rmunn

To expand on this incompetence vs malice point a little:

It doesn't take very many people being malicious to create a weak sandbox. The people creating the sandbox don't even have to be in on the plan: all you have to do is be an upper-level manager who makes sure to put the 23-year-old PFY in charge of creating the sandbox, rather than the 60-year-old BOFH who would have put in far more paranoid extrusion-detection measures.

(And for the lucky 10,000 who don't know the acronyms PFY or BOFH, look them up. Then get ready for a few hours of enjoyable reading as you read through the BOFH archives).

> I’m almost convinced openAI used such a crappy sandbox because they wanted it to “escape”. It plays into their two most important narratives: LLMs are genius gods that are worth lots and lots of money, and they’re scary enough that open weight Chinese models should be regulated.

I just posted a comment to that effect; had I seen yours, I would have simply upvoted yours instead.

Never attribute to malice what can be adequately explained by incompetence. But the weakness of OpenAI's sandbox, which so perfectly aligns with their goals of getting legislators to pass regulatory-capture legislation that will hamper their open-weight competitors, cannot (IMHO) be adequately explained by incompetence.

Hmm, let's see. OpenAI wants legislation restricting AI research, a.k.a. regulatory capture. Around the same time, they build an inadequately-monitored sandbox that their agent swarm breaks out of, thereby causing scary-sounding headlines and making it more likely that legislators will pass the regulatory-capture bills they're hoping for.

Never attribute to malice what can be sufficiently explained by incompetence. But IMHO, their complete lack of monitoring their own sandbox cannot be sufficiently explained by incompetence.

And the fact that it can go both ways is why the author would be "apoplectic if that happened during an incident on something in production" (emphasis mine). Because if you're doing this during an incident, you're connecting to a server that you have reason to think might be running malware right now. Which means that if the malware is programmed to look for incoming VS Code remote connections (not that hard to do, anyone competent enough to write the malware causing your production incident is probably capable of programming it), the malware could then infiltrate your dev machine via the VS Code remote tunnel. Your dev machine where you might well have credentials lying around in plaintext .env files.

Yeah, I'd be apopleptic too. Because the clueless dev who did that just escalated the production incident into "track down every credential that was present on that particular dev machine, and assume those credentials are now compromised and have to be rotated".

Cache invalidation, one of the two hard problems in computer science.

I'm sure most people here already knows the joke, but for the lucky 10,000, here's the full joke:

There are only two hard problems in computer science. Naming things, cache invalidation, and off-by-one errors.

Since muridae is the family of rodents that includes rats and mice, I believe he's referring to a RAT, a Remote Access Trojan. Something that functions rather like https://hunt.io/malware-families/reversessh or other similar malware, in other words.

That's the word I thought he was hinting at... but then I looked up the word "murid". It has two meanings, one from Sufism (a novice seeking spiritual enlightenment) and one from science (muridae is the family of rodents that includes rats and mice). Neither one of those seems to match "rootkit". I suspect he intended the mice-and-rats meaning, but I don't know what word related to rats or mice might have a similar meaning to "rootkit".

EDIT: Found it. He's referring to the acronym RAT meaning "Remote Access Trojan" (or, if actually intended, Remote Administration Tool).

> Wait, could someone clarify which machine is being referred to here?

I'm not the author, but I can tell that he means the remote machine. His sentence about being "nervous about letting people VSCode-remote-edit stuff on dev servers, and apoplectic if that happened during an incident on something in production" makes it clear. He considers the VS Code agent to have all the features of a rootkit, and doesn't want anyone to be deploying it onto dev servers, let alone production ones.

Not in science journalism, but I've personally encountered a case in normal journalism that I can only attribute to malice. It was many years ago, but it was so blatant I still remember it.

The 911 call went like this, according to its transcript. Caller: "This guy looks suspicious, like he's on drugs or something. It's raining and he's walking around looking into windows." 911 operator: "Can you describe him? What race is he?" Caller: "He looks black."

How the TV news reported it on the air was: Caller: "This guy looks suspicious ... He looks black."

Omitting excess verbiage is one thing. Omitting words that entirely change the context of the statement, making it look like the caller was racially prejudiced rather than responding to a specific question, is something else entirely. That was the last time I trusted reporting from that particular source (it was NBC, by the way).

My principle is that when someone lies to me, I stop trusting them. By lying I mean not just omitting details, or having an obvious bias, but deliberately telling me A when they clearly know that the truth is not-A. I could not see that report any other way but a deliberate lie, knowing the truth and attempting to make people believe the opposite.

