grayhatter

> It's not that you're prompting it wrong. It's that you're judging the output against a standard (human intelligence) that just isn't relevant

It's not that you're holding it wrong, you're just wrong for expecting it to work the way it's described (able to one shot most problems these days).

> In other words, you shouldn't choose the model that hallucinates the least without detailed prompting

You're prompting it wrong is quickly becoming the new, you're holding it wrong.

It's wild how willing software engineers are to blame the user when the actual problem is their own defective design.

Ideally we all, as an industry, will stop accepting this as reasonable excuse for the demonstrated incompetence

> Hallucination rate scores are a little tricky to interpret because they're conditional on the model not knowing the answer. That means they don't measure the probability of your encountering a hallucination in everyday use, since that also depends on the probability of the model not knowing the answer, as well as how well your distribution of tasks aligns with the distribution tested in the eval.

Do you have a cite for this?

If a human makes up some bullshit lie, I wouldn't accuse them of making it up only if they actually knew the correct answer. If you don't know, the only correct answer is I don't know. Any other answer is made up bullshit. Why is it only a hallucination if and only if the LLM contains the answer? If you make something up it's still wrong. It shouldn't matter if you could give the correct answer. You didn't, and instead invented some bullshit instead?

Follow up question, how can I apply this rule set to the next test I have to take? I'd love to be able to use "I didn't know" as the excuse for why I made something up.

edit:

> and it's not totally clear that this is the main metric that's worth tracking.

I don't know, the rate at which some model is willing to make up something feels useful. If the argument I see repeated on HN so much is that it's impossible to completely get rid of hallucinations; being able to choose a model that's less likely to invent some lie seems like a positive trait, no?

Either way, I'm happy to agree that a restrictive definition, where a lie doesn't count as a hallucination iff the model doesn't know the answer feels strictly, infinitely less useful than an exact error rate. What percentage of emitted tokens are misleading would be useful for me. Anyone know any group that's attempted to quantify the global error rate?

Yes, don't perform medical experiments on people who can't consent, and loudly object when someone suggests anything that sounds like it.

I admire your trust in other people.

> I only mean offer it to them for free so they don't have to [...]

That would be a nice idea, but

> Any plans to trial these types of drugs in the prison system?

Is a very different question from "how long until it gets approval for impulse control, and cheap enough that anyone can get access to it?"

Especially considering how foreign the idea of consent is as a concept to software engineers.

Why is that true today, but wasn't true the many times some group in the US did medical experiments on some vulnerable population without a complete disclosure let alone consent?

Experimentation on prisoners is unethical

> I wonder how many cumulative hours of human life have been wasted waiting on writing comments on creamsicle reddit.

I disagree with a lot of the decisions around the design of Anubis... but resisting the current drive of the industry to ruin as much of the good faith resource donations from others is an admirable objective.

The point isn't to increase the amount of work required to the point of exhaustion, it's to require that scripts be able to offer the exact same feature set that browsers offer. The point isn't to make it impossible, it's too make it more expensive than free.

Anubis isn't trying to prevent all scraping, it's trying to reduce the abuse just enough that real requests get their fair share. You don't need to outcompute the botnet just slow them down a little.

I hate seeing the Anubis interstitial too, I've complained about it publicly already too. But it doesn't come close to the frustration of waiting 10s for an SPA to load all of the routes it'll never use before the first redraw. Clearly our industry has also decided latency is a good thing.

> I'm autistic and long-form writing isn't my strong suit, getting a 4000 word blog post to flow well is genuinely hard for me.

I find the way I interact with the world is exceptionally different from the descriptions of everybody else. Some of the symptoms of such manifest as difficulty communicating... with most people.

There are a subset of people who I have not only no problem, but seemingly a drastically increased information exchange rate.

Do with that observation what you will, but I don't write for the lowest common denominator, the preferred style of AI, because I don't write for the people who cant be bothered to understand me. I'm writing for people like me.

n.b. Maybe you are writing for the lowest common denominator. In which case, say that: "Yeah I know it sounds like AI but it's supposed to be advertising, not a technical white paper or PoC"

> the AI just helps me get a baseline down so I'm not staring at a blank page.

If this was true, the top comment wouldn't be a complaint about how the voice of the article sounds "inauthenticlly human" or like an LLM. It's having a stronger influence on your writing than you're giving it credit for. It's on you to decide if or how much you care, but ideally you wouldn't be lying to either yourself or your readers.

> They just can't kick people out willy-nilly.

why not?

If I'm forced to choose between enforcing rules against a random ass on the internet, or watching them annoy an actual contributor... no contest they're gone.

