cjbprime

Sometimes? If you have enough altitude to trade for speed then after the cutoff you could glide to a hypothetical miraculously-placed runway right in front of you, vs. having fire quickly consume the entire plane if you don't cutoff..

It's not that rare, and there are institutional factors (such as seeking treatment for psychosis being career-ending for a pilot) that incentivize serious pilot mental health crises being untreated.

Not really, though. They're both (retracting the gear, and cutting off fuel) just toggle switches, as far as your brain's conscious mechanisms go. Doing them both on every flight dulls the part of your brain that cares about how they feel different to perform.

(I'm not strongly arguing against the murder scenario, just against the idea that it's impossible for it to be the confusion scenario.)

> There is no possible way to confuse these two actions.

This is obviously an overstatement. Any two regularly performed actions can be confused. Sometimes (when tired or distracted) I've walked into my bathroom intending to shave, but mistakenly brushed my teeth and left. My toothbrush and razor are not similar in function or placement.

> I wonder if a built in delay would make sense for safety.

(Presumably delaying the amount of time before a raging engine fire stops receiving fuel would also have an impact on safety?)

It's not that nonsensical. After it's accessed the private repo, it leaks its content back to the attacker via the public repo.

But it's really just (more) indirect prompt injection, again. It affects every similar use of LLMs.

I don't know that ChatGPT's voice mode is using audio as a transformer input directly.

It could just be using speech to text (e.g. Whisper) on your input, and then using its text model on the text of your words. Or has OpenAI said that they aren't doing this?

Then the malware would provide that confirmation to the wallet too. Defending yourself from malware running on the same (Windows) machine is mostly impossible.

You should try AI sometime. It's quite good, and can do things (like "analyze these 10000 functions and summarize what you found out about how this binary works, including adding comments everywhere) that individual humans do not scale to.

Ghidra's a decompiler and WinDBG is a debugger, so they'd be complementary.

Semiconductor fabs are actually decently large (>20k employee) cities.

It's a British thing -- another example is that Brits would use e.g. "Apple have decided to.." instead of "Apple has decided to.." (for every group of people including "the government", not just businesses).

I like this language quirk a lot. It almost feels subversive, pointing out through grammar that group entities are just people, responsible for their choices like everyone else.

I agree with you, which is why I'm redirecting the blame to the CVSS standard, which does not agree with you.

That's a CVSS issue. Heartbleed only affected Confidentiality, and CVSS rates scores on a triad of Confidentiality, Integrity, and Availability. RCE affects all three.

Looks like it was possible to include the `x-middleware-subrequest` header in your request, tricking the state machine into thinking you'd passed auth already.

(Don't use the user input itself to encode state!)

Could be measurement noise..

The fact that those certificates had been issued without a secure method of verification is the thing that was wrong with those certificates.

Dyndns is not the only use case for having someone control a subdomain without having the full trust of the root domain.

> the incorrect belief that there's some emergency button you can press to demand that a court consider your arguments ASAP

... isn't that exactly the legal button the complainant pushed to prevent the revocation?

(I think Sectigo's argument is that Digicert did not even attempt to convince the court that it should be allowed to revoke those certificates in the mandated timeframe. If they had attempted and failed, I don't think they would be receiving criticism.)

Those companies are always ready to defend themselves in court, and this is a country with extremely strong free speech rights.

> The problem in this particular case is that Cursor is not selective in what env vars are loaded, it serializes _everything_. That seems like an odd choice to me.

If you want to stop it having access to your secrets, that is done by not providing them, not by hoping that it won't access the secrets that you give it. The focus on what Cursor is doing after it already has access that you didn't mean to give it, instead of on what you are doing to provide that access to it, seems the wrong way around.

Env vars are fine for secrets, as long as you provide the right env vars to the right processes. You can unset them before launching a new process, or better still, not "export" the sensitive ones to all processes.

Why do you think it would be? If 200 humans share enough air to dilute the relative concentration of poison in that air effectively, none of those humans will receive lethal doses of poison.

Not really -- the circular dependency issue happened 28 minutes after the customer impact started. That issue was a cause of the outage being double the length it could have been, but not an original cause of the outage.

(iLok has a software-only client that works similarly to the cloud license check-ins you mentioned, it's commonly used by VSTs.)

> variable names limited to two characters

(It sounds like there was a justified reason for that here, though -- the variable names are not minimized during compilation to disk.)

> Something that was very common with BASIC interpreters but still baffling is how they were running on machines with extremely limited memory and fairly limited CPU time, but for some reason decided not to make integer types available to programmers.

To be fair, JavaScript suffers from the same laziness :)

With the current default mobile keyboards, I'd guess it's slower, not faster.

That is not what happened. Carlsen refused to change on the same day because it was "a matter of principle" (his words) -- not because there was insufficient time to.

The US FAA has required 1500 flight hours to receive an ATP (airline pilot) certificate since 2010: https://www.ecfr.gov/current/title-14/chapter-I/subchapter-D...

South Korea requires 250 hours as a country (6x), and Jeju Air specifically requires 300 (5x): https://epicflightacademy.com/hiring-requirements-jeju-air/#...)