TimJRobinson

It's time for all developers to learn about devcontainers and use them consistently. They're super easy to setup and run and would protect from most of what this worm does. https://code.visualstudio.com/docs/devcontainers/containers is the best guide to get started if you use vscode.

Devcontainers are a much better solution, super easy to setup with VSCode and ensures the AI can't access your main machine.

Devcontainers are so useful when working with AI. Not only for rogue agents but rogue scripts/libraries they may download that try and exfiltrate your credentials.

I would love this for magic the gathering

Disappointed Topo Chico isn't included. I've tried sparkling water all over the world and it's my favourite.

I've had a full shakedown at the airport in Brisbane asking for passwords for phone/laptop and they will confiscate for 2 weeks if you don't comply. I'm an Australian citizen. They also didn't let me call anyone so my wife was left waiting for 3 hours wondering where I was.

They could give all nearby residents free/subsidized solar + battery for their homes.

This empowers people making them feel less beholden to rising energy prices, and gives the data center more energy for its needs as the grid is freed up.

Honestly Linux has been so much easier to use since Claude / codex came out. Now I don't need to remember esoteric commands or scroll old forums to fix issues, Claude does it all for me.

Been using ubuntu + regolith as my daily driver for over a year now and haven't needed to use windows for anything. Almost all games all work well on Linux now too.

I built something similar a few years ago where the idea was "jackbox but coop games". It was way jankier than this though.

Would love to port some of those game ideas to this platform when you open up the developer platform.

I use Obsidian with a "daily-planning" template that has a bunch of typical journaling prompts. I customize it over time, adding new ideas and removing boring bits.

Current sections are: - Things to remember - List of 10 important quotes/mantras - What's on my mind - How am I feeling productivity/mood wise today - What do I most want to accomplish? - What would make today horrible? - Gratitude - Something Mundane, something that happened by chance, something I made happen

Most programmers want to get some final output, they want the application or game rather than some beautiful code.

Most artists want to create beautiful art, it's a form of self expression. Creating art just for outputs sake without adding love seems cold and capitalistic.

So AI enhances and delivers what programmers want, and diminishes what artists want.

I wonder if it related to those studies showing couples have more of a shared memory, to manage tasks better. When playing memory games they tend to do much better than two strangers placed on a team.

What if this leads to less of a cognitive workout over time vs having to manage everything yourself which increases dementia risk?

I thought he was going to mention the stupidity of sites like Twitter that when you add SMS as a 2FA option you can now use that to bypass the password and so are vulnerable to sim hijacking, which given how incompetent phone company employees are makes your security weaker.

Always use an authenticator app or physical key, most sites that do SMS 2FA will then allow hackers to use it to bypass knowing your password.

This is the same gotcha as "If you like government so much why don't YOU pay more taxes?"

Nobody refuses free government help even if they hate the government, just as no one pays extra taxes even if they love the government. The point is always to distribute their belief more widely so that everyone has to live with it.

It's not like they have a choice. If they don't they have to declare bankruptcy because they can't honor customer withdrawals.

The wallet is a smart contract (specifically a gnosis safe), the malicious message they signed transferred ownership of that smart contract wallet to the attacker so they could then do whatever they want with it.

The contract address will be the same but the transaction address should be different because transactions include the chainid in them. Otherwise you could easily replay transactions on other chains.

Can you link to some sources / information here because I have no idea what you're talking about

Vitaliks intro to ZK snarks article is great: https://vitalik.eth.limo/general/2021/01/26/snarks.html

We're in a very small window in the battle against climate change where people are even allowed to spend money on space programs.

In a few decades at our current rate we're going to see so many natural disasters and mass migrations that the general populace will be far more concerned about food and water for the populace than wasting it on extravagances like space, and then we may end up all dying on this rock.

Once we're able to successfully mine minerals from space and have some hope for colonizing other planets the game changes, because people could see it as a lifeline rather than a waste.

I didn't mention hashes anywhere in this thread, you were the one claiming you can prove someone's age just based on a hash of it (and still haven't shown how other than breaking the hash with a rainbow table).

