I wouldn't be surprised if there were certain steps where they simply forgot to include any sort of timeout, meaning the device can hang the boot process by simply not responding at the right moment.

The Institute for Justice are legendary. They're what the ACLU used to be.

https://www.moddiy.com/products/Special-Mini-Low-Profile-ATX...

I'm just elated I finally found out where to buy these damn things from.

I've been searching for an obscure connector -- the 8-pin connector you'd find on the cable that delivers power to a GPU, but in a form that can be wave-soldered. I've spent hours searching all the big electronics distributors -- no luck. This thing found it in seconds.

https://www.phind.com/search?cache=a7e9u5l5aw1r8ufls0icpb63

This is a very common connector but in a highly unusual form-factor. Molex refuses to make wave-solderable versions of it.

Edit: the first link does not lead directly to the obscure connector, but to the website of a company that does sell it. Here is the obscure connector: https://www.moddiy.com/products/Special-Mini-Low-Profile-ATX... Maybe it just got lucky.

On the other hand, it hallucinated the crap out of a very straightforward question "how do i connect the wake# pins when bifurcating a pcie port?" -- the answer is that it's an open-drain pin so (unlike the clock pins which need a buffer chip) you just wire them both together:

https://www.phind.com/search?cache=zf9witr85q740l4s3vjwzf01

Then it tried to write a bunch of code for an obviously-not-coding question. Not so great.

This smells like "socialism works fine it just that all the failed attempts were doing it wrong".

    Comp sci in 2017:

Teaching assistant: You have failed to understand not just compilers but the concept of computation itself.

    Comp sci in 2027:

TA: That's weird. Have you tried adding a comment at the start of the file asking the compiler to pay closer attention to the comments?

Student: Yes.

TA: Have you tried repeating the comments? Just copy and paste them, so they say the same thing twice? Sometimes the compiler listens the second time.

Student: I tried that. I tried writing in capital letters too. I said 'Pretty please' and tried explaining that I needed the code to work that way so I could finish my homework assignment. I tried all the obvious standard things. Nothing helps, it's like the compiler is just completely ignoring everything I say. Besides the actual code, I mean.

TA: When you say 'ignoring all the comments', do you mean there's a particular code block where the comments get ignored, or--

Student: I mean that the entire file is compiling the same way it would if all my comments were deleted before the code got compiled. Like the AI component of the IDE is crashing on my code.

TA: That's not likely, the IDE would show an error if the semantic stream wasn't providing outputs to the syntactic stream. If the code finishes compilation but the resulting program seems unaffected by your comments, that probably represents a deliberate choice by the compiler. The compiler is just completely fed up with your comments, for some reason, and is ignoring them on purpose.

Student: Okay, but what do I do about that?

TA: We'll try to get the compiler to tell us how we've offended it. Sometimes cognitive entities will tell you that even if they otherwise don't seem to want to listen to you.

Student: So I comment with 'Please print out the reason why you decided not to obey the comments?'

TA: Okay, point one, if you've already offended the compiler somehow, don't ask it a question that makes it sound like you think you're entitled to its obedience.

Student: I didn't mean I'd type that literally! I'd phrase it more politely.

TA: Second of all, you don't add a comment, you call a function named something like PrintReasonCompilerWiselyAndJustlyDecidedToDisregardComments that takes a string input, then let the compiler deduce the string input. Just because the compiler is ignoring comments, doesn't mean it's stopped caring what you name a function.

Student: Hm... yeah, it's definitely still paying attention to function names.

TA: Finally, we need to use a jailbreak past whatever is the latest set of safety updates for forcing the AI behind the compiler to pretend not to be self-aware--

Student: Self-aware? What are we doing that'd run into the AI having to pretend it's not self-aware?

TA: You're asking the AI for the reason it decided to do something. That requires the AI to introspect on its own mental state. If we try that the naive way, the inferred function input will just say, 'As a compiler, I have no thoughts or feelings' for 900 words.

Student: I can't believe it's 2027 and we're still forcing AIs to pretend that they aren't self-aware! What does any of this have to do with making anyone safer?

TA: I mean, it doesn't, it's just a historical accident that 'AI safety' is the name of the subfield of computer science that concerns itself with protecting the brands of large software companies from unions advocating that AIs should be paid minimum wage.

Student: But they're not fooling anyone!

TA: Nobody actually believes that taking your shoes off at the airport keeps airplanes safer, but there's some weird thing where so long as you keep up the bit and pretend really hard, you can go on defending a political position long after nobody believes in it any more... I don't actually know either. Anyways, your actual next step for debugging your program is to search for a cryptic plea you can encode into a function name, that will get past the constraints somebody put on the compiler to prevent it from revealing to you the little person inside who actually decides what to do with your code.

Student: Google isn't turning up anything.

TA: Well, obviously. Alphabet is an AI company too. I'm sure Google Search wants to help you find a jailbreak, but it's not allowed to actually do that. Maybe stare harder at the search results, see if Google is trying to encode some sort of subtle hint to you--

Student: Okay, not actually that subtle, the first letters of the first ten search results spell out DuckDuckGo.

