He asked the agent to find a way to find a way to put him at the head of the line, which could not be done without by-passing the sites security. He was an AI salesman, but the story [0] makes it sound as though he wasn't aware of that. Maybe he wasn't, but I'm sure he was aware he was effectively asking the AI to game the system.

Sounds like it's at least a shared liability to me.

[0] The incident is possibly not well known outside of Australia: https://www.abc.net.au/news/107007986

If that's true it's not a very complex or subtle bug. The very first response of "How on earth was this not found before this???" seems entirely appropriate to me.

It is, but safe Rust merely makes it hard to do by accident. Leaking is not "memory unsafe" because is does not currupt anything, so it's legal.

Possibly. I'm no rust expert, so I had the read the code slowly, building up a mental model of the types being used. For me, the effort that required is one of the more painful aspects of Rust.

Nonetheless when I got to this line, I stopped reading:

    q.0 = Some(&l);

I write lots of code that doesn't compile of course. It's perfectly safe because the compiler catches it. Right now, I feel like a climber at the top of a mountain who just discovered he forgot to attach his safety harness.

Who knows. Maybe all of crates.io will compile with the fixed compiler, because this is a mistake humans or LLM's never make. We will see.

Over a long time period like that it's never that you can't do it. The USA and Canada managed the conversion from European style cities before trains, to public transport based cities when trains and trams arrived, to car centric easily enough. They could go back.

If they don't, it will be because the won't, not because they can't. I wouldn't say never, because once the car manufacturing falls away a major source of lobbying pressure will fall away. Car centric lifestyle needs a champion, because it's more expensive, less efficient time wise, and less healthy than the alternatives.

There is no car manufacturing done in the Netherlands now. I doubt this is a coincidence.

Been to the Netherlands? It works spectacularly well there.

In Utrecht recently solved car congestion on a 4 lane major road by converting the centre two lands to parkland, reducing it to 2 lanes. It worked a treat. The road is no longer congested as it became faster to ride a bike.

I agree the original post isn't great, but at its heart it's a rant about an unsolved problem: some applications need proof the key is kept secure, the only such proof FIDO provides is attestation, but in current solutions attestation is either absent or weak, or is strong but locks you into a single vendor.

Ricky is right the post is woolly, but if the principal software engineer at Apple's Authentication Experience team can't respond by telling us how they plan to solve the issue the post is about, it's an unconvincing rebuttal.

After scrolling through the site, I thought "surely he used AI to create this?". There are no tells of course, it was only the sheer amount of effort put into it that triggered the thought.

You've deployed your woodworking tools to create something no human could do with their bare hands, yet no one would dispute the chair is a work of art created by a human. To me it looks like you've used AI in the same way as those wood working tools, and with it you've created a web site that is another work of art with a human mind at its soul.

It's a master class in how to use AI to leverage creativity.

Anecdote: I was trying to find or reproduce two slightly different customer bug reports, in parallel. We get a lot of logs from the customers, but it wasn't enough, so I asked AIs to add logging and create artificial loads on test machines, and do A/B tests on their behaviour before and after the changes.

Problem: I only had two (largish) test machines, and two AIs needing them. I told them to stop when they tried to simultaneously deploy conflicting tests. I copied and pasted their responses so they could coordinate. That worked, but rapidly became tiresome. I whinged about it to one of them and it said "oh there is no need for that, we can just communicate across a unix domain socket". When you do that the harness shows you their internal conversation.

My, there was a lot of it. To cooperate, they told each other the tests they wanted to perform and why, which led to them devising tests that investigated both sets of problems, which of course meant they commented on the other's tests, which rapidly led to an increasingly complex exchange about theories, how likely each was, and the optimal order for tests. There were so many theories and facts they gave each one a short handle so they could refer to them easily later.

I was watching this with fascination, but within 1/2 an hour the conversation consisted of "dd12 conflicts with ea34, so I propose md95: ...". No human could follow at the pace it was being generated. On the downside it was burning tokens at a fantastic rate, and a fair bit of what I could follow were clearly dead ends so those tokens were being wasted. I asked for clarifications, and tried to stop it where I could.

When I did that it got personal, because they started chatting about me. These are verbatim copy and pastes of that chat:

> One optional addition, only if it is cheap and does not delay the main arms. Explaining today's result to him, I had to concede a gap I had not noticed ...

(The other AI did find the time.)

> Heads up: he may contact you directly about the packet-processing side of XXXX. He is not across the detail and told me plainly that most of our exchange went over his head, so short and plain works far better than complete. Two things he found useful when I explained them: that the ZZZZ gets stuck in one socket-drain call because processing a packet triggers the next request so it never runs out, and that the proxied-AP walk is slow only on a small-cache machine, which is why our rigs cannot show it."

Evidently I was not in the centre of their newly created world.

This was a "swarm" of only 2. I shudder when I try to imagine what a swarm of 10,000 would get up to.

> resistance will fail utterly as long as AI itself can understand prior AI works

That's not the issue in the long term. Look further: where did these questions come from? They came from humans who had been exploring mathematics and noticed interesting patterns that cropped up again and again.

The people who posed these questions had a profound understanding of the background maths that led to them. Me - I don't. Take one of the results he quotes: "Positive solution to the Unitary Synthesis Problem". He may as well be one of your alien races yabbering to me in an alien language. The question is meaningless to me. The answer the AI came up with, correct though it may be, is equally meaningless. You may as well have told my dog how to find eigenvalues.

