I still don’t know why there is the settlement process. If it was just a row in the database that this person has N dollars, why isn’t that enough?
6,596 karma · joined October 19, 2013
> Range Anxiety: Yes, it's overblown, but no, it's not non-existent. The day I bought my used EV, the dealership (which doesn't sell many EVs, even new) didn't have a 'Level 3' DC fast charger—and they had only charged it to about 16%. Letting it top off at L2 while I was dealing with finance, we got to 23%. I wasn't quite sure I'd make it home off the lot! Luckily I did, with 12 miles of range remaining.
And it’s better to let each commit merge down one by one in the stack versus squashing so people can follow your development process via that stack after the fact.
Comment about expert was made off hand. If common flows break with GitHub, people are going to be hesitant to use a new tool, hurting adoption. Again, given this is a for beginner tutorial. But you make a good point about not being too sensitive ;)
That makes the ratios of crawl to referrals shown suspect.
Parlays play in that space too where the allure of a high payday keeps people hooked. And with single-game or in-game parlays, people can speed-run their money losing.
What’s the best way to represent a stack? How do you model jj’s editing a commit at the bottom where everything above implicitly rebases when pull requests are open?
One of the most intimating things is fumbling around with your vcs when an expert is reviewing your code.
It’s for other branches that hang off the commit that introduced the conflicts.
It seems like not running it at package install time doesn’t afford that much protection.
> Anthropic says it hopes to use this research preview as a chance to catch and address novel safety risks; however, the company has already introduced several defenses against prompt injection attacks. The company says its interventions reduced the success rate of prompt injection attacks from 23.6% to 11.2%.
A user of chrome can know, barring bugs that are definitively fixable, that a comment on a reddit post can’t read information from their bank.
If an LLM with user controlled input has access to both domains, it will never be secure until alignment becomes perfect, which there is no current hope to achieve.
And if you think about a human in the driver seat instead of an LLM trying to make these decisions, it’d be easy for a sophisticated attacker to trick humans to leak data, so it’s probably impossible to align it this way.
That said, it’s definitely the best approach listed. And turns that exploit into an XSS attack on reddit.com, which is still bad.
“In our analysis, we came up with the following strategies which could have prevented attacks of this nature. We’ll discuss this topic more fully in the next blog post in this series.”
The browser is the ultimate “lethal trifecta”: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
Giving an LLM’s agentic loop access to the page is just as dangerous as executing user controlled JavaScript (e.g. a script tag in a reddit post).
It’s actually worse than that though. An LLM is like letting attacker controlled content on the page inject JavaScript back into the page.
LLM within a browser that can view data across tabs is the ultimate “lethal trifecta”.
Earlier discussion: https://news.ycombinator.com/item?id=44847933
It’s interesting that in Brave’s post describing this exploit, they didn’t reach the fundamental conclusion this is a bad idea: https://brave.com/blog/comet-prompt-injection/
Instead they believe model alignment, trying to understand when a user is doing a dangerous task, etc. will be enough. The only good mitigation they mention is that the agent should drop privileges, but it’s just as easy to hit an attacker controlled image url to leak data as it is to send an email.
With a subscription plan, Anthropic is highly incentivized to be efficient in their loops beyond just making it a better experience for users.
Then add a grader step to your agentic loop that is triggered after the files are modified. Give feedback to the model if there any errors and it will fix them.
“After my failed custom image attempt, I found a promising XFCE-based Debian image on Docker Hub. I downloaded it in minutes and, with a few commands, launched it. When I opened the URL, I was greeted by a fully functional Linux desktop, running right in my browser. The pure geek joy of seeing a complete OS served from inside a Docker container was a feeling I won’t forget. It worked”
And on Windows, docker for Linux containers is just a VM, so this part isn’t really true:
“Containers are not isolated Operating Systems: Docker containers share the host kernel. This is what makes them lightweight and great for single services. Whereas desktop environments expect system services like (systemd, logind, udev, DBus) and device access to be available. Containers don’t provide that by default
“ The union took CBA to the workplace relations tribunal earlier this month as the company wasn’t being transparent about call volumes, according to a statement Thursday from the Finance Sector Union. The nation’s largest lender had said that the voice bot reduced call volumes by 2,000 a week, when union members said volumes were in fact rising and CBA had to offer staff overtime and direct team leaders to answer calls, the union said.”
Their original owners also sold the site.
But it’s great point that you need context to be sure.