whizzter

Maybe maybe not, something interesting popped up reading the currently top-of-HN article on the GHC policy is that OpenJDK currently forbids AI contributions.

From the page, https://openjdk.org/legal/ai

--------------------------

What are the intellectual-property risks of using generative AI tools?

The Oracle Contributor Agreement (OCA) requires that a contributor own the intellectual property rights in each contribution and be able to grant those rights to Oracle, without restriction. Most generative AI tools, however, are trained on copyrighted and licensed content, and their output can include content that infringes those copyrights and licenses, so contributing such content would violate the OCA. Whether a user of a generative AI tool has IP rights in content generated by the tool is the subject of active litigation.

--------------------------

But they're just Oracle lawyers so it's baloney right?

Not more than accidentally or when actually interested in something that pops up, but as a friend said, I'm not a usual core customer so I've never been the baseline.

The thing they're doing correctly right now imho, is that AI mode is mostly toggled for things that passes a quick questions filter (probably low probability of a purchase, like "global illumination methods" giving a decent overview of the field) while if you just type green shoes it'll put out an assortment of online and local shopping options.

Now if as someone said in the sibling comments, Google is gouging their customers with the new auction model that's another problem, but if I was a shareholder I'd be less worried about an exodus of end users to OpenAI,etc than I was a year ago.

For me Google has stayed as the default interface, if I need to ask a basic query (probably searches that don't yield much revenue but keeps me on Google), the results were becoming worse a 1-3 years ago but now the AI parts of Google is now good-enough(TM) that I mostly don't need to go to a separate interface, as long as users aren't fleeing they can probably continue to get paid for ADs (also the if YT ads are included, those have really become obnoxious but probably well monetized).

Where does it say that it's carrier configuration? Looking through the page it mentions WAP and PDU, seems PDU from my skimming is just a part of encoding WAP messages, so basically anyone being able to send WAP messages onto the network will have the carrier happily retransmitting it unless carriers starts blocking them/filtering these incorrect ones?

Apple knows how much of a premium they can charge vs other manufacturers, if everyone else starts dropping they will as well.

Yes, but the irony here is that Apple used to (or perhaps still has) forbidden using other HTTP(S) clients in iOS apps (or perhaps Appstore in general) than the built-in out of security concerns like this would address by using 1 central storage instead of multiple ones were one won't get timely updates.

Ah, so I might end up not looking like a fool for marking it green, good to know! :)

A while back I was thinking it wouldn't be enforced, but the entire Craft-clones and REA tools usage explosion kinda hints that disassembling/rebuilding the source is cheap enough that LLM's(ironically) could probably quickly find culprits if you had suspicions about certain apps.

You mean as in binning? High defect rates for chips but they're burned to disable non-working parts and sell them as non-pro chips and accumulate the good ones ?

This caught my eye, remember how the eMudhra certificates had weirdly low parameters, like 4 and others in the single digits?

"Mbed TLS - Medium, CVSS 5.9 - A buffer-length typo reduces a 2048-bit DH modulus to one byte. TLS 1.2 DHE_RSA sessions are decryptable when the client accepts the broken parameters. GOAHEAD-SA-2026-0005."

Not familiar with those implementation details but was this the root cause?

No, the question is, if the GPL'ed code/structure is more or less recovered during inference, would a court rule the result to be covered by the GPL?

I know there was some cases in the past where people swapped licences and changed variablenames,etc but the essential code clearly remained.

Does it matter? Lawyers don't know either since most majorer cases are still in progress.

So far it seems more cases that have been decided in lower instances or has been settled or gone in the direction of the party with most money for lawyers, still even in those cases there seems to be a slight tilt towards rightsholders.

I'm not saying anything categorically, but if some cases go all the way and towards rightsholders, it could become a real shitshow in the software industry since we've adopted AI so heavily and the non-significatng portion of public GPL licenced code could bite people in the ass.

I think technically such a model should abide by the licence of the inputs, hence all models would probably be GPL if the FSF had resources to fight it and the legal profession had an inkling of the processes involved.

