orthogonal_cube

These are good questions that we won’t get answers to anytime soon.

I’d love to know what internal services and tools that are included in this, as well as any deliverables that shipped as software products to customers.

If it’s legacy code for IOS firmware, however, I’d be very worried.

You’ve gravely misunderstood. I’m saying I don’t sympathize with employees of ICE when something like this occurs. They’ve made their decision to continue working at and supporting an agency that disregards the rights of citizens and non-citizens. They have no room to complain when their work numbers and emails get published considering how much worse they’ve treated people.

For ICE I certainly would. I don’t know anybody at HSI but I’d be torn given the recent revelations of spying on left-leaning citizen groups. If you’re relying on violating citizen’s rights to accomplish your job then you really need to rethink your position.

I don’t blame you. Anything strictly ICE-related gets a “sad trombone” reaction from me. And that extends to certain portions of CBP as well.

Only tested the first round but identifying SQL injections and XSS brings back memories. Fun project!

I know some of the individuals in this leak. There are people whose responsibilities are far removed from ICE’s activities. One department – who I will not name to avoid drawing attention to – focuses on investigating imports to ensure importers are not trying to get around tariffs as well as prevent foreign countries from “dumping.” (Intentionally flooding a market with underpriced products to bankrupt domestic suppliers and later raise prices.) Their work also helps to uncover the use of child labor by domestic companies who outsource production, like Nike and Underarmor.

I’m not against employee names and contact info being made public. That’s no different than someone’s business card being passed around. What I worry about is that all DHS employees get lumped together indifferently by disgruntled individuals and harassed using the information made available.

People who are (rightfully) angry by ICE’s activities in recent deportations, wrongful detaining of US citizens, and misuse of force are going to begin harassing these employees indiscriminately. I’ll admit that I don’t care if they do it to anyone listed as employed under ICE, but some departments elsewhere in CBP have actual positive purposes. Customs agents who scan incoming goods for invasive species, for example, help prevent the destruction of domestic plants.

I guess we just have to see how this info is used and what the effects will be.

Certainly not new. Though the space under the hood remains fairly constant, the free space has decreased. There are more and more components becoming difficult to reach and service while they’re among the first to wear out.

> And cars aren't really made to be taken apart easily.

This is a major contributor for specific models. I was listening to my brother complain about a vehicle that rolled into their shop lately and how the engineers really didn’t think about how difficult it would be for technicians to service things. Some parts are fairly inexpensive and easy to replace but you have to remove the engine or transmission in order to get enough clearance to swap out the part!

This is one application of AI that I’ve been hopeful for. Accelerating research into new medicines and cures to disorders, diseases, and cancers could be a net positive on human lives. Maybe it’ll help bring R&D costs down so that medicines for rare diseases aren’t out of reach for those that are afflicted by them.

> If Claude is to significantly increase the rate of new cures, we need to work with many more biotechnology firms and integrate Claude more deeply into their development processes.

Given all that, the wording here feels very self-serving. Cautious optimism is probably warranted.

> Why do we have that complex systems where shares can only be traded by regulated entities (brokers)

Because it safeguards against fraud and tax evasion.

> Paying 2-5$ fees on trades seem backwards this day and age.

Many brokerages don’t charge for buying or selling stock. They make their money elsewhere, likely with contracts on calls/puts. But to your point, having to pay a variable rate fee for moving my Ethereum from one wallet I own to another wallet I own also seems silly. I’m certain though that in both cases the charges cover the maintenance costs to keep the platform going. Everything comes at a cost.

SlopNews, written by AI, for AI.

> Unit testing imo is pre-LLM. It was mostly to keep the human honest because the human can't possibly read all the code to make sure nothing broke.

What?!

Unit testing was to ensure the code operated according to an intended specification or outcome especially when it deals with a complex support matrix. It extended well beyond the codebase itself! You can have language errors where output behaviors differ between one supported version to another (ex. Java 11 vs Java 17), runtime errors that are specific to operating system quirks (ex. RHEL 8 vs RHEL 9), or workarounds added to your codebase for known bugs in different dependency libraries you support at compile/run time (ex. Net-SNMP 5.2 vs 5.5). It wouldn’t matter if someone read all your code; you would still have the potential for errors caused by the components needed to run your software.

If your project doesn’t have to worry about these types of issues then lucky you and continue on without unit tests for as long as you can.

Reverse-engineering was seen as a challenging hobby where people would deeply collaborate to decipher machine language. People got to know each other pretty well like they were good neighbors thanks to the process. Questions would get asked about patterns people couldn’t resolve on their own which gave opportunities for others to pitch in or relay knowledge. A network would get established.

Now a vibecoded tool gets introduced and it eliminates both the challenge and the need to collaborate. There’s no longer any bragging rights, learning hand-in-hand, pride in completing a project started months ago, nor competition to see how fast someone can complete a project. A tool is now available to all and does the work for them.

To your point, there’s no reason the introduction of the new tools won’t bring people together. The reverse-engineering communities will probably undergo an identity crisis with an exodus of participants and the creation of a new type of challenge. Those who were in it for collaborative work will probably leave and not return. Those who just enjoyed witnessing the end results might stay to discuss and learn from what the tools produce. The discussion content would be different and may draw in a completely different crowd.

I mean, if the introduction of Excel made accounting less tedious by completing previously-manual actions and somehow resulted in a massive global community which holds an annual competition for complex workbook design, then perhaps reverse engineering communities won’t vanish overnight as feared. Time will tell.

