But then I found this:

https://craci.com/resources/CVE-publication-trends?sev=criti...

Trend for critical CVEs is actually worse, at roughly 25x that of 2020, compared to all CVEs which are roughly 5x compared to 2020.

It's not clear to me from the article if the comparison is with locally compiled binaries, that would be the fair comparison.

I would expect this to be better all rounder in theory, but it would be interesting to see what the difference is from a locally compiled baseline, and therefore if the complexity, obscurity and cost is worth it (again probably application and hardware dependant question).

> it is tempting to view the algorithm as based on cellular automata (Sarkar 2000), yet the lack of parallelism and the strange shape of the 'neighbourhood' of cells surrounding X makes the cellular-automata notion contrived.

If you consider rows as time then dependence is local rather than global. It looks like a 2D automata with a temporal neighbourhood component. And IMO asymmetric or nonuniform neighbourhoods dont necessarily exlude it from the definition, but affects its classification.

Does anyone with deeper academic overview of CA have any insight here? I find many things can look like CA if you stare at it right, but am never sure where to draw the line (maybe there isnt one)

There is a 3rd option: malicious stupidity / aka wilful ignorance.

Google is a collection of individuals, so it's very likely both sides of Hanlon's razor are true: a little malice from those in control, persisting a state of stupidity for those executing the process.

As others have pointed out, there will be resistance to improving a process that negatively impacts their bottom line. Incentives, dictate long term behaviour of organisations; whereas Hanlon's razor works better at an individual level IME.

It's not uncommon practice to omit the security implications on public facing commit messages when fixing secirity issues, so as to not to draw attention until it's ready for distribution.

The problem is the incentives, even though TVs represent a higher turnover for LGE (roughly $1 B), they barely break even, whereas most of the 0.5 B from their advertising division (made through the TVs) is majority profit. They don't want you to use their TVs as monitors (they lose money that way), they are highly incentivised to find a way to track you. This is not unique to LG but they seem the worse affected while having the largest chunk of the market.

I feel a lot more comfortable with a monitor controller attached to the same OLED panel rather than trying to figure out if i've neutered LGs ad department enough, or worrying about it somehow independently gaining network in the future after monitoring everything in isolation as proven in this latest news. I think LG tvs doing something like automatic exfil via their own mesh network in future is not far fetched, it's practical with their market share and they have the incentives.

I haven't finished researching yet but happy to discover this category of monitor is a thing now, with close enough to the latest display tech at reasonable prices. I've never owned a TV either and I keep getting stuck trying to buy one because they are all so horrible.

These are essentially huge TV panels, with basic TV features like a remote control for the OSD. I guess because it's what gamers want... A TV scale monitor for use as a TV without all the smart TV bits which ruin games. There are also a bunch of "Smart Monitors" in this category to be ware, including from LG. The work is in distinguishing the true large format dumb monitors from the smart TVs in disguise.

[0] https://www.trustedreviews.com/reviews/asus-rog-swift-oled-p...

But also vertical scaling seems to be able to handle so much these days that more people probably aught to ask themselves if their application is ever likely to truly need horizontal scaling - Maybe my work is just a small pond, but I suspect we will eventually end up in a place where the vast majority of applications are happy on a single box, and only twitter scale things need to care about this stuff.

.. or maybe I lack imagination of what possible future applications might make use of such massive horizontal scaling on such capable individual boxes (seriously).

If the purpose of down votes is to guide discussion away from uninteresting or counterproductive paths, then it also scoops up divisive comments.

I suppose divisive comments are potentially disruptive if they are particularly flamey. But it seems like they deserve to be distinguished from more objectively negative comments. If the raw up/downs were exposed it would be interesting to experiment with this in the front end.

What's being ignored is the 1/100 of these stories where this judgement pays off, saves aircraft and lives that make the other 99 worth while.

The examples show the concrete use cases... Basically giving you the wiregaurd + DERP quality tunnel but as a one shot point to point cli tool. Which is a nice upgrade from the alternative "in a pinch" tools.

RE "how much tailscale" I guess it's the DERP bit + this minimal point to point control plane. Without which it's significantly more configuration to get the wiregaurd tunnel working, or impossible because of NAT, unless both machines are on the same ipv6 network.

TS basically sell the full control plane with Auth and ACL style management etc as their product so this doesn't really compete.

Trust, stability, security. The reasons many people run Debian.

Although I think the main incompatibility in philosophy here is in "hand that off", e.g. direct agentic usage eroding opportunity for human judgement, which seems unlikely to be adopted anyway. The realistic proposals are essentially AI use with various guard rails and rules to preserve that human judgement (my interpretation).

Actual Proposals (scroll down): https://www.debian.org/vote/2026/vote_002

LLMs operate in abstractions. "Reasoning" is bolted on.

Large groups of people in a poor country steal from rich countries, and your explanation is a morally corrupt culture? not the obviously extremely poor prospects of it's citizens?

> They have none, or worse they can talk themselves into this "Robin Hood" psychosis, where stealing the pension from the elderly is just fine, because they are part of the upper crust of the world.

You're describing a cartoon character. Most of these people are trying to survive, not make some kind of twisted moral stand. Please try to recognise the privilege your place of birth affords you and how much of a global minority you are in. Incentives are everything here.

I don't disagree with your sentiment, but as someone who manages infrastructure which is literally on the opposite side of the planet (from me) RTT is long enough to be objectively horrible for anything interactive like typing over SSH. At least 250ms capital to capital for Europe to Oceania + last mile latency makes 300ms a more realistic minimum + actual processing time + client side rendering and it really starts to feel like a half second from the full human perspective... Under ideal conditions.

The crux is here somewhere.

A massive group of people (A), don't fully understand or care about code, but they care about arbitrary specific outcomes that serve their needs and desires VS a tiny group of people (B), who initiate, architect and maintain successful projects, who care deeply about the health and cohesion of the codebase over it's lifetime, because that serves everyone.

Group-A is now liberated for better and worse. For the first time they can force their will upon a codebase without understanding. They are making selfish changes, and that's fine, this is hacking for the masses. The problem is they still don't realise these are selfish changes, because they have not been forced to tread the path of the programmer to understand they are selfish changes.

The response from FOSS maintainers seems inevitable from this perspective... But I think what's going to be more interesting is watching how Group-A over time respond to creating their own personal hell.

As group-A accrete more and more unsupervised selfish changes into their forks - at what point will they implode and turn into LLM-token-tarpits, at what point will Group-A notice, and I wonder what their response will be.

This default can affect all consumers of NPM packages, regardless of whether you use yarn, pnpm or npm itself, because most package maintainers use NPM. This is why it's NPM's responsibility to change this default in order to prevent spread of malware in packages.

It's a convenience feature that provides built-in Arbitrary Code Execution (even for transient dependencies), and every one of these widespread NPM worm style attacks has propagated through it, because of the default setting. Also enabling it for one command shouldn't automatically permit all transient dependencies to run lifecycle scripts, it should be required to explicitly mark each dependency to limit it to where it's absolutely necessary.

The vast majority of NPM packages do not depend on these scripts, and you should disable them globally if you haven't already.

OK, Question: Would this outcome still benefit society overall?

In the aftermath of this bubble "AI" will still have utility, like the dotcom bubble. So lets say FANG doesn't make a return, how much should we care? How much of this investment is sunk cost that would continue to provide value, and how much of it is operation costs just keeping the lights, I mean GPUs on, that would become unviable post-bubble? As an immediate effect, what happens to these AI companies? or if they become insolvent, what happens to the assets and tech? and what are the secondary economical effect to society if FANG doesn't get their ROI?