Or maybe the FSF is just waiting for everyone using AI code to become hooked and then subpoena every Antrophic/OAI/Codex customer and force the most massive source release in history (If Adobe/MS would file lawsuits vs the Craft apps and with their resources create legal precedent it could create chaos, maybe the only part stopping them right now from filing lawsuits is them realizing it could backfire since they're heavy AI users themselves).

Aaron Swartz pulled down by the legal system for trying to get things accessible for people instead of being blocked by profit requirements.

Companies copying things to make profit for themselves not being held accountable.

Progress is one thing, injustice is another.

It's a community site, first model I looked at (Tanya by Shrimport) is under CC-BY-ND-NC licence (Creative Commons, By attribution, No-derivatives, Non-commercial).

AI training by definition is derivative, and Roblox not using it for commercial purposes if used in production is practically nil.

This is a huge part of why AI upsets people, we can't have nice things such as communities where people are sharing 3d models without it being feeding ground for commercial companies that has little intention to ever honor any licences or compensate authors.

I was thinking the same thing when another PDF library popped up in the .NET subreddit a few hours before this post.

I'm not really in that camp, but I'm still in the camp of "will they survive long-term if good enough open models trickles down to commodity hardware" (in a way the opposite camp perhaps?).

Sun made bank 25 years ago because their servers was needed for websites, today we run larger workloads on 5$ VPS servers (well maybe the VPS servers has gotten more expensive due to HW shortages but they're not intrinsically expensive anymore).

Oh my, here I'm looking like a fool, literally gave a talk on the new <meta>/Reflection feature on Thursday and doing it assumed that it was more or less a lock (Well I guess the refl feature will come out if contracts can be dumped and the standard gets out even if it won't technically be in C++26 anymore :P )

The reflection feature is good, I would've settled for less but there's some pretty cool stuff enabled by it.

- direct to struct JSON parsing with property-name aliasing via annotations

- field creation/renaming, I've made a make_named<"a","b">(1,"hello") to create an object with fields named a and b (think of std::make_tuple on steroids)

- I'm basically halfway done with a DB abstraction that can be used similarly to C#'s Linq.

struct [[=sql26::name("posts")]] post { int id; std::string name; };

dbcontext<post> dbctx;

for(auto post:dbctx.posts.where([](auto post) { return post.id>100; }) { ... }

^- in the above example the template inclusion of post creates the posts-field in the context, the where predicate lambda gets a decorated variant of the post type members that are then deferred until execution (starting iterating the itererable).

It's dangerously powerful though since all of this is enabled by consteval, so any IDE support will need to be running the consteval code continiously in these scenarios to update type-info before being able to do code completion (even if people are probably way into LLM's to bother anymore?).

The talk isn't online yet since they haven't had time to edit the videos.

The JSON and make_named example/code can be found in my repo, haven't pushed the SQL feature yet as I'm not happy with some other parts of the API surface yet (aggregation is hard to express/translate compactly and unambigiously).

https://github.com/whizzter/ret26

I think the big contention is yet-another "optional" feature you cannot rely on when C++ security record is so-so with regards to memory safety, and if you for "elegance" put predicates for such into contracts.. it can all go out the window even if you intended for it to be strict.

I think defaulting all assertions to enforce would've been better with an optional soft modifier (ie "soft pre(foo)" ), as it is now it's just always assert in a trenchcoat.

Lovely, I remember the first cracktro that blew my mind long before I actually got in touch with the demoscene.

It was an ACE cracktro for International Karate that was putting huge things in the borders, something about it stuck to my mind.

https://www.youtube.com/watch?v=2ODIb5r_fS8

That's why it's built on SEPA instant that is written into EU law, requiring 10 second transfer times, and the banks have incentives to support these things (they often own it, but also because it creates lock-in effects of focusing business in one bank).

Like someone else who made the "SEPA in trenchcoat" comment, it's all built on tying phonenumbers (universally available and easily connectible) to bank accounts and relying on SEPA instant for the money.

The only thing to make sure is that QR-codes,etc that are often tied to apps will be supported for routing/connecting between different apps.

Like the Swedish Swish app when asking for money produces a QR-code that says, A+(my-phone-number) , if that's universally recognized by the apps as an ask-request then an Italian app scanning my QR code will be prompted send money and the Italian system will query the Swedish counterparts what account is registered to that phone and then just send the money over SEPA when the request finishes.

