jerf

Taking the question seriously (when I wrote this there was no /s), since I think it is still a question some people legitimately have, it is still extremely implausible that such tight dates and such a small number of iterations are all backdoored. For backdoors to be that dense would indicate some sort of serious flaw in the algorithm as a whole as well, something so serious that it should be fairly obvious. If these were initialized from dates, each separated by some billions of years and with the iteration parameters also in the millions or billions or trillions for no apparent reason it would be time to be suspicious.

Is it impossible? It is hard to prove impossible. But this is not what I would expect backdoors to look like.

In fact this makes me think that the information about how these were generated must have been lost very early in the process, or over-compartmentalized away from the wrong people. It seems like the NSA should have been positively delighted to show that these were the origins of the seeds as they are decent "nothing up my sleeve" numbers: https://en.wikipedia.org/wiki/Nothing-up-my-sleeve_number Advertising that fact should have been advantageous to the NSA if that is indeed how they were generated, so my best guess is that the parts of the NSA that should have been showing us that must not have themselves known.

QA is becoming the blocker for projects in an AI era, and the real source of value. AIs can lay down a good base of testing but I see even frontier models still need help with testing because they are basically as bad as humans in terms of testing only what comes to mind, if not even a touch worse. Though they are really good at blasting through problems once they are found.

Ironically, despite the predictions that AI will murder SaaS, I think the result is they end up even more entrenched, because Job Bob's Bait Shack And Tax Filing Services may be happy to instantiate some front office system for themselves via AI prompt, but they aren't going to want to QA that post-AI any more than they want to now. Once we all settle down, SaaS will manage more code than before, and do more QA, and Joe Bob's etc. will be even less interested in trying to replicate the work with AI because it will represent an even larger QA load than it does today, relative to the size of their business.

Or, to put it in the context of this article, even if you can prompt a database into being today, which you can, you can't prompt something into existence that has been tested and QA'd like Postgres, and you would be well advised to ponder that gap between your prompt and billions of computer hours of field testing very carefully before you decide where to store your company's most important data.

It's time for the rest of the world to learn about Amdahl's Law. Even if we flipped a switch and tomorrow everything that could reasonably done by AI was suddenly free and instantaneous, the world does not instantly transform into an AI paradise wonderland of free goodies and lollipops because there's still plenty of other things that need to be done for goodie and lollipop production and distribution.

I guess if I wanted to put my skepticism about the AI stock bubble into one little phrase, it would be that I don't think the bubble has accounted for Amdahl's Law. Costs don't actually go to zero with AI, and there's a huge difference between costs falling even 90% and costs falling a full 100%. And the difference between "30% improvement this year, trending to 85% in five years" and "90% this year" is pretty significant too.

Ah, the classic "picture is worth a thousand words" move. Well played.

If you think "company might have faked public demo in some important way" is a "conspiracy theory", your conspiracy theory sensor is badly miscalibrated and desperately needs a tune up. Your default presumption should be that a demo is faked to at least some extent because most of them are. If I don't hear an explicit declaration that this is real and live and working exactly the same on stage as it will be for the consumer I assume it isn't. And even some of those declarations have been shown to be false over the years, a particularly popular one being "this is real game footage on the real hardware" except it's actually a developer box with a lot more power than the console in question.

It's a pity they're such jerks. On their own terms they are absolutely beautiful birds. But they're not so beautiful that I don't also want to see some of the other beautiful birds that live around here.

A tiny bit fuzzier but not in a way that mattered back then. If you're running a software renderer it could well have been at 320x200 and on any monitor that comes out still looking pretty much like an LCD display, with slight blending on the edges technically but still large, large pixels not being blended. Even at 640x480 there was noticeable blockiness not being blended away. Monitors were designed to be sharper than the televisions the consoles were outputting to. Software rendering at anything high enough to be blended looking was a slideshow.

There is a bit of a fine line between caring about the future and not screwing them over, versus just being so arrogant as to think we know now the right thing to do for them.

But given the amount of time it is going to take to accumulate so much as another leap minute's worth of leap time, let alone an hour, I'm pretty confident we're in the "arrogant" branch if we start declaring what they need.

