avemg

Having recently gone through this exercise with our IAM vendor to secure our MCP service, OAuth DCR scares me in that context. With redirect flows, which are usually what you're using when you're plugging your MCP into an agent, the spec says nothing about how to secure that. I really don't want to allow just anybody to register a client with an arbitrary callback. That's opening us up to phishing. Register your client with a malicious callback url and then trick users into clicking a link that initiates that flow. Our legitimate idp will authenticate them and then send then hand their access tokens off to an attacker.

The spec handwaves around this talking about initial access tokens which a client would obtain first in order to register but the details are sparse and probably unworkable when we're talking about every end user being a client.

Ideally i would be able to specify an allowlist of redirect patterns so i could limit it to say, chatgpt or whatever else. But that would be a non-standard behavior so my IAM vendor isn't in a hurry to do it.

This is mentioned right in the article itself.

Yep! Extremely annoying when traveling with my family of four!

Because Etsy is not a general second-hand marketplace. Its niche is artisans making small batch items. And making your own thing at the scale of ebay is not exactly a small feat.

I'm tickled at the idea of asking antirez [1] if he's ever written a PoC for a CVE.

[1] https://en.wikipedia.org/wiki/Salvatore_Sanfilippo

I am going to ask a question that I’m a little scared to ask because I suspect it’s really dumb, but here goes: is it at all feasible or practical to have a way to jettison a runaway battery from the aircraft? I guess most of the time the problems happen because nobody knows there’s a problem before it’s gotten too out of control for that.

it was on a taxiway. The fire truck had to cross the runway to get to it.

Ok thank you. That was the key to my misunderstanding.

I'm familiar with this strategy but there's one thing about it that I don't understand: After death, the loans are an estate liability, right? Doesn't the estate need to be settled before heirs get their inheritance? If i had an outstanding $1MM loan, wouldn't the estate need to liquidate some of that $RIVN at the $67 basis in order to pay the loan? and then whatever $RIVN was left over would go to the heirs at a stepped-up basis?

Jeff Epstein? The New York financier?

Do we need to wait for a tragedy before we do something? Good on the airlines and regulators for recognizing a burgeoning problem and taking action before (hopefully) it leads to unnecessary deaths.

> In reality, it's more like the Fellowship of the Rings trying to make it to Mt Doom, but that realization happens slowly.

And boy to the people making the decisions NOT want to hear that. You'll be dismissed as a naysayer being overly conservative. If you're in a position where your words have credibility in the org, then you'll constantly be asked "what can we do to make this NOT a quest to the top of Mt Doom?" when the answer is almost always "very little".

I'm not an expert on the legal mechanisms but I believe it's a combination of all of those things through a hodgepodge of various local zoning regulations which the article references: limits on the number of unrelated people living in the same home where the limit varies by locality (i've always heard of these as anti-brothel regulations). Limits on number of leases in a single space or requirements for each leasable unit to have its own bathroom and/or kitchen. Requirements that each tenant have their own parking space. Lots of creative ways cooked up by local regulators across the vast USA to discourage anything but single-family homes occupied by single families.

Even what you described (single lease, 4 roommates) is very common and usually allowed but the single lease part is what self-limits the impact of boarding-house type places. You need to find 3 other people to go in on this place with. You need to trust those other people and coordinate lease payments and utility payments and deal with it when some of them to decide to move on. That's a headache!

I think it's well and good to try to address that problem too, but it does seem like a different, although not entirely unrelated issue. What you're describing is already happening now, it's just happening in public spaces (transit stations, parks, etc) where it affects everyone.

How will you know that Bob is typing into it if you're offline?

I take your point, but I think your hypothetical is a wonderful example of Hyrum's Law. And for that reason, if I was going to go to the trouble of mapping my internal v7 uuids into something more random for public consumption, then I'd be sure generate something that doesn't look like a uuid at all so nobody gets any funny ideas about what they can do with it.

I’m a native speaker from the US and I think you’re imagining things. “Try and” and “try to” are completely the same.

I think you should embrace a bit of ambiguity. Don't treat this like a stupid computer where you have to specify everything in minute detail. Certainly the more detail you give, the better to an extent. But really: Treat it like you're talking to a colleague and give it a shot. You don't have to get it right on the first prompt. You see what it did and you give it further instructions. Autocomplete is the least compelling feature of all of this.

