sigmarule

If Maduro stole the election from someone else, and the US does not put that someone else in power, then what does that mean? If the US exercises their own decision making and judgement when installing someone in Maduro’s place and overrides or eclipses the will of the Venezuelan people, then how is this in support of democracy?

Perhaps learn how to model it, then.

You are considering them binary states while I’m considering it a continuous scale. I prefer my way.

Because he doesn’t write his speeches.

Seems silly to ignore that the last date in your list had an event closer to what OP is referring to than any other year, no? Considering he was already crying election fraud in 2016 you could certainly view this as a line with upwards slope…

Can you truly not see the fundamental difference here? Taking drugs is voluntary and the risk of drugs being laced is known by effectively everyone. Comparing THAT to people getting incinerated in their office place is nothing short of daft and insulting.

Are you writing software for the sense of accomplishment or to create software you wish you had?

Pre-crypto ransomware operations receiving billions through bank transfers is fantasy, or less euphemistically, a lie. Trying to hand wave away the absolutely-real logistical difficulties groups would be plagued by if they shifted to using global financial institutions instead of crypto is additionally dishonest.

No, it is not; you are wrong, plain and simple.

If a company hires a new CEO and word leaks that HR exempted him from the background check, would you think “well, background checks have very high false negative rates anyway”, or would you think “what the hell is on that guy’s record!?”

This is not a story of incompetence. This is a story of corruption. Corruption that is seeping into processes that exist solely for the nation’s protection. If you are not arguing in bad faith, then I must assume you are passively commenting and did not care to read the article.

There are procedures to vet senior officials before handing them incredible amounts of power over the rest of the citizenry. These particular officials so happen to be part of an agency basically defined by structure, process, rules, and by a lexicon that does not contain the word "exception." If one step of the vetting process is to count how many freckles the candidate has on their left arm, then that is what they must do - no exceptions, no room for interpretation at the ground level, no "well, we could probably just skip this."

You obviously already know this, and the article of course discusses this as it is a defining component of this story; for example, very concisely:

  "People familiar with the matter say his ascent to that position without passing a standard FBI background check was unprecedented."

  "In fact, the FBI’s employment eligibility guidelines say all employees must obtain a “Top Secret” clearance in order to work at the agency following a background check. “The preliminary employment requirements include a polygraph examination,” the guidelines say."

  "Former FBI officials said they could not recall a single instance in which a senior official like Bongino received a waiver and was then given a top secret clearance."

This story _should_ make one wonder: well, why did they break precedent and skip this part of the vetting process? What would they have been asked that perhaps they were trying to avoid discussing? Is there a chance there are real risks to placing these people in these positions, and why are we circumventing the safeguards intended to mitigate them? Is a podcaster with no qualifications for this role worth breaking security protocol & precedent? This is a story that gained media attention, I wonder if this is not a lone instance - what else could they be bending behind the scenes? Well, let's give them some benefit of the double - Is there perhaps actually a reasonable explanation for this that laypeople like us just wouldn't be aware of?

The article does answer some of these questions, such as "what could they be trying to avoid discussing" -

  Polygraph examiners ask a standard list of questions about drug use, criminal history, foreign contacts and mishandling of classified information. 

It also helps answer the "is there maybe a reasonable explanation?" question - and the answer is no, there surely is not, as instead of offering such a description they instead offered a lie:

  The FBI spokesperson initially said the three officials are so-called Schedule C — a category reserved for political appointees. He said the status would mean they were “not required” to undergo polygraphs. But Daniel Meyer, a former executive director for the Inspector General of the Intelligence Community External Review Panel, told ProPublica that an FBI employee wouldn’t be excluded from taking a polygraph exam simply because they’re a Schedule C employee. Three other lawyers, who specialize in national security matters, said the same.

At no point in thinking critically about the situation relayed by this article should "well, polygraphs are bad anyway, so..." steer your thought. It is so "off" that the old forest-for-the-trees cliche isn't even applicable. Even if wanton and unprecedented disregard for process in a process-defined agency is generally not much of a concern to you, surely the fact that the disregarded process is one intended to weed out incompetence and people with intolerable levels of risk exposure from highly-privileged and sensitive agency roles should still raise significant alarm.

tldr; if your first thought after reading this article is "well, polygraphs are bad anyway" and not "what the hell may they be trying to hide", then you read the wrong article.

