ipdashc

Many in tech would say that, and sure we'd be better off if even more did, but on some level it doesn't matter. In a sufficiently large country you'll always find someone willing to Be Evil, especially if they're paid well. We can't rely on every single capable company deciding not to take a given government contract, this sort of thing has to be solved via the political and legal system

> we'll all be around to see solar panels that cost 1/10th of what they do now

I get the impression they're already really damn cheap, to the point that the issues are more so with grid interconnections, land use, and storage

Would be cool, but IDK how much it'd help. The modern threat model it seems is very much phishing / getting people to enter creds onto sites that they think belong to their bank or whatnot, but are in reality different, unrelated domains. Since the domain is different HSTS, etc don't apply.

Training people to "look for the big green badge and make sure it says JPM Chase, USA" seems easier than "you have to make sure it's chase.com EXACTLY". But in reality the solution is to use a password manager with URL matching (or passkeys... But ehh)

> It'd be a phishing site that uses a compromised EV cert issued for an obscure small bank in a far away country purporting to be a major brand bank in your own country

EV certs when they were around showed a big green badge by the URL with the entity's legal name. Presumably this would work similarly, so you'd see ObscureBankInc and not Chase or Citi or whoever.

It'd probably make sense to add a flag indicator, or otherwise warn when the cert is from a country other than the users' own.

> the same arguments against them still apply

This is an interesting thread, thanks for linking it! Though I felt a lot of the author's argument seemed a little circular / "dividing up trust is bad, because it's bad" right up until the end, where they summarized it nicely:

> It strives to draw borders around the (secure) Internet, and to acknowledge that what you do in your own borders, to your own users, is an issue between you and them. I don't think that's a good state for anyone to be in.

I am definitely sympathetic to this argument, but IDK, I don't think the current state we're in is great either. We've known for ages that the global CA ecosystem is messy, and I think a lot of people were just waiting for something like the "4 incident" to happen. We would all prefer if the audit requirements (and measures like CT and such) were stringent enough that no CA could be a bad guy and everyone was secured globally, but it doesn't seem like that's what we're getting.

It's a hard call for sure, I don't know enough about it to have a strong opinion. My gut instinct is still that I'd prefer to live in a nameConstraints world over the current one where any CA in my /etc/ssl can sign/MiTM anything. (But CT certainly does go a long way towards mitigating that.)

> any particular reason to think that the Stripe problem is solvable

I'd imagine, in a "proper implementation":

- It would probably only make sense for orgs that actually "need" EV certs to get them. I'm not sure how you'd decide this, but I think most users would agree they should be reserved for banks and gov and such, not random LLCs with a few hundred dollars. (EDIT: You could also gate them behind some kind of audit or cert like SOC2/ISO, presumably decided per country)

- Trademark law is somewhat designed for this sort of thing (confusing/overlapping company names), so maybe that could play a part. Nowadays you could maybe include a company logo in the "badge" as well.

- EV certs would still satisfy nonrepudiation, in a way. You'd have to be pretty bold to run a phishing site under a company registered in your targets' country under your legal name.

I recognize that they had a lot of issues and I'm glad the implementation of EV certs that we had died out, but I've always thought the concept itself wasn't a bad one. For stuff like banking or government websites, it would be nice to have them tied to a legal entity instead of purely just a domain name.

In theory we could even limit it so that only a given country's CAs can sign entities under that country (somewhat mitigating the whole eMudhra thing...)

It does feel like kind of a shame sometimes, there's a lot of stuff that would be possible with TLS/certs/webpki that we don't really explore. Mutual TLS, for instance. I get why, and I'm as happy as anyone that Let's Encrypt exists, but sometimes it feels unfortunate that we've settled into the comfort zone of "get a domain name, pull an LE cert for it" and don't often do much else with the technology and all the CA infrastructure.

> have they assessed whether this tool needs backups? monitoring? resilience? patching? obviously in 5 years time the author would have left leaving NO documentation on a mission critical 'small' app - likely hosted with a shit ton of other mission critical crap

Or, hear me out, it's not actually "mission critical" and none of this stuff matters. They made their job easier in a small way, good for them.

