gsnedders

RSS 2.0 is kinda an unspecified mess, and at least 15 year ago, if you wanted to be compatible with the majority of content you needed some weird heuristics to detect which interpretation of the spec a given feed was using (lol).

And Dave Winer was strongly against ever clarifying the spec, and that’s part of what led to Atom.

Other common approaches:

1. Per capita

2. Per registered vehicle

3. Per trip

All of these have upsides and downsides (as does “per vehicle km”), and all will paint different pictures with different distortions.

https://www.spiegel.de/auto/aktuell/tempolimit-koennte-jaehr... claims a 75% higher fatality rate on unrestricted autobahn v. autobahn with speed limits.

But in general: freeways/motorways (whatever you want to call them) almost never account for the majority of fatalities anywhere — there’s a lot that makes them safer than the average rural road even given comparable speeds, and there’s fewer vulnerable road users around.

At least in SF, there’s both a phone number and a QR code on a sticker on the driver-side window, and per what’s linked from https://waymo.com/firstresponders/ it seems like that’s a dedicated phone line.

I wonder quite what the priority matrix looks like for support requests; I’d expect something like:

1. First responders 2. Human-initiated in-vehicle 3. Autonomous-initiated vehicle

But I of course don’t know.

Buttons are something that seem inherently obviously (both internal and external), but I’m also never sure quite how useful they’d be: a lot of the things that have gathered press have involved vehicles driving when it was unsafe to do so, and then any external button is of minimal use.

I also expect they have some level of concern about anything external having an abuse potential? (e.g., deliberately walk in front of an AV just to stop it in the road)

Something like “give first responders some mobile app which provides some level of direct control” feels like it should be doable (authentication there seems unlikely to be harder than the various “educational” authentication gates that Alphabet has in many products) — though of course that doesn’t scale with more AV operators, and thus maybe this just falls into the category of “this should be standardised” (by whatever SDO).

And some can clearly just leverage existing datasets — many jurisdictions have ways to publish things like “this road is closed from X to Y”, and you can imagine a slightly broader case of “close a radius of Z from point A” being something you might want, especially in the AV case (imagine a “police incident” closing an intersection, such as the one a Waymo drove through a few months ago — you probably want to close a bit beyond the interaction itself in all directions!).

And sure, to some extent things can be handled by AVs getting better at understanding their surroundings, but we’ll always have the question of whether they’re good enough, especially when they fail in non-human like ways.

AS2 was mostly following the direction of ES4 — so it wouldn’t have diverged if it hadn’t been abandoned.

You cannot stop in a cycle lane to drop people off without first driving into the cycle lane.

A few devices do support USB 5Gbps over Lightning!

Also just unit tests in the source files, which again aren’t included in the binary via compile-time flags!

CryptoKit isn't relevant to `goto fail`, which was the origin of this thread, given CryptoKit merely implements primitives and not TLS.

If you really are doubting what gets used for TLS, open up Console.app, start streaming, run `nscurl https://example.com/` (or load it in Safari, etc.), and you'll see logging like:

    default com.apple.network boringssl 18:11:46.229209-0700 libboringssl.dylib nscurl boringssl_session_apply_protocol_options_for_transport_block_invoke(2360) [C1.1.1.1:2][0x1008cef10] TLS configured [server(0) min_version(0x0303) max_version(0x0304) name(redacted) tickets(false) false_start(false) enforce_ev(false) enforce_ats(false) ats_non_pfs_ciphersuite_allowed(false) cc_mode_enforced(false) ech(false) pqtls(true), pake(false)]

It really is boringssl which is nowadays used for TLS by the Network framework.

See e.g. https://developer.apple.com/documentation/network/creating-a... where the logging output makes it clear BoringSSL is what is used.

Or comments such as: https://github.com/apple-oss-distributions/Security/blob/rel...

Unsurprisingly, given BoringSSL doesn't have a stable API (yet alone ABI), it isn't exposed as a system library.

https://docs.tinygrad.org/tinygpu/ are their docs, and https://github.com/tinygrad/tinygrad/tree/4d36366717aa9f1735... is the actual (user space) driver.

My read of everything is that they are using Docker for NVIDIA GPUs for the sake of "how do you compile code to target the GPU"; for AMD they're just compiling their own LLVM with the appropriate target on macOS.

To some extent, that’s just the nature of the incentive structure — you pay money for exploits with no penalty for false reports? Just rely on monkeys typing reports till one happens to be correct.

The other thing is to remember is that when it comes to complex targets, attacks still are found by using a different fuzzer and/or targeting a different entry point.

It stands to reason that the same will apply for LLMs.

Last I knew Opera still had a decent amount of engineering staff in Poland, and still had some in Sweden, both in the EU, plus still has some amount of staff in Norway, not in the EU but definitely in Europe.

That’s not to say their privacy story is fantastic, but they very much still have European operations.

A lot of countries don’t stamp passports — if you can guarantee the entry is immediately recorded in your central database, and you can reliably look up the latest entry for a given passport, a stamp doesn’t really gain much.

