I'm not really qualified to deliver a good holy war; but it does seem like there may be something to the criticism that monolithic integration has gone a bit far if supporting one utility being written in a different language is a special feature rather than a matter of the rest of the system not knowing or caring what is on the opposite side of an interface so long as it can act as expected.

You can't really beat the fundamental economics of software development: expensive to do right but cheap to copy means that you really, really, want to share a problem with as many other people as possible(unless your whole business is being uniquely good at solving whatever the problem is; but that typically isn't the case for this sort of software). Applies to both proprietary and FOSS: relatively mass-market software is often pretty cheap for what you get; really oddball niche stuff is frequently both pricey and terrible; while your life is going to get steadily more miserable if you are personally responsible for handling backports and fixes for some internal fork of a long-EOL version of an OSS package.

The big difference, at least potentially, is that, while it tends not to be economic to DIY, licenses that give you the right to DIY also give you the right to pay someone else to do it for you; or to form a coalition of people with similar problems and have everyone pitch in to pay someone to do it for you. You still need to either eat the cost of maintaining an internal fork or putting together some sort of coalition of people with similar problems to be the openJDK 8 forever pals and share the cost of maintenance; but the vendor can't just stop selling you licenses if they want you to move to their cloud offering or whatnot.

Random intermediate CA. They got a couple of commonly used root CAs to sign for them; and everything just works from there.

That's the problem. It's relatively easy to fire a certificate issuer; but it can get surprisingly fiddly surprisingly fast to ensure that all your stuff actually distrusts one(unless you are responsible for basically nothing but a a handful of in-support major browsers and are OK with the choices their vendors make, in which case it will be handled for you relatively quickly; and was in this case). Basically any network connected widget is going to have at least one trusted root store embedded in it somewhere, possibly not updated anymore; and a number of software packages either bring their own or only partially track the OS-provided one.

You also have very little control over what other people do; both what CAs they chose to get certs from and what...questionable...partnership decisions the root CAs you do chose to trust. It's not technically secret; but unless you are practically a full-time PKI nerd you probably didn't know until after the fact that Comodo, now Sectigo, had quietly trusted eMudhra for you.

Admittedly I wasn't using a paid frontier model, but I've tried it a few times with very mixed results.

One attempt was to write some code for a microcontroller to do some tricky stuff with DMA and timers to generate a complex waveform. It failed miserably and couldn't seem to understand my implementation that did work, or debug it when I introduced a subtle bug.

Another attempt involved having to develop a system to automatically crop and rotate images to be upright and remove the border. It managed to remove the border reliably, but never got about about 30% of them upright. I provided it with sample, hand crafted output to compare against, and told it to keep iterating until it got it right, but it just couldn't figure out how to do it.

Ironically if I just uploaded the images to bog standard consumer AIs like Gemini and ChatGPT, they could reliably crop and rotate the images 100% of the time. I even suggested that it use the same image recognition systems as those were using, but it couldn't make that work either.

I used to hate long form writing because it hurt my hands, due to arthritis. When I learned to type I was suddenly freed from the pain and I started to enjoy it.

So while hand-written notes are a nice idea, they won't work for everyone. I think recording the screen is going to be the only option for some kids.

It seems to disproportionately affect people on the Autism spectrum. I've been accused of it more than once, and seen people accused when to me their text reads perfectly normally.

These detectors seem to be a load of crap.

There are 640 acres in a square mile

[Sighs in metric]

Microsoft has probably the most illustrious history of bugs where just visiting a website or opening an email can get your system hacked, but you're right, this is not a problem unique to them.

These days, Lookout asks you before it loads any images from outside your organization...

Assuming there are 2028 elections. Let's see how he reacts to the mid-terms.

They probably have intel that China is making good progress on it's "before 2030" goal. They have all the parts needed either working or in late stages of development, and their plan is conservative and focused.

I fully admit that this might be a 'me' problem, not a them problem; but I just don't understand why this agent monitoring setup was so vulnerable and is being treated as so novel.

Sure, the monitoring of whatever goes on inside the LLM is comparatively new and exotic; but when you set it loose on the internet it's going out through one or more of your WAN links, presumably with your router and firewall and so on in the way, and is mostly doing HTTP(s) stuff. Keeping an eye on what an internal host is doing when you can insert whatever trusted roots you want for TLS MiTM and you 100% own the pipe that it is using to communicate is not necessarily a desperately enjoyable task; but it would have been a relatively banal requirement a quarter century ago.

I'd also think that, when you are spending $$$$$ on the exercise in Nvidia compute gear, and it's a test of a 'frontier model' whose behavior and capabilities you are trying to better characterize and refine, allocating the handful of terabytes necessary to just store a full packet capture of the session in case it is relevant would be a no-brainer item.

Is there something I'm missing that makes this case more complex? I'm not talking about the 'grubbing around in the LLM's vectors and such' side; just the "a host is doing HTTP stuff through a WAN link we control, can we observe what it is doing?" aspect.

The proper response to being in an area where datacentres are crowding in is "lobby your elected officials to increase property taxes and not give out tax increment financing deals". Tax everything, and tax it well. They'll stop building new datacentres in your area, and the ones that are there will (unless they were given a long-term sweetheart deal beyond your already-low tax rates) start being cash cows for your area.

We should really be building operating systems with more process isolation and clear permissions systems for which apps can interact with which other apps in which ways. There's elements of this in Android, and in capabilities systems like selinux, but the more powerful they get the harder they are to use. This is inevitable, but a lot more can still be done to make this kind of functionality accessible to users.

Not even Python could keep up with having to update from Python 2 to Python 3.

Really, you don't see any difference between Elon Musk and, say, John Stankey? Is John Stankey actively transforming the US into an autocratic fascist-adjacent state?