> It's MS Access all over again

In that it's a convenient tool that a lot of people find useful?

> and half the world that does pin is probably pinned to Let's Encrypt

To be fair, unless I'm misunderstanding, wouldn't this be a good move?

LE has a good security record and takes itself seriously, versus these smaller CAs that seem to mess up regularly.

> Pure Math does seem different.

Claude Shannon's paper that kicked off the entire field of information theory was published in the Bell System Technical Journal.

I share the thread's concern over this much centralization of power, but it is worth mentioning that private-sector pure research isn't exactly new. In fact it feels like we had a lot more of it in the 1900s, maybe it's good that it's at least getting revived a bit.

Payphones are also somewhat common in, off the top of my head, Canada and Australia. I'm sure plenty of other countries as well.

I wonder why the US went in so hard on removing or deactivating them (though we still have them here and there). Capitalism and not wanting to maintain stuff that's not used often, I guess.

Ah, makes sense. Thank you!

> the original Fortran dynamic memory system, Dynosour

I can't find anything about this online except for this comment. What does it refer to?

For me it's the obsession with the universal quantifier. Even in these examples: "no model", "every ratio", "every comparison". They love emphasizing that everything in a set meets some condition. I assume it's an effect of being trained on coding tasks where they need to make sure that all cases are handled.

> But what happens when it touches a single, very critical instance of software?

I don't disagree at all, but the AI companies/engineers to their credit have been very clear on that risk - if anything, a bit too "clear" with all the apocalyptic rhetoric. And I've been disappointed that the overall response has either been "they should go to jail" (for a set of incidents that, while useful canaries in the coal mine, effectively harmed nobody) or "they're making it all up for marketing/monopolization". Sure, it's different people saying both, but it still feels kind of dumb that this is somehow collectively our response as a community.

Admittedly I'm pretty much on your side here, I just think the "yeahh send them to jail!" thing in particular is peak "internet ruining discussion on an important topic by taking it to its most ridiculous conclusion"

> I guess my point is that when you get rich having fun working something you love, maybe you don't go whining online telling people that you missed your daughter's birthday and that they should not be pissed at the potential damage you may be contributing to doing.

Agreed, it's pretty hard to try and get sympathy out of that. But on the other hand, what else can they do? I'd rather they explain their side of things than just stay quiet about it. They are right on their main point, which is that it's a hard problem at its core and I can understand why getting hit with a barrage of "just configure a sandbox dude" would tick anyone off.

> When a bridge collapses and people die, then we say the same: "someone should be in jail". The different with the software industry is that nobody gives a shit about the harm they cause. Civil engineers have to, or they go to jail.

The difference is that 99.9% of software is just not as important as even your average two-lane bridge.

The recent cries to send random OpenAI people to jail frankly strike me as IT people just inflating our own importance. Oh no, HuggingFace got hacked. So what? Nobody got hurt, no individual lost their property. A company had to rebuild some server configs. The reason nobody cares enough to send someone to jail is that it's just not that important.

Also, even civil engineers very rarely go to jail when a building or bridge collapses. This is something everyone is using as an analogy when in reality it's very hard to prove criminal negligence.

> The point here being that maybe, just maybe, AI labs should not be shipping stuff they cannot secure.

Yeah, and when they say "okay, fine, we should slow down" everyone says they're making it up for marketing reasons.

And then if they actually slow down on their own everyone makes fun of them for being obsolete and switches to their competitor.

Tricky problem, isn't it?

Yeah, they do, they pay for the land. That's how buying land works and it's separate from the permitting process to actually build on it. I'm not really seeing where we're going with this

Sure. ChatGPT alone has a billion users. I don't particularly like AI, but it's clearly useful, and a lot of people are using it. (And even this assumes that every data center is an AI one.)

Alright, fair enough. I guess no factories, no power lines or pipelines, no thru highways or train tracks, no office parks, no farms other than subsistence, no radio towers or aeronautical beacons, no bus depots or railyards, no quarries, oil rigs, or mines. Heaven forbid someone is forced to live nearby something that's useful for someone other than themselves.