P(nobody cares about UTC anymore anyhow | someone had to solve the problem of incorporating non-terrestrial time which is way harder than leap seconds) would seem to me to approach 100%. You can decide which branch you want to take, but P(things just keep on keeping on without much change from today for the next several thousand years) seems not large enough to start trying to make lots of plans for.

I find myself a bit astonished whenever people have trouble with this idea.

We can just decide that if you can't afford a person to vet the ad, it's not allowed to run.

Yes. That will destroy the current online advertising industry. As tempting as it is to say "that's the point", that is in fact not the point. The point is, we are completely in our rights as a society to say through regulation that if you can't vet an ad with a human, you can't run it, and the capital structure can damned well do what it does best and accommodate that whether they like it or not. We absolutely can write laws that say that Google is to some extent directly liable for the ads they run. Nothing is stopping us, at least in principle.

Does that mean it will be a lot harder for the advertising industry? Yes. So be it. That is not a reason this can't happen. Is it expensive for them? Yes. I don't care that this means that they won't be able to run anywhere near as many ads.

It is not a stopper that it would be really hard for them. It should be harder than it is. It should not be profitable to build a vast surveillance apparatus to squeeze literal fractions of a penny at a time out of us. It should not be profitable to have this massive machine that can push such targeted malware at as.

We're not talking about some minor tweaks that they can toss a few AI tokens at. We're talking about regulation that would rewrite the entire social contract of advertising. A social contract that we have not really signed, either individually or collectively. We can do that. We can rewrite the contract. It's a permissible thing.

We don't have to have a massive surveillance state just to serve us ads. We don't have to have sports gambling advertising on television. We don't have to have billboards on our highways. We don't have to have extra-cheap mailing rates for ads. We don't have to have Roblox and other video game systems exploiting our children's psychologies with deceptive game currency practices and gambling mechanics. We don't have to have state-sponsored gambling running what everyone knows is a backdoor tax on the poor. None of these things are physically inevitable. None of these things are socially inevitable. There are reasons why these things do exist, which economists and game theorists and political theorists have various words for, but none of the reasons are because they are mandatory and we're just stuck with them forever because there are no other possible worlds.

I'm reserving "vibe coding" in my head for "the programming style where you just prompt your way around without even looking at the code and only caring if your happy path works".

I have a couple of nice "vibe coded" apps I would never dream of releasing because I'm not interested in the QA, more than anything else. The problem is the other people who are not quite so considerate and think that what they tossed out in 15 minutes is of interest to the rest of the world. The value of a software package release now is more in the QA than the code.

My guess based on the timing is that it is primarily for the Steam Frame. Steam is not just a game launcher but the entire desktop environment for the Steam Machine, the Steam Deck, and anything else like Bazzite that uses it as its primary UI as well. But in those cases, while at scale every second saved is nice, for the most part a second here or there doesn't really amount to that much.

But for the Steam Frame, which is probably booting while it is strapped to your face and completely obscuring your vision, every second is felt much more intensely. Anything that can be done to get to first interaction sooner has a much, much larger effect on the feel of the experience.

The speed would always have been nice to have, but it moves beyond "nice to have" for the Steam Frame case into having a significant effect on how it feels to use and the out-of-box experience. Yes, you'll use sleep most of the time, but when you do a full boot or reboot, you feel the seconds.

How many of them will go away?

To a first approximation, none of them.

There's a huge difference between "zero" and "a little" when it comes to Amdahl's Law and scaling up, let alone the things where it won't be "a little". Which is one of those things that sounds obvious when I say it. But clearly a lot of people are predicting a future that is based on costs and times being "zero" that won't be.

If you're planning on posting snark it's generally a good idea to make sure you read the rest of the post first.

You couldn't integrate it into theirs, so you'd be looking at having to fence in the entire space you want the dogs in because the gap you'd leave would have to be big enough for a dog.

Which is hardly the end of the world, but it can definitely grind the gears to be spending thousands when you could fix the problem for several hundreds, if not perhaps several tens, of dollars if they wouldn't be assholes about it. But I would absolutely advise anyone in that situation to spend the thousands and not bank on the state not being assholes about it.

