orf

> Instead, labor and computing power are being diverted toward a singular “frontier-model effort” led by Pieter Abbeel

Strange headline given that it seems they are actually just refocusing resources to train a frontier model?

The language forum is the place to start- you should already have a thread there gathering feedback before writing a pep?

anyone who has ever worked at a large non-technical company can tell you exactly where these requests came from

It wouldn’t be the most secure consumer phone then, would it?

It’s crap, sorry. It’s an inconsistent mess. Having come from iOS it’s as clear as night and day.

It doesn’t really matter to me if there’s some other specific version of Android that fixes some issues if I install it. As a user that’s not something I care about.

Having been given an android work phone, I can’t understand why anyone would use this willingly.

The desirable outcome for most people doesn’t seem to be the ability to run android on an iPhone, let’s put it that way.

So it indeed wasn’t the point then?

Could you point to the part where I said revocation as a principle is a bad idea? Rather than what I actually said, which was that untraceable random third parties revoking your keys without any involvement likely isn’t a good idea.

Also GitHub doesn’t revoke the keys. The providers of the key take provider-specific actions, which may or may not be revocation.

So… yeah.

I agree, but that wasn’t the point at all was it

Can you point me to where I said I had an alternative? Or any rules that say you can’t discuss an ideas flaws if you don’t immediately have an alternative?

The status quo is clearly the local minima, given the myriad of trade offs and different parties involved.

This is so stupid. It’s pretty simple: malicious actors will use it to do all of those, plus now they can unilaterally bring down a system via revocation.

Non-malicious actors using it to bring down a system via revocation are therefore indistinguishable from malicious actors. It’s by definition a malicious act.

That’s why it’s a stupid idea. Non-malicious actors should just contact the company and let them take action. It’s not for an outsider to decide the impact of a leak.

Read the thread?

> I think every API key system should have endpoint "invalidate_api_key"

Not this.

Are you really unable to imagine a situation where financial or physical harm is caused by a system abruptly being shut down by a credential revocation, triggered by a random person on the internet?

Be serious.

And the whitehack hackers finding keys should do what, exactly?

Unilaterally decide they should be revoked, without contacting the owner?

And that’s not malicious?