4,484 karma · joined July 31, 2010
I also wonder if the fix that they "just rolled out" is actually activating the 'short' mode that TFA mentions...
[0] <https://code.claude.com/docs/en/statusline#how-status-lines-...>
Do you disagree with the numbers and conclusion in the -pretty obviously bot-generated- Fine Article?
It's exactly as enforceable as when projects require you to swear that you can legally assign copyright of your submissions to the entity that runs the project, and/or swear that your submissions don't infringe on anyone's patents, and/or -as the ReactOS project does- swear that you've never seen the code that the project is reimplementing.
If someone swears that they're conforming to the rules and you later find out that they lied, then you ban them forever, publicly announce why, and -if needed- purge their contributions and do your best to alert affected users about the tainted versions. These sorts of policies work for the same reason ordinary doors and door locks work: most folks aren't profoundly antisocial shitbags.
...what exactly do you imagine the Bad Guys would do with the information that they've likely been siphoning off of the systems of ICE and -in the past- the NSA? Do you imagine that they'd be exclusively distributing it via Sneakernet? Just like the Good Guys, the Bad Guys also have access to IT guys who know how to set up a login portal... and the well-resourced ones are totally capable of setting up things akin to SIPRNet.
Nah. A single fucked-up maintenance shop is a single fucked-up maintenance shop. You can gut-check this by noticing that bombers weren't routinely falling out of the sky.
FedGov simply didn't want to be deeply embarrassed and wanted to try to wiggle out of paying a quarter million 1940s USD to the widows. Because they were unwilling to admit to their negligence and face the consequences, they did deep and lasting damage to the US justice system by introducing a mechanism that lets FedGov conceal nearly any evidence for any reason by uttering the words "state secrets privilege".
I'll say the same thing that no one with access to a microphone said during the 2013 NSA data leaks:
What makes you think that the Bad Guys didn't already have access to this information? The folks that should have detected this clearly didn't. [0] Given that the Good Guys didn't learn about this until it was made public, neither they nor we have any idea of knowing how many Bad Guys have been siphoning off this data and for how long.
[0] In this specific incident, Okta appears to be claiming that there has been no breach despite claims that it is the source of the information. Back in 2013 -given that the NSA would often claim something that would be quickly countered by the publication of yet another leaked document- it was pretty clear that the NSA had little idea of what data had been released to the press.
Nope! These methods were available to everyone who was literate as well as anyone who either maintained oral traditions describing how to perform them or just decided to make up a language for fun. Maybe you're forgetting that our ancestors were generally just as smart as we are today.
> The original point was about scale and the scale (and strength) of encryption available today was not possible for most people until the advent of computers.
This is completely irrelevant. Why? Cops have access to computers that can brute-force most everyday ciphers that would have been cooked up in the 1700s. The just outcome is for non-cops to have access to those same computers to create and use ciphers that restore the ability to keep one's private communications safe from the eyes of the police back to what it was hundreds of years ago.
This just outcome is -incidentally- what we have today because of a lot of tireless, difficult, thankless, ongoing work by some absolute heroes starting most visibly in the 1990s and continuing through today.
As a bonus, none of this has anything to do with the establishment of dragnet surveillance systems built and operated by private companies that are defacto acting as agents of The State. Dragnet surveillance is -at minimum- plainly antisocial and has no place in any civil society.
EPN3D's point stands despite your complaints: the only reason that the illegality of these dragnet surveillance systems wasn't immediately obvious to the courts is because the US Constitution doesn't explicitly mention that courts must always consider the expanded scale of what enhanced technology makes possible, so courts are very slow to incorporate it into their decision making process. Judges and lawyers rely heavily on tradition, so this slowness is only natural.
This is -incidentally- how the ancient English "state secrets privilege" got introduced into US law.
In the 1940's, godawful maintenance resulted in the crash of a bomber over US soil and the death of all three of the civilians on board the plane. The widows of the dead civilians sued the government and demanded the accident report. The government refused to provide the report, claiming the privilege because "national security", and courts all the way up to the Supreme Court agreed.
In the early 2000s, the accident report was declassified. Inspection revealed that the only real reason to refuse to release it was to both prevent government embarrassment and to avoid having to pay out -IIRC- nearly a quarter million in 1940's USD to the widows.