I can also add that you can't even be sure that if you got away with it for years that you will continue to get away with it. The particular issue that my father got into a bit of hassle with the state about is that he accidentally put a pole barn across the state line. Didn't mean to, but he misread the survey markers. Fortunately, they let him remediate it at his expense without pursuing the matter any further legally... but it means they did, after several years of it being there, come through a with a survey team and verify that nobody on the border was crossing into their land, and anything they found they made the residents fix no matter how many years the deviation had been there. All the laws about such thing between two citizens mean nothing to the state.

I was in the house a couple of weeks ago when I kept hearing a voice coming from upstairs every so often I couldn't track down because it never happened when I was up there.

I had forgotten my son bought the Nintendo Talking Flower: https://www.nintendo.com/au/products/talking-flower/ Usually his door is closed when he leaves but that day it had been left open.

Which is to say, nowadays we have some toys that spontaneously speak in the middle of the day with no input too, by design. It didn't "freak me out" or anything, it was clearly an electronic sound from a speaker. Did make me ponder the idea of leaving some sort of speaker with a software-defined-radio wired into the mains so I could do a drive by of my old house a few years later and start transmitting things into it around Halloween or something, though.

My family used to live next to state land. The state can be very pissy about its land. If the fence line is on the state land, which it almost certainly is barring a surveying error when it was put up, it is entirely possible that if he fixed it, he would actually get in trouble with the state. Hopefully not actual legal trouble... but only hopefully, certainly not a "oh they would never bother". Oh they most certainly do sometimes decide to bother about the most random things.

My default presumption, without checking with them directly, is not only that it would not be allowed, but that this is also very much not a "better to ask forgiveness than permission" situation either. Even just asking the question can draw attention from them you may not want.

The ready accessibility of the land is advantageous in some ways, but as neighbors the state can be quite nasty. Your other neighbors don't tend to have anywhere near the regulatory firepower to make sure you comply with what they want.

Oh, good. Not exactly where I expected it but it's there at least.

Am I missing something or is none of this information documented in net/http itself? This is a surprising implementation of "Close" and should be documented somewhere.

I can attest to the fact this is a Frequently Asked Question among people who are trying to Go as an HTTP client, so even though this feels somewhat icky, I can understand where it is coming from. However, I'm also missing, if I want to slam this connection closed, which is a reasonable thing to want, how do I do that without uselessly draining a socket I don't intend to reuse? Fake the "Connection: close" header into the Response object? Hope I can dig out an underlying socket of some sort under the concrete type of the Body.Response that I can bypass this code with? Seems like there should be a way to do that too.

I think the passkey standard included attestation for good reasons, but it is obviously also possibly a trap in the sense that I'm sure there were some people on the standards committee(s) envisioning a glorious world where they can flip this on for everyone and instantly all the bad stuff stops.

I have to admit I don't worry too much about the entire internet flicking attestation=true anytime though, because the resulting support nightmare would be ferociously expensive. I wouldn't be surprised that, on its own, it would be more expensive than the cases that the companies flipping the switch are trying to avoid. Which means it isn't going to happen.

The simple truth is metaphorical-Grandma can't handle the degree of responsibility put on the user that strict hardware attestation implies. Netflix et al are more likely to want metaphorical-Grandma's money more than an incremental improvement in their ability to be sure it's an attested login, and won't want metaphorical-Grandma to call Netflix every other week trying to figure out how to log in again. There is no way around the fact that strict attestation implies more user responsibility to make sure they don't lose their token, and at scale, they absolutely will. Work environments can get away with this because work environments have a scalable mechanism to re-verify identity to the extent the business cares about it personally, and reissue tokens. At scale the big companies do not have this for individuals. You can't use hardware attestation without this infrastructure for reverification, and any infrastructure for reverification a large corporation tries to create will have exploitable holes in it.

Yes, I have no doubt that AI is going to seriously impact the economy over time. I have lots of doubt that it can impact the economy sufficiently quickly and with enough impact to pay out all the very, very, very large bets being made on it. Even as the AI quality curve has been running ahead of most predictions, its actual impact on the economy has been running well behind.

I am watching the dawning realization among the management class that even if coding costs drop to zero, Amdahl's Law means that perhaps productivity doubles for most software engineers, rather than goes to the MOON. AI can help some of the other bottlenecks, but not 100%.

