cortesoft

Who is 'they'?

> The value of money, and the ability for average people to have influence on future events, ultimately is tied to the fact that the labor of an average person has inherent value.

We also have the power of the vote, at least for now. I understand that that is limited, but it isn't nothing.

There is also just the power of having a lot of people. We don't yet have the technology where one person with a lot of machines can dominate a society. It still takes people.

Then use an http header like we do with CORS or something, which lets a domain set a cookie for another domain that opts in. Or, you can just include the necessary cookie info in the redirect.

They should have never allowed cross subdomain access for cookies. Every subdomain should be treated as completely unrelated to all other subdomains.

So you are therefore arguing for the author's point.

The entire exercise is to counter the claim that AI means every script kiddie with tokens can just have their AI create an exploit, and then have their AI scour the internet for vulnerable endpoints. If that were true, then the exploit has very little value, because everyone could make one.

In addition, the claim is that these exploits will all immediately have a thousand bots using them to exploit every possible website, and you can't leave your website vulnerable for a second or it will immediately be owned.

The fact that that hasn't happened to this server already proves the point. Whether professionals can create an exploit from the vulnerability was never the question.

Whether it is a trap or not doesn't change the OP's point... they are trying to push back on the idea that all servers that have this vulnerability are going to be instantly hacked by bot swarms. If AIs are at the point now where they can all instantly create an exploit from a known vulnerability, then you would have no need to keep your exploit secret because everyone would already have one.

The fact that you keeping your exploit secret means anything already proves their point.

The difference between investment and debt is that debt has a senior claim and fixed returns. You can't be forced to sell from investments.

You say they aren't even close to being an answer, and then give basically the same answer...

> they also ask questions, and if they are good, they ask the right questions, something LLMs still have a problem with.

Sure, but LLMs do ask some questions already, and there is no reason to think they can’t keep getting better at knowing the right questions to ask.

Humans also often fail to do this well, and I think we all have experience with developers who do a very poor job at understanding what is actually being asked of them.

Maybe LLMs will never become as good as an expert developer at being able to suss out what someone is actually trying to do when they make a request, but it is certain LLMs will become better at it, and there is no reason to currently believe they couldn’t eventually become as good as the best humans eventually.

This is how gossip and urban legends and other myths have always spread. The difference is the size of the network and how much distance a myth can travel in a very short time.

Now, the entire world can share the same piece of gossip, and it takes on an entirely different quality when it is global instantly.

This doesn’t help you if you need to run a public website.

I was more talking about staying up on security issues with your stack after they are patched. We will need to check for security updates constantly, or risk being exploited in the gap between a security release and you finding out that you need to update your software.

That is an excellent point

Is the starting statement on about half of the comments on this page. The world is getting so weird.

It feels like the only solution is going to be proactively running your own AI agents looking for patches and applying them.

I think calling private data "lost" if it is accessed is not a misnomer, even if you have backups.

You lost its privacy

And you trust this source because?

Is there a way from within the VM, though, to determine if that hardware feature exists and is enabled? If you don't trust your VM provider, how do you trust them when they tell you they have that feature and it is enabled?

We still build lots of things here in the United States, too. While many people can point to examples of projects that couldn't get off the ground due to red tape, you can also look around and see a lot of projects that are being built.

Many states operate that way, and many other states have rules that limit what the local governments can do.

If real people are using the model for real, they will discover for themselves that the data isn’t reliable, and then might switch to a different model.

The incentive will be to maintain a subscriber base.

> It's meaningless to say that selling something is profitable if you are ignoring the cost to produce it.

At the same time, training costs don’t scale with usage, so no matter how expensive they are, they can be paid for as long as inference is profitable. It is only inherently unsustainable if you lose money on inference.

Of course, it could be that the inference usage required to pay for the training is too high to be possible, but that is a separate argument.

We would still know if certs were issued, though, which is the thing we want to check

Seems like the next push, then, will be to get agents and LLMs to start doing that discernment?

There is nothing stopping us from adding the ability to understand the context of information an LLM consumes, too, right? The same process humans use to assess data reliability could be taught to an LLM?

What? I have spent $10k on a computer but would never fly business or first class, that shit is way too expensive. Two trips would buy a new $10k computer!

Just because other people don't use your version doesn't mean you can't.

This is true for pretty much every fixed price subscription service in existence

What else would it be ranked on other than value? How else would you compare different types of items?

Yeah, you are right. I don't know what I was thinking when I said that.

Little harsh to say I have NO idea what I am talking about, though.

I still don't agree that companies won't revoke their passkeys if we are in a PQ world.

If they don't, you are still in a better place than passwords. Each public/private key pair is unique for every domain, so a compromise in one place is not a compromise in others. Many people re-use passwords (even if you don't).

Where are you seeing that? I don't see the word honest anywhere on the page