/s

I absolutely love monster-in-the-middle. Big round of applause to whoever thought of that.

All I read was that it creates a directory from the build file but seemingly no description how new files or added dependencies slipped by. Was `cook.pth` a dependency that got automatically downloaded from PyPI on install and then the build system put it into dependencies?

--

Leaving this for others:

> BerriAI’s private release pipeline built these wheels from an attacker-modified git source. The attacker could have used a compromised maintainer or bot credential, a private branch or mirror, or the reference the pipeline builds from. A stolen PyPI token used from the attacker’s own machines fits the evidence less well.

Makes sense. It was that a maintainer or the private pipeline was attacked and the malicious dependency was injected there by squatting on the maintainer's local copy rather than the dependency being hijacked for everyone. Very clever.

It baffles me why so many sites block paste on bank account number inputs like it is 1995 and we are typing it from checks.

I absolutely endorse new creations when they are necessary but the people making these aren't doing it from a point of education, they are doing it purely because _they_ don't understand the framework or language that is the standard for that area.

It always always always involves a high level of AI Psychosis, that a brand new web framework is needed for your revolutionary... CRUD app?

Waymos aren't without fault either, they smash the front off cars, run into static poles, block emergency vehicles, etc; just the nature of AV development.

A lot of problems would just be solved by trust-but-verify information. If a user wants to put non-sense in a text box, that should be a 'them problem' but a service that presumes all email address end in .com or that a user doesn't know their own address is worse. With that said, I understand why services do it because the Venn diagram of "will type non-sense into a field then wonder why it didn't work" and "will email into support and be the reason someone drinks" is largely a circle.

FSD driving in decently heavy rain (this is mine): https://www.youtube.com/watch?v=uKePEavEhv

Both of the above aren't current consumer models and the Cybercabs run one major version above this.

I've seen it avoid small rodents and deer that were hidden in foliage around a blind turn, it's super freaky with what it sees that humans can't and this is with only cameras. It is really good, in my experience, at reasoning about other vehicles and what they are about to do such as seeing a vehicle not slowing down quickly enough at a stop sign its crossing so it slows itself down to make sure the car stops. My favorite story is that it swerved out of the way of someone doing a u-turn from the opposing lane hidden behind another car; it had already gotten us out of the way before anyone in the car realized what had happened.

An AV is already superhuman because it never loses focus, it can see all the way around the car, and it can react quicker than any human, besides maybe an F1 driver, could.

If you aren't familiar with SAE AV levels, check them out. It is a common refrain that L3 AVs are a SUPER bad idea because they would be 99.9% perfect at driving but could still mess up so 'drivers' of them would become too trusting and minimally attentive which would cause accidents.

The common thing is that L3 needs to be skipped entirely so a car should either be L2 and wouldn't be good enough to drive entirely on its own for long periods (lane assist, low speed traffic jam chauffeur, etc) or L4+ where the car can drive on its own but if conditions degrade where it can't continue it is capable of finding a safe spot to stop rather than aborting in the middle of driving suddenly.

The controls vs no controls isn't really an argument. Like you said, it will basically be fine either way if the system is sufficiently advanced especially if autonomy can't be disengaged while moving.

My understanding is that it is a legal and safety liability for them to drive. The driver is employed by and the car is owned by a company that the wealthy person founded and pays so if the driver hits & kills someone, the company gets sued for a bunch of money then the liability can be discharged in bankruptcy / isolated to the company's coffers rather than the wealthy person's.

It's the same gambit as their security. I am sure more than just Gates and Musk do it but I know that both of them own personal security companies who only provide security to themselves. It's all just shells of liability shielding.

If it is 2am and you need to get home as a woman, it would be a no brainer to get in an autonomous vehicle while going on public transit is a bad coin flip on being harassed at minimum.

If you are wheelchair bound and the elevator is broken, wheelchair ramp is broken, or someone is already using the wheelchair spot, you just have to wait for luck to change.

If you have sensory difficulties that make public transit uncomfortable, private transit is always the better option.

The list goes on for many reasons and people that having only public transit would harm. The idea we can get rid of or otherwise push out private transit marginalizes everyone who isn't prototypical nor should we hand-wave that they can just rely on runs-on-other-people's-time disabled specific transports to get them into city centers because private transport isn't allowed in.

A good version of this kind of system would be pushing as much LLM magic out of the core and having solid internal tools that personas/agents _happen_ to have access to. So rather than having one big messy ball of ~*~magic~*~ where it burns tokens trying to invent strategy and keep track of every thread via memory, you have a few personas that manage specific tools to gather information about the world and outlay of the company. Inside those specific tools/platforms, you can have ~*~magic~*~ to do things deterministic code can't while still keeping the magic halves of CMO and copywriter separated by a deterministic concern-specific platform so structure is consistent and enforced by strongly typed code.

The model I think many go after is a strong monolith when the idealized 'autonomous company', in my opinion, should be decentralized and largely tool-driven rather than agent-driven along with not re-inventing the wheel / pushing third-party integrations out to the edge or later in the roadmap. It's a lot easier and better to just write an MCP against Linear than re-inventing the wheel on a todo app basically.

Let me know if that is your design because whenever I look at stuff like this, especially the broad promises of an autonomous company, all I can think about is just a slop factory that produces even worse slop the longer you run it due to agents running away and inventing new things.

Literally nothing could get delivered to me if they used a Google Maps address bar. My address just didn't exist at all to that search bar. It could be found on maps, just not on that little search bar widget.

I ended up just putting my neighbors address and either intercepting delivery drivers or putting in the notes that I was at the half address next door.

Moral of the story: check your potential address BEFORE you move in

I am asking that partially as a rhetorical question but also wondering your thoughts on when to deploy 'loop engineering' versus 'one-shot' versus writing the code yourself.

Additionally the post seems to talk in broad strokes without a specific proposal on a 'scorer' / determining adherence to the state goal. Do you have a thought on how that should be expressed? Do you feel that a human in the loop slows things down unnecessarily?

That will happen before you sell the company.

> By the way, madamelic.com appears to be available.

Hmmm! I may have to grab this one. The one I really want is madeline.com (it's owned by the family who made Madeline the book) but I am doubtful I will ever get that one without loads of money or ever, hah.

I am hesitant to say the domain because of spammers but it is the [shortened version of that name].today.

I have a domain name with the TLD of "today". Many people think my email is [email]@[domain].today.com. It's not just the common person's fault but also software engineers / product managers who still have a very restrictive view of what a TLD is (under 3 three letters is the primary restriction I hit).

Since I don't believe we'll ever convince people that domains longer than 3 letters / full words are TLDs, I think the solution is every human being gets 10 domain names at marketprice then every domain ownership above that gets graduated ownership costs; the first year is market, second year is $100, third year is $500, fourth year is $1,000, and so on until the 10th year where it levels out at $10k per year.

The idea of it being if you want to hold onto a lot of domains you need to pay for it or make the domains economically viable. With what is essentially infinite space, we shouldn't be allowing domains to be like finite real world real estate to be speculated on.