Given its enormous potential for unchecked abuse, along with the fact that the first ever invocation of it was abusive, courts should refuse to permit its use.
Nope. You need not stop everyone -or even anyone!- you search for it to be a dragnet search.
A search that is widespread and indiscriminate is a dragnet search... regardless of whether it's done by agents of the government or by the private sector. [0]
The thing being caught in the dragnet is not people, but information about with whom those people caught in the dragnet associate, where they spend their time, and other details about their private lives that -frankly- the government has no business knowing without either paying the cost to have a police follow those surveilled around, or justifying beginning and continuing the search of specific individuals to a court and receiving its approval.
[0] I'd love for the courts to start generally taking notice of the fact that a private sector company for whom the overwhelming majority of its customers are public-sector law enforcement is very likely to be defacto acting as an agent of the state. Private companies acting as agents of the state have far more strict regulations that apply to them, and it'd be really good for courts to catch up with the current situation on the ground regarding the public sector's "partnerships" with private-sector companies like Flock, Axon, and similar.
Pardon? We know that encryption was used at least as far back as the days of Julius Caesar. [0] Clever kids and adults have almost certainly been making their own ciphers since the invention of written language, and their own conlangs since the invention of verbal language.
I expect that -in the US- one could not be compelled to provide the decryption methods for one's papers and journals to the cops back in the 1700s just like cannot be compelled to provide one's passphrase to decrypt one's encrypted data today. Both are really obviously testimony, which cannot be legally compelled. [1]
[0] <https://en.wikipedia.org/wiki/Caesar_cipher>
[1] ...abuse of contempt of court charges notwithstanding...
Given that the impact-absorbing parts could be [0]
...rubber on the edges where impact protection is needed.
Apple's decision to make most of its handhelds out of various grades of "fragililum" has boggled my mind since they sold the first iPhone with an easily-shattered glass back. That choice makes sense for a conspicuous status symbol that people are going to take very good care of... but most folks either end up with one with damage that makes plain how theirs is not the kind of life that makes that possible, or they have installed some aftermarket shell that ruins the effect by covering up the conspicuously fragile part of the hardware.
That reminds me of the time -IIRC- Scalia asserted that it was A-OK for the cops to "happen" to kill a fleeing suspect by dropping a tree on his moving car, even if they expected that the falling tree would strike the car.
If I'm attributing the decision to the right guy, I'm sure he would have loved to have gotten a chance to exonerate all those ICE agents who've -collectively- gone on a murder spree here "recently".
_If_ this is an accurate summary of the ruling, that definitely doesn't agree with -say- the Third Amendment.
Do you happen to know whether the Supreme Court declined to hear the case?
Cops have limited resources, so they must prioritize. Even the Supreme Court acknowledges this.
Because of this truth, SF cops give nearly zero shits about recovering stolen property. It has been decided that they spend their limited resources elsewhere.
> Why have cops at all?
Yeah, that's a really good question that folks who are poorly-served by their federal, state, and local police forces often find themselves asking. Folks who are well-served generally ask themselves that question far less often.
Given that their Q3 sales numbers didn't grow by much, and that if they can't get Congress to both order a halt to the production of new LLM-based tools and either tightly restrict "open weights" models or make them illegal [0], they're going to have the dual squeeze of the ever-increasing R&D costs needed to build the next big LLM-based tool and ever-reducing revenue as more and more businesses notice that they get decent results with something they can host on-prem... and the only cost to the business is hardware that they may or may not already have and the power that they're likely to be already paying for.
[0] ...illegal because "China Bad And Scary", naturally...
Speaking as a San Francisco resident: No. SF cops give nearly zero shits about recovering stolen property.
Speaking as a USian: Even if it did lead the cops right to the car and provided unimpeachable evidence that what the footage showed was a theft, rather than something legal, I still don't want these electronic mass-surveillance systems to be deployed. Dragnet surveillance is plainly unacceptable.
If -somehow- we can magically build such surveillance systems to be completely unable to provide data that's unrelated to a search warrant or other such court order, I'd reconsider my stance. However, building such a system is simply impossible.
Imagine a world where housing is free, where anyone without can request a primary residence in a location of their choosing and -after twenty four hours- receive one free-of-charge that any member of today's working class would declare to be solidly of above-average quality.
