Good post! Also, in my opinion, domain expertise is actually more interesting than pure coding ability. Coding, for me, has always been a means to an end. I'm equally happy with a spreadsheet if it solves my problem, and in fact I hate most apps.
The first thing. Invoked processes inherit the permissions of the user who invoked them (unless they have the setuid bit). It's just in case you land access to a computer which has all the standard Unix tools disabled to stop attackers from lateral movement.
> Fundamental in the dependency cooldown plan is the hope that other people - those who weren't smart enough to configure a cooldown - serve as unpaid, inadvertent beta testers for newly released packages.
This is wrong to an extent.
This plan works by letting software supply chain companies find security issues in new releases. Many security companies have automated scanners for popular and less popular libraries, with manual triggers for those libraries which are not in the top N.
Their incentive is to be the first to publish a blog post about a cool new attack that they discovered and that their solution can prevent.
This would just speed up the discovery -> patch cycle, at least until such time that all the low hanging fruit (=represented in training data) is patched.
Though another possibility would be that since LLMs generate so much code, the LLM vulnerability discovery would just keep chugging along and we'd simply settle for the same amount of potential vulns, same relative vulnerability-exploit-patch dynamics, though higher in absolute numbers.
I agree with you. It's clear that they're leaving X because "X bad", but they don't want to say it that way. I don't know if X is or isn't bad, but it seems pretty mainstream and a good representation of a lot of society, both US and international, so for an org that apparently cares for the online rights of people, it feels silly to leave a platform where there are - people. (and this is coming from someone who doesn't use X or social media in general)
I can't get it to save emails that I've corresponded with on the Android app. I always have to find specific emails in the email history, and then "Compose message to". If I try to start a new email and start typing the name, or email address, there's no dropdown, no suggestion. Have you ever had this issue on Android?
Yeah, I don't get it either. Deploy a VM that runs an LLM so that I can talk to it via Telegram... I could just talk to it through an app or a web interface. I'm not even trying to be snarky, like what the hell even is the use case?
There are sometimes truly bizarre demands for evidence. I once posted a pure opinion piece -- essentially a moral judgment on what is good and what is bad (in the domain of technical writing) -- and got hit with "source?"
I find the downvotes to your comment absurd. The downvoters seem to me what Kaczynski called "oversocialized". They accept being taken against your will because the system says that's how it's supposed to work. And then rationalize their conformity with apparent consequences (medical emergency services not providing care elsewhere, you being penalized for a fake call, and so on).
It shows a concerning lack of agency and a concerning amount of conformity.