mike_hearn

But that wouldn't work, right? If the proxy is on another server then editing their own /etc/hosts wouldn't change the proxy's behavior. So the proxy has to be colocated and reading the same /etc/hosts that they're editing. But that would mean it's running within the same userns/pid domain as the agents, so at that point they don't even need to edit /etc/hosts, they could just use the network directly.

And the agent says ABS is not handled by the proxy, it's listed in NO_PROXY so they should connect directly.

At any rate it's easy to let agents install packages without giving them root. I use a small SUID binary that just invokes `apt install` after checking that the given argument isn't a file path, which I think is sufficient (using sudo to whitelist a prefix allows an agent to create a .deb themselves and then install it directly via apt, similar issues exist for other package managers).

Are we sure that's what they did? How does this even work? I'm struggling to understand what sort of HTTP sandbox design could lead to this "exploit" actually functioning. It implies the agents have root on their own machines, which seems way over-privileged for the question answering task they were given... so surely that's not deliberate? Did the models use local root exploits? And then it suggests they can open TCP connections to any IP address without issue once DNS is bypassed but what exactly are they bypassing here? Azure Blob Storage being in NO_PROXY implies IP addresses of other parts of the internet should be blocked outside their hosts to force them through the HTTP proxy, but then, apparently it wasn't?

The more I think about this thing said by the agent the more confused I get.

They're paid so much either because they're the company founders, and so they kept a part of the value of the whole company they created. Seems fair.

Or because being a (well known) CEO is a terminal career position. It's a bit like being a top sports star. The wages are high because once they're out, they're out for good. Whatever they earned needs to last them a long time. Screwing up in the CEO position is, when boards are doing their jobs at least, pretty much the end of the road for them because nobody wants to hire an ex-CEO into a middle management or IC position.

Random example: Marissa Mayer. She did well at Google, but once she became CEO of Yahoo! and failed her career was effectively over. Since then her career history is: did a startup with a friend that produced an iPhone app for cleaning your contact lists, and later a photo sharing app. I guess she's nice and pleasant enough, so she also did the usual post-CEO thing of sitting on a few boards, NGO work and investing. It's not a bad life. But in terms of actually running things that matter again - no.

Lots of cases like that.

Who wants to sign up for a job that's high pressure, high hours, and will probably the last real job you'll ever have, and one where your success is often entirely out of your hands? Not that many. So the pay has to be good.

I feel like we read different blog posts. The announcement shows Astra filling out a tax form, looking for a kindergarten and apartment hunting. These are ordinary everyday tasks for normal people. It also shows lots of non-consumer stuff like financial modeling, genetic sequencing analysis and coding.

It won't happen overnight. Social change is constrained by integration speed. The average enterprise has many tasks that could be automated by models for several years already, yet they remain stubbornly unautomated. The reasons are primarily social:

• Lots of people aren't aware of what the models can do.

• They also aren't paying attention, and getting their attention is hard.

• Their impression of AI was formed by cheap low quality AI like free ChatGPT as of two years ago, Google AI overviews or Microsoft Copilot. So they think it sucks.

• A LOT of executives got burned by early pilots that overpromised then failed. Enterprise IT is a wasteland of dead AI pilots.

• Their IT systems are difficult to connect to models because they lack proper APIs or auth systems. Note the huge emphasis on fast computer use in the Astra announcement. A lot of work can only be done by clicking things.

• Executives don't want to let employees go, but aren't sure they can find new work for them either.

The last point is worth dwelling on. HN is full of socialists who imagine corporate executives as cigar smoking top hat wearers who chuckle all the way to the bank. The reality is more mundane: most executives don't want to lay people off and will fight hard to avoid doing so.

The average person in a position to make an AI project work either isn't incentivized with stock - this is often the case outside the US even for quite high ranking execs - or they are but don't believe laying people off will raise the share price enough to be worth the pain.

Also, executives often measure their success and self-worth by how many people report to them. Laying off half their department, even if it gets them a monetary bonus, would lead directly to a loss of social status as they can no longer say they manage 1,000 people but only 200, which matters if their social circle are all managers too (and for their wives, girlfriends, etc).

