xorcist

It is, and other software handling untrusted data should also treat it as adversarial. For example, your package tool should probably not output raw package metadata to the terminal.

These are not vulnerabilities in the "remote exploit" sense. They should be taken seriously, you should be careful not to run local software on untrusted data, and GPG should probably do more to protect users from shooting themselves in the foot, but the worst thing you could do is panic and throw out a process your partners and colleagues trust. There is nothing here that will disturb your workflow signing commits or apt-get install-ing from your distribution.

If you use crypographic command line tools to verify data sent to you, be mindful on what you are doing and make sure to understand the attacks presented here. One of the slides is titled "should we even use command line tools" and yes, we should because the alternative is worse, but we must be diligent in treating all untrusted data as adversarial.

How is that not text? Surely if we consider Arabic to be text (lots of ligatures, grouping, right-to-left notation) then music notes must be, too?

Another important reason to move to online applications is that you can change the terms of the deal at any time. This may sound more nefarious than it needs to be, it just means you do not have to commit fully to your licensing terms before the first deal is made, which is tempting for just about anyone.

> That works while the size of the community is ~100-200 people,

Yet we regularly observe that working with millions of people; we take care of our young, we organize, when we see that some action hurt our environment we tend to limit its use.

It's not obvious why some societies break down early and some go on working.

How will you store them? In the freezer? It's not trivial to keep batteries in good condition.

That someone might be Google, though. Not all ad dollars are well spent.

> you should prefer copyleft licenses over non-copyleft licenses,

For most, but not all, software. Stallman did famously argue for libvorbis, which you may know as the ogg codec used mostly by games and spotify, to be licensed under BSD instead of the (L)GPL.

How could it be illegal? It's not aviation software and doesn't need to be certified to allow it to be used.

Maintaining a patch set for Mattermost is almost trivial. I did it for several years to authenticate users to internal Active Directory and found it easy enough to understand.

> Trump is secretly a Russian agent,

Russian asset, not necessarily agent. At least that's the commonly spread idea, for which there is at least some circumstancial evidence: commercial projects in Russia for several decades and well documented links to Ukrainian and Russian oligarchs under Trump I just to name two.

> people like T Swift and whatnot tour constantly

Maybe not the best comparison to anything. Swift is known for being an even better busiensswoman than artist and obsessed with having control.

She screwed her record company for profits, not the other way around. Not many people have done that. She's likely making money on both ends of the stick.

> society views being fat as a moral failing

This is just as weak as a counter argument. If every argument that concludes that lifestyle changes are necessary, in most situations and for most patients, are just written off as some sort of moral high ground and not necessarily something to take seriously, then what do we have left?

Is there seriously no functional difference between healing a broken bone and getting someone to stop smoking? The only problem is just that we haven't found the right medication for the latter? Evidence of necessary lifestyle changes as part of some moral crusade?

The science is pretty clear on the subject and it is up there as one of the most well studied in medicine. Yes, anyone can stop smoking and anyone can gain or loose weight. Yes, lifestyle changes are the most imporant factor in a treatment being successful.

Metabolism also isn't immutable. Ask anyone who became vegetarian for example.

That's the thing though. Most European states (inside and outside the EU) consider the US their strategic ally, and they will support whatever it takes to make that strategy work. Policy at international level is made for strategic reasons, and you have to look at what countries do, not at what they say.

The strongest state, economically and military, can get away with a lot others wouldn't, since everyone else will want to be on their good side. The new US administration has clearly shifted in terms of what they say, but not yet much in terms of what they do. Maybe Ukraine will be the exception here.

Pray tell, how much of, say, the latest Afghanistan war did the US pay and how much do their allies need to bear? The rebuilding of a whole country, the reinstatement of the Taliban regime, the destabilization of the region, and the still ongoing stream of refugees? The political aftermath of which is still felt in Europe.

It is also important to realize that an atomic clock will only give you a steady pulse. It will count seconds for you, and do so very accurately, but that is not the same as knowing what time it is.

If you get a rubidium clock for your garage, you can sync it up with GPS to get an accurate-enough clock for your hobby NTP project, but large research institutions and their expensive contraptions are more elaborate to set up.

It might be a reference to Netanyahu and other high ranking people of Likud who has supported of Hamas for decades, both directly and indirectly via Qatar. It is uncontroversial and there is even a well researched Wikipedia article, but for obvious reasons only include what has happened in the open.

Not taking part of Israel's politics, it was a bit surprising that this hasn't been more controversial but politics in the entire region is complicated, I guess. After all, the corruption in the prime minister's office did cause protests when it was exposed so clearly people care.

Comparisons with deterministic tools such as calculators will always lead astray. There is no comparable situation where faced with a new problem the AI will just give up. If there is the need for an expert, the need is always there, because there is no indication external to the process that the process will fail.

> XML-DSig isn't great with XPaths

Or at all.

> How would you digitally sign a Json document and embed the signature in the document?

Preferrably you wouldn't because that's a really bad idea.

That said, this type of support-every-conceivable-idea design-by-committee systems would be equally bad built on json or anything else. That much is true.

There's probably no silver bullet here. But that is still not an excuse for XML-Sig.

It's always entertaining to hear such absurditites presented with a straight face. An alien studying our race would struggle to understand who would even care about this.

The obvious solution is, of course, to just allow people to pass on other's land. Maybe with some provisionings so ensure it isn't abused. You can already beathe the air legally, why not walk the ground legally?

Land "ownership" isn't really ownership in the physical sense anyway. You are allowed a certain set of rights, but you can't even mine your ground without permission, or dump toxic waste, or forbid planes to pass over. You could easily just decide to let people over on foot, too. It wouldn't take anything away from land rights.

Now you tell me!

There are plenty of companies today where "not using AI enough" is a career problem.

It shouldn't be, but it is.

Why no audio jack? Sooo close!

With OpenAI, the most bullish analysts calculate that 40% of the world's population will be users in three years time, and they would still lose money on every sale. That's a bold bet.

Sounds very likely. Perhaps if you are sufficiently big you could also get a small kickback from someone like VISA? Operational expenses must be fairly low.

That's not how those NFC cards work. They are payment middlemen. They are full cards on their own and just pass on every charge to your other card. Just like Google Pay.

Telco capex was $100 billion at the peak of the IT bubble, give or take. There's going to be $400 billion investments in AI in 2025. Just saying.

Perhaps. But does it matter? There is a million tools to investigate complex data already. Are you suggesting it is more useful to develop a new tool from scratch, using LLM-type tools, than it is to use a mature tool for data analysis?

If you don't know how to analyze data, and flat out refuse to invest in learning the skill, then I guess that could be really useful. Those users are likely the ones most enthusiastic about AI. But are those users close to as productive as someone who learns a mature tool? Not even close.

Lots of people appreciate an LLM to generate boiler plate code and establish frameworks for their data structures. But that's code that probably shouldn't be there in the first place. Vibe coding a game can be done impressively quick, but have you tried using a game construction kit? That's much faster still.

Don't forget: SCUMM