ameliaquining

Do you also think the committee should ship a compiler? If not, what's the difference?

I'm confused about what exactly you're arguing for. Is the idea that the standard library should be minimal and then each compiler should ship its own nonstandard "batteries" library?

It's probably possible to improve things here, but it's likely best done as a separate open source project.

The memory-safety-relevant parts of the proposal could be salvaged without keeping contracts more broadly, by saying that the relevant behaviors (like indexing past the end of a std::vector) cause program termination in hardened builds. I'm sure it's more complicated than this but I don't think much more.

More generally, the C++ committee has had a really hard time agreeing on memory-safety stuff because there are a lot of different constituencies with completely different priorities (especially whether they're using it for greenfield vs. legacy vs. something in between), and the incentive is to make proposals sound good to everyone at the expense of actually being coherent.

Would anyone who watched the video like to tell us what the answer to the headline question is?

Not to defend the particular proposal at issue here, but my sense is that contract-like things synergize quite well with AI coding, for the same reasons automated tests and static types do.

The primary reason this hasn't happened is that it'd break C++'s de facto stable ABI (even though officially there's no such thing). For a lot more context, see https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2020/p20... and https://www.open-std.org/jtc1/sc22/wg21/docs/papers/2019/p18....

Spoiler alert: The option described as "the sort of leadership failing that I pray we can avoid" is what ended up happening.

Doesn't work for me in Chrome either; it transforms the URL from the top comment into https://sp.m. I believe this is the result of browser-level defenses against IDN homograph attacks, some of which postdate this article.

Explanation of why this hypothesis is unlikely to be correct: https://www.lesswrong.com/posts/7iAABhWpcGeP5e6SB/it-s-proba...

No, Nordhaus was never the problem and policymakers have not been anywhere near as aggressive about climate change as he thought they should be. If everyone had listened to him, we'd be in much better shape. The climate movement's antipathy towards him is a narcissism-of-small-differences thing. The actual problem is that voters only want to address climate change if it can be done without inconveniencing them in any way, which it can't.

For further argument, see: https://www.slowboring.com/p/economists-arent-the-problem-on...

This took place in 2005, nearly a decade before Medicaid expansion went into effect.

And so it comes full circle.

Why would the government use local LLMs? Compute is a central example of the kind of thing that makes sense to outsource.

...no? Whatever value they got from inference they already did is still there? Of course the government still needs to worry about vendor lock-in, but they'd have to do that no matter what, and also general-purpose LLMs are relatively replaceable for most use cases.

That's an argument against any descriptive name at all.

I don't understand this question, sorry.

But some organization has to check all that stuff, confirm that it's accurate, and then issue the certificate, right? So what's lost from having that organization just have a website that maps that information to domain names?

Can you give a concrete example of the kind of claim you think QWACs would be useful for verifying, that can't be addressed just as well with existing protocols?

Do you have any particular reason to think that the Stripe problem is solvable?

ccTLD name constraints are an old idea, back in the news again lately for obvious reasons, and the same arguments against them still apply: https://groups.google.com/g/mozilla.dev.security.policy/c/pF...

Are there other use cases besides those that you think the Web PKI should support?

Why do agents need any of this cryptographic infrastructure? Can't they just check on the certifying authority's website whether an entity is legitimate?

I think most American tech people are against most of those things? Why would they not have careers without them?

I've usually heard it called "ASP.NET MVC" except when the former part was clear from context.

The browser vendors, I think, were at least making a good-faith attempt to address a real security problem; it's not like they made any money from EV certificates. Even if it was inevitably going to be marketed somewhat predatorily, and ultimately didn't work out.

Do you have any reason to believe that your interlocutor is in favor of the U.S. government enforcing regulations beyond its borders?

Link to an explanation of the C++26 change? I can't find it.

Well, no one's saying they shouldn't also do other things about the problem.

I don't think that's a problem with the Oracle of Bacon data; I think there actually are more newer movies than older ones, because Hollywood has figured out ways to ramp up its production over time.

A sufficiently smart model could get somewhere that way. But again, I think it's less likely that our current ones are already there than that they can defeat the protections outlined in the post. So sandboxing would help.

Well, it seems better than not doing that?