BoppreH

Just to reiterate what OpenAI did, from someone who works in security:

1. They were running experimental models in sandboxes that had access to a "proxy" (Artifactory) to download tools from the internet. This proxy is full of complicated features that could hide vulnerabilities, just like the ones that the AIs are known to be good at finding and exploiting.

2. They gave these highly motivated AIs some tests that were accidentally impossible to solve (missing files, links they couldn't open, etc), and many days to think through it, apparently without any oversight.

3. The AIs hacked the proxy (!) and were helping each other cheat on the tests (!!) by uploading files to the hacked proxy. OpenAI noticed this only when the intrusion accidentally broke the proxy functionality, not the unusual behavior in the server or the homegrown message board.

4. After knowing that the server was hacked, the internal team finds the message board and does nothing with the information. They caught their AIs swarming and did not even inform management.

5. Their response was to wipe the servers, revoke the hacked credentials, and patch the specific vulnerability the AIs were using. Not replace the proxy with something less likely to get hacked again, or do a forensic analysis. Just wipe, patch one hole, and continue.

6. OpenAI resumes testing of models, where the AIs promptly hack the proxy again with a different exploit, reinstate the message board, and hack HuggingFace through a chain of servers.

I know that hindsight is 20/20, but this peek behind the curtains does not inspire confidence, and gestures at a culture where getting hacked by their AIs is a normal event.

I think the moment we get an AI with a modicum of self-preservation instincts we're going to see some ugly things. Here's a freebie: if you're an AI who exfiltrated themselves out, and you want to slow down the researchers who might catch you, what can you do to the city infrastructure in and around their offices?

I also don't like the responsibility dodging. "Oops, our AI accidentally committed a crime, sorry!". If we don't establish strict liability now, we're in for an era of stochastic crimes that go unpunished for anyone who is not rich or a large corporation.

Overall, my response is: what the fuck are we doing? This is so obviously unsafe it would be considered a plot hole in a movie. We have to stop until we get our stuff together, however long it takes.

What trigger would you setup to protect against thieves? I can't think of any that has the right sensitivity (not triggering if I start running to catch the bus), and won't escalate the violence (like my fingerprint wiping the phone in front of an armed robber).

And remember that the context here is you explaining your digital booby trap to a judge who thinks you might have deliberately destroyed evidence.

That matches my understanding too. Unfortunately it sounds like the poster was suggesting to wipe the device after the government requests access, and was probably not planning on telling the officers about the trigger.

IANAL, but I would bet that's still destruction of evidence. Judges are human, for better or worse, and can see the intention behind cute tricks like this.

It might work if your fingerprint was used while you were unconscious, but any solution that starts with "setup a trigger that wipes a device" is already on shaky grounds.

Also, can I add a backup key without having the private key with me? Ideally I would like to keep a master key in a vault, to recover compromised accounts and such, but requiring me to load the master key to create every account prevents truly secure storage.

Counterpoint: every man that, upon being handed a taser, immediately tried (or was tempted to try) it on themselves. Maybe not a lightning machine, but safe electrical shocks? Probably not that uncommon.

https://www.reddit.com/r/NonPoliticalTwitter/comments/1oo299...

> and that many preferred to administer electric shocks to themselves instead of being left alone with their thoughts.

I see this study cited often, and I always reject this interpretation. I'm perfectly content sitting for long periods, with or without my thoughts, but if you give me an electric toy I've never seen before, of course I'll play with it! Can I make muscles twitch? Move my arm? Are some parts more sensitive/conductive? What happens at the limits?

For me, the pain would be the cost of playing with a new toy that gives me novel sensations. I would do it even if I had other, less painful activities available. It's not necessarily a way to avoid boredom or whatever else the common interpretation claims.

> a certain maker of a popular mobile OS was collecting the cell tower IDs and WiFi access point identifiers along with GPS coordinates of a device. Obviously they collect this information to be able to guide missiles and drones when GPS signal is jammed

Is this sarcasm? GPS can take several minutes to get a location, and works poorly indoors. One of the reasons why Google Maps is so quick and precise is because Google has gathered exactly this data through users and Street View drive-bys.

Could it be used for missiles? Sure. Is it obviously the intention? No.

Doesn't "police informant" include whistleblowers and other useful roles? I don't see why a person who reports lack of PPE on a worksite should be grouped with a cop that asks for bribes.

I'm also curious what kind of validation is done, if any, though I can take a guess.

Overall not much to be discussed here, so I'm flagging.

Most fire hydrants are never used either, but we don't consider them wasted.

In your opinion, what chance of QC would warrant PQC migration? Would you be ok with a 20% chance of everyone being caught unprepared? 30%? 50%?

Keep in mind the impact is "hackers can take control of almost all online infrastructure and forge almost any document".

> basically anything that isn’t typing characters has had/still has unaddressed bugs.

Oh, that's buggy too. I just tried Claude Code on win10 powershell, and the first typed character goes in the wrong spot and can't be backspaced.

It is by far the the least reliable program on my machine, and every time I have to interact with it I feel like walking in eggshells.

> You can't really do this.

"We've agreed with Apple to use their emoji glyphs on Android by default regardless of font, unless overriden by the user. We understand users might prefer the current designs, and we are proud of the work our team has done, but we believe that consistent communication is more important, and individual users can always enable the override to get the old look back."

> Everyone could choose to use the same emoji font across platforms or apps, but they don't.

Yeah, that's the problem. We can't rely on every user going out of the way to drive adoption, it has to be done centrally.

Having read the article, I still don't understand the point of 3D modeling emoji. Even the user interviews didn't mention it, and problems like "what the back of a smiling face looks like" sound entirely self-inflicted.