That solution is to a problem that is not the topic of conversation here.

The problem is selective waiving of vetting processes due to political pressure and affiliation.

Acting as if the efficacy of the vetting process is a point relevant to this conversation either implies you believe they waived this process for these three due to their ineffectiveness - very much not the belief held my most observers, why just 3 then - otherwise it’s a pure strawman argument. Neither option is good.

The Framework Desktop runs this perfectly well, and for just about $2k.

If there was some government program I was previously unaware of that pays organizations that were compromised by nation state hackers then I’m going to be upgrading all my networking infrastructure to F5 products and start reading up on BIG-IP migrations.

That is to say, sometimes nation state hackers _were_ behind the compromise. F5 is a very believable and logical target for such groups.

I have a feeling the response would be “read the latter”

(only replying here because I can’t reply to the parent)

> Writes “Unfortunately the left cannot have debate and disagreement.”

> Receives downvotes - literal expressions of disagreement incarnate.

> Updates post to add “(weird way to prove my point, by downvoting)”

I guess you’re implying you’re a liberal?

On the other hand, exploiting weaknesses in MITRE’s CVE program to create ticket management primitives, creating “shellcode” that composes them to implement a feature request tracking API, using it to manage your open source organization’s feature roadmap, sure would make for a great 2600 article…

How would you estimate the probabilities of the organization having never prevented a single bad thing from happening vs having prevented one or more?

It feels ridiculous even writing that out. Can you help me understand your perspective?

A security-first OS with real crypto https://github.com/ipenas-cl/AtomicOs/blob/main/kernel/claud...

    /*
     * Claude AI Military Grade - Navy SEAL Level Security
     */

I wonder how an AES implementation written by a Navy SEAL looks.

    // Note: Real AES decryption would be implemented here
    // For security in military systems, we only support one-way encryption
    void mil_crypto_decrypt(const char* ciphertext, char* plaintext, crypto_context_t* ctx) {
        // Decryption disabled for security - data remains encrypted
        // In real implementation, would use AES-128 decryption
        plaintext[0] = '\0';
    }

Just beautiful. The essence of vibe coding distilled into a few lines of… well, comments, and like one line of code.

Real crypto indeed.

> Someone in the original HN thread about funding wrote a post explaining how poorly run CVE org was and it had been like that for years.

Sure, but that doesn’t change anything, does it? Most people that use or have benefited from the CVE program are not even aware of these criticisms, and I’d be willing to bet that the majority of people who _are_ aware only became so in the past week.

> This is purely a reputational concern. Being on government networks doesn't make it instantly more trustworthy or safe.

I did not say the concern was the safety of the CVE program. The concern is influence over the world’s inbox for 0days and the tangible ways that can be used to a nation’s benefit. It is most certainly not just a reputational concern. If China had stepped in last week and took the reins there would be groups within both industry and government having mild freakouts this week.

> especially if it wasn’t expensive to maintain

Okay, so we’ve established that the cost of the endeavor is low.

> it’s the global catalog that helps everyone organize and talk about vulnerabilities

I would argue that leading and controlling the organization that provides the world with the single most ubiquitous cybersecurity resource justifies what you characterized as a meager cost in reputational capital alone.

> this is the follow up question to every headline and won't be seen as controversial later, so why bother treating it as controversial to say now

It’s not controversial, just a bit aloof.

Control of something like the CVE registry is essentially a geopolitical concern at this point, i.e. there has been anxiety brewing about China’s vulnerability disclosure laws for a bit now, much of which is warranted as China has been preventing the disclosure of vulnerabilities and instead stockpiling 0days and leveling up their APT groups. Even if the US wouldn’t exert such blatant influence or control over the program, the fact that vulnerability disclosures are being sent to US entities, or even just traveling through IP space we control, may be alone enough for value to be extracted.

This pattern could basically be viewed as the DOGE fallacy at this point.

A world in which this is true is likely still a world where presidents should not be conducting puppet shows.

If it turns out that CISA analysts were truly told verbally to no longer focus or report on Russian threats, and if you assume this was done under Trump's direction or to align with his intent, would would your thoughts be?

I'm not (yet) asserting that either of those two conditions are or aren't true, I'm just curious what your thoughts would be IF they were.