In this world, would police who were tasked with destroying evidence of child molestation from the home of a convicted child molester be in error if they burned the molester's house down, rather than going through the trouble of locating just the documents, trinkets, & etc. that they were tasked with removing? [0]
I mean, what's the harm, right? The child molester can get a good house for nothing with a day's notice.
To make the analogy explicit: just because the child molester can re-use the phone doesn't make torching everything on that phone the correct thing to do. The fact that their mass destruction of that guy's property also destroyed evidence that was relevant to a civil lawsuit only makes things worse for them... maybe not legally, but definitely from a "That shit ain't right and shouldn't be happening!" standpoint.
I hope that the courts treat the relevant evidence as being deliberately destroyed, should the molester bring his civil suit.
> The court said (more or less) "that's not unreasonable: cops have better things to do than hand wipe criminals' phones of criminal evidence".
Yeah, this court is using bogus logic. If the cops don't have time for it, then they should be required to delegate to specialists. Mass destruction of one's papers and other personal effects in order to destroy a tiny slice of them is wildly out of line.
[0] The child molester lives alone, so the majority of the property in his house happens to be his... not that the torch squad bothered to check.
IIRC, it's mentioned at at least one point in the first big video on the topic that they haven't tested other manufacturers "'Smart' TVs" but would not be surprised to discover that other manufacturers are doing the same thing. They're not a news organization owned by one of the 0.1%, so they can only do investigation and reporting so quickly.
> There really wasn't a lot of new information in the Gamer's Nexus video.
I'm not sure which video you're talking about.
If you were expecting the recent one that talks about the lulzy ASUS RCE and how it could interact with "'Smart' TVs" to have even more information about "TV" vulnerabilities or consumer-hostile features, then your expectations are out of line.
If you're asserting that you knew nearly everything in the initial "Wow, these LG 'Smart' 'TVs' can really easily become always-on spy devices, and -in some respects- already are!" video, well, okay? There are those of us who know that shady shit is going on because we have ten brain cells to rub together, a moderate level of awareness of the world around us, and can pretty easily connect the dots. It's an entirely different thing to demonstrate that that is going on for the benefit of people who are -for some reason- reluctant to believe that -yes- Big Megacorps do heinous things to their customers in order to make a bit more money because they don't expect to get caught... and even if they get caught, the punishment will only be a tiny fraction of the profit gotten from doing those things. [0]
[0] The biggest irony here is that objections to claims that this is how Big Megacorps typically do business with us Little People are often dismissed as "4D chess" or "conspiracy theories"... but, like, this behavior is a textbook example of a rational economic actor responding reasonably to market incentives. This is the "Invisible Hand Of The Market" at work.
No. I addressed your electricity assertion here. [0] I'm calling nearly all of your commentary word salad because it reads like the "conversation" in the picture behind the "...cognitotoxic" cut on this Mastodon post [1], just with the "spiritual woo" vocabulary module pulled out and the "finance bro" and "LLM Tech Exuberance" vocabulary modules loaded in.
> And this whole attempt at making someone with legitimate questions look bad...
No one here is assisting with that; it's all you.
RFC 2827 (BCP 38) was published in May 2000. There's no good excuse for end-user ISPs to not be doing this for pretty much all of their customers.
[0] For the purposes of this discussion, I'm declaring that "cloud" providers are ISPs. They provide IP addresses and Internet connectivity to their customers, so they count.
No, they did.
From [0]
> To gain access, the models identified and exploited a [bug in the Artifactory] registry cache proxy. With this access, our models performed a series of privilege escalation and lateral movement actions in our research testing environment until the models reached a node with Internet access.
If the sandboxes' network was airgapped, the only thing on the network with Internet access would be the router that sits between them and the Internet... and that router wouldn't have any services that listen on the airgapped network. Instead, they had at least one Internet-connected host on this "airgapped" network running a bigass pile of code, which -like many bigass piles of code- had at least one RCE in it.
If the software running on your machines can use anything other than Sneakernet to get data to and from the Internet, those machines have Internet access and are not airgapped. [1]
[0] <https://openai.com/index/hugging-face-model-evaluation-secur...>
[1] ...and -personally- I'd argue that if data can flow out from the systems to the Internet via Sneakernet, that ruins the airgapping. There are so many ways for a clever adversary to hide their communications. In this specific situation, this communications path isn't really relevant... but for many-to-most of the ones where you're bothering with the huge hassle of setting up airgapped systems it is.