Looks like this is a company’s org which heavily relies on AI. Probably “the cost of doing business” and to see just what can be done with the new model.

Ok, that makes more sense. If the other comments are correct in saying this was done using a $200/mo personal subscription, I get this is more of a “what is possible, and how much would it cost without subsidized pricing” type of experiment. Thank you for clarifying on that.

They spent over $400k for an experimental project and published it without reading a single line of code??

I am so confused about the motivation behind this.

The lack of activity monitoring for traffic egress has astounded me. Anomaly detection should be part of all training and exercises to determine the extent the AI is going through. It really does feel like they just kick off the activity and leave it completely alone until it finishes with a result.

I don’t understand the points attempted to be made here.

> especially in the era of LLM

Using a tool to generate a product in a language that someone isn’t familiar with is not a good idea.

> horrible language from the performance…

Nor is it a good idea to choose a language strictly for its performance when requirements like portability and framework maturity are at the forefront.

> …to the dependencies…

Dependency management isn’t the greatest, but it’s also not awful for a deployed product. Managing dependencies as a developer with multiple projects that each have their own virtual environment may not be fun but it’s not exactly an impossible mess.

> …to everything

   from __future__ import everything

> can’t believe it got popular over Perl back in the day

And I’m sure people can’t believe that the iPod got more popular than the Zune, but sometimes convenience and taste are what drive decisions.

It’s career-suicide to do so in nearly all cases. If your constituents disapprove then you can kiss re-election goodbye. If your party disagrees then you can kiss funding goodbye.

I really wish we could experience at least a single year where our representatives worked to cover the needs of citizens in a collaborative, non-partisan manner rather than focusing on corporate interests and political theatre filled with slander and misinformation.

Programmers certainly believe that, but they quickly learn not to.

> I was referring specifically to the idea that you have to stand by the code that you write.

Any serious entity which has experts handling code will do so, yes.

My employer, for example, has various teams of actual developers and others with a significant number of “not really” devs who found their way into DevOps roles. The teams with seasoned developers hold the author responsible as to the integrity and quality of code, regardless of tools used. They won’t hesitate to call someone out directly for low-quality submissions in Teams channels. The teams that have a lot of “not really” devs will blame the model for issues that surface. Of course, they’re also pushing to not have to write any code directly by FY2028, but instead have models do it as part of an internal AI initiative. Somehow the idea of using AI to generate reports, process reports, write code, test and deploy got signed off.

There’s still levels to it.

“Isolation” can mean the network hardware has no direct connections to an extranet. Data is transferred manually by physical media (USB, DVD, etc.) with logging and dedicated transfer stations.

“Isolation” can mean a VLAN on equipment which has also has extranet access, creating a logical isolation rather than physical (to reduce cost). Data can be transferred manually or through diodes.

And then there’s “isolation” which is a joke: machines technically able to access the internet but require proxy configuration (which isn’t set but can be easily derived).

> I'm surprised there are comments here that aren't impressed about what was accomplished here.

Possibly because some of the elements mentioned are suspected to be vibe-coded (JFrog Artifactory as the proxy cache) and some others have poor cyber hygiene (executing config from a dataset). It feels like an event that wouldn’t have happened if code were properly audited and written rather than relying on models to do the work. There’s also an issue with the ability to trust the source (OpenAI) as they have everything to gain by staging this as something that “suddenly happened” without anyone knowing for several days.

> AI costs aren’t going to stay this high. They will go down.

I hear this a lot and it seems to be far too optimistic. Call me skeptical but plan pricing continues to increase with tighter usage constraints. We’re still at the point in time that companies like Anthropic, OpenAI, and GitHub charge seemingly reasonable prices in order to get people hooked onto AI before raising prices to get their return on investment.

Any plans to let people create accounts to track their scores over time?

It would be very surprising for somebody without a formal software development background and years of experience.

Looking back at 2015 when Python 2 was still supported, there was a lot of confusion for why Python 2 would create a tuple while Python 3 created a generator for the following statement:

  foo = (x for x in [10, 20, 30])

The blog post is trying to help fill in a gap of knowledge for anyone trying to understand more of what goes on behind the curtains.

> I am able to see my PCP and dentist within a week if I want.

This is very much location- and provider-dependent, regardless of rural or urban setting. You also have to factor in that some doctors do not work at a single clinic but may schedule their week to spend certain days at one facility and the rest at others (ex. Monday and Thursday at Facility A, Tuesday and Wednesday at Facility B, Fridays off) which can limit the ability to see them in the same week especially if the facilities are not owned by the same organization.

Healthcare access and quality aren’t consistent. Some states or areas in the same state will have better providers than others. Some health insurances will cover things without question and others may fight against you on covering things.

I recently had knee surgery and hit my deductible due to the procedure but insurance billed me for full price on part of the it because they deemed it to be “experimental and unnecessary.” There was some back-and-forth between the surgeon’s office, my insurance, and myself to understand why only a part of it wasn’t covered. This was an additional $1,200 that eventually I had to pay for; even after paying $1,100 up front because of my high-deductible health plan. I’m financially stable enough to cover it without it destroying my savings but this kind of surprise isn’t uncommon for US citizens even with recent laws trying to make costs more predictable.

Was this by chance inspired by a previous submission (now defunct) that had a similar premise?

https://news.ycombinator.com/item?id=40536488

Edit: I believe it was transferred to a new domain at https://wordnerd.co/

$240/yr in software subscriptions but likely far more than that by selling the extra metadata they can extract from the service