Layoffs suck and people HATE doing them, which is why companies often resort to forced percentage based layoffs to get managers to do it. If the incentives aren't there, the average executive will just sit on obvious AI deployment opportunities and/or deliberately sabotage them because getting rid of people is just all downside for them with no upside.

So institutions have enormous inertia. Model capabilities will run far ahead of what is actually used in reality, and this will continue for decades. It does mean that startups have a better chance than ever of outcompeting much larger incumbents though, as not hiring is far easier than firing.

If anyone is puzzled what this is about, Silo is an Apple TV sci-fi show set in a giant underground survival bunker of some kind.

However, the bunker is filled with strange mysteries. The people inside have lost all connection to the world before they entered. They don't know what disaster befell the outside, or why people die immediately if they go through the airlock. They don't know when it will be safe to go outside. They aren't even sure what AD year it is, or how long they've been inside, as the Silo population marks time in "years after the rebellion". And their lives are dominated by weird unexplained rules found in a book called the Pact, rules like it being illegal to create elevators, so they have to schlep up and down 144 levels of a mile deep cylinder via a giant spiral staircase. Other rules include a ban on magnification beyond a certain level, and keeping any objects from the "before times" - which are called relics and destroyed on being discovered.

The show (and book series on which it's based) follows the inhabitants of Silo 18 as they try to figure out the mystery of their own existence.

It's pretty good, probably the first mystery box show I've seen where they actually answer questions at roughly the same rate they raise them. The show is four seasons, all already produced, and no more, so you do have confidence that the show knows where it's going and the story will have a satisfying end.

The website is showing a rough mockup of the silo with the different locations seen in the show, but be warned if you haven't watched it - the website is designed for show viewers and there are spoilers in the text.

It kinda needed suspension of disbelief, but not too much! I blogged at the start of 2017 a comparison of Westworld's hosts with what existed in the research literature at the time. Even got it reviewed by Alex Graves at DeepMind :)

https://blog.plan99.net/the-science-of-westworld-ec624585e47

I think he worked on Sawmill, where he developed a language that looks superficially a bit like Go called Sawzall. Sawzall seems to have been open sourced at some point.

It's got some common syntax similarities like using `a := b` to mean creating a new local variable of inferred type.

https://github.com/anthonyu/Sizzle/blob/master/docs/sawzall-...

Data Colada is a handful of volunteers who do this kind of thing as extra-curricular activities, and rely primarily on tips. That is a tiny drop in an ocean of fraud, for which the institutions get no credit at all. Academic institutions don't systematically check for fraud, but they do systematically ignore fraud reports that come from outside the academy (of which there are many).

Yes, it's true. No more firewalls. Go read the article I originally linked, here it is again:

https://apnews.com/article/science-business-arts-and-enterta...

Some key paragraphs are:

> The Associated Press said Tuesday that it is assigning more than two dozen journalists across the world to cover climate issues, in the news organization’s largest single expansion paid for through philanthropic grants.

> The grant is for more than $8 million over three years, and about 20 of the climate journalists will be new hires. The AP has appointed Peter Prengaman as its climate and environment news director to lead the team.

> For many years, Journalists and philanthropists were more wary of each other. News organizations were concerned about maintaining independence and, until the past two decades, financially secure enough not to need help. Philanthropists didn’t see the need, or how journalists could help them achieve their goals.

> Nonprofit news organizations like ProPublica and Texas Tribune led the way in changing minds. The Salt Lake Tribune, which in 2019 became a nonprofit to attract more donors, and The Seattle Times are other pioneers.

> “As far as we’re concerned, it has been really seamless,” said Monica Drake, assistant managing editor at the Times. “It has allowed us to focus on things we want to cover and to do it independently.”

> Both sides had things to learn. For Carovillano, it was getting used to the idea that funders weren’t just being generous; they had their own goals to achieve. “This is a mutually beneficial arrangement,” he said.

> “I feel like our language has gone from people talking about local news dying to there being a renaissance of local news,” she said. “If you can provide good, high-quality journalism, people are willing to pay for that, people are willing to support it. I think there’s a lot of room for optimism. The trick is, can we move quickly enough?”

The article leads with climate grants but is really about the phenomenon in general, which covers many topics.

