For example, if secret storage methods aren't specified in the prompts, a model might decide to be clever and implement a generic secret access interface, with a default implementation that hardcodes everything. It will probably tell you that this is not production ready and you should write or specify your preferred secret storage implementation, but if you don't read or understand that, you'll just leave it as is and push to prod.

What games and some software do these days is much worrse. You have a license to use their "software installation service" and their "let me run the game" service until they decide to turn them off. At any point, at their discretion, they can remove your ability to install a new copy or even run it all together.

Very different and quite recent.

The internet has plent, of security elements. Devices use TLS to communicate, are encrypted by disk encryption, users' messages/calls/data are encrypted with various protocols... This is already in place.

Building codes and such are laws, the government didn't go and change the laws of physics to make it impossible to build something not up to code. They also don't limit the same of materials and tools to only certified builders who they know will respect the code. You can still break the rules to some extent, or even follow them, just without external certification.

Remote attestation and related technologies change the laws of physics - not complying is simply not possible. You can't just make one little change and hope nobody bothers you about it, the system makes the change impossible, or it detects it and "burns the whole house down".

If your house isn't certified because you repaired a light fixture on your own, you can still invite friends over, you can receive mail and packages to it, you can get phone, internet and other utilities. If you want to change the color of the icons on your phone, or if you want to disable the pre-installed spyware, you're cut off from talking to your firends and family, from social networks, reading the news, you can't pay your taxes, can't get a bank account, can't get paid for your work or even apply for a job. That is the reality we're going towards.

The thing that changes isn't that your every action will be followed. That already happens. It's that you are powerless to avoid it. It's a technological lock to keep you obedient. There is no security element to it. We as an industry need to stop pretending like these are security technologies and start talking to more social sciences experts. Before it's too late...

Even if the other models were trained on the same data, which is unlikely, since they had less time and money to scrape it and fewer lawyers to be able to do something like pirate, the proprietary models are still largely built on the public data and wouldn't exist without it. At the very least, they should release the intermediate model, before training on their proprietary data. Not that that's how that works...

Back in the day you could dismiss all of that as "it's part of the learning path" and yes, I made over-engineered non-solutions to long-solved problems when I started programming too. But this isn't learning. It's pure LLM slop.

LLMs are doing the thing that greedy/unethical programmers used to. They'd quote a client a dozen microservices and four months of work for something that could be solved by writing a slightly longer Excel formula. Not that the quote was crazy or the work was poorly done, it just wasn't anywhere near necessary to solve the problem. But they got paid and the client was happy because they didn't know any better...until I showed up to ruin the fun.

But you're just Mastodon-brained, you don't get it!

The master AI switch doesn't actually change whether the browser uses AI features - it never does unless you specifically run them. What it does is hides them from the user, pretending they don't exist.

Browsers that don't respect their users' choices about using AI do things like automatically download large models in the background, integrate cloud-based speech recognition and synthesis as an API available to any website and make the default search engine which they also own show LLM slop above actual results.

If your service works by taking whatever file the user gives you and shoving it into unsandboxed ffmpeg, you've already fucked up. It would be nice if you could do that, but that's not a guarantee ffmpeg has ever provided, nor would it make sense for them to spend their limited resources on it.

The move to WebExtensions was painful, but it also made it possible to easily port Chrome extensions to Firefox, which was a great boost for the extension ecosystem, as well as being the thing that actually made mobile extensions possible.

I do agree they should've made the transition period longer though. There were like two years in between where some of the big Chrome extensions hadn't been ported yet, but their original Firefox counterparts were already killed. That probably made a few users move ti Chrome, but that was already during the great Chrome migration, so I can't imagine this made a huge difference.

What? They didn't make these 10 distinct features one single all-or-nothing button? They let you switch them on or off individually?? How dare they?!?

What? They shipped new features to the browser...turned on?!? Instead of spending all those development hours and then...hiding them behind a setting by default?

I need "AI" in my browser, so I don't use the AI features. No data was sent anywhere. No 4 GB model was downloaded. Nothing happened, except for a popup saying "hey, by the way, if you want to do X, just press this button here". It's just UI elements. No AI-related code runs, no data is sent to AI companies unless you directly tell the browser to do that.

Imagine if Firefox shipped a brand new GPU-accelerated compositor, improved hardware video decoding and WebGL/WebGPU. You people cry about why they didn't add a big "disable GPU features" button? And that they dared to enable this by default?

In terms of everyday threats to my life, billionaires are a bigger one than criminals.

2. K8S DaemonSet, PVC backed by probably Ceph

3. Just..don't care? Do maintenance outside of working hours, fix issues quickly and explain things nicely to your customers. Not everything is google-scale. Most people can deal with some downtime.

And it's not like you won't have downtime in let's say a postgres-backed app. But now you have two "servers" to deal with.