> Why? In the end it's a patch's quality that counts. Regardless who or what contributed it.

You just said: The things that I think and care about matter more than the things that you care about.

is that what you meant?

Being honest, if we're talking about the health of any given project, the patch quality doesn't matter that much. Not when you measure it against the importance of consistency and continuity of a regular contributor. A thousand perfect LLM patches are less valuable than an experienced maintainer.

If your LLM is annoying them, and they quit. The perfect LLM patch just destroyed the repo.

People wasting others time is a social problem, not a technical one. Rate limits can't prevent somebody feeling disrespected.

> As a "new" maintainer myself - how do you decide when to ban someone?

When I want to. I like to describe it using the amusing language from a generic cardholder agreement.

At any time, at my sole discretion, I may ban you from any of my projects; for any reason, or for no reason at all.

My projects exist because I enjoy working on them. My continued enjoyment is the most important aspect to the health and survival of any project. You don't owe anyone anything, you're allowed to donate your work to others, and also enjoy the privilege of setting whatever arbitrary rules you want to make sure you enjoy your time.

Imagine you're running a free ice cream shop. Some random asshole walks in and starts verbally abusing your best employee who has done nothing but try to help. At what point do you kick them out because your employee is more important and worth more.

You should stick up for yourself, I would.

You can't be an asshole to an LLM. They can feel offended.

I didn't get fired.

To be fair; you don't need a union... you can just say no. Context; I told them they couldn't ship this exact feature as designed. (It worked until I left.)

I'd bet I could tell with a result somewhat better than random chance.

While there is no meaningful difference in the ability to write code, vim has earned it's reputation for having a learning curve. I'd argue that predisposition, that requirement for additional investment energy will bias the results towards attention to detail, and pure minimalism.

> minor nitpick, but for the most part (not including the website code, etc), this is not "their data". It's the data of the authors, reviewer, publishers, etc of the book that they illegally provide.

Both are correct. You can say the data belongs to the work of the author. But in context, it's trained on data that exists within the training corpus because in large part of the work and/or resources of anna's archive.

> But let's not forget that if author cannot live of what they create, they, for the most part, won't be able to continue creating.

This is a separate and distinct argument for copyright, I don't find the argument that piracy meaningfully hurts artists compelling. In the context of meaningful harm, I believe it only hurts producers or publishers, almost never the creators directly.

> Good for artists, fair from a market perspective

Bad for fans,

just because you can pick a solution that can extract the most amount of money from the thing, doesn't mean you're required to do so, (nor are you required to suggest it.)

It already is a subscription based model. The difference between they're lying by charging once and pretending like they don't know they're going to stop providing the minimum requirements to play the game.

You're describing the reality, and the difference after adding these additional rule, they'd have to be honest about what you're paying for and for how long you are allowed to use it.

Additional, if it is a subscription, it's more likely ongoing revenue could possibly fund providing the service indefinitely. Will that always happen, obviously not, but then game studios won't be as likely to do the same exact thing that catalysed the stop killing games project.

which will also encourage more people to switch to indie games who don't abuse their users.

$company might see this requirement, to treat people with respect, as a threat to their business model and will respond by becoming worse.

Is only a problem if you're not willing or able to introduce additional requirements to compel ethical behavior.

The problem isn't companies are evil and we're hopeless to stop them so it's better to bend over. The problem is we're unwilling to force companies to behave ethically. Its more profitable to be evil. And it's not technically illegal to do so.... yet. (It's also more profitable to just steal.)

> I doubt it's possible for legislation to mandate meaningful compliance regarding something as dynamic and rapidly evolving as online games. Despite good intentions, such legislation often results in unintended consequences including distorting the market, creating perverse incentives or even making the problem worse.

I believe it's possible to write laws that serve the people they're supposed to protect. It may take iteration, but you have to start somewhere.

I'm willing to tolerate the new problems that may arise from trying to solve an existing one. Presenting the unknowns as something to be avoided because it might be complicated and require additional effort to fix, is not a sane refutation.

so a new law making it required would likely solve the legal issues, and gets the dev team (the only ones thinking about users or doing what's right) get what they wanted from the start?

> We looked into it. Hackers got part of the way there so we decided not to make a change. They might be able to do it after the title is fully sunset and the team disbanded.

This doesn't actually answer the question about how hard it would be. What's the specific level of effort required, and some amount of why so people can learn from your experience.

> We basically have to get as much done on a 3/4 month timeline as possible and it isn’t a priority like saving content or refunding gift cards is. Shutting down is a lot of work.

