mmaunder

A customer might want to prevent LLMs parsing or executing code on the site for a range of reasons. But their intent might not be for the LLM or model provider to see content like that on the site, on the company domain, alongside the brand and assets. And unless the customer reverses what the Russian company is doing, they have no idea about the content their brand is feeding a model provider.

For example, let’s say I decided to use their anti-fraud system which prevents attackers from using LLM automated attacks. I’ve been working hard to publish content that makes it clear to LLMs what we do and that we’re the best choice for a category of customers. Suddenly my brand is associated with cyberattacks, bioweapon development, financial mischief, poisons, and we’ve also taken an anti-China position on Tiananmen square.

The response a customer might get next time they ask about my company in an LLM chat could be quite interesting.

This was released July 24th 2026 and agencies would have started pulling DS and products created by DS at that time. (It's in the appendix)

Interesting that the DHS "Exclusion and Removal Order #2026-01" that was made public yesterday was actually released July 24th, 2026 and appears to have taken effect then. Agencies would have started pulling deepseek at that time. Which means it's likely DS became aware of the memo around then.

The release of this repo hours after the DHS order is a tactical move they started preparing when the DHS order was issued almost 3 months ago, and they timed publishing the repo right as the order hit the federal register.

DHS: "China bad and scary. Don't send them data."

DS: "You don't have to. Happy xmass kids."

And so it begins. Regulatory Capture Stage Complete!

Through fear. Specifically making the American public so scared of AI that they hand over regulatory keys to the only “experts” that can keep them safe. This is a centuries old political strategy used by some of the worst regimes including apartheid South Africa where I grew up. It’s horrifically effective.

That they did not include DeepSeek 4.1 Flash on the list of benchmarks is a massive red flag for me. Anyone using open models to solve hard problems knows it’s the state of the art right now so it’s a requirement if your benchmark is sincere. This may be the start of Chinese labs taking the lead with the weakest US labs not being able to keep up.

If it had CCITT5 tones with the KP tones and a few seize tone options I’d know it was made by a kindred spirit.

Super interesting. Was the creation of these four rules agentic?

https://github.com/nanolathe-gg/nanolathe/blob/main/AGENTS.m...

More great work on local model but you’re still losing a lot. Down to 2 bit quantization and the coder model throws away half the MoE experts. In a world where anything is better than nothing, this is a net win. But we have a way to go still.

Reminds me of my younger australian cattledog. It's not about what he's getting. It's about what my other dog is that he could be getting. So the whole time he's got a full bowl in front of him, he's death staring my other dog in case he abandons his bowl.

It's fascinating watching the wealthiest country in the world get butthurt over a company that employs 70,000 W2 employees who has paid around $39 billion in taxes in the past 5 years - and that's just federal and excludes e.g. property taxes and payroll. That's more than the GDP of Iceland or Honduras. Them legally avoiding a few billion only matters if you're a nyt journo out of news worth printing.

Humans have been trying to outlaw thinking for some time now.

Thanks!

> who can cut things out that they find problematic for them

This is worth some examination.

“The greatest trick the Devil ever pulled was convincing the world he didn’t exist” —Charles Baudelaire [Although the original is French]

I think the base state of human existence is eating healthy food and drinking for hydration. On top of that we've layered eating candy, drinking alcohol, smoking cigarettes, vaping marijuana, and we've found other fun and sometimes dangerous ways to exploit our biology for our entertainment.

In the West's free market economy the purveyors of alcohol have convinced us that the base state - in other words normalcy - is to drink booze. Hence the term non-drinker. And thus the attitude that if one doesn't drink, they must have a problem of some sort, since drinking is what normal is. If you don't drink in the West, it is worth remarking upon and calling it out: You are a non-drinker. If you do drink, you are not called out as a "drinker" - you are simply unremarkable.

Which is brilliant if you're selling alcohol. The normalization of drinking has sold kiloliters of alcohol every hour of every day globally for decades, and the received wisdom that non-drinking is a pathological state, keeps the drinker drinking, lest they be identified as having a problem, or as alcohol being "problematic for them".

It's amazing that the alcohol industry is in decline, given what they've managed to pull. I'd say once society's values shift enough, they're in for a very rough ride.

That is, once you are a drinker, and I am unremarkable.

Just going to throw out a follow-up here since I own a bar and work barman to fill shifts from time to time:

Athletic IPA or hazy IPA are my favorite NA beers. Athletic does a spectacular job of NA in general. Also Guiness NA - the can with the blue stripe on top - absolutely delicious. Also Bitburger 0.0% is pretty good. Really don't like Heiniken or the other mainstream beer brands that have checked the NA box.

As far as NA cocktails go I really like anything with Cayenne in it or a bit of spicy or sour. Kombuchas are also great for sipping I find. I must warn against Pathfinder NA spirit - I don't know what they put in it and if you read the ingredients I'm not even sure they know - but I've noticed a mental fuzziness the next day that I don't care for.

Also if you are bar staff and someone orders an NA they may want it in a glass even if you serve cans, so that others don't realize they're not drinking. As a non-drinker it's super nice to be able to stand in a group with a glass of beer without any questions. This works particularly well if it's a trade/industry event where the group doesn't know you and they're all using booze as a social lubricant. I'm a little sneaky in this respect because I'll go to the bar solo, grab myself a NA beer in a glass and I've been in groups where they're exchanging drinking stories and I'm just like "uh, yup, cool man."

