It doesn’t even have to be only for known devices. Once you’ve compromised one device, you can just phone home to have a full powered LLM do your work.

The only real use cases for this would be on closed networks with no internet access, or networks where the traffic is closely monitored. Like, yeah, if I’m trying to hack the CIA, maybe I consider something like this. For the vast majority of devices and networks, this is inefficient and unnecessary.

I mean, it is kind of cool. But vanishingly few organizations have tight enough security that this is worth doing.

I think people are right that the solution here isn’t to try a different project.

Instead of being confrontational about it, though, I’d recommend a different aproach.

evelyn: .lol 😜

you: I know! I know. The branding is pretty silly. But this really is the right tool for the task. Unesco and Wikimedia use it. And we can do our own branding for $50/month. 🤷

A lot can be fixed by just acknowledging people. They’re trying to evaluate something they don’t understand, and having a reaction. It’s not even unreasonable. The right thing to do is just acknowledge and move on.

Usually that’s all it takes. Don’t let yourself be embarrassed when you’re being reasonable. If they won’t move on, that’s the point where I start thinking about job applications somewhere else.

Doesn’t mean they’re wrong!

I’ll just upvote the both of you. We all need to be more aware of our echo chambers.

I really like the infographic, but given the amount of disinformation out there, some sort of source is really needed here or I have no idea if I should trust this.

I mean, it’s probably not Russian propaganda with these numbers, which does improve confidence a bunch. But still - it’s bad information hygiene. We should have a norm of not trusting unsourced data. If our side doesn’t care about sources, it makes it easier for the Russians to ignore them too.

Yeah. Once you spend an afternoon debugging a failing cron job, the 5 minutes needed to write the boilerplate starts to feel pretty ok though.

I’ve never had to spend an afternoon debugging a failing systemd timer in the years since I made the switch.

It’s not. But the systemd timer has more robust logging and monitoring, and much more explicit and readable syntax.

Once you get used to systemd timers, it’s really hard to see why you wouldn’t use them if your system has systemd. Unless writing crontabs by hand makes you feel like a hacker I guess. I’m not even being totally sarcastic about that - there is a fun retro feel to cron.

I think most the serious investors know. But, in a bubble, stock value can keep going up long past the point that makes sense. If you think that’s going to happen, it can make sense to invest even if you think it’s a losing play in the long run.

This should really make the timing more urgent for Anthropic. I was legitimately surprised when they decided to delay the IPO.

Also there’s still a real chance that Anthropic has some real value proposition that I’m not understanding, though I’ve yet to find someone who can make a coherent argument for what that looks like.

Right? This is going to be an interesting story to follow.

On the one hand, they don’t want to IPO right now, probably because they don’t think investors are keen to buy at the price they’re asking.

On the other hand, I don’t really see things getting better for them as long as cheap open-weight models that are almost as good as Anthropic’s exist. As more people figure this out, I think it’s going to get worse not better. So I don’t think they can afford to wait long.

I think it’s important to call out that this isn’t an issue with AI being brilliant at hacking. It’s that these systems are basically totally unsecured, and the main protection is that no one with the technical skill is bothering to try to get access.

This isn’t to say this isn’t a serious problem. We’re moving from a world where you need a trained security expert to spend non-trivial time to get access to these systems to one where anyone with access to an un-restricted agentic LLM can do this trivially and quickly.

As a civilization, we need to start taking security seriously.

GPL (and copyleft generally) gets way more attention than it should. In the wild, MIT and similar permissive licenses are by far the most common. Linux is on GPL, but that may be a historical artifact as much as anything. I don’t know if Linus himself would choose it if he were making the choice today.

The wider FOSS community, in my experience, leans permissive rather than copyleft. The copyleft people are just loud.

EDIT: To be clear, when I say I don’t know what choice Linus would make today, I don’t mean that I’m skeptical he’d choose GPL. I literally just mean that I don’t know. He’s been quite clear that he’s not a principled believer in copyleft, but it does have real advantages for a project like the Linux kernel.

