md_

By all means, you're not the first person to proudly wave their ignorance on the Internet, nor will you be the last, and yours isn't especially egregious by Internet standards. I am baffled that you would want to write a blog post about how ignorant you are and then submit it to the front page of HN. If I were you, I'd, like, not want people to read that?

But, up to you. Good thing you don't use your real name I guess. ;)

> > Just to head off the inevitable deluge of GPG-encrypted emails with dramatic subject lines, we are not doing this in response to any kind of legal threat or pressure. This is just a weekend hack; please don’t make us regret it.

This doesn't say what you said it says.

> tl;dr: it's not reproducible with shared libraries, or gradle and it was just a hack, please don't make them regret doing it.

As I said, in which codebase does the key verification and encryption live--is it in the native code, or in the Java code? I suspect you don't know, or you don't know why that matters.

> Oh, and did you actually run through the steps? Or is it merely enough that having them listed makes you trust them?

Oh, definitely the latter.

But I think it's quite valid to suggest users should carefully think about the tradeoffs between being subject to legal disclosure and being subject to compromise. Basically, do you trust the FISA courts, or do you trust the code?

The answer isn't really obvious! When it's a random anonymous startup based in, like, Panama that claims to have reinvented JavaScript-based encryption or whatever, yeah, I sorta trust the FISA courts more!

No, Forbes is a shithole. https://www.entrepreneur.com/growing-a-business/did-someone-...

The New Yorker is not a shithole, and don't take money for articles.

Maybe you want to, like, correct your blog post? Honestly, the claim makes you sound dumb.

> The reproducible builds website; is; as previously mentioned a really nice looking page which basically says: It won't be reproducible even if you follow these steps.

I don't know what you mean. Are you referring to the NDK portions? And if so, does the critical stuff (key verification, encryption) happen in Java or in native code?

> "please don't send us messages about how it's not reproducible"

Huh? Where did they say that?

I mean, you wrote, "From everything I personally know about the media, articles like that are usually paid for, though almost never directly by the person being profiled."

This is, frankly, a stupid claim, though I think from your profile you are probably German or Austrian and thus might not really know which news outlets are reliable. As a perhaps helpful analogy, the New Yorker is roughly like Der Spiegel or Die Zeit, only more respected. (That's not to say they don't have misses; Ken Auletta's profile of Elizabeth Holmes comes to mind.)

The prospect that you can pay for coverage--and as an aside, I don't think The New Yorker has ever run "30 under 30" lists--is rather laughable.

> You are not, since nobody can bloody run the software themselves anyway, and the entire point is transparency.

Er, what are you talking about? https://signal.org/blog/reproducible-android/

I don't know how to say this nicely, but your post doesn't have a strong connection to facts.

I don't think this has been _successful_, but the concern about platform access seems _reasonable_ to me. If you think it's existential, burning billions on a long-shot might even be a good strategy, though one that seems likely to fail.

There was probably more political upheaval--that I agree with. But there were a ton of European wars prior to the industrial revolution and the (consequent?) rise of democratic movements.

I'm not yet prepared to agree that the scale of bellicosity in the 20th century was the result of labor displacement (as opposed to, say, the results of the mechanization of violence). I mean, like, https://en.wikipedia.org/wiki/List_of_conflicts_in_Europe.

As a trivial example: LLMs don't learn new skills on the fly. A key aspect of human behavior--implicit memory--simply doesn't exist for these models.

That seems like a pretty huge gap! Like, if ChatGPT is mediocre at your job today, it's going to be mediocre at it tomorrow and the next day, until a new model is trained!

I don't think that means that "good next-token prediction" is identical to "AGI". As Yan LeCun says, I think LLMs are an off-ramp on the highway to AGI. But they are powerful at specific tasks.

Unfortunately, instead of evaluating their actual utility at a specific task, people just seem to think "if we throw AI at the problem, we will solve it," which is sort of like every other tech bubble ever.

I do want to pick on what I think is a bit of hype around the potential to eliminate whole classes of work, though.

First, in the weeds: I keep seeing this reference to script writing, which I assume is a reference to the WGA strike. But as https://www.gq.com/story/writers-strike-2023-wga-explained explains, the big technological transformation driving this dispute isn't the risk of generative AI; it's the changes in royalty payments created by streaming platforms.

I'm pretty skeptical of claims that generative models can replace script writers. Like, maybe for some really, really crappy shows? But I think "My ChatGPT could write that" is the 21st century version of looking at a Rauschenberg and saying, "My 5 year old could paint that." Good luck, I guess?

More generally: Labor productivity growth has remained fairly constant over the last 40 years or so. So anyone who thinks generative AI is going to totally upend productivity and the job market is implicitly suggesting it's a bigger technological change than the Internet--which didn't really do that!

So...dunno. That's a bold claim!