I posted this earlier (and it's in the article...) but will reiterate again: ZK proofs are used when the prover (server) and verifier (client) don't trust each other and don't want to give each other data on each other. If you trust the server you can just give it a copy of your passport, if the server trusts the client they can just show a checkbox asking if they're old enough.

I linked to a working library earlier, it's here https://github.com/zk-passport/openpassport

Lol, well yea if you throw away the zero knowledge part or trust the client to tell the truth of course you don't need zero knowledge proofs. Its not zero knowledge though (you just gave the server the info) and/or isn't proving anything.

This is the situation zero knowledge proofs are used in:

- The client doesn't trust the server and doesn't want to give it any info (that's the zero knowledge part)

- The server doesn't trust the client (that's the proof part)

If you break them of course the problem is much easier to solve.

If the client trusts the server they can give it a scan of their passport.

If the server trusts the client to run that code then you don't need a proof, you may as well just have a popup that says "are you over 21?"

A rainbow table is just breaking the hash and then you may as well not have it, in the real world the client would add a salt so this isn't possible.

- Do you not understand that client side checks are insecure?

- As you're still not getting it, how about this: This is a sha256 hash of my birthday, write a function that returns if I'm over 21: `1028d7ea22cbbcb17c4926b08b591506227d7b0e32ce6ce76122461e551a5ab2`

- Nothing I've mentioned needs an append only log, where are you even getting that from? A ZK proof is created from only the data stored on the passport chip.

Yea the chip gives the information written on the device. It doesn't answer arbitrary questions about the data.

The whole point of ZK proofs is the zero knowledge part. If you don't care about the person being able to see the information of course there's no need for them.

You think peoples licenses / passports are little computers with API's built into them that return arbitrary information on demand? Over the internet?

> you definitely do not need "ZKPs" to do this trivial task.

You haven't provided an alternative way though? If you're looking for more complicated things they can do see: https://news.ycombinator.com/item?id=41430157

> Yeah you can, you log them in then link them to that userData with an identifier - typically an email address or unique user ID. You can easily write the login API to know nothing but hashes, or you can write it to respond with - to use your example that user's age - if the password is correct (without ever actually knowing the password).

This doesn't make sense, how do you verify someones age without getting their birthday? Hashes are binary yes/no checks, not range checks.

> Anybody can verify any document with enough identifying information about the document and a registry to match it up to.

So your alternate solution is that every government in the world runs an API you can check a passport against? Instead of them just providing a known public key they signed the passport with? Sounds way over complicated compared to a ZK proof.

A more complex way they are currently used is for proving arbitrary computation.

One of the most obvious flaws of blockchains is that every node needs to re-run every transaction to know that the block is valid, leading to the same computation being run thousands of times.

Instead of having to do this there are new Layer2 chains like Polygon zkEVM or zkSync that post a compressed blob of transaction data and a ZK proof that all transactions in that data are valid according to the rules of the EVM. This makes the chain 1000x more efficient as the computation only needs to be run once and verified 999 times.

The proving is still slow and expensive which is why this isn't fully rolled out, but it's getting faster very quickly with both software improvements and custom ASICs for proving.

Yea you can prove you're some set of users without revealing which one.

This is useful in the case of whistle blowing you can prove you do work at a company, or say a US Senator can show the government is up to no good and prove they are a senator without revealing who they are.

What do you mean scoped to a particular proof? There are different proof types like there are different hashing algorithms, they can all prove any data just like sha256 and md5 can hash any data.

How do you verify the password meets certain requirements sever side without getting that user data? Client side input can't always be trusted as anyone can modify that regex check.

Here's a project doing passport verification for services without needing to send them a photo of your passport: https://github.com/zk-passport/openpassport

With something like TLS notary you can prove anything signed by a https certificate, so you can prove there are enough funds in your bank to get a mortgage without revealing how much money you have.

Yea it's the same as a hash collision, maybe they managed to type some other message that hashes to the same thing but it's very unlikely.

You can also use multiple different types of ZK proofs for the same data, same as using multiple hashing algorithms, for more certainty.