I’ll add, the whole series on proofs (that this is an intermission from) is a great read.

“The outputs of this opt-in vulnerability scanner will be fully model-generated, without human review or triage,” Anthropic explained. “This will enable faster and more frequent scanning, but means that it is possible reports will be incorrect or invalid.”

When I saw the headline, I was wondering about this specifically. This may make this service not super useful.

My experience with AI security reviews is that they’re fantastic at finding faults, but they always find a list of things to complain about. If there are no real/serious faults they’ll start finding things that kind of have the same shape as a security issue, but really aren’t if you dig into them. I’ve regularly had an LLM generate a list of 10-15 issues ranging in severity from “nits” to “critical” where none of them were actual issues.

Periodic reviews seem like they could get annoying really quickly, becoming more of a maintenance burden than a help.

To explain it to other people, understand the implications for future results, to know what it really means, is now even more important.

I think the thing a lot of the non-mathematical community doesn’t understand is why this is important. I suspect a lot of people imagine a future where AI can build one result on another into a tower of useful math, and the math produced being incomprehensible is a human limitation, not a fundamental problem.

What they don’t understand is that the LLMs aren’t really much better at understanding these messy sorts of proofs than we are. They’re able to move forward one step because the foundation they’re building on is solid, but what they’re building isn’t that useful even to future LLM work.

I’m a software engineer by trade, and I work with LLMs daily. Give them a solid codebase, and a plan, and they will implement features at an impressive rate. But the architecture will be haphazard, and if you just let them keep going without a well understood structure to the code, eventually they’ll hit the point where they’re introducing more bugs than fixes, and the whole process falls apart.

I think we’re going to see an analogous situation with mathematics. LLMs are great at building the next floor of the tower, but to make real progress we have to build those into a solid foundation before we can build higher.

In his “defense,” the plan to sanction the ICC came before the Nobel. Some of the reporting even claims that the Nobel committee chose to give the prize as a response to the threatened sanctions.

He’s sanctioning the ICC because they’ve stood up to him in the past on issues like Netanyahu.

I don’t?

No one does anything well when they don’t want to do it.

The real solution here isn’t to try to figure out how to force yourself to do something you don’t want to, it’s to figure out how to want to study. The people who can study a broad range of things effectively are the ones who think of themselves as good at learning, and want to understand as much possible. For most of them, part of their self story is that they’re good at learning, and understand things. That can be part of your self story too if you choose it.

I definitely don’t want to pretend that’s an easy change to make. Motivation is one of the harder things. I would like to be able to tell you how to be motivated, but I can’t. But if you’re looking for the difference between you and the ones who seem to study effortlessly, that’s it. They’re not smarter or more capable on any fundamental level. At least not at a level that matters for most things. They just actually want to do it.

Every time I think we’ve hit maximum “cartoon villain” with Trump, I find out I was wrong.

Retractions do happen regularly. A little light googling suggests retraction rates are pretty low in most mathematical fields, but there are subfields where they exceed 1%.

I don’t know if the <0.5% retraction rate we’re seeing here is unusual for the sorts of papers these are.

And that’s kind of my point. I read the article and I still have no idea. I doubt the author of the article knows either. Which makes me think that they had an agenda going into the whole affair.

Domain pricing doesn’t really vary that much over most of the sites. The price is usually based on the specific domain. .com domains are usually pretty pricey. Some TLDs are very cheap.

There are definitely issues with what OpenAI is doing. I’m the last to defend them.

That said, a small correction rate after uploading a bunch of preprints just doesn’t seem like news. An article that headlines with that, but doesn’t even bother to tell us what the normal rate of corrections and withdrawals is for humans really feels like propaganda to me.

I would really like to live in a world where we don’t reward this sort of “journalism” with attention.

I really love the simplicity and security focus of Porkbun. It feels targetted at engineers, not wannabe startup CEOs.