I'd rather have a working game then a refund of a gift card. Including if that means I have to stand up my own servers.

Priorities I guess

The security/safety controls they have to add to make it safe enough to release?

are you able to detail a single safeguard you plan to implement, so that I can stop believing it's vaporware and/or a scam?

maybe you should ask on the issue directly?

> What on earth is going on here?

With the nearly complete PR with the port to rust, a number of people predicted that it was going to happen. They were assured it's unlikely to happen and then they were accused of overreacting over effectively nothing. When those same people who were already upset about the rewrite, learned that their predictions the same ones that were rudely dismissed, were in fact, correct, they became upset again; this time about being lied to.

Correct or not, it's reasonable to conclude they were lied to. Especially given they correctly predicted the future.

> so now it makes sense that people have strong feelings about it, as it's no longer just an experiment.

It also makes sense to have strong feelings when you're able to pattern match well enough to predict something will happen despite others trying to convince you that your predictions are incorrect.

It's not overreacting when correctly predicting the future, just because others couldn't. In the same vein, the idea that "everyone out to get you" is not called paranoia when there are people actually out to get you. That's better called being observant.

Some of those who predicted correctly might also have overreacted, but I believe that the majority understood that to be a blanket statement about prediction as a whole vs any specific individual reaction.

> The implication that I don't know what I'm looking at, or that I don't know what security is (despite having a clean track record for about 15 years now) was a bit aggravating.

I'm a security geek, a clean track record means much less to me than anyone would expect. The comment from the article mentioning that there was no evidence of exploitation explains why. I would never have noticed that implication, because I don't think it exists. (And it's completely unreasonable if it does), so that's your own deal... it's not a good conclusion to take from the article.

The only thing that matters is how much any given owner cares. Are they willing to go the extra mile to make sure things get done correctly. That's the best signal about if you can trust a project. Seems like you give a shit, so I wouldn't be too hard on yourself. The people that matter can tell, (everyone who can't tell is already willing to lie so they can be safely ignored!)

> In fact, even months later, the lasting effects have been panicking over anything that is remotely suspicious. The most recent example was just a few days ago. Had just gotten on the plane to go on vacation when someone Liked the original "I've been pwned" post on Bluesky. I misread the notification as being a new message to me saying "You've been pwned" and started to panick.

You haven't dealt with it yet, if you want to get your attention back so you can spend it on more important things than worrying about something from the past, you gotta talk to somebody. A therapist would help the fastest, but friends and family are often just as good.

> I'd have had no way to address it and it would have ruined the small chance per year I get to have a break.

Seriously, having been there myself it's not worth it... you're just allowing them to DoS your brain by allowing them to live rent free in your head. The only thing that matters is how seriously you take the remediation. Attention to detail, and the willingness to go the extra mile for security defects to tie up all loose ends is what matters. It's not your job to fix everybody's issue yourself, even if they don't or can't. You still have to enjoy life, or you burn out, and some idiot that doesn't care will take your place. Then they really win.

You're not responsible for the security or stability of anybody using nightly packages. (Only maintainer signed and tagged releases)

> The attack last year wasn't me misunderstanding security. It was the sum of many, many small things

so, a misunderstanding of how the little things actually impact security?

> (my history with and perception of npm especially w.r.t. their security posture and poor outreach over the years, being stressed out overall, and being in a rush at that particular moment, and a few other personal things) coming together in a perfect storm that resulted in the attack.

Those other personal things are the kinda thin that being able to enjoy a vacation make much easier. You can't help anybody if you don't put on your own mask first... Well... You definitely can, you're obviously trying to do now, but it's needless harder.

Npm, and the JavaScript ecosystem is a fucking joke. It's a mistake to blame yourself (or any maintainer) for how difficult it is to meet the bar for both security and accessibility. Worrying about the difficulty in consistentenly demonstrating the perfection required for security is a fool's errand, and your allowing the bad guys to get what they want by letting it live rent free in your head, it won't go away for as long as you worry about it more than you talk about it.

And I say all of that as the person who has multiple times, made the argument that it's perfectly fine to name an engineer and their decisions or incompetence as the root cause analysis in an official incident report. (Pilot Error is a thing): If I thought you were responsible, or had done anything wrong, I'd gladly blame you. Smart people don't care about mistakes, because they are always noise in the signal. I care about effort. People who give a shit are much more important and valuable.

> you're almost certainly going to have everything you send go straight to spam.

I run my own email server on DO, nothing I send goes to spam. (I normally follow up on nearly all emails in case you're assuming some flavors of sample bias.)