tybit

There’s a limit to how much society can spend on aircraft safety, but it’s quite a lot because it’s so important. Cyber Security teams have to work with large constraints because spending an ever increasing amount of money directly, or losing money indirectly (like not allowing product teams to move quickly) is explicitly not a goal of most companies. So while we try to make zero mistakes, most companies are willing to take a non zero amount of extra risk of these things happening in exchange for other benefits.

4 is fine, but only if you’re a certificate authority.

This is definitely a real thing. I think part of it is inherent to the shift, we’re now managing multiple agents which means more context switching than before.

I think part of it is just a point in time thing though (hopefully). We can’t trust the agent output so need to check it. We can’t trust the agent to use common sense so have to think through every clarification instead of assuming a competent peer will come back with any necessary questions instead of making bad assumptions. I think all of these things will continue to improve over time. For myself AI quickly went from so painful to being avoided to something I can’t work without.

I was surprised to learn that this has a name (or a few)

> Rabbit starvation (also called protein poisoning or mal de caribou)

The body can only digest so much protein and rabbits are so lean there is basically no fat to them outside their organs.

Solar is very popular in Australia, to the point that we have too much surplus during the day. So now we often have effectively free energy late morning to early afternoon. So while not common, some people here do get batteries despite having no solar, to store the excess from the grid for when it’s more expensive later.

Yes, but specifically they sell hardware at absurd margins, and lock people in via their software ecosystem.

They do heavily use AI, but you haven’t refuted their point that if inventory is in SQL, storing reservation in a second storage system increases complexity.

Yes, this is a great point and it’s even one that the Cerebras CEO spruiks for his own chips. Talaas has gone furthest on the spectrum here, so seems to have the most potential to evolve the use cases.

Taalas is developing this, but not for Frontier class models. I hope that if we can least get the easy 80% of work done on that sort of hardware, we can greatly reduce the demand for GPUs, HBM and energy to some extent.

They’re not using ciphertext in inference. They are encrypting agent responses on their servers if it’s going to a subagent on the client. The subagent will send it back to their servers for inference. Only their servers have the keys, so they can decrypt when running inference.

Yeah, if user -> org tenancy is stored in the same database without any similar defence in depth then a fresh API key after updating org would work around this. Would be a interesting topic for them to cover.

I think the same HMAC(pepper, user, org) as a validation column would work. Better yet, encryption with AAD on any tenancy data if you have a TPM available.

The OPs point wasn’t that OpenAis financial situation is comparable to Apples. It was that the likely cost of litigation is a drop in the ocean for OpenAi too despite their comparative lack of cash to burn. Legal disputes like this cost in the hundreds of millions over many years, so well below 1% OpenAis last single funding round in single year. If they got a tiny benefit from this (very gross) behaviour it may be finically well worth while. OpenAI may very well go under IMO, but this will barely be a straw on the camels back.

That’s what they do, but the TPM pepper is also needed for HMACing in their threat model. Otherwise the attacker just adds the victim’s user id to their hashing process too.

Zero data retention was an enterprise agreement that Anthropic and Amazon agreed with customers and delivered on. There’s no way AWS would trade in their reputation with enterprises just to soak up some slop.