rectang

I don't trust Maytag and GE. It's good that they have simple interfaces and lack surveillance tech, but their cheap machines are almost certainly built for price-driven consumers who don't consider that they are built to fall apart.

Household appliances have been around for a long time now. I wish that there were open-source hardware designs that a certification organization could evaluate.

Who can tell which Whirlpool appliances are actually quality? It's so hard to trust anybody. Between the short-time-horizon thinking of public companies driven by the share price and the brand cannibalism of Private Equity, the brand you thought was reliable a couple years ago is today dialing up short-term gains so that its current leadership can gut the company and retire.

Reviews are so easily gamed that it's hard to trust them. Only companies with small product lines can build and maintain a durable reputation for quality.

I'm about to buy a Speed Queen TR7 washing machine. It feels great to buy a dumb appliance that's built to last and serviceable.

No spyware and featuritis a la kings of user-hostilility LG and Samsung.

No planned obsolescence from built-to-disintegrate brands living off ancient reputations like Whirlpool and Maytag.

Just a machine that I won't have to worry about from a company that makes money by providing value rather than by victimizing their customers.

Has there ever been a "Stop political texts" ballot initiative?

When real income goes up 15% but rent goes up 75%, people are absorbing a cost, not flaunting their wealth.

That stability claim is an average for all American households, gathering together high-income households and long-tenure homeowners along with poor renters. But in a K-shaped economy where the wealthy do well and the rest do worse, averaging the two forks of the K hides the hardship of those on the lower fork.

From https://www.jchs.harvard.edu/blog/rental-housing-unaffordabi...

> The net effect of this longer history is that renters today spend much more of their incomes on rent than they did in previous generations. The median renter household in 1960 spent less than a fifth of their income on rent. By 2022, housing costs consumed 31 percent of the median renter’s income. And in inflation-adjusted terms, the median rent is up 75 percent over these six decades while the median renter income has risen by just under 15 percent.

To escape the "communist" critique, I think it's worthwhile to grapple with opposing all concentration of power, whether private or public, governmental or corporate.

For instance: marketplace competition requires some regulation, but recognizing that regulation is a necessary evil with many opportunities for abuse (e.g. regulatory capture) helps inoculate against socialism's worst excesses.

I agree, but I don't think many wealthy people are open to that perspective. Many seem to credit themselves with having created an environment where everyone's lot is improving in absolute terms, and don't see anything wrong with accumulating outsized relative power for themselves.

The reluctance to give up resources also an understandable aspect of human nature, but power concentration in the hands of the few is always problematic. I'm very much a capitalist but the last few decades have persuaded me that wealth taxes are a necessary and moral correction to capitalism's unfortunate spiraling acceleration of inequality.

Then can we agree on a government funded safety net for the sake of labor mobility? ;)

Typically the real disagreement here is over whether workers should get benefits at all.

EDIT: can we get another `vouch` or two for groundzeros2015's currently [dead] reply? It's well-argued and an olive branch and deserves to be visible.

Since the 1980s, the wealthy have done fantastic while the rest have not done nearly as well. The argument from CATO and others is that we should be content with the majority of households taking home a shrinking share of an increasing pie so long as their absolute purchasing power isn’t decreasing, but that argument feels wrong in part because it’s human nature to measure status relative to others rather than in absolute terms.

Furthermore, wealth applies more pressure against certain costs like housing[1] than against others like food or durable goods. Cheap toasters only go so far in making people feel like they aren’t falling behind.

[1] https://www.jchs.harvard.edu/blog/home-prices-surge-five-tim...

> the average number of hours worked per worker have fallen

Hooray for just-in-time scheduling where workers have to be available full time but rarely get scheduled full time. It’s an innovation that has been great for capital and terrible for labor.

Everyone in your filter bubble is not "everyone else".

The specific legal arguments made in this video are hedged and sober. For example, Stone doesn't play to popular sentiments about expansive EULAs — he notes that the liability for listening devices like LG TVs is at most limited to guests and others who haven't consented to being recorded by clicking on the EULA agreement.

Channel founder Devin Stone is a licensed lawyer who seems busy enough with his media business that he's likely not spending a lot of time with legal clients... so he's both.

Is it bad to have political activists investigating corporate spyware? Any consumer advocate could be characterized as a political activist.