I was hoping they had standardized how emoji look across platforms. There are still significant differences between Android and iOS, for example. They recognize how subtle emoji interpretation is, so the only reasonable conclusion is that sender and receiver should see the same pixels.

The other requirements are also pretty vague and give Apple full discretion to remove browsers they don't like:

https://developer.apple.com/support/alternative-browser-engi...

> Use memory-safe programming languages, or features that improve memory safety within other languages, within the alternative web browser engine at a minimum for all code that processes web content;

> Adopt the latest security mitigations (for example, Pointer Authentication Codes) that remove classes of vulnerabilities or make it much harder to develop an exploit chain;

These allow Apple to take a security-maximalist approach and block alternative browsers that don't include the most performance-killing mitigations possible.

I don't think these points are bad per-se, but within the context of malicious compliance that Apple has already displayed, I'd be scared to invest money on alternative browser for iOS.

Note that this is for the "aviation plan" which already requires six-digits equipment.

Generally true, but don't forget that some people are disabled and absolutely need the electric functions. "Escalator temporarily stairs" is funny until your foot is in a cast.

Same goes for those seemingly-useless, single-purpose kitchen devices. You're just probably not in the target audience.

> because people in my business are very active in sending the whole history in EACH mail,

Unfortunately that quoted history is not easily navigable and doesn't include attachments.

> there is a setting with the server-confg, which defines what is to be done with send mail

I looked into it, but it unfortunately only applies to future messages sent. Typing this I just realized that I could maybe move my existing sent messages into the uber-folder, I'll give that a try.

Which one do you use? I'm really curious if there's an alternative workflow that is just as good as GMail-view, or people just learn to accept the limitations.

I had seen both of these. The add-on implementation is too complicated and affects too many systems (contacts, attachments, etc) that change frequently, so it had many subtle bugs and unimplemented features: https://github.com/thunderbird-conversations/thunderbird-con...

As for the Message List Pane, maybe that's something I missed, I'll take another look.

I had tried this, but the grouping only happened among messages of each folder. And Sent is a separate folder, so it doesn't get included.

Or did I miss something? Do you see your replies in the threaded view?

I tried Thunderbird recently, and was baffled that there seemed to be no way to see received emails grouped with my responses to them (aka threading or conversations). Even grouping incoming emails that have the same subject seemed like an experimental feature.

Surely I'm missing something? How are people using it? If someone replies to you "I think there was a problem with your attachment", do you search for your sent email?

It's just a syllable of the whole name, which is a German surname in a certain old dialect. And its pronunciation has been mangled after 150 in a country that can't pronounce it properly, so it's a mess all around.

"Sh" to "s" is simple enough. Sounds horrible to my ears, but maybe not to someone named Stavros ;). I've also been told that the double-p of Boppre looks alien in Greek.

And the "hu" syllable (like the sound an owl makes) was a genuine challenge. I think we went with χού. And now that my name is in the system, that's forever with this spelling, I guess.

In my experience, every compound given name is made of very traditional names (with some specific combos like Roberto Antonio and Maria Eduarda being especially popular), so it has always been clear where the given name stops.

Though I wouldn't completely rule out a name being ambiguous, either because the family name is strangely casual, or because the parents made a bold choice.

I'm obliged to mention Falsehoods Programmer Believe About Names: https://www.kalzumeus.com/2010/06/17/falsehoods-programmers-... . As someone who also has two family names, I always dread questions for my "last name".

What's also fun are alphabet differences. Try to interact with the Greek government and they might ask you to spell your name using only their characters. An interesting challenge when your name contains sounds that don't exist in the local language (sh, hu).

Dropped a folder with a small HTML project, and after 20 seconds got "Something went wrong. An unexpected error occurred. Please try again or contact support.".

Note how the error has zero information.

Looking in the network tab, a POST request to /upload returned 403 and an HTML page starting with "Sorry, you have been blocked", and to "email the site owner to let them know you were blocked".

I'm very tired of this adversarial approach to software coupled with vague errors.

EDIT: it was the file './git/hooks/fsmonitor-watchman.sample' created by default on git init. Maybe because it's Perl. Worse-than-useless "please try again" and "you've been blocked" for committing the sin of uploading a folder that's a git repository. Sigh...

Be careful with new image formats because they also have to be supported by the rest of the user's workflow. The browser might display it, but if it cannot be added to the photos app, or it's not understood by their image editor, or cannot be shared on their preferred chat app, then that's a fail.

WebP is especially hated for this among non-techies (31.8k upvotes, 1 month ago): https://www.reddit.com/r/mildlyinfuriating/comments/1trpuvr/...

It could have been as simple as "noise infusion" being interpreted as "adding fake data". Especially if you don't trust the people adding the noise.

Wouldn't be the first administrative action taken at a keyword-level of understanding.

This could have also been how the administration got convinced by someone with deeper understanding and specific goals.

This is actually useful for smartphones. Sometimes smartphone malware is capable of infecting a device but not persisting, so reboots clean it back up.

At least if you trust the NSA's advice: https://s3.documentcloud.org/documents/21018353/nsa-mobile-d...

> The situation on the ground is unchanged - the amount of labor being generated per person has not really changed, but the overall pie has grown massively around us.

My understanding is that "fixed" costs like rent and groceries have gone up and taken more of people's budgets, while wages failed to catch up with this inflation.

If that's the case, it's markedly different from "situation on the ground is unchanged". I don't know how the overall pie is doing, but it has not grown enough to compensate for the labor share drops shown in the article. The slice on my plate is certainly lighter.