woodruffw

This kind of hellish experience is a great example of the CVE system trying to have it both ways: when on the offense it’s a rich source of information for defenders, and when on the defense it’s just an opaque ID for coordination that implies nothing about the quality or correctness of the underlying report.

Another one?

My understanding is that IME and PSP come more from the world of corporate compliance than anything else. In other words they exist for x86 because x86 gets deployed in corporate settings, and any ISA that attempts to occupy a similar niche will meet a similar fate.

(Compare ARM’s TrustZone, etc.)

I don’t think the average American voter “genuinely” thinks that they’re on a Blues Brothers-style mission from god to deliver liberalism and freedom to the world. I would be surprised if that’s even a minority view among voters.

Is there some evidence that x86 is uniquely prone to exploitable memory corruption? I haven't seen it, if so.

> That's why Huawei and the Chinese government aren't even trying any more to make western CPU architectures secure, it's a hopeless cause.

I suspect there are much more boring reasons for this, ranging from licensing to geopolitics (i.e., it being useful/valuable to have a domestic base of engineers who can design an ISA).

Another useful one if you have a large number of tags and want to see the most recently created ones first:

    git config --global tag.sort -creatordate

(`-creatordate` reverses the sort so that the newest come first.)

I've seen monorepos with over 10k active branches. But even at a smaller scale (10-100 branches), it becomes useful when manually stacking and/or rebasing, especially if you have a smaller terminal.

I mean more in the psychological safety sense. An assembler's process is deterministic, not statistical, and knowing that affects how we interact with it.

Python's tiering has to do with testability and availability thereof, not modernness. In the case of 32-bit Windows, the reason it's still testable is because Windows still ships a 32-bit userspace, even if Windows itself only supports x86-64.

(From personal experience, testing Windows aarch64 is a massive PITA, even on GitHub Actions, which all common sense would indicate should have the best aarch64 Windows CI runner story.)

I agree. It remains to be seen whether the field will even stabilize, beyond some local maxima of everything being a chat interface. I for one hope it does.

Charitably, we could say that “agentic” software engineering is less than 4 years old. I say charitably because I think even that’s an extraordinary stretch. But even at 4 years, I don’t think anybody can fairly claim to be experienced in it in a way that’s going to be stable and fungible for, say, the next 30 years.

(My experience has been the polar opposite: the people I know who are the most “AI pilled” are also the ones who have the shortest technical horizons in terms of how transferable they expect their LLM skills to be.)

I generally agree with this. One of the strangest things about LLM driven engineering is holding two seemingly contradictory positions in your head: they’re both better than the median developer, and they’re also much worse at producing artifacts that are comprehensible to humans.

I often find myself throwing away large amounts of LLM driven code not because it’s bad, but because it doesn’t fit within my attention span. The code itself looks very reasonable, passes tests, benchmarks well, etc. But I throw it away because the models don’t yet “explain” their decisions in ways that elicit psychological safety. Humans are still very good at that, even when their engineering is worse.

(4) is not actually co-extensive with any of Kant's four formulations of the CI. To break them down:

1. The "universal law" formulation (GMS 4:421) states that an action if permissible if and only if we can will that maxim of our action becomes a universal law. At no point does the FUL actually ask whether the world becomes a better place, it asks strictly whether there's a logical contraction between the maxim of one's actions and their universalization.

2. The "humanity" formulation (GMS 4:429) states that an action is permissible if and only if it treats its rational subjects (including the actor) as ends in themselves, rather than means. But this too is a logical construction without reference to outcomes: a plain reading of Kant suggests that the HF formulation permits actions that make the world a worse place so long as the maxim behind the action is derived from a basic source of respect for humanity as a means.

3. The "autonomy" formulation (GMS 4:432) is similar to the FUL, except that it asks us to imagine ourselves as a legislator of universal law. My interpretation of this formulation (IMO it's Kant's most confusing) is as his attempt to emphasize that we must not merely follow derivations of universal law, but actively legislate and derive it for ourselves. This effectively layers a constraint on the FUL, but preserves its basic logical structure, i.e. does not ask us to perform casuistry when determining whether an action is permissible.

4. The "kingdom of ends" formulation (GMS 4:439) is intended as a unifying formulation of the first three, and essentially challenges us to test the moral permissibility of the maxims our actions not merely through universalization, humanity, or self-legislation, but as acceptable to an abstract community (Kant's "kingdom") of similarly rational, self-legislating actors. This is arguably Kant in his most Rawlsian/Piagetian state, since there's an additional idea that the permissibility of our actions is qualified and constrained by whether our peers would accept them.

