ahupp

> “The Hugging Face incident definitively showed that it wasn’t the fact that the agents were super smart. It’s that there literally was a hole that was exploited because it was not configured correctly on the containment side.”

I would encourage reading the actual report, which is explicit that a previously unknown exploit was used to escape the sandbox:

“Agents exploited a separate, previously unknown vulnerability in Artifactory to move beyond their sandbox environment and compromise the Hugging Face environment.” — Section IV.A, p. 9 in https://github.com/zeke/openai-huggingface-incident-research...

> but no indication of what that means

The very first thing it means is that a firm has to understand the new law and then determine what changes it requires. And as a firm gets smaller that makes the relative burden higher. Of course this shouldn’t imply you never change anything, but it does mean every incremental new regulation is a ratchet that shifts in favor of large firms. The EU estimates this regulation avoids 23Mt of CO2[0], which is about 0.8% of EU emissions. Not sure that’s the place to focus unless you can make a case that it will have spillover effects into other markets.

[0] https://www.europarl.europa.eu/doceo/document/E-9-2023-00218...

What is the principle you’re using here?

I think the parent comment is saying “why did the agent produce this big, and why wants it caught”, which is a separate problem from what granular commits solve, of finding the bug in the first place.

Hilarious. When working on a virtual reality VOIP product, someone added a test mode that played back your own speech with a delay. It was like part of your brain shut off, was a surprisingly strong effect.

Do they need software? Presumably the volunteer firefighters 30 years ago didn’t have this and did fine. Plenty of volunteer organizations are built on Airtable or some spreadsheets.

IMO corporate income tax is the first that should be removed, with a corresponding shift to income taxes. Those can be as progressive as you want, have much lower compliance costs, and don’t distort behavior in the same way. Thought in practice I’m not sure how tax collection from foreign owners would work.

I’d agree with this, unless the kwargs is typed with the new-ish PEP-692: https://peps.python.org/pep-0692/

Can you quantify what you think that choice looks like?

Say you seized the entirety of Elon Musk’s assets: that could pay for a year and a half of the Dept of Transportation. Say you seized all the wealth (somehow) of the world’s 100 richest people. That’s 2 years of US non-discretionary spending (social security, Medicare and Medicaid). I often see comments that assume all problems could be solved by just taxing the rich more, but I just don’t think that’s true.

The Nordic countries pay for their social safety nets by taxing the middle class more heavily than we do in the US. If you want to change that, it’s less about capital vs labor, and more about your dentist vs labor (dentists be the classic example of jobs that earn high incomes without being “capital owners”).

With o3-mini-high (just the last paragraph):

civilization Mycenaean the of practices religious and economic, administrative the into insights invaluable provides and B Linear as known script the in recorded was language Greek the of form attested earliest The

Say they, hypothetically, the police just looked at every drivers license photo of people living in a 1 mile radius. And they find the suspect, and go to a judge saying a combination of appearance, perpetrator in suspects driveway, and criminal history gives probable cause for a search. I don’t think that’s any different.

If they came to the judge and said “an informant said we’ll find the gun here” and the informant was actually Clearview, thats obviously a problem.

The big risk that we need regulation for is not that insurance charges too much, but too little. There will always be the temptation to charge less than the other guy, get lots of customers and hope nothing really bad happens.

Using language-native packaging doesn't imply that you have to use binaries from wherever. In the pytorch example you can still build it as a regular part of the distribution, using the C++ dependencies/toolchain, it just means you don't try to stuff it into a versioning/distribution/install model that doesn't match the languages expectations.

This is conflating static linking with how the distribution handles updates. If a language is always statically linking dependencies (like Go or Rust), the distribution will have to rebuild everything that depends on a patched package whether or not they are using the language's native tools or some import into the distro package system.

What I'm specifically suggesting is:

  * Distributions package *binaries*, but not the individual libraries that those binaries depend on.
  * Distributions mirror all dependencies, so that you can (in principle) have a completely offline copy of everything that goes into the distribution.  Installing a binary uses the language-specific install tools to pull dependencies, targeting the distribution's mirror.  
  * Enough dependency tracking to know what needs to be rebuilt if there's a security update.
  * Any outside dependencies (e.g openssl) will continue to depend on whatever the distribution packages.
  * Dependencies are not globally installed, but use whatever isolation facilities the language has (so e.g, a venv for python, whatever npm does)

It’s not like this is unique to rust; you see similar issues with node and python. Distributions have many jobs, but one was solving the lack of package management in C. Now that every modern language a package manager, trying to apply the C package management philosophy is untenable. Specifically, the idea of a single version, globally installed, and producing distro packages for every language specific packages.

