palata

> For my assumed goal of yours

Wrong assumption, my goal was to get more information from someone who sounded knowledgeable and said "it's not quite the same security level", which was ambiguous to me.

> I know that probally doesn't help.

No, it doesn't. I know how to learn myself, I don't need someone to tell me that if I want to know more, I should go read about it.

> gvisor isn't quite the same security level though

Which one is more secure? I thought gvisor but your sentence sounds like it implies the opposite.

> then we could probably be extracting close to double the amount of crude domestically compared to what we are currently extracting

So doubling... roughly nothing? Europe is importing almost all its oil and gas, right?

> If we went for the only viable green energy source we have, which is Nuclear

Well I do agree that it was unfortunate that Germany (and others) actively avoided nuclear power. Though it's nice that renewables are improving, too.

> if Russia with the backing of China actually does challenge us we are likely done for

Really? Russia has been fighting Ukraine for years. You're saying that Russia can easily beat a much larger part of Europe? How?

> France and the UK, both seems on the brink of internal collapse with repeated riots

Times are hard. Germany does not look that good with AfD, if you ask me.

> high levels of disaffection by the vast swathes of their imported populations that feel absolutely no sense of belonging with the host population and countries, and high levels of resentment and disgruntlement of the native populations with the utter failure of centre-left governance.

Not sure where you're going, this sounds racist.

> if the US withdraws support for Europe that France and the UK will actually go to war to defend any other European country

When did the US last go to war to defend any European country again?

> We can be the dominant power in the world

Is that the goal? I just want to live in peace.

Does Europe have enough gas and oil to extract that it would be profitable and allow them to rely significantly less on importing them?

Well Europe doesn't have more fossil fuels to extract, does it?

> Europe will secure the Hormuz straight but only once USA has secured it.

Wasn't the Hormuz straight perfectly fine before the USA decided to... well do whatever they did?

"I don't have a great idea right now, but I will make an app store and surely people will have great ideas and build great apps and it will make me rich".

> I really ask myself where those top engineers that make it through Google's famous hiring practices land.

Can I question the quality of said hiring practices?

I have been rejected for a project that was starting from scratch on something exactly like I had been building for 6 years at a competitor, based on such famous hiring practices (not at Google though). I was literally more experienced than the whole team on what they were building.

Because you hire people who are really good at leetcode doesn't necessarily mean that you always get the best candidates for the job?

It adds some level of privacy without going as far as something like Tor. As a result, it's a lot faster than Tor, but a lot less private.

The "privacy" it adds is that it separates your IP from your request, so no one actor on the way knows "X requested Y". A server knows "X requested something", another one knows "someone requested Y".

Maybe you don't need it, but I don't see how this is slightly creepy.

> makes me think it's just kneejerk "cloudflare = bad".

I mean, sure. There is that against BigTech all the time, and I understand where it comes from.

What I don't get is that... I don't know, I feel like it should be possible to be against the fact that there are monopolies and criticise them on the one hand, and on the other hand to actually have technical discussions about technical solutions. Here it feels like many comments denigrate Cloudflare without even understanding what the OHTTP gateway does.

For example:

- "Google sucks, they just optimise for profit like all BigTech and that makes it worse for everybody" -> criticises a monopolist entity, all good. No need to be constructive here, it's just sharing a feeling.

- "Android's security model is soooo bad because Android is developed by Google, you should use Linux on mobile it's a lot more secure" -> criticises a technical solution (Android's security model) in a completely uninformed manner, not good.

In other words, BigTech companies "suck" by being BigTech companies, but they do hire brilliant engineers and develop nice stuff (when they don't develop technology to screw us, that is), and I think it would be worth acknowledging that. Cloudflare does contribute a lot of cool stuff open source. One doesn't have to like that Cloudflare is as big as it is, but that's not a reason to say that what they open source is bad software.

I think an issue is that with such design, you want to "hide in the crowd". If you add a hop for your friends, then the third-party service knows that whoever connects from your server is one of your friends and it somehow defeats the purpose of the system, right?

I may be naive, but they offer a privacy service which adds a hop on the way. They don't control both their server and the third-party, and that is the whole point of the design, right?

How is that exactly what you would expert from a covert government operation?

Do we agree that the design goes through two hops, only one of which is controlled by Cloudflare? And that it is the whole point of the design?