The quoted journalists are duplicitous, trying to reassure themselves. The text says that what they're doing used to be taboo because rich guys had "goals to achieve", but now it's considered "pioneering" and "mutually beneficial". Their justification is they didn't have any money and felt sad, but now they've got lots of money and are happy. They say the transition has been "seamless", i.e. readers aren't aware of it. And hilariously, at the end Carivillano claims there's room for optimism because people are willing to pay for high quality news - except "people" aren't paying, that's the reason they need to take money from a handful of donors.

It's obvious this compromises their journalism, especially in the stories they don't publish. These news orgs have basically been bought by the donors, large chunks of their staff only exist because of these grants. Thinking it doesn't compromise their news would be like saying Facebook simply buying all the news teams that cover the internet wouldn't have any effect.

If you target cross-platform frameworks that don't require Apple's toolchain, it can be made to work. For instance if you write an Electron or JVM app for the desktop then Conveyor can ship it from anything, because all the native components come pre-compiled in that case. But I don't think many people are writing mobile apps in that way.

I think ads were better because everyone was aware of the conflict of interest issues and took steps to manage it. They admitted it could be an issue and would have internal firewalls where ad sales weren't allowed to talk to the journalists, things like that. Advertisers accepted it because their goal wasn't to manipulate news reporting.

The problem with the "philanthropic" funding is not only is there no firewall, but it's explicitly pay-to-play agenda pushing. So that culture of keeping revenue and news separated has vanished without the public being made aware of it.

The right wing are saying things like, journalism is fake because they're just pushing a left wing agenda for money. That's the claim that delegitimizes journalism. But it turns out that the rightists are correct and that's exactly what journalists are doing, so it's hardly their fault that mistrust was created and cultivated. You should mistrust people who mislead you about their agenda, and if you go to the AP website today and look at some random article paid for by these grants there's no mention of where the funding comes from. Actually you get a popup begging for donations, saying that because the AP is a non-profit it's extra trustworthy.

If they want to regain trust, a good start would be by refusing to accept money for stories, relabelling all the stories where they did that, and then pay for journalism purely out of subscription revenues or ads brokered through exchanges (i.e. where the advertiser doesn't have any contact with the publishers).

Most of the problems are with academic fields that were barely funded before WW2.

Right, it's meant for portable desktop apps. You have to compile iOS apps on a Mac anyway so I'm not sure there'd be any demand for Conveyor's cross-building support for iOS apps.

Feel free to not engage, but for anyone reading the Nepal flash flood was caused by bedrock giving way, which isn't climate related.

https://www.theweek.in/news/world/2026/08/28/new-satellite-i...

The two links I give show the problem in action. In 2013 the IPCC was concerned because temperatures had gone sideways for a decade. Der Spiegel's first sentence is "Data shows global temperatures aren't rising the way climate scientists have predicted" and the next says they were trying to "hush it up". In 2015 climatologists announced a new temperature record that replaced the entire 21st century with different data, as reported by Nature.

That's an unambiguous sequence of events. You can't make statements about replicability in an environment where they routinely decide their already published data is wrong post-hoc, without retracting the papers built on that data.

Peer reviews don't appear in Google Scholar.

The involvement of governments is when they force the public to pay for the studies via tax funded grants, without caring about the quality.

You're right that we don't need a universal definition of hamburger. That's because the government stays out of it, so private individuals can use things like Google Maps reviews to police a common sense definition of hamburger along with quality and other nuance.

If governments were forcing everyone to buy anything advertised as a hamburger no questions asked, then the definition of hamburger would matter a lot.

The devices on my desk are 99.9% the product of the private sector and owe nearly nothing to academia.

If people can't define it, then that seems to me like a valid criticism of the scientific method. You can't have institutions that claim to be doing science if they don't use the same definition of science as other people do.

Replicability isn't enough to be scientific. Many studies have invalid methodologies, so replicating them by following the same method just propagates wrongness and makes the problems worse. And if you don't follow the same method the original authors will claim it's not a replication study.

https://blog.plan99.net/replication-studies-cant-fix-science...

My proposal is: let science be done by those who need its results to be correct.

Disagree, those two fields are extremely unreliable. It takes a lot of things happening simultaneously to be scientific. Yes, those two do make testable predictions, sort of. But that isn't enough.

