Ucalegon

That is not how enterprise pricing works. Not everything gets the same API model, because not everyone has the same unit economics. But lets make the sane underlying assumptions, does your business work?

There is a difference between being able to validate a Windows license and copying Windows from source code.

If we are talking about distillation vs building from scratch, none of these are congruent to Windows. I can build my own LLM [0] and then distill off of Claude, but that is not the same as a 1:1 copy of an operating system because there was the ability to crack how licensing works. We are not seeing Windows clones, at the source level, for that reason.

Also, Linux exists. Anyone can copy that. Why doesn't that count?

[0] https://huggingface.co/docs/transformers/quicktour

Have you copied Windows and tried to run it? I would love to see the plain text source code that you claim to have. We all would.

This one of the places to manufacture the consent for that to take place, because we are commenting within an organization that has given the money to ensure it that what could be is done. Most people clapped and made money, who cares what happens next, making money is the only good that matters.

That might be an indication that the business is not sustainable because there is not any technical or practical differentiator besides scale. Harming your customers to maintain that differentiation isn't sustainable either.

Its not just about the quality of output, but you also can finetune them to proprietary needs, if the skillsets are their internally, to make them better without governance risks. So being SOTA doesn't matter as much, since generalized tasks are not what matter most to companies, its the specialization relative to business need or internal datasets.

[flagged]

'Move fast and break things' has been a core ethos for so long that many have forgotten that moving and breaking without an end or a point just leads to a lot wreckage and nothing to show from it, since someone else moves fast and breaks what you just did.

No one is asking why we are doing all of this, just some vague hand waving that it is inevitable, predetermined, as if we are not taking actions that are leading to these outcomes, that we do not have agency. But if we all tell ourselves that the future is predetermined, that this was always going to happen, then we do not have to own the outcomes.

For alot of people who preached radical ownership within the product, they are not willing to take radical ownership of the product externally besides profit.

I know. I don't expect them to come up with anything, but its fun to see how far they will backtrack/change the goalposts and how much they will tie themselves into knots to try and justify their lack of integrity.

So we have moved the goalposts to this point.

I am sorry you feel this way, it does not change the facts of whats being discussed, its just that you disagree and you lacked the initial courage or intellectual capabilities to express that constructively, so you had to obfuscate through providing nothing of value to the discussion via low value comments. I get that YOU don't think something, but just because YOU feel something doesn't make it valid, grounded in reason, or should be listened too.

Have a great rest of your day and weekend!

I have already addressed this elsewhere. [0]

The call to HIPAA wasn't about PII, it was about knowledge around standards and regulations such as HIPAA when it comes to application/information/network security is just baked in. Which is why the passivity around the statement made no sense given the risks/obligations/liability associated with vibe coding applications at the executive level, which someone who's company deals with HIPAA should understand and appreciate.

Never have I said that, and please quote me word-for-word otherwise, what I said applied to "very executive/ leader at my place of business who does nothing except work with PII data all day", that is a windmill you created yourself.

You can keep tilting at the windmill.

[0] https://news.ycombinator.com/threads?id=Ucalegon#48133230

There is a fundamental difference between non-technical users from using Claude, or any other LLM, for whatever reason and whatever they produce being produced into production.

There are significant reasons why an organization would not want to use Cowork, because it does not fall under Anthropic's ZDR [0], which is a huge issue for... anyone dealing with anything sensitive.

What I think this comes down to is that you value velocity regardless of whatever the costs. We will get to see how that solves itself, there are going to be a lot of billable hours that are going to figure that out.

But none of this means that you have any idea what you are talking about nor do you understand why individuals or organizations act the way that they do.

You are free to do it better. Please do.

[0] https://code.claude.com/docs/en/zero-data-retention#what-zdr...

How many of those people, including yourself, actually understand what the technology is, what the risk factors are relative to your existing contracts/obligations, and how what you are doing with the technology interacts with the aforementioned questions.

I say this as someone who deals with sales/CRO/CFO functions quite regulary, I have to tell everyone that uploading contracts to Claude and/or ChatGPT does not hold confidentiality because files are not covered under enterprise ZDRs. [0] [1]

It comes down to 'everyone else is doing it' without an understanding of why, then past that, the what of how that applies to the specific business to find the unique value of AI to an organization that does not touch external networks.

Please give your GC the links below, let them look over your contracts and obligations to ensure you aren't exposing risk for no real reason other than saving a couple seconds for something that a SDR/BDR level employee could do.

[0] https://code.claude.com/docs/en/zero-data-retention#what-zdr...

[1] https://developers.openai.com/api/docs/guides/your-data#zero...

Does Anthropic's DPA provide indemnity to code thats produced from the product and any damages associated with security vulnerabilities within that code?

We are talking about vibe coded applications by executives and the risks that are associated with that, nothing within a DPA covers that. Please, be my guest, link an Anthropic DPA which includes indemnity for damages associated with the code produced.

Again, you keep showing your lacking of understanding of the domain in some really fundamental ways which shows that you haven't negotiated B2B contracts nor have you held a position of responsibility where you hold liability.

But keep responding because this feels more like therapy for you, and your feelings about people like me, rather than the realities of the exposure that come from vibe coded applications for executives.