Depends on the API? Considering how much Chinese actors rumored to be spending on straw owners buying for them to then distill information out of OAI/Anthrophic, I'm sure any OAI/Antrophic keys in the wild gets bought up quickly.

I'd say yes-ish, the 9.2 rating hints that it's not a straight to-shell exploit, but still serious enough that the step is probably easy enough, imagine the DB connection string or similar leaking through the working memory leak.

The reason it's so bad is because the multipart/form-parsing by the accounts I've read happens- or begins before the PHP code is actually run, ie it's in the initial runtime stage of a request.

I wouldn't be surprised about a timeline like

1: Wiz finds the exploit , begins responsible patching procedure

2: Chainguard,etc gets to know about it, adds some monitoring on top of their patches.

3: OpenAI being happy for the upcoming publicitiy starts an automated run to _count_ vulnerable instances for _marketing_ purposes.

4: Chainguard interprets it as wild exploitation and pulls the trigger early.

Different use-cases.

C# is often like Java but without taking a wrong turn when it came to type-erased generics, the generics are uncomplicated enough even if slightly less powerful than what you get with the full instantiation of C++.

C++ was severely lacking before reflection came along in 26, I'm actually writing some new reflection based libraries and it's mostly a joy and quite capable.

But C++ has so many outrightly dangerous semantics when it comes to writing secure code, the coping of pointing to realtime systems,etc as another security "dimension" doesn't hold when Rust,etc exist today.

C# is good in that it's "easy" yet the performance profile of the features allows optimized code to run far closer to C++/rust/etc in performance compared to Java,etc. (that said, a wast majority is probably running like Java due to programmer patterns, but not needing to drop down to another language when it's needed feels good).

Reading the claroty article mentioning nginx, I think it's more likely that their decompiler is just setup to use windows semantics since that's probably a majority of what they analyze.

Iirc LPCTSTR is just an alias for const char* , lp being an anachromism of "long pointer" held over from the days when needing to do a distinction for "flat" 32bit pointers since there already was "near" and "far" pointers during the x86 16bit era.

XML/XHTML is a fairly strict language syntax wise compared to HTML, tags are either explicitly self-closing i.e. <img/> or terminated with a matching closing-tag, no exceptions.

HTML has special rules depending on the tag's type, ie a bunch of them are just written (<img>) and the parser doesn't even really want to see a matching closing tag, or tags like <script> that has a special mode that stops being a HTML parser up until </script> is found. (1)

A HTML parser can become a XML parser by disabling a bunch of special-features and supporting self-closing tags (depending on XML level).

A XML parser needs a ton of "hacks" to become a HTML parser.

Also browsers needs an XML parser anyhow to support svg that's an xml-based format, also the DOM spec is written to support namespaces's like XML.

XSLT did complicate things, and most importantly it seems many relied on that one old implementation written in the 90s that was a swiss-cheese when it came to security concerns that nobody wanted to spend money on maintaining.

(1): https://html.spec.whatwg.org/multipage/parsing.html#script-d...

Yes and no, canvas was fine for replacing flash, and JS performance was good enough quickly.

Audio however was a crapshoot for years, especially for games.

Even basic WebAudio took until 2015, and the final piece to match Flash being AudioWorklet was only first available in 2018(Chrome) and took until April _2021_ land in Safari.

So before 2021 you needed to either write your own abstractions to support multiple API's with different execution models with so-so capabilties to be somewhat on-par with what Flash provided or even for years resort to simpler solutions (ie just samples).

Claude seems to be fairly good at bruteforcing/testing/etc on it's own, it solved a fairly intricate thing while I was busy on other things.

I've adapted a crypto-lib for TLS connections and had a mistake during negotation that truncated some algo-selection value, worked up until the other party started trialling post-quantum algorthims that apparently had algo-id's that collided with the truncated values I was using.

Claude figured out that from the code and trialling TLS handshakes.

Besides, since there was a bounty on finding the curve it seems unlikely that someone would've found out and not shared that? (unless working at a security service that figured out that it was possible to attack?)