ICE’s scope isn’t who is coming into the country — that’s CBP’s scope. ICE’s scope is supposed to be those committing immigration offences who have already entered the country (either because the CBP failed to catch them, or because they were admitted but never left).

The only difficulty justifying this is ICE’s power to stop and question people, and an airport is no different to a random street from that point of view. Do they have probable cause? What suffices as probable cause?

And once you have probable cause, you run into the problem 8 USC 1304(e) creates: someone who doesn’t have documentation proving their legal immigration status falls into one of two categories, they’re either a citizen, or they’re an immigrant violating that section.

(And this is looking at it from a simple legalistic point of view, ignoring any questions about ICE’s behaviour or powers!)

Yeah, this.

In my experience, it’s the relatively basic questions that have the highest value — both because they’re what you run into programming most often, and because they’re less likely to overwhelm candidates in a high-stress setting.

The goal, at least from my point of view, isn’t to see if they can come up with the perfect algorithm, but about how they construct an algorithm, how they communicate about the decisions they’re making, how they respond to challenges about edge-cases, etc.

I’m also strongly in favour of picking out questions that are reflective of the actual codebase they’re being hired for — find something with some basic algorithmic complexity which has a relatively simple and easy to explain input and output, and use that as the problem.

In general, I think the best problems are those which any competent senior engineer could design a good solution for almost off the top of their head with little difficulty.

It’s common enough for groups to not consider the spec done until there is a decent bit of implementation experience (both because actual implementers tend to find interesting bugs in specs, and because many things are hard to measure without any implementation).

What counts as “our cost”? How long it takes to find the MaxSAT?

Beyond the economic arguments, there’s a lot in JS that actually makes it a lot easier: almost all of the operators can only return a subset of the types and cannot be overridden (e.g., the binary + operator in JS can only return a string or a number primitive), the existence of like string and number primitives dramatically reduce the amount of dynamic behaviour they can have, only proxy objects can exhibit the same amount of dynamism as arbitrary Python ones (and thus only they pay the performance cost)…

From when I was working on optimizing one or two things with Cython years ago, it wasn’t per-se the branch cost that hurt: it was impeding the compiler from various loop optimisations, potentially being the impediment from going all the way to auto-vectorisation.

If you send a flag ever, then absence of a flag is also fingerprinting surface.

If you imagine a world where you have a header, Accepts-Adult-Content, which takes a boolean value: you essentially have three possibilities: ?0, ?1, and absent.

How useful of a tracking signal those three options provide depends on what else is being sent —

For example, if someone is stuffing a huge amount of fingerprinting data into the User-Agent string, then this header probably doesn’t actually change anything of the posture.

As another example, if you’re in a regular browser with much of the UA string frozen, and ignoring all other headers for now, then it depends on how likely the users with that UA string to have each option: if all users of that browser always send ?0 (if they indicate themselves to be a minor) or ?1 (if they indicate themselves to be an adult or decline to indicate anything), then a request with that UA and it absent is significantly more noteworthy — because the browser wouldn’t send it — and more likely to be meaningful fingerprinting surface.

That said, adding any of this as passive fingerprinting surface seems like an idea unlikely to be worthwhile.

If you want even a weak signal, it would be much better to require user interaction for it.

One thing that I’ve often seen is models, when very much told to just write a plan, still including sizeable amounts of code in the plan.

Maybe it’s needing to step back and even ask for design doc before a plan, but even then…

While not wholesale replacing it, there already is Swift in dyld: https://github.com/search?q=repo%3Aapple-oss-distributions%2...

Also, as someone on the periphery of Selenium (mostly via WebDriver), some of the challenge is that Selenium has a huge amount of test code already written for it — and making radical API changes would break every test already written for it, and at that point you’re effectively a new library.

It’s gonna be very interesting to watch exactly how the adoption of WebDriver BiDi goes with Selenium, especially once WebDriver Classic starts to go away, and how API stability is balanced with exposing more and more async capabilities.

> Performance isn't all that matters, especially once you have an established codebase and ecosystem.

And this is no small part of why Java and JS have frequently been pushing VM performance forward — there’s enough code people very much care about continuing to work on performance. (Though the two care about different things mostly: Java cares much more about long-term performance, and JS cares much more about short-term performance.)

It doesn’t hurt they’re both languages which are relatively static compared with e.g. Python, either.

Is there any plan about how to deal with indirect prompt injection attacks that could trivially be lurking in malicious web pages, given the agent can navigate to an arbitrary URL?

Is there anything at a protocol level that prevents using a modern font rendering stack for it?

Not just WM/DE, but also the toolkit too.

I mean, you can create alternate APIs that would work for the pop-up use case: you could have a command to create a new window positioned relative to the current window’s coordinate space.

That limited capability still has a risk of denial attacks (just throwing up pop-ups that extend beyond the current window’s boundaries), but those can be mitigated in a number of ways (limit the new window’s boundaries to the current window’s, or just limit how many windows can be opened, etc.).