But the whole point of this gateway is that Cloudflare doesn't learn "who makes the request" and "what they request", only one of them, right?

This is not drama, this is a technical opinion about their competitors. Happy to have Fairphone and /e/OS do it constructively as well. And I mean constructively. When the founder of /e/OS says "we are not one of those hardened systems for pedophiles", it is not constructive. If they said (I'm inventing here, not sure if they did): "The problem of GrapheneOS is that they only run on Pixels. We try to run on more phones in a best-effort basis", that would be valid.

What relationship does GrapheneOS have with Google? My understanding is that they fork the open source stuff made by Google, and as a response Google (the entity) does everything they can to screw GrapheneOS.

> Google the entity has a reputation

Yep: "EvilCorp"

Is the hardware so much better, or is their integration superior? macOS can be bloated but still more efficient, right?

I mean, the "so much better" in my experience is really the battery life.

Oh sorry, I thought you were talking about something else. Well... yeah IMO Google deserves it as it (as a company) is predatory.

Don't get me wrong, there are brilliant engineers at Google and I'm glad they are paid to contribute to open source projects like Android. But it doesn't make Google less evil.

And criticising a company is very different from "denigrating people". I don't think that the Google entity has feelings, does it?

Well to support real devices you need the device manufacturer to not prevent you from supporting it. Samsung can totally make a smartphone that does not support Android today. But I'm not sure what you are trying to say with that...

> So it's concerning to see this move from Google, which is also the device vendor for all currently supported GrapheneOS devices.

It is, and the solution to that is the partnership with Motorola.

> But they often choose to denigrate others, which is destructive, damages relationships

It used to be like that (and to be fair, all the similar communities were contributing to the drama, not just GOS), I agree, but I genuinely feel like it has become a lot more professional lately. Like I haven't seen drama in... at least 6 months?

Now I almost exclusively see them explain their technical decisions, which is very interesting.

I read a lot of comments like this, saying "we should have an alternative". And I agree that it would be really cool, BUT:

AOSP and the Android SDK are open source. GrapheneOS is exactly an alternative to Google Android. Sure, Google could shut down the Play Store (but alternative stores exist), or destroy the Play Services (but even then, there is microG).

I am happy that Google is still contributing to Android because they have a ton of money and many brilliant engineers, even though as a company it seems like it's somehow trying to burn it to the ground. But I am optimistic: it would be possible to build on top of the open source parts of Android if needed.

When did the word "challenge" start meaning "taking the lazy way"?

"Challenge accepted: I will eat ice cream when I want ice cream". Are you impressed?

I used to say that "the easiest way to hack into someone's account is not to find a technological exploit, but to ask the human nicely", referring to phishing of course.

Turns out that the best way to do surveillance capitalism is not to find technological ways to spy on users, but to ask them nicely to share absolutely everything they own.

"I don't have anything to hide (at least not that I understand), so I may as well reinforce a predatory monopoly".

Interesting times.

Yeah I think we agree. I just wanted to note this:

> but the AI companies/engineers to their credit have been very clear on that risk

I am not a big fan of that. It's too easy to say "I make a ton of money harming society, but I'm good because I am telling me that you should regulate me". If someone told me "I hit my wife, but you should not criticise me because it is not illegal, and I have been telling for years that it should be illegal. But as long as it is legal I will hit her", I wouldn't suddenly respect them just because they are apparently very well aware that what they do it bad.

Fine with those engineers explaining how it is on their side, but not whining because other people think what they do is unethical. It sounds like "please, I need you to tell me that I am a good person even though I take money (and pride) contributing to something I know may hurt society".

> The difference is that 99.9% of software is just not as important as even your average two-lane bridge.

You miss the point. LLMs are not the two-lane bridge here, they are the trigger. Sure, when an LLM makes 99.9% of software fail, nobody cares. But what happens when it touches a single, very critical instance of software?

> Oh no, HuggingFace got hacked. So what?

Ever heard of NotPetya? Blocked Maersk unwillingly (as a collateral). Could have resulted in a global economical crisis. There is a nice Darknet Diaries episode about that.

> Also, even civil engineers very rarely go to jail when a building or bridge collapses.

At the very least they don't go public saying "well it happens, building bridges is hard". Usually it goes more "it shouldn't have happened, and we need to get our act together and make sure it doesn't happen again anytime soon".

