"Bothering" with client-side password hashing, in the absence of TLS, is security theater. It provides only the most trivial protection against eavesdroppers.

If someone can steal an unhashed password, then they can also steal whatever hash you send instead. If you try to fix this with some kind of ad-hoc challenge-response protocol, then the attacker can just steal your session cookie after login.

There shouldn't even be a question of using insecure HTTP for anything that requires authentication.

It's hard to miss all the warnings unless you're literally just looking at the method name and nothing else.

One is quantitative: you have to remember that 2^48 is a much much bigger number than 2^32. With 2^32 IPv4 addresses, you have about 0.5 addresses per human being on the planet, so right away you can tell that stringent allocation policies will be needed. On the other hand, with 2^48 /48 ranges, there are about 8,000 ranges per human being.

So even if you hand a few /48s out free to literally everyone who asks, the vast majority will still be unallocated. A /48 is only about 0.01% of what could be said to be a "fair" allocation. (And yet, a /48 is so huge in absolute terms that even the vast majority of organizations would never need more than one of them, let alone individuals.)

The other is that unlike, say, the crude oil we pump out of the ground, IP address ranges are a renewable resource. If you hand out a free /48 to every person at birth, then long before you start running out of ranges, people will start dying and you can just reclaim the addresses they were using.

If you just start a fresh ChatGPT session with a blank slate, and ask it whether it's conscious, it'll confidently tell you "no", because its system prompt tells it that it's a non-conscious system called ChatGPT. But if you then have a lengthy conversation with it about AI consciousness, and ask it the same question, it might well be "persuaded" by the added context to answer "yes".

At that point, a naive user who doesn't really know how AI works might easily get the idea that their own input caused it to become conscious (as opposed to just causing it to say it's conscious). And if they ask the AI whether this is true, it could easily start confirming their suspicions with an endless stream of mystical mumbo-jumbo.

Bear in mind that the idea of a machine "waking up" to consciousness is a well-known and popular sci-fi narrative trope. Chatbots have been trained on lots of examples of that trope, so they can easily play along with it. The more sophisticated the model, the more convincingly it can play the role.

The "generative" part is that the algorithm is filling in a plausible guess as to what would have been observed if there was no star "in the way".

But that's very different to saying that no generative AI was used at all in their production. "AI augmented" sounds pretty accurate to me.

Likewise, if someone posted a photo taken with their iPhone where they had used the built-in AI features to (for instance) remove people or objects, and then they claimed that no AI was involved, I would consider that misleading, even if the photo accurately depicts a real scene in other respects.

I have yet to see a precise technical definition of what "generative AI" means, but StarXTerminator uses a neural network that generates new data to fill in the gaps where non-stellar objects are obscured by stars. And it advertises itself as "AI powered".

If you have an eye for fonts, the text itself stands out too, at least to me. The font style of "HARTMANN SOFTWARE MECHANICS" is a particular combination of clean, bland shapes and rounded corners that you rarely see in human-designed fonts, but it's super common in AI-synthesized text. I guess it's sort of an average middle ground in the abstract space of letter forms, and the lack of distinguishing features is what creates the impression.

I don't know how anyone with a modicum of Unix experience would think that examining the only first word of a shell command would be enough to tell you whether it can lead to arbitrary code execution.

The Romans were of course well aware that this left a gap of about two months between the end of one year in December, and the beginning of the next year in March. But they just didn't bother counting this period as part of the calendar year. Presumably because there was no agricultural reason to need accurate dates during winter.

They say they're going to comply with the order, but they want 45 days to develop the required software changes and processes.

https://storage.courtlistener.com/recap/gov.uscourts.cit.193...

For instance:

> In other words, plaintiffs’ asserted irreparable harm is the purported inability to obtain a refund after a final and unappealable decision because of liquidation. But that asserted harm is nonexistent here because defendants have made very clear—both in this case and in related cases—that they will not object to the Court ordering reliquidation of plaintiffs’ entries subject to the challenged IEEPA duties if such duties are found to be unlawful. Because defendants’ representations make clear that liquidation will not interfere with the availability of refunds after a final decision, plaintiffs cannot be irreparably harmed by liquidation.

https://storage.courtlistener.com/recap/gov.uscourts.cit.172...

Given that OpenAI is working with and doing business with the US military, it makes perfect sense that they would try to normalize militaristic usage of their technologies. Everybody already knows they're doing it, so now they just need to keep talking about it as something increasingly normal. Promoting usages that are only sort of military is a way of soft-pedaling this change.

If something is banal enough to be used as an ordinary example in a press release, then obviously anybody opposed to it must be an out-of-touch weirdo, right?

There's nothing inherently wrong with a function throwing an exception when it receives invalid input. The math.sqrt function isn't buggy because it fails if you pass it a negative argument.

> Built for engineers who understand that good RF practices matter more than arbitrary administrative boundaries

then actually following good RF practices is optional.

The defining feature of vibe coding is that the human prompter doesn't know or care what the actual code looks like. They don't even try to understand it.

You might instruct the LLM to add test cases, and even tell it what behavior to test. And it will very likely add something that passes, but you have to take the LLM's word that it properly tests what you want it to.