Of these, (4) is arguably the closest to us asking whether the world is made better or worse as our moral test. But two problems emerge. First, Kant himself sees his formulations as co-extensive, meaning that (4) cannot imply any consideration for outcomes if (1) through (3) do not (and they do not, as purely logical, non-casuistic constructions of duty). Second, Kant emphasizes acceptance of actions in the KOE formulation, and acceptance in turn is grounded in (1) through (3). If acceptance were not grounded so, the imperatives in question would be hypothetical rather than categorical.

> Even in the Metaphysics of Morals, the whole concept of duty would be arbitrary if not in reference to rational beings.

In what sense? There's a sense in which there's no moral law without rational agents, but Kant himself is explicit about the "good will" being entirely independent of intended or obtained ends. In other words, no rational agent needs to benefit (or be harmed) in Kant's system for individuals to be morally blameworthy or praiseworthy.

(See GMS 4:394 for the "jewel" analogy, which is most popularly cited as evidence for Kant's position on this.)

The entire point is that they have no control! That’s what makes it not nullification.

Edit: to be clear, the essential quality of nullification is that it’s the product of a contradiction between two unassailable principles in our legal system. Without that contradiction, which does not exist in a grand jury context, a juror’s decision is not nullifying. It’s just a decision.

It doesn’t fit the spirit, because it doesn’t have the legal qualities of nullification. In particular, the prosecutor can choose to empanel a new grand jury and seek a new indictment on the exact same charge.

Nullification is based on a contradiction in terms: juries cannot be punished for the judgments they render, and prosecutors may not re-try a case to obtain their preferred outcome (“double jeopardy”).

With a grand jury, the second term doesn’t apply: the grand jury’s decision doesn’t prevent a second indictment.

So in other words: grand juries can choose to render “faithless” decisions, but they can’t nullify a case in the sense that matters.

I don’t know anything about this particular tool. But I’ll note that comparing package counts often doesn’t make sense between ecosystems, since some ecosystems (like Rust) lean heavily towards workspace patterns where several “physical” packages make up one “logical” unit.

(Rust even enforces for proc macros, which is why so many of the crates in your example end with “derive” or “macros.”)

Yes :-)

zizmor wouldn’t catch that condition at the moment, although it does have similar checks for other unsound conditions and incorrect/vulnerable bot actor checks. This one wouldn’t be too hard to add, though.

(Source: I am zizmor’s maintainer.)

Wait until you hear how many people drive a car every day.

But less facetiously: there are large demographics that might ride bicycles more if it was slightly easier for them, including older people and people with mobility issues. I don’t have opinions particular to this product, but expanding the feasibility of cycling seems like a generally good thing to me.

Independent reporting on the treatment of detained immigrants might reasonably lead one to believe that expenses are not scaling linearly with increased revenue.

> What is the actual concern with McDonalds having this data about you?

I have no idea if it’s realistic, but I could see people being reasonably concerned about insurance companies, etc. making actuarial decisions based on a partial understanding of your dietary habits.

I think the advice at the end of this post is essentially sound: you should pre-filter your evaluation of others’ opinions through their understanding of related topics. But that isn’t elitist, and I think we shouldn’t call it that! It’s a form of media and cultural literacy we should be encouraging people to have; there isn’t (and shouldn’t) be anything elite about it.

From a very quick look online, “Grade II” means that the building is of historic or architectural interest. I think it’s reasonable to infer that cleaning graffiti off of a building like that might require materials or consultations that a normal removal wouldn’t, although I have no idea whether £50K is a reasonable amount for that. I guess it would depend on the material, size of the graffiti, etc.

The author of that page appears to be a Holocaust denier[1]. Not exactly the example I would put forwards, especially if I want to make an unannealed appeal against Israeli war crimes.

[1]: A search for that name mostly brings up links to pages for SS apologia.

I left out the code on medical devices for a reason! And similarly for avionics software.

(The distinction I’m making is between the code that operates the medical device and the code that operates the app I make doctors’ appointments in. The latter is subjected to a different - and lighter - regime than the former.)

What does this mean? NIST and NSA are not even in the same federal department.

It might be an unpopular option, but I think the regulatory regimes that control medical and financial privacy as they interact with software are significantly lighter touch than e.g. the regimes that control material quality for bridges and tunnels, much less airplanes.

It seems to me like two things can be (and are) true: programming can be hard in absolute terms, and is also the easy part of the thing that we call “software engineering.”