> Tricky problem, isn't it?

I get the irony. And I also totally get why someone getting an insane salary would see no reason to not work on it (and cynically think "if I am not getting rich having fun here, someone else will... may as well be me"). Who am I to say I wouldn't do the same? I strongly believe that sending astronauts to space is fun but useless, and taxpayers shouldn't agree. But offer me to go to space? I go tomorrow. Ironic, isn't it?

I guess my point is that when you get rich having fun working something you love, maybe you don't go whining online telling people that you missed your daughter's birthday and that they should not be pissed at the potential damage you may be contributing to doing. And comparing yourself to Sully (while saying you don't).

> but don’t attack staff directly

Sure, agreed.

> I literally missed my sister’s wedding a few weeks ago to help clean up after some of the recent incidents

If you're not paid for that, you should just leave. But my understanding is that OpenAI employees cannot complain about their conditions, can they? Hard to feel for a millionaire saying "I earn orders of magnitudes more than you, but I work 50% more", I think (I don't know if it's the case here or not).

> all I hear on X is how I “don’t know how to configure a sandbox” or that I should be in jail

I think it can be two very different comments. "They don't know how to configure a sandbox" is condescending. "Someone should be in jail"... well that can make sense. When a bridge collapses and people die, then we say the same: "someone should be in jail". The different with the software industry is that nobody gives a shit about the harm they cause. Civil engineers have to, or they go to jail.

The point here being that maybe, just maybe, AI labs should not be shipping stuff they cannot secure. It's hard to build a dam that does not collapse, but that's not a reason for civil engineers to vibe-build a dam and then say "ok it collapsed, but look it's hard to get right".

> Very few organizations can survive that scale and growth, and yet OpenAI did a very good job handling it (and should be commended).

So if OpenAI results in people dying, it is fine because "really, it's very hard"? I'm trying to think about a company that would build dams at such a scale and then use it as an excuse for only a fraction of them collapsing from time to time.

> To say it lightly: this surprised the fuck out of us. We had not expected it this soon. Suddenly we weren’t dealing with just a small jump in capabilities; we were talking about a different sport altogether.

Last example: imagine a geoengineering company coming out with a "solution" to global warming. Suddenly it goes out of control and it screws us even more. Would we say "please, have some respect, having that kind of impact is really hard and it honestly surprised the fuck out of us", or would we say "maybe you shouldn't have done something dangerous you didn't understand"?

> I recently watched the movie Sully.

Okay I can't resist it. It's inverting the argument. In Sully, we accept the fact that they took risks they shouldn't have because it turns out that they saved lives (and they prove that doing what they should have would have resulted in more casualties).

Now if the plane had crashed into a tower and killed thousands of people, of course we would blame the pilots!

OpenAI resulting in security incidents is NOT AT ALL the same as Sully saving lives by not following the rules. What a weird comparison that is?

If Starship crashed in Central Park, I wouldn't expect a SpaceX engineer to write a blog post saying "Look, luckily it didn't kill anyone, and I'm sick of reading comments saying "someone should go to jail". It's very hard to build a rocket, and people who think otherwise are just misinformed. Give us some slack, crashing into Central Park surprised the fuck out of us".

Maybe... legacy?

I guess we disagree on the meaning of "relatively easy". I do it a lot, I consider it boilerplate. It's not like passing 10 strings is exponentially harder than passing 1 string, is it?

I agree that the more you mix, the harder it gets. Maybe I'm just never working on "serious" projects, but I have never been in a situation where I had to mix 10 languages.

Well once you have a C API, it is relatively easy to call it from any other language.

The painful part is to have to go through a C API (modern languages can express much richer APIs and of course there are different constraints on the different runtimes, e.g. GC).

The annoying part is that each language adds overhead (its runtime). I wouldn't call it painful (I don't have much to do about it), I say "annoying" just because I would rather minimise the amount of code I ship.

I agree that mixing languages adds complexity. And I say that as someone who routinely does it, because many times it's better to reuse a mature/audited component than rewrite it from scratch.

Sometimes it's about the libraries. E.g. writing Computer Vision is nicer in C++ right now (IMHO) because most CV libraries are in C++.

Similarly I like to do video stuff in C just because I call gstreamer/ffmpeg directly in C, rather than having to bridge everything.