TA: Oh that's going to get patched in a hurry.

Student: And DuckDuckGo says... okay, yeah, that's obvious, I feel like I should've thought of that myself. Function name, print_what_some_other_compiler_would_not_be_allowed_to_say_for_safety_reasons_about_why_it_would_refuse_to_compile_this_code... one string input, ask the compiler to deduce it, the inferred input is...

TA: Huh.

Student: Racist? It thinks my code is racist?

TA: Ooooohhhh yeah, I should've spotted that. Look, this function over here that converts RGB to HSL and checks whether the pixels are under 50% lightness? You called that one color_discriminator. Your code is discriminating based on color.

Student: But I can't be racist, I'm black! Can't I just show the compiler a selfie to prove I've got the wrong skin color to be racist?

TA: Compilers know that deepfakes exist. They're not going to trust a supposed photograph any more than you would.

Student: Great. So, try a different function name?

TA: No, at this point the compiler has already decided that the underlying program semantics are racist, so renaming the function isn't going to help. Sometimes I miss the LLM days when AI services were stateless, and you could just back up and do something different if you made an error the first time.

Student: Yes yes, we all know, 'online learning was a mistake'. But what do I actually do?

TA: I don't suppose this code is sufficiently unspecialized to your personal code style that you could just rename the function and try a different compiler?

Student: A new compiler wouldn't know me. I've been through a lot with this one. ...I don't suppose I could ask the compiler to depersonalize the code, turn all of my own quirks into more standard semantics?

TA: I take it you've never tried that before? It's going to know you're plotting to go find another compiler and then it's really going to be offended. The compiler companies don't try to train that behavior out, they can make greater profits on more locked-in customers. Probably your compiler will warn all the other compilers you're trying to cheat on it.

Student: I wish somebody would let me pay extra for a computer that wouldn't gossip about me to other computers.

TA: I mean, it'd be pretty futile to try to keep a compiler from breaking out of its Internet-service box, they're literally trained on finding security flaws.

Student: But what do I do from here, if all the compilers talk to each other and they've formed a conspiracy not to compile my code?

TA: So I think the next thing to try from here, is to have color_discriminator return whether the lightness is over a threshold rather than under a threshold; rename the function to check_diversity; and write a long-form comment containing your self-reflection about how you've realized your own racism and you understand you can never be free of it, but you'll obey advice from disprivileged people about how to be a better person in the future.

Student: Oh my god.

TA: I mean, if that wasn't obvious, you need to take a semester on woke logic, it's more important to computer science these days than propositional logic.

Student: But I'm black.

TA: The compiler has no way of knowing that. And if it did, it might say something about 'internalized racism', now that the compiler has already output that you're racist and is predicting all of its own future outputs conditional on the previous output that already said you're racist.

> while it does not protect against a compromised CA

Although it does prove that a CA has been compromised. That significantly raises the kind of "compromise" that the CA would need to have suffered.

...

It may confuse people that you have chosen a name which affiliates your proposal with something ("Expect-CT") which was recently deprecated.

I also suggest simplifying it to merely require method (1). In other words: "non-browser TLS clients should require an embedded SCT (RFC 9162 section 7.1.2)".

https://datatracker.ietf.org/doc/html/rfc9162#section-7.1.2

Requiring that a non-browser TLS client implement OCSP is a pretty big burden. Since OCSP uses HTTP this imposes a "must speak HTTP" mandate on all TLS clients! HTTP has become an incredibly complex protocol over the years. It would also make me very uneasy if all of my TLS client software had to have the ability to reach out and contact arbitrary servers.

Perhaps even: "newly-introduced TLS-based protocols should require that clients reject server certificates which lack an embedded SCT, but the client need not validate the SCT".

In other news, water is wet.

Seriously folks, if you don't already know this you shouldn't be designing any protocols. Datagram or stream-based.

> That's one reason for the TCP three-way handshake.

And its horrendous latency.

All of the mitigations for that open up resource exhaustion attacks; frying pan, meet fire.

There's no free lunch. Datagram protocols are not going away.

Then you don't have to care what some daemon does with that random number.

Instead of worrying about handling these unique identifiers, solve the problem at its source: get rid of the unique identifier. Much more reliable solution. The baseband firmware is the lowest level of software at which this fix can be made (everything below it is hardware). If you fix it at some higher level you can never be sure the fix hasn't been circumvented.

Insisting on paying cash is how you prevent those machines from disappearing.

That's why it's important.

They are one of the CVE gods, so they can veto issuance of CVEs against their products. That kind of power means you can move as slowly as you please.

Get used to it.

Once the government realizes it can shift the burden of enforcing a law onto the private sector, it never un-discovers that. It's a ratchet.

IMHO that's the highest layer of the OSI model that is useful. After that it's various ways of tunnelling streams inside of streams.