Lawyer Devin:

> I want a dumb TV

If it’s not just tech people asking for dumb TVs, might the demand rise high enough that they actually appear on the market?

By encouraging prosecutors to punish the innocent, you ensure that the guilty go free to commit more crimes.

American voters care about conviction rate above all else for their prosecutors.

Because the AI vendors do not acknowledge the contributions of those who created the knowledge they trained on. The fruits of everyone's collective efforts flow exclusively to them.

But UTF-8 is also extremely well-studied.

We can have an LLM enumerate all those edge cases, and we can assemble them into a spec. Then we can integrate that spec into a proof.

And because the spec is functional rather than expressive, we can produce copyright-free, provably correct reference implementations whose correctness is as strong as our spec and our proof process.

This reference implementation would then be available for use by a language like PHP, or perhaps an LLM generating a vibe-coded dependency.

Over time, then, the accumulation of such proven reference works grows. We'll never prove all the application code out there correct, but incremental progress is possible.

According to "Today's PHP Security Release, and How We're Strengthening PHP Security" discussed at https://news.ycombinator.com/item?id=50182987

* Regarding one CVE, "Remote code execution was also confirmed on PHP-FPM through application-level code paths."

* Regarding the other CVE, "A use-after-free and worker crash were confirmed, and the reporter demonstrated remote code execution against a real-world application running on Apache with mod_php."

Since those exploits exist, I expect that LLMs will duplicate them soon.

Vibe coding deps is security through obscurity, with all of its weaknesses (and strengths). It's not that such deps have fewer security bugs than the open source reference implementations from which they are derived, it's just that those bugs are currently less discoverable.

In the near to medium term, the current open source regime has issues because bugs have become extremely discoverable and easy to exploit. But I am skeptical that obscurity will provide vibe coded deps sufficient protection over the long term. As soon as the source code for those vibe-coded deps leaks, you are screwed.

I just gave this prompt to duck.ai (5.6 Terra under the hood): "How would one go about writing a provably correct algorithm to count UTF-8 code points?"

It gave me something which looked pretty legit. Of course, the generated output very likely to be subtly wrong, but as starting input to a formal checked specification/proof process it seemed like a good start.

I wrote some UTF-8 based string handling software back in the day. It doesn't seem unreasonable to write up a set of requirements and edge cases and then have a formal mechanism prove correctness for common UTF-8 string manipulation operations.

[PEAK HN ON] Now if we could just write provably correct exception handling, we could solve one of the two PHP vulns from today. [PEAK HN OFF]

It's funny, that's true although I personally can't relate — I enjoy having built something robust, but the act of building isn't something I love.

I can imagine prompting an LLM to build provably correct software. Aren't we already doing something similar already when we remind it to write unit tests and account for all edge cases?

Actually writing provably correct software from scratch sounds terribly tedious, which is why I've never explored it. But maybe an LLM could make that task more approachable.

Could open source activity transition towards provably correct software, with far more modest feature sets?

I don't have experience with proof based tools, so I'm not sure what's feasible.

The issue is where to direct the LLM's attention.

Prompting the LLM to "look for vulnerabilities in PHP's multipart upload handling code" is going to find stuff that "look for vulnerabilities in PHP" won't.

I really don't know how we are going to deal with accelerated exploit generation via LLMs — it blows up the disclosure processes we've evolved.

The only thing I can think of is hunkering down with static HTML to reduce attack surface, but that's laughably incompatible with many many business requirements.

I've read it and besides the "why", I'm also wondering about the long-term impact on the person who was hit (Buford's father).

I'm generally bullish on migrating C projects to Rust, but that will only reduce a particular class of vulnerabilities. There will still be other vulnerabilities which remain discoverable by LLMs, and for those, the problem of accelerated exploit creation will remain.

I'm really not sure how you mitigate this issue, other than serving static HTML and reducing the attack surface to cut out dependencies like PHP.

See also original source (paywalled and downgraded on HN at time of writing): https://news.ycombinator.com/item?id=50172214

Note to anyone considering buying defense product from Musk's companies: your security may be shut off at Elon Musk's whim.

I don’t know about that. I remember when California Hispanics turned on Republicans after Prop 187 in the 1990s, and the realignment was permanent[1]. This could be the timeline where national Republicans lose Hispanics for good, destabilizing the knife-edge balance between the parties.

[1] https://www.npr.org/2019/11/08/777466912/californias-prop-18...