Retr0id

I'm fairly sure maxing out the usage on a subscription costs them money.

Is it easy to get CVP on two accounts at once? Do they make any attempt to prevent or penalize multi-account usage?

I also want this, even just $40 (i.e. "2x") would be plenty. The way it is right now, Pro is a tight squeeze but anything else is total overkill and I have no idea how I'd use those extra tokens productively.

Don't be fooled into thinking that planes can fly.

Heh, there's one of mine: https://stoppels.ch/goalposts/?c=39727943

"GPT-4 looks at original ASCII art of a foot, not copied from the web, and says it is a foot."

The vote is currently 64% yes, 18% no.

Just now I asked Opus 5.5 to generate an ASCII art foot, and it did a passable job. It's not great, but it's a foot. Then I pasted it into ChatGPT (whatever they're serving to the free tier by default, which seems to be 5.6 Luna), and it said it was a "train/locomotive": https://chatgpt.com/share/6abeaa39-cc80-83ed-851f-29370db089...

Maybe it's Opus's fault for drawing a bad foot but I think it's fair to say LLMs are still pretty bad at ASCII art (without additional tool calling etc).

Alternatively, you can bet on your predictions. If you're wrong, you lose money.

Attestation only detects user-initiated "compromises" like unlocking the bootloader and flashing a custom ROM. It does not detect exploitation.

The leaks likely happened in the first place because the model forgot it had a tool call for running properly managed background tasks (claude seems to do this all the time). I'm not saying a the model is going to be malicious and try to escape, I'm just saying it's going to employ workarounds to get its job done.

It's easy to "escape" from timeout by daemonizing etc.

A trivial bypass I can imagine is spawning a new process via `ssh localhost foo` - the new process forks from sshd, not the client. This is simple enough that an LLM could come up with it all on its own, if it feels that you're getting in its way.

It's a broad class of bypasses that can apply to just about any "long running daemon can be instructed to spawn a new child" situation.

look up has the same number of syllables but it does not have quite the same semantic density, you can look something up without using a web search engine.

Heads up, your youtube link has a tracking ID in it that is bound to the account/device you shared the link from.

Attestation does not solve this.

> GrapheneOS does everything and more for key attestation

Right, that's the problem, in my opinion. I'm not referring to the apps that require Google's keys only, I'm referring to the ones that allow GrapheneOS keys too. If you use one of these apps, you can use vanilla GrapheneOS builds, but you cannot run your own self-signed builds.

You are gaining freedom relative to running Google's OS, but you are still not free to further modify the software running on your own device.

Apps that require "integrity" should monitor their own integrity only, they should not attempt to infer the integrity of their environment.

Maybe I'm just the wrong demographic, but I clicked around for a bit and couldn't really tell what I was looking at. In particular I couldn't figure out how to "Choose a preset or click Random".

Edit: I found the presets in the end, I was not expecting them to be above the other controls, when it's at step 3 in the "getting started" list.

It is possible to build a device where the modem is not at all trusted, but I don't know if anyone is actually doing that.

I will never feel bad about blocking ads on youtube, because they have an effective monopoly on distribution of certain content. But when it comes to music, why not just use something else?

You are not quite the owner on GrapheneOS either, because of Android Key Attestation (which has functionality analogous to desktop TPMs). If you re-unlock your bootloader (say, to run a custom build of GrapheneOS), attestation will snitch on you and the subset of apps that use key attestation to require a locked bootloader and/or enforce an AVB key allowlist will not work properly. This is a very small subset of apps currently, but I don't see it getting any smaller.

It used to be my "it just works" distro for systems I didn't want to spend time configuring, but they managed to make me feel like a second-class citizen as a not-enterprise-customer (not really anything specific, just a lot of small cuts).

I appreciate that they're running a business, but the Fedora/RHEL split feels much cleaner, and Fedora is my current go-to in instances where I used to reach for Ubuntu. (Or I use Debian, for headless/server setups)

I'm sincerely curious, when was the last time you tried agentic coding?

I'm very grateful I have public pre-LLM projects I can point at (including a 6502 emulator!), and I have absolutely no idea how I'd go about bootstrapping the same kind of reputation starting from scratch.

It'd take a few extra sentences to get the details, but I'm confident enough that it would work that I'd rather save my tokens for something more personally interesting.

They opened their AI agent and typed "make me a 16-bit computer built from NAND gates" and hit enter.

Yup. I got excited for a bit, until I loaded the page and saw it was slop. I still would be impressed if someone actually took the time to learn about and implement it for themselves.

So now that the "trial" has failed we're going to stop doing face scanning, right? ...right???

It's a federated network, so even if everyone has symmetrical 1Gbps links you cant throw 1Gbps at all of them at once.

Are you an LLM?

You're arguing with the same OP that an LLM piloted into claiming SHA-256 was on the cusp of being broken https://news.ycombinator.com/item?id=47557755, https://news.ycombinator.com/item?id=47546028

Line rate of sender != line rate of receiver (I am also not GP).

Because throwing UDP packets requires a bandwidth advantage (aside from reflection attacks), whereas application-layer attacks can impose an outsized cost on the victim.