The doctor / hospital that refuses to treat when insurance declines is also involved in the “omission of expected care”. Would they also be guilty of premeditated murder?

Murder is by definition an unlawful homicide. This isn’t just pedantry; it’s the most parsimonious explanation for why someone would support the death penalty and object to something like the assassination.

This is a great illustration of why taking about deaths is not really informative, and they should be talking about life-years lost.

The cost of shipping contributes to the cost of every product we export and import. Treating this as a purely zero-sum transfer between longshoreman and shippers is ignoring all the reasons this is interesting & important.

As a hypothetical example, if there was some new method of transport that bypassed ports entirely at 1/10th the cost, would you support an effort to scuttle it to support longshoreman?

This same issue played out with the introduction of the shipping container; if history had played out differently and we were still manually packing ships I don't think you'd choose that world over what we have today.

Is modularity an unalloyed good? Modularity comes with tradeoffs that mean you end up with, well, a bunch of discrete modules rather than something that works cohesively. That's why systemd was adopted pretty much everywhere, ignoring the arbitrary modular boundaries results in a more useful tool.

Some analogs: modern filesystems like ZFS and BTRFS that combine volume management with the filesystem, every service that's consciously chosen to deploy a monolith instead of microservices, and so on, every deployment that chooses to statically link, etc.

nit: HHVM was a completely new implementation of a runtime for a PHP-like language, it wasn't a fork of Zend.

You might be able to do this transparently with a [MetaPathFinder](https://docs.python.org/3/library/importlib.html#importlib.a...), the only trickyness would be replacing the lookup in sys.modules which I don't think has has an official interface.

That stat alone doesn't tell us if the disparity is due to different rates if criminal behavior, or different treatment by the system. A useful check is to look at murder victimization rates, since a) murder is almost always reported, and b) most murders are intra-racial.

The doc you linked says 39% of inmates are First Nations, and this[0] says they are 37% of Alberta murder victims.

Of course this isn't saying that there isn't inequality in the system, but just that happens before someone gets sentenced.

[0] https://www150.statcan.gc.ca/t1/tbl1/en/tv.action?pid=351001...

Yes, a large fraction of ER visits aren't emergencies. Typically they triage new patients, take the actually critical ones immediately and everyone else waits.

I'm not sure wait time is an informative metric, vs something like survival rate for different kinds of conditions.

There may be a bug or change since I left, but I built the app library and authorization logic, and it was explicitly designed to work offline. Of course, using it day-to-day and initial setup are different and I'd imagine if Apple is down it's hard to setup an AVP as well.

I'm not sure who this is directed at. A more interesting question is, does Substack expand the number of people who can support themselves by writing vs a world without it? I personally spend over $1k/yr on Substack; sometimes because I get great value out of the paid posts, and more often because I want to author to keep working in an area I care about.

That's 10x more oil per capital in Norway.

Yes. There are many (infinitely!) ways to write an equivalent expression, most of which are not as clear to read as the standard format.

IMO using operator overloading for this kind of thing makes it hard to read, since I have to be extra careful to mentally parse whether that `*` is a multiplication or units, remember what variables are in scope etc. Notation matters, and if I didn't care about that I'd just write `pint.Quantity(5, "meters/second")` and be done with it. Or more likely, not go to the trouble of using them at all.

> I don’t understand why you’d go to the enormous trouble

But more importantly, it was just really fun to get it working.

If you're interested in this kind of thing, I wrote a python package called "unit-syntax"(https://github.com/ahupp/unit-syntax) that adds physical unit syntax to python:

   >>> speed = 5 meters/second
   >>> (2 seconds) * speed
   10 meter

I'd been using Jupyter notebooks as a calculator for engineering problems and was wishing for the clarity and type safety of real units, but with the succinctness of regular python.

It works in both Jupyter notebooks (with an input transform) and stock python (with an import hook). The actual unit checks and conversions are handled by the excellent `pint` package.