I guess this is a thing people do. ;)

I don't think very many people know what "security keys" or "FIDO" are, to be honest, so you're probably in the tiny part of the Venn diagram of people who a) know what those things are but b) don't know that they support user verification. ;)

- The biggest threat almost all users face is in the form of remote attackers: password phishing, database leaks + password reuse, tricking users into installing malware, etc. Local attackers are so far down the list of concerns that, really, using unique passwords and storing them on Post-Its is, for most people, an improvement in security!

- Leaving a Yubikey in the computer is, in fact, the normal, intended mode of operation--that's why Yubico makes low-profile keys that you can just leave in your USB port. Yes, an attacker can just steal the key, but the key alone is insufficient to authenticate in most uses; almost all relying parties using keys that don't support user verification will also require a password.

- The article was about passkeys, not FIDO security keys. Subtle difference, but, importantly, passwordless authn using passkeys requires the authenticator to support "user verification" mode (like a PIN/screenlock/biometric).

* The real farm families would have a pickup for pulling a horse trailer, moving mulch/manure/hay bales/equipment, but also have a regular sedan for, like, driving places.

* The suburban families would have a pickup or SUV as a daily driver.

A quick Google search seems to back my impresssion:

"According to Edwards’ data, 75 percent of truck owners use their truck for towing one time a year or less (meaning, never). Nearly 70 percent of truck owners go off-road one time a year or less. And a full 35 percent of truck owners use their truck for hauling—putting something in the bed, its ostensible raison d’être—once a year or less."

As you say, taxing the externality is reasonable (and currently imperfect, in a few dimensions). One reason to look especially hard at SUVs and light trucks is that they have externalities in a number of dimensions (road wear, emissions, accident safety for other cars) and seem to have very limited utility (most people who buy them aren't really using them for their supposed purpose).

I totally agree that an over-emphasis on "access" leads to inaccurate reporting. You're certainly right to tie that to the invasion of Iraq.

But I don't think there's any evidence that the US military is running domestic psyops, and certainly if they were doing so it would not be via unpaid internships.

Of course there are broader problems. A lack of trust in the media and a lack of attention span--no doubt driven by social media intermediation and a lack of accountability for individual publishers--reduces incentives to get stories correct, and increases incentives to get stories. A public that misunderstands the role of reporters thinks analysis equals bias and is obsessed with up-to-the-minute stories, and high production values--the latter of which can only be afforded in large metro and national markets, leading to a hollowing out of local content.

These aren't original observations, of course. But they are indeed real problems. I think they have very little to do with the prospect of Pentagon psyops, which, frankly, are unnecessary given the underlying structural flaws.

I think this kind of cloak-and-dagger conspiracy theorizing trivializes the real, challenging, human issues of editorial independence, the complexity of fairly representing reality, etc, etc.

C'est la vie. It's hard being at the top (depending on the stock price on a given day).

The joke is on all of us for giving this silly man our attention. I regret that I even know about this "news story."

In fact, as I noted elsewhere in this thread, there are many (dozens?) of other public broadcasters around the world, most of which are not labeled as "state affiliated"--apparently in keeping with Twitter's (IMO reasonable) distinction between "state controlled" and "state funded/editorially independent."

Musk's eye of Sauron fell upon NPR--and only NPR, not Deutsche Welle or Radio France or CBC or BBC or any of the other respected independent public broadcasters--because he is, in the American sense, a right-wing nutjob with an ax to grind.

That Twitter would bend their principles--in either direction--to American domestic politics in such a transparent way should give users, especially those who are not interested in American culture wars, pause.

https://twitter.com/bbc https://twitter.com/deutschewelle https://twitter.com/srf https://twitter.com/radiofrance https://twitter.com/CBCNews

"Cable Network News (CNN) and National Public Radio, (NPR) denied that the "psy-ops" officers influenced news coverage and said the internships had been stopped as soon as senior managers found out . For its part, the army said the programme was only intended to give young army media specialists some experience of how the news industry functioned."

That...seems like a pretty reasonable explanation?

Just to be clear, the alternative theory you have is that the US government wanted to influence NPR's coverage, and thought the best, most inconspicuous way to do so would be by using an intern placement program targeting Army media officers?

It's amusing that Musk's incentive appears to be fear of what his viewers will see--namely, competitive services they might consider using instead of Twitter.

I do think that's fairly different than the incentives for Facebook and Reddit.

You'd come into work at 9, wander off campus to a nearby restaurant with coworkers for a relaxing lunch at noon (granted, because the food in the cafeterias sucked and cost money), and after a bit of exercise or a nice game of racquetball at the gym, you'd go home at 6. Or if you were single and it was a weeknight, you might stay late in the office watching movies in a conference room and doing a bit of coding.

Of course, fifteen years ago, Google paid more and had a reputation as a place where the really smart people came to grow their careers, whereas Microsoft was sleepier and more middle-aged.

But it had "WLB" in spades.