Thanks. (4) is the critical piece here.
793 karma · joined September 13, 2023
Thank you! This is not only good to know as an ngrok user myself, but it's also more informative than what's in the article.
Sounds like we can rule that out as the avenue of detection.
Does the Microsoft store imprint an identifier into the network traffic of all the binaries downloaded from it?
And if so, how?
All of ngrok's traffic is TLS encrypted which means that only the client software and the server/peer should be able to decrypt or modify it.
Exactly how does Microsoft's device identifier get associated with the ngrok session (normally initiated via its closed-source CLI)?
I can't tell from the article whether Microsoft is doing something underhanded to inject its device identifiers into network traffic, or whether the ngrok client software (again, closed-source!) grabbed the device identifier… and might well do the same on any other OS, using /etc/machine-id on Linux for example.
Since ngrok uses a "freemium" model, it wouldn't surprise me at all if its clients send machine IDs to try to catch users trying to get around its free limits.
Canada is lacking in large domestic cloud providers and Canadian companies often use the default US regions of public clouds (e.g. AWS us-east-1) rather than Canada regions (e.g. ca-central-1).
And even fewer who are single and childless. (Google would likely go after the estate of anyone who did this.)
Man, I just. don't. care.
Why should I worry about this hypothetical future dystopia, which seems to me incredibly unlikely to come to pass, rather than the glaring and terrifying current dystopia being enacted by Donald Trump in the USA?
A couple months ago, I started using Claude for some tasks related to processing really messy data. Our company was making a big push for its use, and a co-worker gave me a fairly impressive demo of what he was able to do with this data in an hour or two.
Our company's Claude subscription defaulted to Opus 4.7 and we were encouraged to use it as much as we could.
I don't think I ever did more than 10 or 15 prompts in a day; I tend to do very detailed prompts and then spend 10-30 minutes playing around with the results and resulting code.
Today we get this:
> TL; DR: We're nearly at NNN Claude users and growing fast. Three quick asks: (1) default to Sonnet for everyday work; we have launched XXXXXXX to help with clarity, …
> …
> As we scale, let's be smart about how we work. Claude offers several models, and for everyday work — … — Sonnet is your go-to.
My hat's off to swelljoe.
This part was especially interesting:
> The cheap Chinese models kick ass. MiMo and DeepSeek are directly competitive with Opus 4.8 and GPT 5.5 at roughly an order of magnitude lower price. There have been accusations of “benchmaxxing” with the Chinese models, but I don’t think there’s any reasonable way for the models to already be tuned for these very recently disclosed bugs. I think they’re genuinely becoming competitive with the frontier from Anthropic and OpenAI. If you’re in a hurry, DeepSeek was the fastest, on average, while finding 4/9 bugs. And, if you’re cheap, MiMo found bugs as well as any model for the lowest price.
So I presume there were several revisions or additions.
I had this book when I was ten years old.
I learned a lot from typing and trying to modify the BASIC games in it. I went on to learn C and many other programming languages, and to use them professionally and otherwise for decades.
How would I learn anything at all from untested, machine-generated C translations of them?
This is practically the definition of AI slop, to me.
If you ask humans to write 1,000 books, you're asking 1,000 different humans with different experiences and different skills and different moods (etc.) to write those books.
But if you ask LLMs to write 1,000 books, you're probably only talking to 3 or 5 different models, tops. And they've all trained on the same or similar data, and are trained to respond in very similar ways.
The LLMs don't differ much in anything like "life experience" or "skills", and they don't really have anything like a "mood" independent of the prompts you've given them.
You want me to have email and teams/slack on my phone? Sorry, I won't install the spyware. Want to pay for me to have a second phone with it? Okay. No? Well then, I just won't have email on my phone.
On the Nexus 5, you could just `fastboot oem unlock` right out of the box, install TWRP (custom "recovery") and install CyanogenMod/LienageOS, without ever booting the stock ROM.
On my Moto G4 Play and Moto X4, you had to get an unlock code from the Motorola website (based on the phone serial number I think) and waive some warranty terms, but once retrieved at least the phone didn't need to be online to unlock the bootloader.
The process on the newer Pixels is disappointingly intrusive, like basically everything Google has done for the last decade.
I don't understand this argument.
SpaceX is not being "excluded" for any exceptional reason.
S&P has stated, essentially, that SpaceX will be subject to the same INclusion rules as other companies. When (if!) SpaceX has a series of profitable quarters and reaches 50% free-float market cap, it will be included in the S&P 500 index like other companies are. https://news.ycombinator.com/item?id=48414252
Here I once again agree with you in part, and disagree in part.
The S&P 500 should reflect the actual market. That is, the actual market of publicly-traded companies with legal requirements for transparent accounting and reasonable expectations of future positive cash flows.
As you wrote yourself (https://news.ycombinator.com/item?id=48408363), "These [mega-cap IPO] companies will likely never meet S&P profitability inclusion criteria for the next 5 years."
At this point in time, I don't think it's reasonable to expect future positive cash flows from SpaceX or Anthropic. There are indeed some reasons to suspect that there won't be future positive cash flows from them.