On the positive side, we programmers have been trying to collectively explain to management for decades now that our jobs are not just 100% banging away at code on keyboards, we're not just interchangable code monkeys. Well, they're getting their noses rubbed in it now, complete with metrics and charts and all the other things they value more than the feedback from their employees.

In fact I was just noticing this week... in the past few months I had been really banging away at a lot of code projects. I was doing that whole "3 or 4 streams going on at once" that many of us have talked about, with a variety of mixed feelings. But in the past few weeks that seems to have starved out. I seem to have burned through the things that I was blocked on code for, and had a reasonable business case to pursue. Now my projects are all blocking up on non-code things again... communication with other teams. Review of documents that are irreducibly things humans need to review. Coordination and planning. Applying human attention to cover over the way that even the best frontier models still seem to have huge gaps in their superficially-expansive automated testing code that they write for their own code. I'm still sometimes unblocking multiple things at once and can briefly have multiple projects going, but then I hit a blocker somewhere and I end up unable to continue having multiple simultaneous code projects going at once.

(The document review is a particularly interesting case. The documents in question are something we expect some humans to at least skim, but are going to be basically a meta-program for AIs programming the rest of the company's code. It is important to get it right because every error is going to magnify quite a bit. AIs are helping a lot with that document, yes, I certainly agree we are proceeding more quickly with it than the same project 5 years ago would have gone, but it is also irreducibly sopping up a lot of human attention.)

Point of all this being that the casual presumption that AI will just utterly destroy the entire economy because it is good at coding may prove to be, well, yeah, exactly the same as the assumption that we are going to all be rich by 2002 because we'll just shift the entire economy to be on the internet and everything will multiply by 1000 in just a couple years as a result. But everything can't be shifted on to the internet. I can't eat a web page. AI can't do everything, and as it advances the things it can't do become a larger and larger percent of the remaining pie as a result. It seems to rhyme a lot with the dot com crash.

All my life, minors have wanted to fake being of age, so they can get access to the various privileges thereto, but for the first time I find myself asking, how do I, as an adult (multiple times over at this point) convince the system I'm a minor?

"Oh, no, I seem to have failed your intrusive system for proving I'm an adult and you have to assume I'm a minor, how awful. Don't mind me, I'm just a particularly precocious minor who loves to learn about computer science and whose search history looks an awful lot like a professional programmer, but nope, seriously, totally a minor."

I suppose banking would be a problem if the bank ever took that flag seriously. Probably have to go through the almost-certainly intrusive validation process for that, at least. But otherwise, gee golly it seems like Jerf Junior does a lot of interneting and he sure isn't an adult, nope, no way, not even a little. And it's pretty wild but when Jerf Junior aged out it seems Jerf III had just been born and is also a minor, an even more precocious baby who loves the same thing as his father and/or possibly his grandfather, it's, uh, honestly a bit unclear what is going on there. What a bizarre family I seem to have.

https://github.com/ggerganov/kbd-audio is probably the best-known one.

The amusing aspect is that this is so easy that multiple good ways someone could hobby program this long before AI was a thing. The sound of a bunch of keypresses may just blur together to our human ears, but if you try, you can tell that different keys make different noises, which is really the key insight. Between the different noises, the possible directionality you can get from a stereo (or more) pickup, and characteristic delay patterns during typing various bi-grams, there's a ton of information leakage in a recording of a keyboard.

Marketed as Himalayan Dog Chews: https://www.amazon.com/dp/B0B1GX8THY/

Despite the initial stick shock on the price, we've found them very effective dog chews, threading the needle on lasting a long time but also retaining interest over time relatively well. Also threading the needle on being designed to come apart safely, yet not instantly disintegrating. In late-stage capitalism part of what you're paying for in that price is that you won't need to buy them very often, if you get the correct hardness level for your dog.

The hackers have AIs too.

This doesn't make everything secure. It turns the universe into what we see in Star Trek, where everything is hackable all the time by everyone just by trying hard enough, or, in the real world, spending enough. A lot of the utility of hacking systems can be obtained in running off with the data so the inability to use a break tomorrow is not necessarily a problem, especially if I just ask my magic code fairy for another break tomorrow and the remote system has, to a first approximation, learned nothing from the previous breach as it busily churns away.

