bobbiechen

This is generally true of every application that handles sensitive data. Unless you explicitly clear that memory, it's likely to hang around forever.

For example, here is a 2019 writeup from KeePassXC with similar notes: https://keepassxc.org/blog/2019-02-21-memory-security/ - even though they explicitly clear sensitive data, there is still a window of opportunity.

During my time working on confidential computing, we had a variety of demos showing similar attacks against lots of different datastores, scripts, etc. That's just how computers work and your options are very limited if this is part of your threat model (imo just confidential computing and, if you can handle the performance hit, fully-homomorphic encryption).

Surely the prevalence of this saying contributes to the jailbreak's effectiveness.

I called this last year: https://digitalseams.com/blog/the-ai-lifestyle-subsidy-is-go... .

I see it as no different from the previous generation of consumer startups burning money - as Derek Thompson wrote,

> ...if you woke up on a Casper mattress, worked out with a Peloton, Ubered to a WeWork, ordered on DoorDash for lunch, took a Lyft home, and ordered dinner through Postmates only to realize your partner had already started on a Blue Apron meal, your household had, in one day, interacted with eight unprofitable companies that collectively lost about $15 billion in one year.

It's an interesting concept but unfortunately I think the comment is actually AI slop so there's no real story behind it. Check the account history.

If I understand correctly, threat model here seems to be to protect against accidental issues that would impact performance, but doesn't cover malicious actor.

For example, Sketchy Provider tells you they are running the latest and greatest, but actually is knowingly running some cheaper (and worse) model and pocketing the difference. These tests wouldn't help since Sketchy Provider could detect when they're being tested and do the right thing (like the Volkswagen emissions scandal). Right?

I love how many interviews Larry Tesler did (he passed away in 2020), he was so influential and it's interesting to see what that looks like from the inside.

Gypsy (that first modeless editor) recently turned 50 years old and I wrote about it here largely from those first-hand accounts: https://digitalseams.com/blog/the-gypsy-document-editor-cele...

And it's not mentioned in this ACM interview but rather this one with the Computer History Museum https://archive.computerhistory.org/resources/access/text/20... that implementing a modeless editor was easier too, since you could use a simple case-switch instead of having a bunch of explicit modules for each mode.

I was agreeing with you! Though I can see how I came on a little strong there.

It's interesting how many people I know who jump instantly from hobby to thinking about hustling, Etsy, Patreon, fame, etc. and the thought that they'll never be good enough to go pro is a real barrier. You don't need to monetize your joy.

Enterprise userscripts? Very neat, though I wonder if typical enterprise security policies would allow for this.

What LLM tool are you using to write this comment? It must have been really good to lift the stress of _10 years_ of never commenting?

https://news.ycombinator.com/newsguidelines.html#generated

This article is a great example of "strong + weak = weak".

I only made it to the interesting stuff because of Carreyou's name, otherwise I would have stopped.

The email timing and lack of email metadata were also strong, in my opinion. But all of this nonsense like "Wow, these guys both talk about PGP??" distracts from it.

I'm a big fan of Merlin and learning more about its development changed my perspective on software development! I wrote about that here: https://digitalseams.com/blog/what-birdsong-and-backends-can...

I heard an anecdote that Qwen Coder works better when prompted in Korean - haven't tested it for myself though.

I'm sure it's planned. To miss out on the Warren Buffet sale is to miss out on additional revenue on zero COGS, and it's against the goal of individualized pricing to squeeze out all consumer surplus.

I recently wrote about the harms here and it made the front page at the time: https://digitalseams.com/blog/the-behavioral-cost-of-persona...

This is an extension of running untrusted code, except AI agents are basically interpreting everything -> prompt injection.

I'm surprised we haven't _already_ seen a major personal incident as early adopters tend to be less cautious - my guess is that it has already happened and no incident has been publicized or gone viral yet.

