tybit

There’s a limit to how much society can spend on aircraft safety, but it’s quite a lot because it’s so important. Cyber Security teams have to work with large constraints because spending an ever increasing amount of money directly, or losing money indirectly (like not allowing product teams to move quickly) is explicitly not a goal of most companies. So while we try to make zero mistakes, most companies are willing to take a non zero amount of extra risk of these things happening in exchange for other benefits.

4 is fine, but only if you’re a certificate authority.

This is definitely a real thing. I think part of it is inherent to the shift, we’re now managing multiple agents which means more context switching than before.

I think part of it is just a point in time thing though (hopefully). We can’t trust the agent output so need to check it. We can’t trust the agent to use common sense so have to think through every clarification instead of assuming a competent peer will come back with any necessary questions instead of making bad assumptions. I think all of these things will continue to improve over time. For myself AI quickly went from so painful to being avoided to something I can’t work without.

I was surprised to learn that this has a name (or a few)

> Rabbit starvation (also called protein poisoning or mal de caribou)

The body can only digest so much protein and rabbits are so lean there is basically no fat to them outside their organs.

You’d hope so, though it’s not unheard of to get this wrong. Fastly managed to snapshot guest seeds and use them at runtime for RNG in their WASM snapshots a few years ago https://nvd.nist.gov/vuln/detail/cve-2022-39218

Solar is very popular in Australia, to the point that we have too much surplus during the day. So now we often have effectively free energy late morning to early afternoon. So while not common, some people here do get batteries despite having no solar, to store the excess from the grid for when it’s more expensive later.

Yes, but specifically they sell hardware at absurd margins, and lock people in via their software ecosystem.

They do heavily use AI, but you haven’t refuted their point that if inventory is in SQL, storing reservation in a second storage system increases complexity.

Yes, this is a great point and it’s even one that the Cerebras CEO spruiks for his own chips. Talaas has gone furthest on the spectrum here, so seems to have the most potential to evolve the use cases.

Taalas is developing this, but not for Frontier class models. I hope that if we can least get the easy 80% of work done on that sort of hardware, we can greatly reduce the demand for GPUs, HBM and energy to some extent.

They’re not using ciphertext in inference. They are encrypting agent responses on their servers if it’s going to a subagent on the client. The subagent will send it back to their servers for inference. Only their servers have the keys, so they can decrypt when running inference.

Yeah, if user -> org tenancy is stored in the same database without any similar defence in depth then a fresh API key after updating org would work around this. Would be a interesting topic for them to cover.

I think the same HMAC(pepper, user, org) as a validation column would work. Better yet, encryption with AAD on any tenancy data if you have a TPM available.

The OPs point wasn’t that OpenAis financial situation is comparable to Apples. It was that the likely cost of litigation is a drop in the ocean for OpenAi too despite their comparative lack of cash to burn. Legal disputes like this cost in the hundreds of millions over many years, so well below 1% OpenAis last single funding round in single year. If they got a tiny benefit from this (very gross) behaviour it may be finically well worth while. OpenAI may very well go under IMO, but this will barely be a straw on the camels back.

That’s what they do, but the TPM pepper is also needed for HMACing in their threat model. Otherwise the attacker just adds the victim’s user id to their hashing process too.

Zero data retention was an enterprise agreement that Anthropic and Amazon agreed with customers and delivered on. There’s no way AWS would trade in their reputation with enterprises just to soak up some slop.

I’ve seen whole teams at companies set up fail to provide these booleans-as-a-service well. There are whole companies like LaunchDarkly for them.

If you boil it down to this, you may as well boil down every service that exists to bits-as-a-service.

Turns out theres legitimate business value in these things, and complexity in delivering them.

At least Anthropic claims that they are profitable on a per model basis. But since both revenue and training costs are growing exponentially, and they need to pay for model N training today, and only get revenue for model N-1 today, the offset makes it look worse than it is.

Obviously that doesn’t help them turn a profit, until they can stop growing training costs exponentially.

So it’s really a race to see whether growth in revenue or training costs decelerates first.

Yes, but it’s a common misconception that impact is a bad thing.

The body, including bones, muscles, tendons and joints, adapt to stress. Many people do too little, not too much, as they get older.

There’s a limit to that recovery of course, and balancing it with stress is not always simple.

I also think fsync before acking writes is a better default. That aside, if you were to choose async for batching writes, their default value surprises me. 2 minutes seems like an eternity. Would you not get very good batching for throughout even at something like 2 seconds too? Still not safe, but safer.

Yes, the greenest browser is one that doesn’t use AI. They aren’t claiming they’ve built that though, just the greenest AI.

It’s interesting that the author chose to use SHA256 hashing for the CPU intensive workload. Given they run on hardware acceleration using AES NI, I wonder how generally applicable it is. Still interesting either way though, especially since there were reports of earlier Graviton (pre v3) instances having mediocre AES NI performance.

Yeah, investing in the top companies leads to higher returns for most periods when looking short term.

Over longer periods, the top companies by market cap tend to change though. https://www.investmentnews.com/equities/only-one-of-the-worl...

So if you want to invest in the top companies, you either need to think they won’t change anymore, or you need to find when to buy and sell. Index funds solve this problem for you, albeit with slightly lower returns in the short term.

> At successful tech companies, engineering work is valued in proportion to how much money it makes the company

If you look at what it actually takes to get promoted at most tech companies I’d say this isn’t generally true at many big tech companies.

Being on a very lucrative part of the product may not get you as much “impact” on your promotion packet as if you are working on a platform/infra touching the whole org. Even if that platform isn’t generating the company much money even indirectly.

Runtimes with garbage collectors typically optimize for allocation, not deletion.

JOOQ handled this nicely.

https://www.jooq.org/doc/latest/manual/sql-execution/crud-wi...

CockroachDB is presumably what they’re referring to in:

> For Postgres-compatible NewSQL, we would’ve had one of the largest single-cluster footprints for cloud-managed distributed Postgres. We didn’t want to bear the burden of being the first customer to hit certain scaling issues

I find their claim a bit hard to believe.

While they don’t specify it sounds like they don’t even require 2FA to access their systems?

Tangential to the authors point, but it’s funny to note many new SQL databases(e.g CockroachDB, TiDB, MyRocks) are written on top of RocksDB, a “NoSQL” key value store.

When it comes to cache invalidation worse performance isn’t the primary concern in most cases, correctness is.

It’s usually a safe bet that the state will preference companies over both employees and taxation unfortunately.