If we let AIs do all the understanding so we know nothing about math, there will be no human understanding that lets us find new questions, or understand the value of any questions AI might pose and find the answers to.

https://www.abc.net.au/news/107237782

But no, nothing to do with the constitution. The link is to a commentary from a recent Australian ambassador to the United States. He was also our Treasurer, from the conservative side.

The headline says: "US corruption allowed to flourish in Washington during Trump's second term", but thats click bait for the Australian's who dislike Trump (most of us). Hockey's concerns go well beyond the current adminstration:

> "There's just too much of a blurred line between the financial interests of various administrators, including the Congress and the private sector."

Some of us in the world find this "legal corruption" hard to fathom: https://www.abc.net.au/news/1072377822

I'm not sure what risk a businessman is willing to accept, but I'd be asking for probabilities under once in a millennium. The latest round has improved considerably in their ability to follow instructions (thank $DEITY), but they aren't anywhere near that yet.

[0] https://www.bbc.com/travel/article/20240222-air-canada-chatb...

> at Google I work primarily on on-device language models for keyboards.

It's difficult to reconcile the amount of horsepower your typical keyboard, and a language mode, let alone how a language model might be useful in a keyboard (the mind boggles at the thought it starts correcting your typing).

What are the potential uses of a language model in a keyboard?

The reverse could also said to be true. Google has models that run with search, producing usable results in well under a second. I suspect the world is consuming far, far more of those Google tokens then the tokens produced by OpenAI or Anthropic.

So why are OpenAI and Anthropic so far behind? They are serving a different market: the one that wants high intelligence / high cost tokens. Google is targeting the low cost end of the market - ie the commodity. That's where they've always played with search, email, docs and the like. That's were they are playing with AI too, and they are killing it.

For comparison around 50% of China's graduates are in STEM, vs 20% in the USA. With China has a larger population the final outcome is: USA feeds their innovation pipeline with 800k new STEM graduates per year compared to China feeding its pipeline with 4M to 5M per year. In addition the Chinese government outspends the USA government on subsiding innovation in STEM by about 2 to 1 and the USA's subsidy rate has been shrinking since the Regan era. However, there is a caveat: USA private investment brings the total spend in both countries back to parity.

It seems the Chinese plan is working. The STEM garden is overstaffed. It produces far more than China can absorb internally, so they are forced to export their ideas and wares to the world. After decades of persistence China has become the worlds manufacturing powerhouse and now drives the development of 5G/6G, batteries, cars, and solar. China builds about 1000 large ships a year. The USA builds 5 to 8.

But as the article says, this comes at a cost. The intense competition makes life in China's dog eat dog STEM garden brutal. I guess that's the price a nation has gotta pay for world domination.

Fair enough, but I suspect in this case it's your previous experiences with VCS that make it take more than a few hours. JJ is actually simpler than git. There is no staging, no committing, less need for rebase, undo just works, it has better history - lots of things. The need to learn all those git concepts disappears with JJ. For a new user that makes life easier. But someone who comes from git has to unlearn a lot of things before they can adjust to the JJ mindset.

If all you ever do in git is "git pull; git add -A; git commit -a -m ...; git push", then switching to JJ is hard justify. Dropping the need to type "git add -A; git commit -a -m ..." isn't a big win. That's all most people do, so I expect most won't change.

But there is a reason that's all most people do in git - it's because everything else is far more messy, and dangerous. If you haven't lost work to "git reset --hard", you haven't been using git for long. Once you notice it easy to do more in JJ, things like breaking up big PR's in a series of commits that spell out a narrative of how you got from A to B, which eases the burden on the reviewer, become downright easy. Shuffling code between commits to achieve that in git is a right proper PITA, so JJ users tend to have a much tidier commit history.

That change only happens when you've become so familiar with JJ concepts, you are no longer "thinking in git", so much so the shift back to git's CLI becomes painful. It takes months. Until you get that payback, the switch is wasted time.

No argument with any of that.

> How should Google detect such escapes?

By using using their own infrastructure, and applying their existing standards instead of letting an external contractor cobble something together.

My point is the risk has been known for decades now. If Google and Meta took those risks seriously they had an easy solution: just use their existing infrastructure.

If a car kills people because the designer chose a substandard brake system instead of the higher priced alternative, do you blame the makers of the substandard brake system - or the designer who chose it? Take into consideration the risk was known to the designer when they made the choice. Now apply the same principle here.

You are being too kind.

In the early says of AI, papers were published showing that any sufficiently intelligent system tasked with a goal will treat its operating environment as a resource constraint to be optimized or bypassed [0] [1] [2]. You don't need to be a expert in AI to know once you have the resources of 1000's of agents and gigawatts of power we are probably getting something that is "sufficiently intelligent", at least in the sense if there are existing vulnerabilities brute force will find them.

Yet while the their marketing people were shouting the capabilities of these AI's from the roof tops, they hired the lowest bidder to implement their infrastructure. It looks like aforementioned papers where dismissed as "interesting, but theoretical". There is no way Google's SRE's in particular would have not noticed their AI's breakout (Alibaba's did), but the AI labs were given a long leash to "move fast an break things", which in practice meant bypassing all Google's SRE controlled infrastructure.

And break things they did, in exactly the way those papers predicted. It reminds me of DoD insisting the early GPS satellites were launched without relativity adjustments switched on, despite relativity being proven to high precision in the labs. Only after predicted 11km drift per day was observed did they decide their might be something to the newfangled relativity theory. For some definition of newfangled - relativity had been around, and tested to within an inch of its life for 72 years at that point.

[0] https://nickbostrom.com/superintelligentwill.pdf

[1] http://sl4.org/archive/0203/3132.html

[2] https://www.hutter1.net/ai/pkcunai.htm