0123456789ABCDE

it's really cool when i can fall a sleep in peace knowing this keeps my folks from getting rooted

isn't root level access one of the selling points of the cloud vm product line?

i disagree wholeheartedly with this.

a loved one, gun to the head: "please pay the ransom, i don't want to die!"

what's your play now? save loved one, and go to prison? or worse, bank blocks transfer, and they die?

go ahead and tax ransom payments (0 tax if human life at risk, 10x otherwise) if you have to, but making it illegal feels disconnected from the messiness of the real world. then, go after the attackers.

all* of that + sharding -> https://sqlite.org/lang_attach.html

ex: main.db + fts.db. reading and writing to main.db is always available; updating the fts index can be done without blocking the main database — it only needs to read, the reads can be chunked, and delayed. fts.db keeps the index + a cursor table — an id or last change ts

could also use a shard to handle tables for metrics, or simply move old data out of main.db

* some examples:

  conn = sqlite3.connect("data.db")
  conn.execute("PRAGMA journal_mode=WAL")        # concurrent reads (see above)
  conn.execute("PRAGMA synchronous=NORMAL")      # fsync at checkpoint, not every commit
  conn.execute("PRAGMA cache_size=-62500")       # ~61 MB page cache (negative = KB)
  conn.execute("PRAGMA temp_store=MEMORY")       # temp tables and indexes in RAM
  conn.execute("PRAGMA busy_timeout=5000")       # wait 5s on lock instead of failing

edit: orms will obliterate your performance — use raw queries instead. just make sure to run static analysis on your code base to catch sqli bugs.

my replies are being ratelimited, so let me add this

the heavy duty server other databases have is doing that load bearing work that folks tend to complain about sqlite can't do

the real dmbs's are doing mostly the same work that sqlite does, you just don't have to think about it once they're set up. behind that chunky server process the database is still dealing with writing your data to a filesystem, handling transaction locks, etc.

by default sqlite gives you a stable database file, that when you see the transaction complete, it means the changes have been committed to storage, and cannot be lost if the machine were to crash exactly after that.

you can decide to wave some, or all of those guaranties in exchange for performance, and this doesn't even have to be an all or nothing situation.

and excel has gui for forms

"When the enemy is making a false movement, we must take good care not to interrupt him." — some guy, you wouldn't have hear of him

not to disagree on the merits of encryption — i'm not a clown, but scripting.com is still port 80 only, and Dave is the type to write a rant

doesn't this event speak for itself though?

can confirm, at least another 54k seconds from where i sit

patagonia is gonna to lose some clientele

don't you mean _allegedly_ "has his signature and…"

i don't know a lot about the subject, but the little i know tells me this is not the way to look at this

your password (plain text) is secret because only you are supposed to a have it. in the digital realm, sharing the contents of the password (plain-text) is be akin to making a copy of it — undesirable

now, the algorithm that hashes the plain-text for comparison with the stored hash, that can be know by anyone, and typically is

so password ≠ hashing algorithm

right, thanks

some folks also refer to these as PRODUCT decision records

waterfall is not the sole purveyor of written docs

distributed teams do well when proposals, decision, etc, are written down, and can be easily found and referenced

it doesn't mean docs are frozen in time and can't be patched like code

how is this relevant?

pfft, just don't have a computer and you'll be good

just sinkhole the domains

https://dpaste.com/E7RZ34MVD

https://github.com/StevenBlack/hosts

have you considered, in the specific example of google being different from the rest, that all the other services were _wrong,_ or their goals were different than google's?

> /ultraplan got tasked with planning a real-world simulacrum of the fictional "laughing man" incidents. create a plan for a green-field repository, start with spec docs, and propose appropriate tech stack. don't make mistakes. ty

and you know this because you have privileged access to their internal models

they are already getting paid for opus 4.7, why would they release mythos?

assuming mythos is a paper tiger: great marketing, keep going

assuming mythos is for real: err, does this have to be explained?

perhaps, before the thread derails into a bunch of comments like the parent, we should consider that the article is not a comment on what your side-projects look like, those obviously should look however you please. rather the comment is directed at folks who want both great UX, and for their taste to reflected on the website, and quite frankly: some of you have absolutely no sense of what usability affordances require, not to mention _taste_.

it's also gpl v3 licensed, you can just take a copy, won't cost you shit

that would be full disclosure, i don't particularly dislike the idea, but it's slop, the devs are already overwhelmed, i don't fully understand the legal implications i would be exposed to.

i'm well aware that a pull-request with a fix is a lot of work. i don't pretend to have the capacity to do this, with all the rest i have to attend to.

it just doesn't sit well with me that, i am aware of something being broken, and not telling about it to someone who would otherwise want to know about it.

i'd be happy to use an official skill for vulnerability reporting

the skill would be manually triggered when vulnerabilities are found; do another pass for details; version, files, lines, then write a lightweight report and submit somewhere. anthropic could host this, or work with h1 to do that. when the models have extra capacity a process comes around and picks up these reports one by one, does another check, maybe with proof-of-concept, reports through proper channels.

something i am missing in this area is education and services.

if, during an automated code review, claude finds a vulnerability in a dependency, where should i direct it to share the findings?

who would be willing to take the slop-report, and validate it?

i've never done vulnerability disclosure, yet, with opus at max effort, i have found some security issues in popular frameworks/libraries i depend on.

a proper report can't be one pass, it has to validate it's a real problem, but ask opus to do that and you run the risk of the api refusing the request, endangering your account status. you ask to do it anyway, and write a report and now, you're burning tokens on a report that's likely to be ignore, because slop.

so i sit on this, and hope it doesn't hit me.

what's the more likely explanation though?

when "explaining a thing, no more assumptions should be made than are necessary."

could be an ios bug; a bug with the notification library they use, any other app behaving similarly?

considering the possibility this was on purpose, they would risk getting banned from the appstore. no, they are not big enough to avoid that. so it's unlikely this was intentional.