dspillett

Hence my having a /64 (/48 in fact, should I ever enable more than the current /64) shows that 64-bits is enough for global addressing. If it wasn't then giving me a /64 would be part of a path to creating an address exhaustion problem just like the one with IPv4 (which was exacerbated somewhat by handing out /8 ranges unnecessarily in the early days).

If it is only free in order to inconvenience competitors in a way that will eventually reduce choice, either giving you undue control of a market or being done with a view to charge later when people have no choice as the competition is broken, or both - that is when free becomes an anti-consumer matter.

It is an issue that you sometimes need to think long term to notice. If you wait for it to be an immediate problem, it is often too late to easily do anything about it.

Your food example is exactly what people feared would happen with IE, and what actually did happen for a long time despite the anti-trust case: client side developments stalled because IE was such a large part of the market and it did not implement anything new because there was no reason for them to. There was not sufficient competition to make it inconvenient for the incumbent to stagnate, so the whole area stagnated somewhat until Chrome came along and stirred things up a bit. MS was in control due to an effective monopoly, the consumer suffered.

IIRC something like that was considered when IPv6 was first being designed, be deemed insufficient for the long-term future. 64-bits is thought to be enough to stave off address starvation though, which is why IPv6 address ranges are usually assigned as /64s (my homer link has a /48 range should I wish to use it all!), so I can see your reasoning on that level.

Thanks. I might need it!

> sooner or later they will start tracking if we fired up Claude for the day

We track who uses what AI and how much. For billing/expense tracking purposes, as we've gone from “use it as much as you can” to “use it as much as you need to but don't waste it”, but there will be a table somewhere with my name in the bottom section next to a bit fat 0.

> has been pretty pushy when it comes to GenAI use tho … Flat out saying no comes with …

You'll have to deal with that or get out, eventually, how soon depends on your management. AI is not going away, even when/if the costs rise when all that investment capital starts being clawed back. If it is any help in choosing an exit strategy: under UK employment law (if you are elsewhere you'll have to verify how things work in your jurisdiction) they can't force you to use AI or punish/sack you for not as it can be argued to be a material change of role (as it is described as revolutionary, or in less breathy terms “like becoming a manager”, etc.) not just a different tool. But if you refuse then the same argument can be used to make you redundant (“we need more AI people and fewer traditional devs, traditional devs are being declared redundant, would you like to switch roles instead?” would be perfectly legal). As much as the payout for my long years in the same place would be nice, personally I don't think I can sit it out long enough for that to happen.

That is a function of the training data/method, like many of AI's problems. This doesn't stop it being a problem of course, but it shouldn't be a surprise.

Big bugs, like heartbleed, over the years have had breathy websites going over how serious the problem is because the problem was that serious, so the models associate that sort of wording with bug reports. Less serious bugs don't get the same excited treatment, repeated in many many places, so more measured descriptions figure in the training data relatively less.

I'm not qualified for anything else that isn't also remote, full of AI and getting more so, or both, so I may quite literally end up waiting tables, I have friends who can help me skip the queue there with an “he's a good bloke” recommendation. While I was in hospital recently (gallbladder trouble and liver infection) talking to one of the porters who was wheeling to & from the CT scanner, they apparently need more bodies ATM, I could certainly do that (other than the temporary issue I was in there for I'm fit & healthy) and might actually find some enjoyment in it. Both involve dealing with real people who are in the room with me. Anything I do once I leave here will be result in a massive pay cut, but if the change saves my sanity then that will have to be acceptable.

I particularly dislike the fact that I was, unbeknownst to me at the time, was coopted as part of that brigade of brick throwers.

--------

[1] a significant chuck of the internet

[2] beat up his online resources

Same. And DBA.se. I was a top contributor of both for the first few years at least, even got sent some free swag a couple of times, not because I cared about the points and being in the first page of people ordered by them, but because I felt genuinely useful and sometimes I got significant help with one or two of my own problems.

I never really did the social side though, I have problems with distance friendships including online communities (I just don't connect well with people that way) which is one reason that I'm hating tech work more and more these days (being on a remote team is not good for my mental health, while I'm not a huge people person it turns out I absolutely need some in my life, and really in my life not on the other side of a Teams call, even though I go into the office most of the people I work directly with don't most of the time so I'm still effectively remote).

A lot of people are rather bitter that they couldn't get the response they wanted from questions in the format they wanted to ask them, and would rather think that this slight against them is part of what killed the site. If it is all due to AI then they can't tell the tale of how SO rued the day its community deemed them off-topic :)

--------

[0] I'm leaving tech as a career in the next year¹, I don't care if I have to wait tables on minimum wage, I've been unhappy since ~2020 for a growing number of reasons and the great purloining+cheating+polluting machines are the final bail of hay

[1] Maybe before then end of this year, my notice period is two months and I have some accrued annual leave to use, we'll see how the next week or so goes!

Trying to keep code small could backfire by ballooning dependency on dependencies to do more of the work.

A lot do it because sometimes there is no convenient library wrapping what they are trying to check or execute that they are aware of, and running a cli command is generally cheap unless you are doing it in a tight loop. A lot of the time this is “it'll do until I find the right library or bindings” code that should have been fixed before release, but it isn't all as bad as running top as you describe.

It may not be directly exploitable on its own, which is the impression some reports give, but it is a serious hole to leave open especially with the current rate of old security issues being found, as it could be _incredibly_ useful to a malicious actor as part of an exploit chain.

