditing process. The CA auditors check a much shorter list than an application that needs FIPS compliance. They just check that the CA is using a FIPS compliant key generator, and then basic things like following a logged, standard, multi person process.

Anybody writing a system for a bank or the govt needs to have every line of code checked that it’s not doing something stupid with its crypto keys. That level of assurance would have caught this. But the process was defined too weakly.

No. 90% sounds like a low number. That implies something else is writing 10% of the code? People? Other models? What on earth is writing that other 10%?

TVs are getting worse not better. Except for the display. Which should be the only real concern. But the built in software is just going down hill universally.

No. Almost everybody using an iPhone is on the latest release, plus or minus one while updates are rolling out. For a given iOS release and hardware type almost all of those probes are highly correlated. No way there’s 30 bits of entropy in that. I doubt there’s even 10.

Now on a desktop PC sure I believe these fingerprints are highly descriptive. And in android land they probably work okay because of the diversity of products and configurations. But iPhones resist fingerprinting just because they all give the same answers.

It’s a question of entropy. If your device is unusual in detectable ways, then the fingerprint has high entropy. But on my iPhone I suspect most of the things being fingerprinted are the same. How many other people get “smug koala”?

What happened to the CIA world factbook? It was great.

> Information should be free.

Healthcare should be free.

Food and shelter should be free.

“Should” is doing a lot of work there. Meanwhile in reality, creating and organizing information requires scarce labor which deserves compensation.