If the software under test can attack the IPMI to gain access to the management network it's connected to, and then hop out to the Internet through either the VPN server or the IPMI client software, and the problem wasn't caused by a boneheaded misconfiguration, then that's a very interesting finding that everyone will want to hear... because that's a vulnerability in a component that's expected to safely run alongside hostile workloads.
[0] I'm using the name "IPMI", but the thing goes by many other names: BMC, LOM, iDRAC, iLO, etc, etc, etc. Whatever you call it, it's a little computer built into the motherboard to provide remote access and management to the system it's built into.
This I don't disagree with... but you and I probably believe this for very different reasons. However, the rest of what you've said -in this comment and the first one I replied to- is just bonkers word salad.
No. The numbers indicate that the price of all "full-sized" computing is mostly the cost of hardware, [0] regardless of whether that's "cloud" computing, "on prem" computing, or -er- "colocated" computing.
And by "full-sized" I mean "computing with regular PC or server-type hardware". I'm sure someone could build some absurdly cheap exotic stuff that invalidates all this math, but I don't expect anything that will be found in a datacenter, server room, or on someone's desk at work and whose primary job is doing compute that customers are paying for to be that stuff.
[0] Unless that hardware is acquired at a _deep_ discount... which usually isn't possible if you're buying new hardware. And if you're buying used hardware at a deep discount, that usually means that someone paid a normal price for that hardware at some point.
168 * 12 < 4562
If we assume that Hetzner's spending cap *doesn't* apply...
If I were saying that, I would have said it. Unless "XXX max/mo." doesn't mean what it means in plain English, I _very_ strongly expect that it's very rare for colo customers to suck down all available power 24/7 and that Hetzner has a Stern Talk with customers who do but didn't disclose their intent to do so up front. I mean, you tell me... if you've ever lived in an apartment where your power and water was included in the rent and was metered with a whole-building meter (rather than per-unit meters), did you consume every amp and gallon that could be delivered to you, or did you use just a bit more than what was useful to you in the course of everyday life? [0]
I worked the math the way I did (even doubling or tripling the expected lifetime of the server hardware) to make the numbers as favorable for the "electricity is almost 100% of the cost of computing" side of the argument as they could reasonably be.
Are you saying that I fucked up my math?
[0] And if you're never lived in such an arrangement, ponder instead how you would behave if you did find yourself in one.
AFAICT, this hasn't happened for any "cloud" compute company that has been in business for -say- at least five years. Unless your prediction is that roughly no one will use "cloud" "AI", I'm rating this prediction as "totally bogus". And if that is your prediction, then what you're saying is
Assuming that you're not doing anything that needs exotic system administrators, nearly all of the cost of computing when you own your own hardware is the power for that hardware.
240V * 10A = 2.4kW
2.4kW * 24H * 30 * 12 = 20,736 kWh
20,736kWh * 0.22 EUR/kWh = 4562 EUR/year
Note that I'm using roughly decade-old hardware prices and allegedly-current electricity prices. If we used hardware prices from two years ago -or worse, from today- the hardware would cost far more per year.
[0] <https://www.hetzner.com/colocation/>
[1] ...which I think is between two and three times longer than is standard to expect in the business world...
[2] ...it's very likely that I have! Corrections are definitely welcome.
[3] ...it's also possible that USians get gouged for server hardware and that it's like a quarter of the cost if you buy it in Finland. I expect that there's definitely a price difference, but I doubt that it's very large.
How often do you buy new computers? I paid something like 2500 USD for my Threadripper machine (including 128 GB of RAM and graphics card) ~seven years ago. Between now and then I paid ~580 USD (at the end of last year) to get a new graphics card and that's it. After last year's upgrade, I've yet to run into a game that it doesn't play reasonably, and I've also gotten a lot of work done with it over all the years I've had it.
The console lifecycles being like a decade long has been a fantastic blessing for us PC gamers. Most AAA games are intended to run well on those ancient almost-PCs, which means that our old actually-PCs usually play the games just fine.