Agreed. When I was working on TEEs/confidential computing, just about everyone agreed that FHE was conceptually attractive (trust the math instead of trusting a hardware vendor) but the overhead of FHE was so insanely high. Think 1000x slowdowns turning your hour-long batch job into something that takes over a month to run instead.

> your bank (hopefully) doesn't check with some central database the government controls before issuing you an account.

Hmm... the OFAC SDN and other sanctions lists? Politically exposed persons lists? These are very standard KYC/AML checks.

>I’m going to tell you about how I took a job building software to kill people.

>But don’t get distracted by that; I didn’t know at the time.

Caleb Hearth: "Don't Get Distracted" https://calebhearth.com/dont-get-distracted

Not sure if it's top 3, but I use Monica https://www.monicahq.com/ which does advertise itself as a personal CRM. I certainly underutilize its features but things like birthday reminders + a place for a few notes (where do they live again? who's their partner?) is nice

Being first matters :')

I wrote a font for these, which does use the triangle-5 and the vertical layout: https://bobbiec.github.io/cistercian-font.html (recent discussion here: https://news.ycombinator.com/item?id=46939312)

And my associated writeup: https://digitalseams.com/blog/making-a-font-with-9999-ligatu... .

As mentioned in the blog, I think the horizontal layout makes more sense too (in terms of writing order). But just like the triangle-5, the vertical layout is more commonly seen, so that's what I stuck with.

I like this a lot. I've seen similar categorization demos on things like Hacker News submissions, but categorizing random links from random people is much less useful than finding the relevant functionality from a codebase (that presumably does a thing as opposed to being a collection of random code)

Speed is a courtesy, sure. I think polish for the sake of polish is bad, and the AI powered polishing is worse. See also: https://x.com/ClickHole/status/2020915972979425699

(creator here) +1, the different digits add trivially as you say.

I also thought it was fun that when you overlay digits, you do get 1+4=5, 1+6=7, 1+8=9, 2+6=8, and 2+7=9 . That one I only found accidentally after a bit of playing, so the demo note is more of a fun side note than a really useful property.

Neat demo. I work in this space of bot detection and unfortunately it is trivial to write scripts (or prompt AIs) to insert human-like keystroke and mouse movements. I did so in this demo with about 5 seconds of Cursor use (around 4:25): https://stytch.com/blog/combating-ai-threats-stytchs-device-...

At the same time, I'm sure this still helps against drive-by attackers. For more motivated attackers, it's one more hoop for them to jump through, though you'd want to do some hardening on the client-side script since it's easy to manipulate the Javascript environment.

Edit: I ended up testing it, not bad! The basic script got to about 0.45 in the end, but never was confidently marked as human. With the hint of the 5 metrics in the prompt, a more advanced script did get to 0.63 (human and confident), but that needed the insider information.

Important too, a fully loaded salary costs the company far more than the actual salary that the employee receives. That would tip this balancing point towards 120k salaries, which is well into the realm of non-FAANG

As the joke goes,

Do you think [big tech company] understands consent?

> Yes

> Ask me later

"A new scientific truth does not triumph by convincing its opponents and making them see the light, but rather because its opponents eventually die and a new generation grows up that is familiar with it." - Max Planck

We're full circle to "Programming by Demonstration" (1993) https://acypher.com/wwid/ or Pygmalion (1975), though this iteration probably works better :)

(author here) I believe I had checked first in this case, which is why it was surprising. Sorry not to mention that in the post. This was in San Francisco, and there were multiple cars shown on the map.

In my experience, I usually don't see this kind of price change before the request has actually been confirmed - and I have seen Lyft change the price between showing me the estimate and confirming the request (with an apologetic confirmation dialog, possibly only after some holding period has timed out).

Maybe in my case where the high quote came first, the opposite scenario happened - a glut of drivers appeared between my request and hers, raising supply.

Opaque pricing is powerful partly because we don't know. This enables people to construct a plausible story to explain any price.

https://bobbiechen.com/ https://digitalseams.com/