Robots specialized in assembling one machine are not general-purpose robots. I doubt they would be able to "do pretty much everything a human could want to do".

Now, if someone does perfect a general-purpose, AI-driven robot, then yes, sending that robot on the Mars mission instead of a human would make a lot of sense. That's kind of, kind of, what we've done already with the rovers. But until such a general-purpose robot is actually created, human beings are still the most versatile, adaptable entities that could go to Mars.

I just told Opus 5.5 "Perform a code review on the current branch" to see what it would come up with. The results were not inspiring. It told me there were five issues, one of which was a test-coverage gap on line 848 of ProjectTemplateTests.cs. But ProjectTemplateTests.cs is only 160 lines long.

I told it that it had made a mistake in the line number, and to double-check all the line numbers. It responded "You were right to push on this: four of the five line numbers were wrong, and while checking them I found two findings that were overstated."

Then I noticed in the corner of the Claude CLI UI that it was showing "Effort: medium". I'm pretty sure I had set it to high effort before; I don't know when it reverted to medium, but that's another thing that doesn't exactly fill me with confidence.

I'll try again on high effort to see if it does better, but so far I am not impressed with Opus 5.5 on my first day of using it.

People have successfully dropped autonomous robots onto Mars before. Wouldn't be out of the question to do so again, except that instead of rovers, the robots could be programmed to open up crates (dropped at the same time, or by a previous or future mission) and assemble what's inside into a landing or launch pad.

Would take a lot of prep missions, and might not be worth the cost, but in theory it's doable. Curiosity massed 900 kg and Perseverance massed 1025 kg according to Wikipedia, so dropping a metric ton of supplies for the robot to assemble would, again in theory, be feasible. (In practice the equipment for landing the supply crates safely would take up a good chunk of the mass budget, but there should be something left over in the mass budget for the crates to contain).

My father used to complain about that 40 years ago, though in his case he was reading newspapers rather than professional journals. But he'd point it out to me often enough that I started to see the pattern. Scientist publishes paper saying "We may have found evidence of X, which suggests the possibility that Y may also be occurring". Journalist: "Scientists find X which proves Y".

This has been happening for decades; I still see it happening today*. My cynical suspicion is that words like "maybe" and "suggests the possibility" don't sell enough papers.

* Worst offender I can remember was actually from the summary of a paper published on the research institution's own website, so I couldn't blame it on "Oh, the journalist misunderstood what the scientist wrote". Summary said "Exposure to X can, on average, cause a 40% higher chance of Y" (where Y was a negative health outcome). I clicked through to the study and read it. Turned out the confidence interval on that chance of Y was so wide, all you could say with 95% confidence was that exposure to X could do anything from reduce your chance of Y by 5 percent, or increase it by 85 percent, or somewhere in between. They had averaged -5 and +85 to get the scarier-sounding 40% number that they published in the summary, but the truth would have been far closer to "this confidence interval is so wide that we really can't conclude anything from this data". But that wouldn't be nearly as likely to get them grants, so they tortured the data in their summary so that it would look better.

But none of them had a government-mandated one-child policy (maximum, not minimum) for over three decades. That's a pretty major difference between China and neighboring countries.

It had so many strategic choices, giving it a depth that would surprise most modern gamers seeing it for the first time. Starting with the race design, where your choices can make or break your game. Choose wisely! Then there's ship design, which is a whole other layer of possibilities.

Plus, the fact that you can fly anywhere through space, not just through artificially-constrained wormholes, means that the strategy of attacking another player can involve a lot of subtlety and bluffing. Fly a medium-sized fleet into deep space, skirting the edge of his scanner range, while you fly a big fleet directly towards his key production worlds. Then on the turn when he is expecting you to reach his worlds and start bombing (and when you think he's going to send his ships to intercept yours), turn your big fleet around and fly it home. Meanwhile, fly your smaller, pre-positioned fleet in from the other side of his empire. His ships will be caught out of position as they'll follow their orders to chase your fleet, a lot farther than he thought they would in one turn, and they won't get back to the other side of his empire in time to prevent you doing a lot of damage. Then, when he's not paying attention to your big fleet, turn it around AGAIN and do even more damage.

There are ways to counter that, of course, but it's easy to catch people off-guard if they haven't noticed yet that you can send ships anywhere, not just between two planets.

What an excellent game that was. I'm so glad it's possible to play it again.

"... but this margin is not large enough to contain it." Sound familiar?

Now, it's possible that Fermat thought he had a proof of his theorem, but that it would have turned out to be wrong. That happens sometimes. But he did not write it down on any document that has survived to this day, so we know that he had something that has been lost.

