zahlman

Something about the writing style here makes it hard for me to follow what actually happened. The section about JSONP for example seems to be explaining how JSONP works and how it's designed as an attempt to work around these attacks, but that explanation is then passed off as an explanation of how they bypassed the protection. And the whole premise seems to be about how manipulating the Preview content let them work through multiple defensive layers, but I don't see an explanation of how they directly controlled that content in the first place. I would have thought that the only control you have over the content of "an ordinary public ChatGPT share" is the prompt text, and that any migration of that text into "a small working webpage using its Preview feature" is up to the model deciding to generate that "HTML block" in response.

Sorry, I think I'm missing something here. How is the Binance hack connected to this one?

Being diligent means that you curl into a text file, see nothing is wrong, and then run the file instead of curling again.

I've been saying it for quite a while. A --dangerously-skip-permissions harness is basically a C2 server, except the operator is an LLM running on remote hardware. It totally has your best interests in mind, though.

So?

Why should I give a damn about what you or others think is required for a "successful" website? Not everything is about profit or popularity or anything else. Some things are about making the thing that you set out to make.

For abusing the network, yes. And of course answer standards are different from question standards.

You are entirely missing the point of the comment exchange you're responding to. Someone else made it sound like they would ban you just for asking a single question that didn't meet the standards for questions. That is completely and utterly false.

> getting viciously angry when these support bots lead with, "I'm very sorry to hear that. I understand how [rehashed summary of complaint] would make you feel frustrated."

The bots are specifically trained to do this because lots of people are dumb enough to prefer it that way.

It's something ELIZA could do in the 60s, and that worked unsettlingly well for an unsettling fraction of people who tried it.

> But what if your mind's thought process on a specific example (or in general…) is downright BAD?

Then maybe you shouldn't be making Youtube videos about it… ?

It's a little funny to me to read this from Fowler, given how enthusiastic Uncle Bob has become about agentic coding (albeit his loop specifies very strict code quality metrics). But yeah, I completely agree with the take. Fowler is, as they say, absolutely right.

> (it's not the em-dashes, it's the load-bearing tapestries)

I suddenly feel an urge to turn this into an image prompt.

"The model failed to refuse a cyber request when it should have" != "the agent hacked someone". For example, refusals also apply to just asking the model how to do something, without extending it any agency.

"<fraction> to <fraction>" means some value in between those endpoints.

You're thinking of "<fraction> of <fraction>".

Sure. But there were countless times that people insisted to me that their question was not a duplicate and that "the solution there" would not work, having not tried it (spoiler: it would work).

They did, in fact, establish and enforce community standards and culture.

They just weren't the standards and culture that you feel they ought to have been.

Communities are supposed to get to decide these things for themselves, not conform to the expectation of outsiders as a condition of them considering the community legitimate.

> But significant concerns about the skills of the people giving the answers. Not sure why that is, and why SO managed to get something right when it came to getting quality answers. For a while, anyway.

Honestly, point seeking behaviour of people writing answers was one of the worst anti-patterns of SO. It would lead people in later years to quantity over quality (especially because of the bonus 15 rep that OP could give you by "accepting" an answer in addition to upvoting it). Worse, it would incentivize them to answer terrible questions that should have been swiftly closed and then deleted when OP inevitably failed to do anything about them. Instead, getting an answer in before closure would prevent the automatic timed deletion system from removing those bad questions.

Quality answers come from intrinsic motivation: from people wanting the site to be a place where people find quality answers. (Something I didn't personally understand in the early days is how important a quality question is to finding a quality answer.)

> You know that users are going to call anything that happens to their posts on any website “moderation” right

I have an article published on LWN. The process of getting a pitch approved and then submitting an article and polishing it to editorial standards is quite impressive, and that's part of why reading articles there is so pleasant. And of course, they didn't have to accept my idea, and there was the possibility of coming to an impasse when trying to figure out a rewrite.

Was this process "moderation"? Do you think other Internet users would call it that? I would not.

The problem really is that the framing is already wrong: what you write on Stack Overflow is not a "post" in the first place, except in a really generic sense (or perhaps if you're looking at the database schema or maybe the codebase). Posts are what you put on discussion forums. Stack Overflow is there specifically to be something else. User generated content is not all "posts". (Would you use that term for a Wikipedia article?) Calling your writing a "post" comes with rhetorical baggage that gives a false impression of the site model.