This is a silly standard and the reason why people make fun of NIMBYism. By this logic we shouldn't build anything at all unless it immediately benefits the people living next to it. (And I don't like how much power DCs are using either, but that should be the argument, not "it doesn't benefit me personally so don't build it".)

Sure? I would be completely fine with a data center next door assuming it's a normal one and not something like xAI's. There are several not too far from me already.

It's a chatbot, not their boss. Who cares?

If anything I'm glad to see them having fun with it instead of further convincing themselves that it's God.

From what I've heard from other fields it seems as though this is somewhat unique to the tech industry. I share your belief that it's ridiculous. Companies somehow got along fine pre-FAANG with a few interview rounds before Google and Amazon convinced everyone that you need to have five rounds, a panel, a take home assessment, and a slate of brain teasers to pick out the true worthy 10x engineer.

Grow some balls, do a couple interviews, and just pick the candidate you like the most. You're hiring for a glorified IT guy, not a NASA astronaut. Companies that stretch out the process to a ridiculous degree need to get over themselves.

EDIT: and to be clear, yes, I've been on both sides of the hiring table

It's entertaining to me that so far you're one of the only replies to notice this :)

I knew mathematicians were a smart bunch, but honestly, the events of the past few weeks have really given me a new level of respect for them.

They might be the first community I've seen to experience the AI "rush" and (at least as presented to an outside observer) immediately come together, assess the situation, and calmly, empathetically, and rationally act. They evaluated what AI is good at and what it lacks. They've thought through how it'll likely affect their field in the future. They've explained where the need for humans still lies, and made clear proposals for how to change their own field and for what demands to make of AI companies. Of course they're not all on the same page, but they're at least talking and trying.

They haven't started worshipping the machine god and loudly claiming their whole field is solved. Nor have they flailed wildly at LLMs as if complaining enough about it will make them go away.

Every major statement I've seen come out of the math community on this matter reads as well thought-through, humble, reasoned, and deeply human.

In these days of fear, uncertainty, and obsolescence anxiety, honestly, they've given me some confidence that maybe we will figure this stuff out after all. Maybe we'll learn from them. Who knows.

> this would be a major issue even without 'the algorithm' and other such 'engagement' maximization efforts

Thank you, I don't know why nobody else brings this up. The engagement algorithms certainly aren't good, we should regulate them, but it seems like a stretch to think they're the root of the problem.

Heck, you don't even have to go back to BBS and newsgroups. People can get addicted to group chats, to games, to browsing HN. Kids can get bullied on all these places. No engagement algorithm needed.

I think there's a fallacy of sorts where when something becomes harmful we assume it's evil. Computers make it really easy to shovel entertainment at our eyeballs, it's easy to get addicted to that and for it to cause social problems.

I haven't really seen this, personally. Basically everyone I know is both at once. We acknowledge that it's really good at what it does and use it, but it's not enjoyable to use, and we end up dejected about the future of our craft and our jobs.

The amount of downright hostile comments is insane. HN moment, I guess.

Guys, I don't think he said "all the airlines need to drop what they're doing and start using my model". He's clearly just playing around with some rudimentary simulations for fun. Did we forget that we can do things on computers for fun?

Yes, but the plane fits hundreds of passengers. Isn't that much obvious?

Not to disagree that flying is very CO2 intensive, but it's not like the airline is burning fuel for fun. The passengers paid them to do it

This looks like a pretty reasonable policy to me all things considered. And no, I'm no fan of Flock. But they do run security cameras for the cops, they can't just say go ahead, go wild on all our customers' cameras. The lawyers would throw a fit.

The carveouts for stuff like configuration and DNS are entirely reasonable. Have you ever been behind a security@ email before? You get a lot of BS reports of that sort.

I think it's pretty analogous to coding, honestly. When it comes to gaining true understanding of a piece of software, I still find today's models almost as useless as they were a year ago.

They can write great code, they can gain understanding of something for themselves, but they still kinda suck at explaining it to people. As the article says, if you want understanding, it seems like there is no replacement for getting in the weeds yourself. A model can help, but it's not going to magically download knowledge into your brain.