It's similar to history. We know that there are books, plays, etc. that used to exist, but that nobody knows today. Because other writings that have survived to this day quote from them. But beyond the quote, we don't know anything else about the play or the book or whatever.

Fermat's Last Theorem almost certainly isn't the only case of mathematical theories that we know were published somewhere but that we have no record of today. It's just the only one that I happen to know about, not being a mathematician myself. I'm sure there are some people on HN who know of others.

It's funny, but I had the same thing happen to me once. One day, overnight, my computer decided it was 2006.

It happened twenty years ago...

;-)

The filter keeps the tea... it's just that you then lift the filter out of the cup, carrying the tea with it. Flip your brain around to see it from that direction and it might help you with the mnemonics.

I suspect the name alone will help drive adoption, especially from non-technical people. Heck, I'm reasonably technical myself (but not expert in image formats) and my first instinct on encountering AVIF was to say "AVIF? Does that stand for AVI File?" And I would have assumed that it's a video format, not an image format. Whereas JPEG XL would have everyone who has ever used a digital camera saying "Ah, it's got JPEG in the name, that means it's a photo format".

Never underestimate the power of a well-known brand name in communicating things to people who know nothing else about the subject. The name is a big part of why I suspect JPEG XL will take off in popularity. (The lossless conversion to and from classic JPEG format is the other main reason).

HDR is something many photography enthusiasts are interested in, and the ability to losslessly transcode from JPEG to JPEG XL (and back again if you have to) is actually IMHO the "killer app" for the format. Many people have years of irreplaceable family photos in JPEG format, and being told "you can fit 30% more photos on the same hard disk without any loss of quality" would certainly sell me on converting my photo library to JPEG XL. (The jpegxl.com site says "up to 60% smaller" so I'm going to guess that 30% is a safe average gain and it might be more).

And nearly everyone who takes photos of their family ends storage-constrained on cameras at some point. Memory cards only holding so much is less of an issue than it used to be, but in my experience the only people with laptops that have more than 1 TB of disk space are the computer professionals I know; every non-computer professional I personally know has 1 TB or less, usually 512 GB. That's room for plenty of photos, but not an infinite amount, and the photo collection (plus videos of baby's first steps and so on) is competing with a lot of other things for storage space. So being able to shrink the collection size by 30% or more with no artifacting added is definitely going to be worth it for one of the biggest selling points for cameras. (Including the cameras on smartphones).

I wouldn't say that JXL is absolutely vital and the industry should switch right now. But I would say that it's likely to be the only image format that has a chance to displace JPEG among the average camera user. Having JPEG in the name is also going to be a major selling point; don't underestimate that. (And the JPEG <-> JPEG XL conversion being lossless will complete the selling point).

Since (if I'm right) it's going to end up ubiquitous, then even if another format would be technically better, it would be wise for everyone writing software that handles images — browsers, OS file explorers, and so on — to make sure their software can support it. Just on general principles of supporting every widely-used format and every format that looks likely to be widely-used in the future.

I would argue that even if JPEG XL isn't the best choice for Web images, if browsers don't support it then that will widely hinder its adoption for its non-Web use cases. Would you agree?

The scenario I'm thinking of is sending a photograph by email. Let's say Sally has just had her second baby, and wants to send baby pictures to her mother, the baby's grandmother. Neither Sally nor her mother are computer professionals, and they don't want to care about image formats. Sally wants to upload a file from her camera, attach it to an email, and send it. Her mother wants to click on the email and see pictures of her new grandchild. Neither one of them wants to have to convert the image themselves.

Let's say it's a few years in the future and Sally's camera produces JPEG XL files by default. (Which I don't think would happen if browsers didn't support it, for exactly the reason I'm about to articulate). If Sally's mother's browser doesn't support displaying JPEG XL, then although Sally (who uses a different browser than her mother) sees the picture in the email when she sends it, her mother writes back an email saying "the picture didn't show up, can you resend it?" And they spend a few back-and-forth emails before finally getting tech support from a friend who helps Sally convert the picture to old-school JPEG so her mother can see it.

If that's the experience for end-users, cameras would hesitate to switch to JPEG XL as a default format. Because nobody wants a hostile review from a user saying "My mother couldn't load my baby pictures, what kind of lousy camera are you making?"

So even if it's not the best format for the Web, I'm still persuaded that having universal browser support for a format intended for photos is an important factor, and devices like cameras will not switch to it as a default format until manufacturers are certain that browser support (and OS support, and electronic photo frame support, and so on) is nearly universal.

