xmprt

You can argue that correlation doesn't imply causation, but typically more contributors means more people who have played a part in the code and so more eyes on the project to catch issues as well as a higher bus factor and less key person risk.

And larger community means there's more rewards for a successful attack and therefore fewer latent security issues (ie, obvious ones are more likely to be caught).

I think companies considering building in-house packages are just trading one risk for another. Especially with LLMs, it's going to be a lot easier to find vulnerabilities in your internal dependency than it would be in a battle hardened dependency used by 100s of others.

I didn't mention the code once in my reply. Code is only one aspect of reviewing a dependency. Much more important is the community and support around the tool/dependency.

When dealing with LLM output, you're getting a 1 of 1. There's no way to measure the community, number of contributors, or how maintainable it is.

This joke is made a lot but I think most good developers take care in considering the npm dependencies they install. You can get a ton of dependencies pretty easily by just installing very popular ones like react, tailwind, nextjs, etc. If there's ever a dependency that I'm not familiar with then I make sure to take at least a cursory look over the repo to make sure it has a decent number of stars/community, is well maintained, has multiple contributors, etc.

Could be? Yes. But I don't know if it's super clear that any existing technology would solve the problem without also introducing new process changes. For example, I can imagine a world where the laws are just a bunch of text files and instead of using git to make changes, we just add a new text file and there's a preamble that says that the law is superseded by any future laws. Laws also aren't as clear cut as code. We have tons of contradictory laws on the books today.

What I'm getting at is that, if we need to make process changes anyway in order to actually make the technology work for us, then the real solution is in the process and not in the technology.

There already is a papertrail. It's just that it's extremely convoluted to navigate. This isn't a technology problem.

If you're like most Americans and pay taxes on time then there's absolutely no reason to be audited. The two possibilities are:

1. You are taking a lot of special deductions and not providing all the required documentation.

2. Or you're not reporting things accurately because there's some edge case in the tax code that you didn't understand but is easy for the IRS to catch (eg. sales of stock without cost basis reported).

Simplifying the tax code and funding the IRS more solves both of those because then they can focus on the real whales who are abusing the tax code the most.

If you've dealt with the American medical system then stories like this aren't very surprising. I'm not going to act like this is everyone's story (a lot of people have pretty smooth experiences) but it happens a lot more often than it should.

Money doesn't mean anything if you don't have a case to begin with. More money/time just makes the lawyers win because they end up siphoning most of the settlement. And more money with crappy lawyers will always lose to less money on smart lawyers who are able to use AI to find 100 examples of prior cases going your way. That's the whole point of AI disrupting the field.

And most of the leverage you have in negotiating a settlement is by referencing prior case law. If something is novel, there's too much variance to get a good settlement.

I've used chargebacks much more often because of services not rendered than because of a lost card or because of stolen credentials.

$59.5 million seems like a drop in the bucket compared to the rent that these middlemen are taking. And was the COVID-tracking app an abject failure because it didn't get public adoption or because the technology wasn't fundamentally sound. Because if it failed because of the former, then simply regulating companies to use it (or even just putting it out there as a cheaper option to outcompete Visa) would solve a lot of those adoption problems.

"I wish more knowledge bases realized their barrier to entry."

I think of it kind of like how Chess AI make "mistakes" which are unrecognizable to humans but a stronger AI would be able to pick them apart. That's kind of scary...

Not really ironic. They even say it here:

> Not anti-AI. Pro-giving-a-damn.

AI isn't the problem. The problem is that people are sending text without proof reading.

> OpenAI's ad collector at bzr.openai.com sets a cookie called __obi, scoped to .openai.com

This sentence is way too much detail and it's literally the first thing you read. I can pick apart most of the sentences in the article. Another one:

> Across 932 decoded sync tokens, 736 carried subject_type: account_user and 196 carried anonymous

This sentence is pointless. What matters to proving that "It works when you are logged out" is to show that the identifier is stable. Why does the reader care about the actual counts.

AI has a tendency to do this which makes AI generated text a lot harder to read. The raw prompts likely don't have the specific websites and cookie names because that's not relevant to the reader or writer for that matter - it's a footnote at best.