Cool story bro.

Do you think the MSFT sales person, or anyone who has the financial incentive to innovate, doesn't want you to innovate? They want you on Azure and O365 regardless, they don't care.

Hell, Microsoft will give you will give you 150k [0] of credits to do so.

But keep talking as if you have some magical, unique, special insight that escapes contracts and the law, compared to the people who, sadly, have to deal with reality.

[0] https://www.microsoft.com/en-us/startups

I am not digging, I am being consistent.

But I appreciate you trying to police the expression of my deeply held beliefs, but, like, nope!

Compliance isn't required due to a vendor.

Compliance is due to the legal obligations thanks to local regulations and obligations that are defined through contracts with 3rd parties.

Saying 'found the Microsoft person' expresses a lack of understanding of the domain.

What does this even mean?

>Every executive/leader I've shown Claude Cowork to has gone from 'what is AI' to 'vibecoding whole apps' in weeks. [0]

I think this is where we have the issue in my tone and approach to my comments. My response was based off of the OP stating that the people who they were introduction were 'executives/leaders' and not 'friends', which has a very different connotation when it comes to information security, liability, responsibility, accountability, and ownership. It was only in their response to my question about risk ownership that they described the persons as friends.

If they had said 'friends' from the very beginning, instead of 'executive/leader' I would not have had the reaction than I did. The reason why I brought up HIPAA was because of 'executive/leader', since the idea of duty of care extends to leadership within any organization, especially those who are involved with healthcare, which they know based off of their company.

[0] https://news.ycombinator.com/item?id=48131968

VCs and investors are a massive issue, which is ironic saying that here, but once you get into contracts with other businesses, it changes things for the business and the leadership within who do carry liability when things go wrong, especially when they have made attestations.

I do not disagree with anything you said.

Generally, when it comes to 'privileged' information within an executives inbox it is business information or trust releastionships and not specific PII/PHI of an user. It was me being terrible at trying to impart that even the most begin seeming access may have major consequences even if it is not a total compromise of everything given the massive scope of 'what could happen' with executives vibe coding applications, like something managing their inbox past their EA, or something trivial seeming.

I appreciate the feeling but this isn't so much driven by principle but by business risk through contract liability or other liability that exists within whatever place you happen to be doing business.

'Adding value' is a very interesting statement and way to judge the worth of something. Adding value to who? And if that value add also causes massive harms, how do we reconcile that? So you build a brand new app with does all of the things that all of your total addressable market wants, but it also exposes all of the IP your existing clients, does that mean you will be able to achieve that TAM?

Corp IT does not exist in a vacuum. Understanding the why of that isn't a 'you should just accept this' but more 'how can we make this better and avoid mistakes already made by others'. I will always point to aviation and 'bold text is written in blood' as a great model to understand all of this not as a blocker but, instead, as a building block.

We are talking about one person's introduction of a technology to persons and the implications of that action within the framework of enterprise governance and risk, it is one in the same. If anything, who a person is, their knowledge of the domain and the associated implications that action has on the domain has relevancy where someone who is ignorant of implications may have more grace than someone who has the experience to know better. The passive lack of accountability or responsibility relative to that does matter given the context.

Explicitly name them then.

Depends on what types of apps are being built, what data they touch, and what those apps are exposed to from a network perspective. Ie; all of the fundamentals of information/network security. Generally speaking, most executives do not have an information/network security background but do have privileged access to extremely valuable information, even if an attacker just has access to their email.

>But I'm not saying it is good or bad.

Wait, you exposed people to a technology, taught them how to use it, then you are not going to own the implications of that action without teaching them about the risks or telling them how they need to ensure they don't shoot themselves in the face or violate their duty of care?

Do you understand what you are saying and the implications of that in the real world relative to the insurance contracts that they have?

Your company is associated with HIPAA, you should have a much higher standard than this.

The reality is, for a lot of people, they do not care about risk or implication or cost, as so long as they see things moving forward, especially if they do not understand what they are dealing with. The desire of 'build, build, build', to these people does not have a downside because they do not have the knowledge of what the implications of that actually means nor is there a culture associated with the duty of care that should come with the liability associated with other people's data.

Also, small business contracts likely do not have the same type of language around indemnity/SLAs, so it is easier for the harms of this type of system to go unpunished because those who are harmed are even less knowledgeable.

>Every executive/leader I've shown Claude Cowork to has gone from 'what is AI' to 'vibecoding whole apps' in weeks.

Do you, and those executives, own the risks associated with that practice? Are those risks actually indemnified?

Its neat that 'anyone can do anything' but if they don't actually know what the risk to business or 3rd parties, why is this a good thing, especially in the enterprise where there are actors who are explicitly looking for this type of environment to exploit?

Depends on the domain. There are plenty of different use cases where the data needed for training is available for personal, or non-commercial, use. At that point, it does come down to compute/time to do the training, which if you are willing to wait, consumer grade hardware is perfectly capable of developing useful models.

Sure;

https://arxiv.org/pdf/1607.06450

Depending on the model architecture, there is normalization taking place in multiple different places in order to save compute and ensure (some) consistency in output. Training, by its very nature, also is a normalization function, since you are telling the model which outputs are and are not valid, shaping weights that define features.