> Because the index needs accuracy. If a company is 1-2% of the total US market cap and not included in the index, then the index is wrong right now. The longer this company is not in the index, the longer this error compounds. In the coming few months, multiple giga-cap companies (SpaceX, OpenAI, Anthropic) are all planning to IPO.
I'm nodding vigorously on this part:
> These companies will likely never meet S&P profitability inclusion criteria for the next 5 years.
But here, you lose me…
> These are not bad companies, but because the S&P inclusion criteria were written for old GAAP profitable companies, and not high-growth companies that invest their cashflow into company growth over profits. Excluding some of the most civilization changing companies from the benchmark means the benchmark is doing a terrible job.
The point of investing in a total(ish) index of the public stock market is to invest in companies that have a reasonable expectation of net-positive future cash flows, justified in part by legally-mandated transparent reporting of their finances.
You can't just buy every publicly-traded stock though: for one thing, that would massively incentivize obvious scammers to do the bare minimum to get their stocks included, and drag the index down. Avoiding companies that are illiquid, non-transparent, or lacking in a clear track record is important. The SpaceX IPO bears more than a passing resemblance to a pump-and-dump scheme:
1. SpaceX's line of business* is tremendously unclear.
2. SpaceX doesn't actually need external capital to fund its operations.
3. SpaceX is floating only a tiny fraction of its putative market capitalization.
4. The main purpose of the IPO appears to be to allow insiders to cash out.
5. The way the lion's share of the IPO gets sold is if large index funds and pension-holding companies demand shares, and that only happens with the index-inclusion exceptions we're discussing here.
So, we agree that these "mega cap IPO" companies won't be profitable in the next 5 years. That's a huge period of time. How can public markets accurately value a company that isn't expected to be profitable for such a long period of time; there are so many things that could change their trajectory towards profitability, all the more so if we accept your premise that these companies are "civilization changing."
My conclusion is that it's perfectly fine, even beneficial, for indices like S&P 500 to avoid any special treatment for these companies. If SpaceX is clearly profitable 5 years from now, and has reached 50% free-float, that seems like a good time to start including it in the index.
---
* Nearly all of its revenue comes from launching satellites and running a satellite-based communications network, but much of its putative valuation comes from a hastily glommed-in also-ran AI company, and its association with a person who is famous for running other businesses and for political connections.
It doesn't eliminate the need for the fund to rebalance, because of companies moving in and out of the index criteria.
But it certainly vastly reduces the need of the fund manager to trade.
(Also, stock buybacks and new share issuance should in principle not change a company's index weight, but in practice they sometimes do.)
https://www.wsj.com/tech/ai/anthropic-urges-global-pause-in-...
There's an obligatory xkcd about this: https://xkcd.com/1301/
> The Gnutella project began as an internal demo that leaked to the public after its corporate overlord, AOL, cancelled the project.
I don't think it was actually a leak in the usual sense of the word. There was no unauthorized release; rather, AOL didn't really understand what their new subsidiary was releasing.
As I understand it, Gnutella was written as a new project by Justin Frankel, the author of Winamp (which probably did more to popularize using computers to listen to music than anything else!), during or shortly after the sale of Winamp and Nullsoft to AOL. It was probably a chaotic time, and a massive culture clash between this big behemoth of a late-'90s tech and communications company, and this small startup of Early Internet Nerds.
Nullsoft's new corporate overlords probably didn't understand what they were creating: a new file-sharing/music-piracy program that would be like Napster, but more decentralized and resilient.
Frankel/Nullsoft released Gnutella and it was downloaded by thousands of people immediately. Perhaps friends in the recording industry called AOL execs, or in some other way they finally understood what it was, and AOL shut down the downloads less than a day later and cancelled the planned open-source code release, but due to its decentralization the network kept running, and it was soon reverse engineered.
As far as I know, the source code of the original Windows implementation of Gnutella never leaked.
Are you being sarcastic?
It's literally mentioned in the first sentence of the article, as well as the subheading.
Even aside from out-and-out spam one of the extremely frustrating things about Google's AI overviews, compared to traditional search, is that the results are presented as coherent verging on authoritative even when they're not.
If you do an "old-fashioned" (udm=14) Google search for, let's say "vendor scsi commands appotech USB NAND flash chip": https://www.google.com/search?q=vendor+scsi+commands+appotec...
… you'll see that there are only a few links, and a lot of them are people who are trying to reverse-engineer the devices' behavior, and uncertain or confused about what they're doing. You get instant feedback that you're looking a dark corner for something that has little public documentation.
If you remove that `&udm=14` and look at the AI overview, Google gives you a confident-looking reply about available tools and techniques, even though some of what it links to are bit-rotted Russian-language forums and file download sites, and other places that likely won't solve your problem in a straightforward way… because that's all that's available for Google to mine.
These seem like the normal ways that an open-source project fades and dies.
There are also several routes by which a project can be revived and reinvigorated. One of my favorites, because it's so obscure and also because I started the Wikipedia article on it, is https://en.wikipedia.org/wiki/Slirp#User-space_networking_an...