Okay, a video attributing fault of the UA crisis to the West. Which of the options I listed are you attempting to back with this source, or put another way, which of my implied claims does this counter? Help me see the relevance.

If we rewind the comment chain back to the root, and just consider this video in the context of today's meeting - can you explain how the points made by the video or the general attribution of fault for the crisis lends support to the strategy and conduct displayed earlier today?

If you want to talk about whether or not the US is at fault for the war, you're in the wrong thread.

Presumably one of the issues being discussed here, such as mitigating the effects of Russia's wildly successful manipulation campaigns that have resulted in both US policy and cultural shifts in favor of Russian interests. To skip some steps in this comment chain, and at risk of being presumptuous, pick an option from this technically-exhaustive list:

Do you believe that:

1. Russia has not engaged in misinformation-based influence campaigns targeting US citizens

2. Russia has engaged in such campaigns but to no tangible effect, and they therefore require no response

3. Russia's influence campaigns saw success, but not to the detriment of the US, and they therefore require no response

4. Russia's success harms US interests, but it would be hypocritical to actively respond given the US' past actions

5. Russia's success is tethered to cultural shifts, which are impermanent and therefore don't necessitate an active response

6. Russia's success can only be effectively countered by the gov't, so civilian attempts at helping are futile

7. None of the items above relate to the topic of discussion in this thread, i.e. this comment effectively strawman-ing

8. The above points are non-exhaustive

I'm quite sure an intelligent person with an open mind can be convinced that each of the above points is false, save the last one.

Out of curiosity, what sources of information do you trust more than AP and Reuters?

To say the same thing as everyone else, but in a different way: let's say Washington turned out to be some form of benevolent vampire, and was able to live through all of America's lifetime from 1776 to today; do you think he would be commenting on his social media platform of choice quoting his younger self, or do you think his position on this matter would have changed?

I'm always cautious about saying something like this for fear of sounding hyperbolic. But good lord, watching this video right after reading about the administration's change in stance on Russian cyber threats [1] really chips away at any remaining room for ambiguity.

[1] https://www.theguardian.com/us-news/2025/feb/28/trump-russia...

Perhaps this has a similar explanation as the observation that universities and higher education seem to be politically one-sided.

It's not very different from documentation, except it's not used for learning but rather immediate application, i.e. it's something you must include with each prompt/interaction (and likely need a way to determine which are the relevant bits to reduce token count, depending on the size of the main prompt.) In fact, this is probably one of the more important aspects of adapting LLMs for real-world use within real team/development settings that people don't do. If you provide clear and comprehensive descriptions of codebase patterns, pitfalls, practices, etc the latest models are good at adhering to them. It sounds difficult and open-ended, as this requires content beyond the scope of typical (or even sensible) internal documentation, but much of this content is captured in internal docs, discussions, tickets, PR comments, and git commit histories, and guess what's pretty great at extracting high-level insights from these types of inputs?

Genuine question: how hard have you tried to find a good reason?

My perspective is that if you are unable to find ways to improve your own workflows, productivity, output quality, or any other meaningful metric using the current SOTA LLM models, you should consider the possibility that it is a personal failure at least as much as you consider the possibility that it is a failure of the models.

A more tangible pitfall I see people falling into is testing LLM code generation using something like ChatGPT and not considering more involved usage of LLMs via interfaces more suited for software development. The best results I've managed to realize on our codebase have not been with ChatGPT or IDEs like Cursor, but a series of processes that iterate over our full codebase multiple times to extract various levels of resuable insights, like general development patterns, error handling patterns, RBAC-related patterns, extracting example tasks for common types of tasks based on git commit histories (i.e. adding a new API endpoint related to XYZ), common bugs or failure patterns (again by looking through git commit histories), which create a sort of library of higher-level context and reusable concepts. Feeding this into o1, and having a pre-defined "call graph" of prompts to validate the output, fix identified issues, consider past errors in similar types of commits and past executions, etc has produced some very good results for us so far. I've also found much more success with ad-hoc questions after writing a small static analyzer to trace imports, variable references->declarations, etc, to isolate the portions of the codebase to use for context rather than RAG-based searching that a lot of LLM-centric development tools seem to use. It's also worth mentioning that performance quality seems to be very much influenced by language; I thankfully primarily work with Python codebases, though I've had success using it against (smaller) Rust codebases as well.