cjbprime

You should probably apologize for the suggestion that I am making up numbers.

The US FAA has required 1500 flight hours to receive an ATP (airline pilot) certificate since 2010: https://www.ecfr.gov/current/title-14/chapter-I/subchapter-D...

South Korea requires 250 hours as a country (6x), and Jeju Air specifically requires 300 (5x): https://epicflightacademy.com/hiring-requirements-jeju-air/#...)

It is relevant that the US requires ~6x more flight hours for airline hiring than South Korea, and the accident happened in South Korea, no?

Two people survived it (or at least, they have survived it so far) by being at the tail of the plane as it separated on impact and avoided the fireball, I imagine.

If your engine had a bird strike than the system is already beeping and alerting like hell.

Not every country/airline has "rigorous pilot training and selection" -- US airlines require around 5x the number of flight hours as non-US. There are, generally, not enough pilots.

They probably started trying to go-around (accelerating) the moment they realized they'd landed half way down the runway with the gear up.

The hotel is three minutes away. He wasn't asked to change immediately, but he was asked to change on the same day.

Even Gukesh, crowned world champion recently, says Carlsen is the best player in the world.

Given the other ways he's currently in conflict in FIDE, the idea is that he finds being disqualified in this way strategically useful, and a way to garner public sentiment that delegitimizes them.

There was no time shortage -- he was asked to change with hours to do it and a hotel that was three minutes away. He said he was refusing "as a matter of principle", not that he didn't have enough time to change.

Haven't LLMs simply obsoleted OpenCyc? What could introducing OpenCyc add to LLMs, and why wouldn't allowing the LLM to look up Wikipedia articles accomplish the same thing?

It would have been good to hear about whether there are still any mainstream computer platforms that ship with IOMMU off, since it is the mitigation here.

Any opinion on whether the q4 quantization is stable/effective? That's a lot of quantization.

Edit: Perhaps answering my own question:

λ ollama run hf.co/lmstudio-community/Llama-3.3-70B-Instruct-GGUF:Q4_K_M

>>> Hi. Who are you?

I'm an artificial intelligence model known as Llama. Llama stands for "Large Language Model Meta AI."

(Assuming it's really from them etc.)

If they were this bad at taking responsibility for the stress in their life with regard to you, imagine how bad they were at handling all the other, more basic and visceral, sources of stress they experienced and refused to take ownership over in their life.

They could write a hundred such messages to people they interacted with (and probably did?).

> I ran all the open models (anything not from OpenAI, meaning anything that doesn’t start with gpt or o1) myself using Q5_K_M quantization, whatever that is.

It's just a lossy compression of all of the parameters, probably not important, right?

> I mean, just writing to ~/.bash_profile wont work as i assume it needs to be executable.

It does not. It's an RC file sourced by the shell, not a script.

> It is very rare to get sql injection at the beginning of the query so in practise this usually isn't an issue (although i guess that was your point).

Yes. Would also be required to use these vulnerabilities.

> attach to write a file with a name that is meaningful to something else on your system.

Yes, this is what I meant, e.g. writing to ~/.bash_profile or so. Forbidding queries to do something like this could have a large negative effect on the capability of the database engine to its users.

(Are you sure that SQLite attempts to protect against RCE from an attacker who can run fully arbitrary queries? I would be surprised.)

The work is impressive, but I wish Google wouldn't try so hard to claim to be the world first at everything. This claim feels extremely unprincipled:

> We believe this is the first public example of an AI agent finding a previously unknown exploitable memory-safety issue in widely used real-world software. Earlier this year at the DARPA AIxCC event, Team Atlanta discovered a null-pointer dereference in SQLite, which inspired us to use it for our testing to see if we could find a more serious vulnerability.

Every word in "public example of an AI agent finding a previously unknown exploitable memory-safety issue in widely used real-world software" applies to the Team Atlanta finding that they are citing too, and the Team Atlanta finding was against an actual release version of SQLite instead of a prerelease. If either team has provided the first example of this convoluted sentence, it is Team Atlanta, not Google.

It is possible that they're arguing that the Team Atlanta finding wasn't "exploitable", but this is very debatable. We use CVSS to rate vulnerability impact, and CVSS defines Availability (crashing) as an equal member of the [Confidentiality, Integrity, Availability] triad. Being able to crash a system constitutes an exploitable vulnerability in that system. This is surely especially true for SQLite, which is one of the most mission-critical production software systems in the entire world.

But if we're going to act like we're being very precise about what "exploitable" means, we should conclude that neither of these are exploitable vulnerabilities. To exploit them, you have to provide malicious SQL queries to SQLite. Who does that? Attackers don't provide SQL queries to SQLite systems -- the developers do. If an attacker could provide arbitrary SQL queries, they can probably already exploit that SQLite system, through something like an arbitrary file content write to an arbitrary local filename into RCE. I don't think either group found an exploitable vulnerability.

There isn't that much training data on reverse engineering Python bytecode, but in my experiments ChatGPT can reconstruct a (unique) Python function's source code from its bytecode with high accuracy. I think it's simulating the language in the way you're describing.

The argument isn't that there is something more than next token prediction happening.

The argument is that next token prediction does not imply an upper bound on intelligence, because an improved next token prediction will pull increasingly more of the world that is described in the training data into itself.

Wouldn't it be incredibly misleading to say you can interact with an LLM, when they really mean that you can lossy-compress it to like 25% size where it becomes way less useful and then interact with that?

(Isn't that kind of like saying you can do real-time 4k encoding when you actually mean it can do real-time 720p encoding and then interpolate the missing pixels?)

Does anyone understand this claim from the press release?

> M4 Max supports up to 128GB of fast unified memory and up to 546GB/s of memory bandwidth, which is 4x the bandwidth of the latest AI PC chip. This allows developers to easily interact with large language models that have nearly 200 billion parameters.

Having more memory bandwidth is not directly helpful in using larger LLM models. A 200B param model requires at least 200GB RAM quantized down from the original precision (e.g. "bf16") to "q8" (8 bits per parameter), and these laptops don't even have the 200GB RAM that would be required to run inference over that quantized version.

How can you "easily interact with" 200GB of data, in real-time, on a machine with 128GB of memory??

Right, the nvidia card maxes out at 24GB.

Consider the Lobster is amazing: https://www.columbia.edu/~col8/lobsterarticle.pdf

Oh cool, thanks! TCAS is much more capable than I expected, I thought it was more like a decentralized coin-toss consensus algorithm.

An aside:

> 3.10.1.1 The ACAS algorithms operate in a cycle repeated nominally once per second. At the beginning of the cycle, surveillance reports are used to update the tracks of all intruders and to initiate new tracks as required. Each intruder is then represented by a current estimate of its range, range rate, altitude, altitude rate, and perhaps, its bearing. Own aircraft altitude and altitude rate estimates are also updated.

Words that should probably never appear in technical specifications: "perhaps".

The Cessna probably didn't have TCAS, right? So how did the system know whether to tell the Boeing pilots to raise or lower their altitude? I thought it was a system with a negotiation to avoid instructing both planes to turn the same way.

(Oftentimes part of the reason the huge, fancy cloud setup costs more is that any component can fail, all the way down to the region-level, without loss of service.)

"Unrelated" doesn't sound right. Zendesk refused to pay for the vulnerability, so the researcher used it against downstream customers of Zendesk, who did pay the researcher for the impact of that Zendesk vulnerability against their own company.

That doesn't sound right. Aren't these @zendesk.com addresses?