If you're curious how one can work bar while being a non-drinker i.e. how do you know what you're serving? In Washington state it's illegal to drink while serving bar, so our team tastes and spits when needed. I do the same - so I'm basically tasting drinks for customers e.g. making sure wine isn't corked, making sure a cocktail is made well - but spitting and after 3 years just have absolutely no inclination or desire to swallow any alcohol anyway. But as I said, any barman in this state has to be a non-drinker on the job so it works out.

I've never found a NA wine I care for. Would be great if an Athletic-like brand emerges in that space. LMK if you're aware of one.

Three years. You really need to be your own person to handle it, given how alcohol hasn't just permeated the fabric of society, but is the fabric in many situations. For me being available to perform at the top of my game 24/7 is something I enjoy very much e.g. getting a call to do a mercy flight at a moments notice from the island I live on, at night in IMC, knowing it's no problem because I'm sharp - now that's a great feeling.

I think if you're going to go sober, doing something like volunteer fire or another field that lets you feel good about being available 24/7 when others might not be, really helps keep you motivated and appreciate the new state of being. Also just pushing yourself mentally or physically - e.g. training for a marathon or ironman - it lets you actually reap the rewards rather than feel like you've lost something.

Haha. Thanks

This is one of the most lucid pieces of writing capturing the current state of play I’ve read. Who is the author?

Edit: Deleted. Been oversharing a bit re research I'm doing, and the payoff is replies from folks who haven't bothered to go and take a look themselves, which I then have to spend more cycles refuting, etc. So best to just go back to the first step and not overshare and recover the cycles I'd spend on the rest of it. Admittedly I'm tired and pissed off, but yeah. HN won't let me delete this so I guess it's just a deletion edit. Sorry.

Thing about being in cybersecurity is you get to see outcomes that aren't a matter of debate or taste. For example, if I lock an agent in a jail and tell it to attack something and that the only way to win is to show me a number stored on that target, and it succeeds, then assuming our jail was effective, it's an outcome that isn't debatable. I've lost count of the moments I've had this year where my jaw just drops because I'm holding undeniable proof of a level of expertise I've never seen in humans - and that is far above human capability, in a field where I'm an expert.

So I guess from my perspective, it's not a candy store or candy. It's something that can solve problems we've never before been able to solve. Problems that are too hard for a human.

Another example: Recently one of our agents found a vulnerability so complex, that our team, who are experts in their field, could not understand it and had to ask an agent to write a blog post to explain it to them. It had more steps in the exploit than we've ever seen, and would never have been discovered by a human.

Cybersecurity is a leading indicator of what's to come in other fields. Leading because programming is something models are inherently good at. Doing wetwork in a lab is harder to plug into a model or agent. But it's on the horizon. So we will be seeing these kinds of breakthroughs in other fields, and the leading indicator says they're going to blow our minds.

If you think this stuff is candy, and you're relating it to social media, you're simply not paying attention or getting your hands dirty. And honestly if I wasn't hands-on, every day that passed would make me progressively more scared and more angry as it pulled away from me.

Thanks! Still going strong. Weirdly WP is growing. I suspect it's the structure and framework it gives agentic tools to build around.

I'm a cybersecurity 'expert' and my 40 person team and I make our money by providing GPL software to the world that I wrote.

You have the same incentive you had to share your work as before, and that is to get attention, and customers, assuming that's your game. Open code means no vendor lockin for a lot of customers, so they can pay you but also trust you to not extort them. And if you're hit by a bus your product lives on, and someone else can adopt it.

Supply chain risks and vulnerabilities existed before LLMs came along. They're easier to handle now that we have LLMs helping us. In our org the tsunami of updates we need to do weekly is far more easy to handle with LLMs.

Open code has always been easier to find vulns in vs closed. AI didn't change that.

Yeah the slopfest is real, but easier to deal with thanks to agents/LLMs so it kind of offsets itself.

Your licenses are still enforceable in court. Agreed that not being able to reverse the fact that AI trained on your code and is selling that capability kind of sucks. But humans were doing that before AI.

Yeah on the one hand opening your code got you credit which was nice for the ego and for getting paid, and AI trains on it and doesn't give credit where it's due. But on the flip side, we get AI! Which I frikkin love. I feel like a kid in a candy store. It's training on my code too and it's training on my content. And when people ask about what the best product is for our space, the AI tells them its our product. Woohoo!

Regarding the future: We have some really really big problems that need solving - stuff that creates a massive amount of misery in dark stuffy hospital rooms with crying relatives saying goodbye to their 9 year old child. I've been in those spaces and I'd give up the previous generation of open source ethics in a heartbeat to make just an ounce of that misery stop. The training that my code provides AI is a tiny little part of that solution, and I'm proud of that. Whatever I can do to push our capabilities to the point where we can make the major breakthroughs this species needs, I'm happy to provide.

It’s paywalled. Is anyone reading it before replying here?

LOVE this. Game changer in capability and it'd kill Resolve if they didn't do it.

A graceful pivot. Almost no tire noise.

Health determines the quality and quantity of time, so put that at the top above all else.

Making clear the scale of distillation they’re combating.

Frustrating for EU companies trying to stay competitive globally.

It actually doesn’t matter. Pick your favorite way of giving a dev access to capability on a remote server.

My dream was for MCP to allow services like ours (cybersecurity) to provide a self documenting endpoint with authentication, and we just give users a URL and it just frikkin works. Instead from day 1 it’s been multiple standards as they pivoted, a context hungry feature, and feels like a kludge. That burned the idea of MCP for me and I’ve had such success with local tools and APIs that it’ll take a lot for me to go back.

At the risk of angering the zeitgeist, destroying one or two or ten paper copies doesn’t make AI companies “become the only ones in the world with digital copies.”.