This is not the way. In fact for secure software I'd happily testify in court as an expert witness that this would be criminal negligence.

As for how closely it matches what Anthropic is doing, no comment. I'd need a lot of time to look at that and decide. That they can write code easily I do not question, whether they have 100GB of problems or 2GB of problem and 98GB of garbage that is slowing down even their AIs is not something we can get from a happy PR puff piece. I'm just speaking to the idea of letting code mutate wildly and constantly.

Yes, everything I have is pinned that way too. That's why I said "when it is done", even in my limited experience and contact with TS it is not currently a suitable replacement, and I'm not a particularly hard user of the tool chain. (I am having a hard time phrasing this in a way that I'm completely sure can't be potentially read as snarky or short-tempered, so I guess I'll just go with the clumsy direct statement that I'm agreeing with you and continuing the thought from my own experience, not trying to disagree.)

As near as I can see, it isn't anything fundamental to the rewrite, it's just a transitional phase, though.

That sounds cynical today, but that's just because the AI models are currently outrunning enshittification. I'm already pondering personal plans about what to do when that turns around. We haven't seen enshittification yet that is going to be like the enshittification of AI. It may even deserve a new term of its very own, it's going to be such a big problem. The AI companies are leaving a lot of value on the table to entice us on to their systems but at some point that's going to turn around.

One was not rewritten in Go. Typescript rewrote its compiler in Go, but that doesn't affect which runtime you use for the resulting Javascript code. Moreover this isn't producing a fork in Typescript as it is a replacement for the previous compiler, at least once they're done with it. The JS runtime forks and churn are not related to Typescript per se.

"Is this why everybody wants to make appliances with wireless?"

Which raises in my mind the obvious defense, which is that if you try to put four or five of these devices on your network they'll be too busy interfering with each other for them to actually spy on anything.

Let the wiretaps wiretap the wiretaps. Keeps 'em busy, makes 'em feel like they're doing something important.

    > What is my purpose?

    You wiretap the wiretaps wiretapping our wiretaps.

    > Oh my god.

It would look like major chaos in the markets.

People tend to conflate the question "is AI a useful technology?" with "are the AI companies going to do well?" but they're surprisingly separated in practice, with either one able to be true while the other is false. There is a lot of money tied up in a lot of hardware with a lot of loans made against that hardware as collateral all based on the assumption that AIs are going to need more and more and more and more hardware and whoever has the hardware wins. If a much better model comes out that requires vastly less hardware, or even more accurately, merely charges vastly less than the current AI companies, then to a first approximation (barring Jevon's paradox, and bearing in mind there's no timeline guarantee on that) all that hardware becomes much less valuable for being grotesquely oversupplied relative to what is necessary, and even though that would generally make AI objectively more useful than it was before, it would cause mass financial chaos in the markets.

The markets need a very particular rate of progress. It isn't entirely clear to me that it's even a possible rate of progress, it may be overconstrained, but they certainly don't have plans for the AI models to get commoditized on the timeframes of these vast, vast array of loans being made against hardware as collateral. Spend a metric shit ton of money to kill all your competition then charge monopoly rent on the one thing absolutely everyone needs doesn't work if you can't economically "kill all your competition" because the economics favor them in the spending spree.

And then, based on the fact that this is not even remotely complicated logic, there are plenty of people who are fully aware that they have a lot of money tied up in not running around telling everyone how wonderful the cheap models have become.

The principle starts much smaller than the "-isms". Pournelle's Iron Law of Bureaucracy is a classic. Another way of phrasing it is something to the effect of, without a strong external motivation preventing it from happening, the primary purpose of any organization inevitably becomes self-preservation.

You can see the effect all the down to something as small as 4 friends who have met once a month for 10 years eventually having to break up due to life getting in the way, and the feeling that not only is it going to be sad to not have these meetings any more but the feeling that there is some sort of almost-concrete entity that is somehow being hurt and needs to be defended, as if there is some obligation that has been created independent of the four participants that is being violated beyond the mere summation of four people's personal feelings. Humans build these structures readily and often defend them beyond what rationality may suggest.