Modern (computational) epidemiology is rife with unscientific practices. They ignore data that shows a model was invalidated so the fact they make testable predictions isn't really useful. They also engage in a lot of circular reasoning, buggy coding and logical fallacies. During COVID I wrote a whole report on this topic for some politicians [1]. But the biggest issue is "A problem in theory" again - epidemiologists conflate fitting a curve in R with developing a hypothesis, so the field is overrun with overfit models that aren't based on any refinable theory of disease, just misuses of statistics. Even if you prove a paper's predictions were wrong it changes nothing because nothing built on it anyway.

The problem in climatology is that when the models don't fit the data they just change the data and claim victory, e.g.

September 2013: https://www.spiegel.de/international/world/climate-scientist...

June 2015: https://www.nature.com/articles/nature.2015.17700

[1] https://plan99.net/~mike/epidemiology.pdf

You can ship a fully signed and self-updating macOS app from Linux (or Windows) using my product Conveyor:

https://hydraulic.dev/

It has built in support for Electron, JVM, Flutter and even native apps (although of course then you still have to compile the native binaries on macOS yourself).

That also works the other way around. You can ship to Windows from Linux or macOS.

It's more that Darwin does. A fat binary is just two independent Mach-O binaries concatenated with a small header.

Only if the study matches its pre-registration and someone is checking that. Which it turns out, they often don't.

https://www.compare-trials.org/

They might not care even then.

Journalism is an interesting case study. Their revenues went into sharp decline around the start of the century, dropping by more than 50% in some cases. Concurrently polls showed trust in journalism was plummeting, that people were tuning out because they felt that what they read wasn't reliable.

Journalism didn't solve this problem by rebuilding trust and their audience. Instead they started reforming as non-profit institutions and taking huge payments from philanthropists to push specific agendas, without alerting readers to that fact.

https://apnews.com/article/science-business-arts-and-enterta...

These grants aren't tied to readership but rather to the content of what's published, so they can produce lots of articles even if nobody reads them. Those articles are then used as "reliable sources" to control Wikipedia, and from there what search engines and LLMs say.

If students start checking out at scale (already happening), or if governments cut funding (already happening in the USA), their most likely move is to just replace the revenue with money from the Gates Foundation et al, and keep going just as they are. Their primary role will switch from education or research to the propagation of approved narratives.

You'd think so. I used to believe this too. Surely you try and build on a result which creates an implicit replication study, then your experiments don't work and the problem is discovered pretty quick. Hence, self correction.

It often doesn't happen. The reasons seem to vary by field. We do see it in a few very hard fields like materials science.

In the softer end of social sciences like anthropology, education or the humanities it's obvious why not: they don't make empirically testable claims about reality anyway so there's nothing to replicate. This is the Arday problem, where he was publishing what they call auto-ethnography: effectively just blog posts about the author's own feelings. He even interviewed himself in the third person.

In the harder social sciences it's because nothing actually builds on anything else (see "A problem in theory" [1]). Psychology and related fields like sociology, criminology, etc are basically just a pile of random ideas pooped out in brainstorming sessions. There are hardly any overarching theories generating testable predictions, so studies test whatever random claims the researcher thinks is interesting enough to get in the news. Everything is just rocks lying on the ground rather than towers of understanding, so when one paper is overturned it has no impact on anything else. Citation counts obscure this fact, but do some reverse-citation checks and you'll find a lot of citations are worthless or outright invalid.

In modeling based fields like economics, epidemiology or climatology, it's because they can't put the thing they study in a lab and do high speed experimentation. "Replication" comes to mean repeating the same analysis on the same data set. Often they literally just run the same program on the same input file, get the same result and call it replicated - or sometimes they call it replicated even if the outputs don't match! See [2]. But the program is just a set of assumptions, not real discoveries, so building more papers on top of that program's output doesn't detect invalidity. It will all replicate in some very narrow technical sense without that proving anything useful.

Sometimes outsiders notice what's happening but over time academia has built up a complex web of lore that protects them psychologically. For example, they routinely reject or ignore feedback from outside their field on the basis that it doesn't come from "experts", meaning themselves, or it comes from "right wing" people, meaning anyone who isn't an academic or close political ally.

