minimaltom

Thanks for being so transparent.

Is it understood what the initial attack vector was? How confident are you that compromise is contained to just this GTM application (and lateral movement/exposure hasnt occurred)?

Fwiw, Anthropic are doing some weird staggered lockup thing, so employees shares start coming online in some strange way much sooner.

I dont remember the details, but its not safe to assume that the first 6m have no employee-shares being sold.

Tailscalar!

Another fun fact: there’s a list of things with tails.txt and scales.txt (see GitHub) and that list is used to generate the random tailnet name :)

(Or at least it used to, it’s been years)

I'm with you- the attack surface of openssh (and my trust in damien) is a better match imo

Do you use tailscale ssh but either dont have sudo, or don't permit login as root?

If all your tailscale-ssh ACLs allow you into an account with sudo, or allow you into root, theres no impact (you cant do anything with these vulns you couldnt do a month ago). Thats the nuance I'm trying to get across (admittedly my english is bad).

If you use Tailscale SSH with headscale you are also affected. The vuln is in tailscaled, not the control plane / netmap.

Former tailscalar here and now someone managing tailscale at an org.

Having done my own review of the vulns and the fixes as they are landing in github, its pretty clear to me that this only affects situations where you use ACLs to permit ssh into a node (via tailscale ssh, not via opensshd), but dont give a path to sudoers/root.

If a user had no SSH access and/or connectivity to a vulnerable node, none of these vulns give them access.

However, if you have a vulnerable tailscaled and you give ssh access as some non-root account/privs, then yes, these vulns are relevant as theres now known privilege escalations that give access beyond some specific user account.

Not trying to play down the vuln (its important), but its not a free-for-all RCE that some ppl are acting like it is.

Thank you for such a detailed explanation! I was wondering why we don't see MD everywhere and things like protein folding are all based on ML.

Is there anything like a getting-started for working with MACE or orbmol, a 'hello world'? Like maybe simulating Allolactose binding to lac1 ?

Wait _how_

Very cool

Hell yeah, whats your thoughts on doing it for like a whole city?

This is beautiful! I would love if we could model out a whole city, ideally using a much cheaper model.

You can have a prediction be specific and falsifable while inside the system, its just then riskier (and less useful).

For example, that french dude that bet on a prediction market what the temperature would be, then broke into the weather station at the airport with a hair dryer. The prediction was still specific and falsifable!

Its a fair question to ask! and ive landed on the opposite answer lol

Indeed!! It was an example of an utterance that wasnt falsifiable to illustrate what falsifiable means.

That’s the crux of it!! You don’t have to agree but people do care, and I think (ignoring the obvious partisans) that’s the two dominant camps of commenters on this thread.

One pony’s trash is another pony’s treasure, so I guess here one persons pedanticism is another persons hobby.

Take a look at the thread below yours, but basically if the prediction has to be wishy-washy or just interpreted as 'direction', theres way more noise and way less signal. Why not just state the underlying trend/forces instead? Why lean into the online culture of predictions and do it badly.

Bad (form) prediction: OAI is gonna be wobbly in a bit Good (form) prediction (could be totally wrong): OAI as we know it today is going to collapse due to running out of money around/at 20xx.

And sure we can be pedantic about detail, but the litmus test is: is the prediction useful if you had a crystal ball and you could know if it was true/false a priori?

Falsifiable means able to be correct or incorrect. So if i said that my stepmom was kinda whelp, that wouldnt be falsifable, because like what does that even mean. But if I said my stepmom is going to be on her third marriage by the end of the decade, that is, because in 2030 someone can yell at me either way.

This is a spectrum of course: a prediction that OAI will collapse is probably right as _eventually_ all companies come to an end, but under that interpretation, the prediction is useless. It's more signal / useful / falsifable to say OAI is going to collapse around/at <year> due to <thesis>.

Anyway thats my two cents. Its fine to outline forces and trends, but when you make predictions there are useful (better, falsifiable) and useless.

I agree he is directionally correct, or at least is a vessel to raise important points and valid criticisms.

But predictions need to be specific and falsifable. If not, its just rag-chewing over a beer (luv that shit, but i aint predicting on taco tuesday). If they arent falsifable, then its not a prediction.

I think a lot of the HN comments generally can be described as one camp which cares about and enforces the rigor of predictions and trying to direct limited ear-time to voices which tend to get predictions right, vs the other camp that puts more weight towards directional accuracy.

Yeah, I think this is fair criticism, and I definitely felt the pointedness in the tone as well.

On the overly-literal / narrow thing, I think thats the culture around evaluating predictions overall. Like, all those posts around christmas where people make predictions and evaluate how last year went. The rigor is the norm.

You made a poor characterization of the content of the post and were rebutted with direct quotes. It happens, thats okay! Its not an attack on your character. There's no need to feel defensive!

Idk about that. A bunch of his wrong predictions were predicated on things turning sour sooner than a "year or so" than now.

Hell yeah a birdie over thirty, with a splash of tech!

(you either go the path of a burner or a birdie, I don't make the rules)

Its not in the kernel but in the userspace tool that goes from password to key (the key is handed to the kernel).

You can see the implementation here: https://gitlab.com/cryptsetup/cryptsetup/-/blob/main/lib/cry...

Oh like one of those scenic cone towers like on a nuclear power plant?

Iiuc youre saying: its more cost-efficient to waste water using evaporative cooling so thats what we'll get, not that a closed loop with a heat exchanger is technically infeasible?

For datacenters specifically I've never understood what specifically consumes the water. Arent the water-cooling loops closed, so the water just cycles around and around and around?

Thats what I thought too but then it would be s**?

Interesting, for anything more than side chats/projects I usually am watching the output generate and thinking about the problem. I have the same issue with switching back, takes a while to recall and page everything back into my context, so I try not to alt-tab away.

What is bpw?

Also whats your cutoff for 'acceptable' speed? I would have said 25tok/s.

Worth distinguishing knowledge/task benchmarks from IF / agentic. It doesn't seem out of the question that you can have a small model thats generally good at instruction following and long-horizon agentic, as usually in those cases any requisite knowledge is in the context.

Most of the benchmark improvements afaict are in agentic and instruction following benchmarks.

Architecture thread! Afaict they continue to use gated attention + delta net, which was also adopted+adapted by K3, but im surprised theres no improvements to the residual stream (deepseek are using manifold hyper-connections, kimi have attention residuals) ?

Perf improvements seem to all come from training?