Sometimes. But it, or 90/10, or sometimes 75/25, is understood to main “a large part of the time”/“a significantly smaller but still crucial amount off the time”.

> If you pay attention, so much user content is just repetition of something they read on the same fucking website and uncritically checked into their brain.

Which is exactly the problem. We now have LLMs doing the same thing, flooding everywhere with more of that noise, further hiding what good signal remains. Even if some of that good signal is by chance almost entirely LLM generated too, it appears to be at best a vanishingly small amount.

Ah, a connoisseur of the semi-automatic foot-gun, I see. Or maybe the foot-RPG?

> It is, SQLite’s docs are great and explain how it works in great detail.

But not the “and when creating a table that way.” part?

That to me sounds like a good way to amplify a bug whereby a foreign key has not been defined¹ where it should be. I hope there are copious warnings about it in the docs and when creating a table that way.

--------

[1] Or can't be as the referrer is in an external system, though in that case you probably want a separate external ID, possibly a UUID of some sort.

Yes you can shrink it down when things get bad, but if your index is large enough that you care then it is large enough that this reorganisation is going to be costly in time and may slow your system while it happens (or cause a complete lock if your DB doesn't support, or optionally supports and you don't select the option, this as an online operation.

If you are using your primary key for anything other than a unique identifier for rows, you are almost certainly doing something wrong. If you need an index on creation time, or just creation order, have a creation time column and an index on that.

The current American regime is hardly friendly to the ICC. Are they fair game too? (I'd likely say yes, they would strongly disagree!)

Only for projects that are in a maintenance state. New features will produce new bugs, unless everyone pays for the tokens to scan every release with the top-of-the-line agents or otherwise spends more time than many do ATM to ensure that changes and new code don't introduce significant exploit paths. Things will slow down once the low-hanging fruit from the past is mostly detected and pulled, but the level of vigilance will always have to be at least a little higher than it has been until recently.

Time between updates releasing and people installing them has been an increasing problem for some time, we are just going to have to be a lot more disciplined about that. This will be a problem for places that have strict availability requirements as they might have to compromise on the testing time they spend on new patches before updating their installations, and we might have to move to having more flexible maintenance windows (the old “an hour or two once a month after Patch Tuesday” hasn't cut it for some time and certainly won't going forward) to allow faster updates.

The bigger problem, compared to the patch-availability-to-general-use time which can be reduced somewhat via automation (though that might accelerate bad-patch based attacks…), is greater constraints for the time between bug discovery and patch release: as soon as there is a rumour of an issue many will start scanning for it (as that is easier now) so the time to wide exploitation is going to be much shorter. This might lead to buggy patches that add new issues of their own.

Perhaps we'll see a lot more projects having explicit LTS releases that only get security updates or signifiant bug fixes, which will reduce the attack surface area (and fault surface area) most users, letting those with less stability concerns deal with the bleeding edge.

> For people like me, this is just yet one more way LLMs are making my life materially worse.

I'm with you there…

It does at least add a useful feature: being able to state a location to search from. The Wikipedia page (unless there is one other than https://en.wikipedia.org/wiki/Special:Nearby that is more flexible) will only work off your current location, which is completely turned off on my work machine. Also upon checking on my phone, even with “desktop site” forced, the map looks to be an additional feasure too.

It is not your lesson to learn. You tried to be helpful, in a way that you had no idea was verboten. Unlearning being helpful is not a good outcome of this.

It being a potentially massive security issue, taking care to make sure it is safe to release the information is definitely something that should happen, but it appears that you did this:

> My contact had told me there was no embargo, and her contact had told her the same thing.

I'm pretty sure I'd have been more cautious given that the CVE details were not minimal, as this usually implies that releasing the details is expected to cause early exploitation¹, and wouldn't have discussed it as publicly as on HN, but don't kick yourself too much for having done so. You did not break the chain, someone before you, maybe several links before you, did by telling others without giving them information about the need for an embargo.

--------

[1] Perhaps that is a lesson to learn, rather than the not being helpful one? Even then that is a small correction to your level of caution, the big lesson (“FFS be careful, things are embargoed for a reason”) is still for those before you in the chain.

You can't take over the world overnight with little money, even the billionaire class and their companies have limits past which the risk of going bust by overstretching is far too high.

Better to sell the AI services to individuals and smaller business entities, let them take all the risks to build those companies, and later consolidate by buying up the ones that are doing well.

--------

Slightly more grounded: the models aren't that good, at least not yet, despite what marketing would like you to believe.

--------

[1] caveat: I am in no way a biologist, sociologist, nor psychiatrist - this pondering may be complete bunkum

As anti-AI as I am, people pointing out that they've spotted an AI are getting quite tiresome too. If you think people won't spot it without you telling them, then it is good enough for them no matter who or what generated it.

Though the cog for settings is, like the three-dots commonly used to represent a menu itself, is only recognised as such because it has often been used that way. The first time(s) it was used it would not have been obvious to people. So the rule isn't that a good icon should be obvious. A good icon is either immediately obvious or consistently used.

The common save icon is a good example of this in both cases: to those of us who have been around a while it is obvious because it looks like a floppy disk, to those who never used floppy disks it is obvious because that is what save icons (almost) always are.

From what I read last night: that patch fixed a specific case (an over-large index that became a negative number) that could trigger the problem, but did not fix the core problem itself. The new exploits try to trigger the problem in another manner, the new patch does address the core issue.