Also, I don't remember what model Copilot uses by default, especially the free version, but the model absolutely makes a difference. That's why I say to spend the $20. That gives you access to Sonnet 4 which is where, imo, these models took a giant leap forward in terms of quality of output.

My advice is this:

1) Completely separate in your mind the auto-completion features from the agentic coding features. The auto-completion features are a neat trick but I personally find those to be a bit annoying overall, even if they sometimes hit it completely right. If I'm writing the code, I mostly don't want the LLM autocompletion.

2) Pay the $20 to get a month of Claude Pro access and then install Claude Code. Then, either wait until you have a small task in mind or your stuck on some stupid issue that you've been banging your head on and then open your terminal and fire up Claude Code. Explain to it in plain English what you want it to do. Pretend it's a colleague that you're giving a task to over Slack. And then watch it go. It works directly on your source code. There is no copying and pasting code.

3) Bookmark the Claude website. The next time you'd Google something technical, ask it Claude instead. General questions like "how does one typically implement a flizzle using the floppity-do framework"? "I'm trying to accomplish X, what are my options when using this stack?". General questions like that.

From there you'll start to get it and you'll get better at leverage the tool to do what you want. Then you can branch out the rest of the tool ecosystem.

But I find THAT attitude to be quite rude. You are prioritizing your preferences when it's me that you're reaching out to for help. Nobody's saying you have to write a complete and detailed problem description in your first message, but give me something to know what i'm getting into.

BAD: Hey, you there?

GOOD: Hey, you there? I'm trying to do X but I'm running into some issues and I wanted to get your advice.

Once I've responded and you know you have my attention, then you commit to filling me in on the gory details.

I am going to use this opportunity to ask: Why is that stackoverflow sites absolutely, positively cannot seem to remember my cookie preferences and seemingly ask me every single time I find myself there?

I mean, I agree. My point is just that if you can't be bothered to read the piece but have such an insatiable curiosity to know what it was about, then do us a favor and just dump it into an llm to scratch your itch.

I find two things to be distasteful: 1) Asking others to do the work you're uninterested in doing yourself and 2) the rejection of any kind of stylistic writing as an annoying distraction. I don't know if the person I was replying to is guilty of #2 but I've seen the sentiment a lot here and more frequently than I used to. Not everything is a technical manual that needs to convey its main ideas in as straightforward a way as possible.

This article is a work of art. And I don't mean that in the highfalutin sense. But the style is meant to evoke something just as much as the words themselves. It's fine if it that doesn't work for you, but the goal was not to convey as much meaning in as few words as possible.

I am seeing this kind of comment more and more here and I think it's a trend I would like to see end. That's fine if you don't want to read a long, meandering essay. I myself made it about 30% through and decided I didn't want to finish. But why would you then expend the effort to come here and ask others to do work for you? Paste it into chatgpt and ask it to summarize for you.

As long as you don't care about splitting the wood.

Believe it or not, it’s not easy for many people. Be careful about making such sweeping generalizations based on your personal experience.

I spent years having a negative opinion of that same "new math nonsense"; my only experience with it being viral examples of its worst excesses. But then I had kids in elementary school and saw it up close every day. It was weird and frustrating to me as a child of the 80s, but eventually I came to see that it was teaching approaches to problem solving that I was intuitively using myself. There's still rote memorization involved, but that's not the primary focus. As a result, I think it's better positioned my kids than I was at their age.

Iron and steel? Of course not, go get a cold saw for that. But it's no problem and very common to cut soft stuff like aluminum and copper on a table saw.

Nails alone usually won't trigger the brake. The nail would also have to be in contact with something conductive or else there's nowhere for the current to go.

There are LED indicator lights that flash red when it detects a current drop. When the blade is not moving, you can touch it with your finger to see. In theory you could do this with whatever material you're going to cut. If you're cutting metal, it's pretty obvious that you need to disable the brake system. Usually where it's iffy is pressure treated lumber. Sometimes it'll trigger, sometimes not. Really depends on the moisture content of the wood and that can vary greatly. "testing" by touching the material to the blade with your hands on it might or might not indicate that the brake would fire. The points you're contacting could just not be that wet.

SawStop saws don't cost what they do just because of the brake technology. They're just, in general, even if you took away the safety technology, built to a high end standard. Certainly the safety tech will add to the cost, but probably not as much as you'd think.