[1] https://www.nature.com/articles/s41562-018-0522-1

[2] https://dailysceptic.org/2020/05/06/code-review-of-fergusons...

In this case even emailing the author didn't work. The data was obtained via some roundabout method.

But it's not the real reason IMHO. You could use LLMs to write takedowns like this one. I gave ChatGPT the paper PDF and some neutral prompts. Although it didn't go straight to 'this is clearly fraud' - it's too nice for that - it did compute and point out the absurdly huge effect sizes, and give a relatively low confidence the paper's central claim would replicate.

The real reason there aren't bots systematically destroying papers is because universities defend fraud, they don't punish it. You'd just be burning tokens to reveal lots of fraud with no outcome.

Replication is overrated. There's no point in doing more of it. You'd just replicate a ton of bad science:

https://blog.plan99.net/replication-studies-cant-fix-science...

N.B. nobody needed to replicate this study. It only took basic sanity checks to spot that it was very unlikely to be true (and thus, very unlikely to replicate). And they went much further than needed. They could have stopped at "the claimed effect is much larger than the height difference between men and women". This obviousness is a common pattern:

https://www.fantasticanachronism.com/p/whats-wrong-with-soci...

> Prediction markets work well because predicting replication is easy. There's no need for a deep dive into the statistical methodology or a rigorous examination of the data, no need to scrutinize esoteric theories for subtle errors—these papers have obvious, surface-level problems.

So you could also say, how do we change the incentives to get people to peer review properly? That would be a lot cheaper.

The obvious solution is for people to get paid to audit work professionally, and be fired if they sign off on bad results. But that exists already, it's called a corporate lab. Managers are incentivized by carrots and sticks to properly understand what their researchers are doing and if anyone is doing fraud they will be fired, maybe prosecuted. Universities don't do this because so much of what they do exists purely to spend money, with no higher purpose. There's no specific goal or outcome they're trying to achieve, and so no reason to do unpleasant things like enforcing incentives to get there.

So in the end the solution is just to defund university research. The social structures are fundamentally unfixable. You'll never get people to care if the only purpose of their job's existence is to convince voters governments are funding science.

Fraud law doesn't need to be stretched, academic fraud is covered and criminally prosecutable in the USA for decades. It has to be because they're using these results to apply for grants paid from tax monies.

Occasionally someone is even prosecuted! Unfortunately, even when the government wins, the institutions just treat the resulting fines as a cost of business. See the Dana Farber Cancer Center: prosecuted by a third party on behalf of the government, found guilty of faking their science for a decade+, paid the fine - and nothing anywhere on the DFCC website mentions anything about it.

They wouldn't dread being included there, not at all. The institutions don't care about fraud and reflexively defend it, ignore it or shoot the messenger. Look at the Arday nonsense. People are still discovering new lies he was telling but Cambridge went to the mat for him.

Dan Ariely in particular has faced convincing fraud accusations for years:

https://en.wikipedia.org/wiki/Dan_Ariely#Controversies_and_c...

Nothing ever happens. Universities do not care.

Science isn't self correcting. This is a harmful meme that we need to collectively put in the trash can, as it's constantly used by academics to evade accountability.

The core problem is people conflating science with Science™. The scientific method is a set of techniques that help people discover and report true things. But there are two huge problems with it:

1. What exactly is the scientific method? It's not like there's a constitutional amendment that lays it out. Try and pin people down and you'll discover nobody agrees on what science actually requires.

2. Even if some subset of people did write down a definition, nobody is checking anyone is following it.

So people conflate science the Platonic methodological ideal with Science™, the institutions that claim most forcefully to be its avatar. But those institutions have neither a definition nor any enforcement arm, so fraud and abuse runs rampant. There's no reason why anything should self correct in this environment outside of corporate science, where the self-correction mechanism is managerial intervention or, in the absence of that, bankruptcy.

Now I'm curious, how do TDX enclaves get secure time and prevent rollback attacks on the VM? NTPS? Where's the secure counter you'd need to stop the disk image being rolled back? A lot of the attacks I discovered on SGX (the concept, not the implementation) were to do with the adversarial operator being able to roll back and replay inputs to the enclave. For example, you couldn't use a password to protect anything, because the enclave couldn't detect brute force attacks as it had no reliable forward sense of time.