None of that takes away from the argument "Other image formats are better for saving space on the Web", which is the main thrust of your post. But I do disagree with the last line, "I'm just not personally convinced we need it in browsers any time soon." I believe that if browser adoption is lacking, adoption of the format in places where it makes lots of sense (like cameras) will also be slow.

What are your thoughts on that argument?

Ah, didn't know that. Then the main reason to use DDG would be if their "we don't track your searches" claim is honest. (Which I think it probably is; certainly I've seen no evidence that DDG is lying about not tracking your searches).

Even if they're only a layer around Bing, having your Bing searches coming from DDG's IP addresses rather than from your own IP address almost certainly makes it harder for Bing to track you, since your searches are being pooled with everyone else who uses DDG. Naturally, Google will track you, your computer, your phone, and would even track your dog and your Roomba if they could figure out how.

Don't worry, I didn't spend much time digging through comment history. Thanks for the links; I'm about to have to leave my computer and do something else for several hours, so I can't look at them right now. But since you replied to one of my comments it'll be easy to find them again via the "threads" link, so I'll look at them later when I'm back at the computer. (And I did look at the first one; Logo Adventure is exactly the kind of thing I love to come across, so thanks for that!)

I'd also recommend `:degree <= 0` as the check, rather than `= 0`, just in case someone passes `5.01` to the function (which would cause an infinite loop as you'd never hit exactly 0). But yes, if that was just coded into the comment box then it looks pretty good.

Where the heck did the sudden vitriol come from? I went through the HN comments of the person you're replying to and found nothing like the kind of thing you're replying to in the first several pages. If he said something months ago that you're bringing up, you might want to link to it, because at it stands it feels like you just suddenly started ranting about politics in the middle of a conversation about teaching kids to code. Which is... kind of offputting, you know?

Could we please try to follow the guidelines and not have flamewars and partisan dispute? Especially ones that seem to spring up out of nowhere, reviving conversations that are months old? I'm here to learn about cool new projects; if I want to read about politics or personal drama I have pretty much the entire rest of the Internet to do so.

That's more true in some locations than in others. There are places where the reported quality of life is quite a bit higher than others. I see comments like yours a lot on HN, and I'm starting to suspect that the average HN commenter is more likely to be living in some of the poorly-run big cities than in the better-run small-to-medium-sized towns. (Specifics can, and will vary. But on average I've found I'm much happier living in a medium-sized town than in a megacity, and I've also found the city governments of medium-sized towns to be more likely to be competent. Perhaps I've just been lucky in the medium towns I've lived in, though; I'd need far more data before I was certain of the thesis).

Point is, if you're miserable in the place where you are, consider whether moving to a different town is feasible for you. It's not always an option for many people, for many varied reasons. But it's definitely something to consider. If it turns out you can do it, sometimes taking that risk can pay off in the long run.

DuckDuckGo is owned by Microsoft? Are you sure? You're not confusing them with Bing, by any chance?

Good example, which is why both you and the other commenter gave it. And if that's as far as it went it wouldn't have bothered me so much; it was when conservative people I know were getting different results from liberal people for the same search terms that I started to realize the potential for an echo chamber, and decided it was a bad idea.

It's good for your mental health to be exposed to arguments you disagree with. Many times they will be bad arguments and you can dismiss them, but it's good to know what the people who disagree with you actually believe. And sometimes, just sometimes, you might see something that makes you realize that it's your own worldview that was mistaken, and adjust your worldview to better fit reality. If your search results only show you echo-chamber results that already agree with yours, you'll rarely learn the areas where you were mistaken. (And nearly everyone is mistaken about some things; the person who is right about everything is a rare creature indeed, and you should never gamble that you're that person).

Glad to know the team is growing, it makes me slightly less worried about the project's bus factor.

There's a limit to how long the name can be, even in Snap! — not an enforced limit as far as I know, but a practical one. You don't want the block you're dragging around to be thousands of pixels wide, it's very inconvenient. So people are naturally going to rename "convert all the upper case letters in the input text ___ into lower case letters" (where ___ represents the input slot) into "convert ___ to lower case" at some point, because they get tired of that one block being so much wider than every other block around it. (Edit to add: especially if they're snapping it into the input of a `map` block, which itself is the list input of "keep items (predicate) from (list)" block. That would get unwieldly really fast).

But you know some wag is going to paste the Pevear and Volokhonsky translation of War and Peace into a block name, just to see if he can. :-) So perhaps there does need to be an artificial limit, at 4096 characters or so, on block names.