1,743 karma · joined October 28, 2021
With well-chosen constants, I've found similar behaviour to the above; low latency and high performance at once.
That's exactly their motivation, yes. Resisting it requires political will, or we will continue to let the increasingly irrelevant tail wag the dog.
There is definitely a case for subsidising the existence of mostly-idle gas plants to make the costs of keeping them around profitable for the medium term (you can think of them roughly as playing the role of a battery), but indefinitely subsidising the equivalent of buggy-whip manufacturers is not a long-term solution for the economy.
When renewables (including storage) can't take up the entire load of the system, that marginal generation is nowadays going to be gas power, and right now the global price of gas is unprecedentedly high.
To simplify things somewhat; the larger the fraction of the time gas generation can be turned off, the lower the annualised price of electricity will be. At the moment, we are already seeing renewables taking up 100% of the load for short periods. As more renewable capacity gets built, those periods will get longer and longer, this effect will get ever larger. In some countries this effect is expected to become significant within the next five years, even at current rates of progress, and will only get better as time goes on.
Lower annualised electrical prices will be good for the economy and the individual, and encouraging this should be a priority for any rational government which thinks more than a few years ahead.
I doubt it will discourage the true large-scale bad actors for whom Wikipedia is only a tiny subset of what they are trying to download, and are sufficiently well-resourced that they can't be bothered to special-case it.
It'll be interesting to see how this plays out.
I think the most interesting thing here is that it shows that the companies doing these crawls simply don't care who they hurt, as they actively take measures to prevent their victims from stopping them by using multiple IP addresses, snowshoe crawling, evading fingerprinting, and so on.
For Wikipedia, there's a solution served up to them on a plate. But they simply can't be bothered to take it.
And this in turn shows the overall moral standards of those companies - it's the wild west out there, where the weak go to the wall, and those inflicting the damage know what they're doing, and just don't care. Sociopaths.
The mitigations in the cited article are good too, but they don't replace the need for safer languages.
The nice thing about this approach is that the LLMs don't need to be flawless for it to work, as the formal analysis / unit testing will keep their errors at bay - they just need to be good enough to eventually output something that passes the tests.
"These four types of integrity, do not establish memory safety, but merely attempt to contain the effects of its absence; therefore, attackers will still be able to change software behavior by corrupting memory."
and the paper then goes on to say, about Apple's implementation of the cited techniques:
"This intuition is borne out by experience: in part as a result of Apple’s deployment of these defenses since 2019, the incidence of RCE attacks on Apple client software has decreased significantly—despite strong attack pressure—and the market value of such attacks risen sharply."
"Decreased significantly" is not "eliminated"; indeed, you could paraphrase this as "the combination of these techniques has already been shown to be insufficient for security guarantees".
Which is not to say that these mitigations are a bad idea; but I think their benefits are significantly over-sold in the paper.
Human civilization is now so totally dependent on fragile, buggy software, and active threats against that software increasing so rapidly, that we will look back on this era as we do on the eras of exploding steam engines, collapsing medieval cathedrals, cities that were built out of flammable materials, or earthquake-unsafe buildings in fault zones.
This doesn't mean that safer C++ isn't a good idea; but it's also clear that C++ is unlikely ever to become a safe language; it's too riddled with holes, and the codebase built on those holes too vast, for all the problems to be fixed.
But it's promising work, shows the treatment seems at least to be safe, and more research will no doubt follow to clarify this.