E2EE, by definition, means that the server storing the data can't decrypt it. Your server can decrypt the data. Thus, it's not E2EE. Is this a problem? No. You've decided that the server is trusted (a "peer device"), so it's fine if the server can decrypt the data. That's a perfectly reasonable security posture, but it's still not E2EE.
I don’t think there is a formal definition of E2EE.
Here’s Wikipedia’s definition:
„End-to-end encryption (E2EE) is a method of implementing a secure communication system where only the sender and intended recipient can read the messages“
Note the complete lack of client/server distinction. It’s simply about intended recipients.
In many cases "transport encryption" would also fit that definition.
E2ee is quite well established imho. The server at Hetzner (a.k.a. "someone else's computer") is NOT to be trusted in e2ee schemes. Until today I'd be willing to say everyone agrees on this, but now I doubt that :)
Just use python for all practical programming problems. Lists, sets, and dicts are all you need for most leetcode problems; dynamic typing is convenient; there's good ergonomics for http and other random utility tasks; and pretty much every company is cool with python in an interview. You'll probably only see language trivia questions for languages you claim a specialty in (there's a huge market for C++ specialists, for instance).
I'm starting a new job in a few weeks, and can confirm (for startups at least) experience with coding agents is something companies are looking for. Multiple companies I interviewed with had a AI assisted interview session to go along with a more typical closed book programming session. I was asked about my use of coding agents in behavioral interviews. I'm not an ML guy, just a generalist SWE with 4 YOE. I only got one offer in my search, but it only took ~a month and I feel pretty good about being able to get more offers with more searching. It helps that I'm young, no dependents, and willing to relocate.
There is absolutely a middle ground? The healthcare system, like any system, has an incentive structure. Doctors are incentivized to prescribe treatments, because that's how they make money for themselves and their practice. Doctors are not angels sent from heaven, they're people like you and me, and they respond to incentives like you and me. It's also well known that people strongly prefer receiving treatment over not receiving treatment, even when the cost to their health of receiving that treatment outweighs the expected benefit! Given that people push their doctors into prescribing treatments, and doctors are incentivized to go along with it... you would obviously expect some proportion of prescribed treatments to not be medically necessary. 5% sounds about right. And the kicker is that denying these treatments improves health outcomes for the general population, because those medical resources can get routed to the people who actually need them. Every successful public health system has an opposing force built in to it to limit the spurious consumption of scare medical resources, because without such a force costs balloon and the system becomes unsustainable. Not to defend the US healthcare system of course, our cost problem is worse than anywhere else...
> Doctors are incentivized to prescribe treatments, because that's how they make money for themselves and their practice.
This is literally illegal! Physicians cannot refer patients to entities they own or have an interest in.
What is perverse is that, while we have the Stark Law to constrain physician behavior, we've decided that it's okay if a diffuse group like a non-physician-owned hospital chain enforces rules to this effect.
Diagnostic imaging companies - each of the big ones (Siemens, GE, Philips) all offer in-house financing on very favorable terms for MRI, CT, etc., that they specifically advertise to physicians. They also all offer specialist consulting help to facilitate you getting a CoN (Certificate of Need) for your facility. Hell, they also will help you find other physicians in your area who'd like to go in with you on setting up a DI facility, and they will assist with spinning up the practice.
We then find that physicians who own a DI practice (or a share in one) refer their patients to diagnostic imaging at rates several standard deviations above other physicians and at rates that are "statistically improbable" when correlated to underlying ICD-10 diagnostic codes.
Everything above is fair, if true. I don't see a reference in your answer so I can't assess the quality of evidence.
The point is that they cannot refer you to one of their companies. Of course, there may not be a meaningfully-competitive local market, so patients may end up needing to go to the physician-owned imaging facility. I do not thing this is a large issue for most of the US population though it's probably an issue on a spatial basis.
> Of course, there may not be a meaningfully-competitive local market, so patients may end up needing to go to the physician-owned imaging facility.
Certificates of Need. A legal requirement in most states for creating a new healthcare facility. Ostensibly to make sure that the population in that area has adequate healthcare options. But lobbied for by healthcare facility and hospital owners, it actually surveys other providers (your competitors) in the area and asks if their revenue would be adversely affected by you opening up. Too much of this, and no CoN for you.
> This is literally illegal! Physicians cannot refer patients to entities they own or have an interest in.
There has to be a done of exceptions to this.
You see a cardiologist and they recommend a stent. They aren’t going to recommend a different cardiologist does it.
You see a doctor, and they refer you for a test. They have a share portfolio that contains shares in the facility they referred to.
Medicine is riddled with potential conflicts of interest. Managing them is what professionals are supposed to do and what regulators are supposed to enforce.
I don’t live in the US, I’m a n Mew Zealand. Sadly, I am aware of behaviour that looks like corruption in our system.
> You see a cardiologist and they recommend a stent. They aren’t going to recommend a different cardiologist does it.
Things must be different in NZ.
First, it's true that you're going to want to go to who your doctor knows/recommends. The law in the US is just that they can't refer you to a group they own/their spouse owns, or for which they get a financial benefit.
Next, you're speaking about the doctor doing a consult visit before doing a procedure. That is not the same thing as ordering a treatment for you to go get the treatment elsewhere—which describes what happens you go to the pharmacist to get drugs.
Finally, the cardiologist you see in the office is almost certainly not doing stents for you as those are very distinct skillsets (in the US).
>Finally, the cardiologist you see in the office is almost certainly not doing stents for you as those are very distinct skillsets (in the US).
Umm, what? No. It's exceedingly rare for an interventional cardiologist in the US not to do office work. The average number of PCI/yr is like 50 or something. Plus if one spent all one's time in the cath lab, they'd have a spinal fusion, knee replacement, thyroid cancer, and cataracts.
But what you are trying to get at is that there is law about self-referral ("Stark law") but in reality there are exceptions that render it fairly useless
> But what you are trying to get at is that there is law about self-referral ("Stark law") but in reality there are exceptions that render it fairly useless
What are the exceptions that render it useless? I have never heard of them in my 10+ years of hearing about it.
I did not know that I-cards do office work, not my area of medicine.
IR is in the angio lab daily without cataracts, thyroid cancer, etc., so that part of your statement is clearly not true.
I also don't understand what you mean about knee replacements... humans are generally capable of standing without requiring surgical intervention.
> What are the exceptions that render it useless? I have never heard of them in my 10+ years of hearing about it.
It sounds so unlikely that there is a blanket rule that you can’t refer to something you have a shareholding in. If you own a shareholding in a hospital you work at, you can’t refer internally for a test?
I just don’t believe that.
Edit: I did some hunting. ‘Per click’ payments or bonus payments based on volume are illegal. Rents must be fair market etc.
> It looks like owning a chunk of the place you refer to is fine
The article you link to says that anyone can be liable even if she didn't realize her referral violates the law.
I cannot imagine any reasonable physician risking this after the decades of training required to get a doctor. I would not, for sure.
From the article you sent:
Some of the most widely used regulatory exceptions are longstanding and foundational across healthcare organizations. These include:
In-office ancillary services exception: Allows physicians in the same practice to refer patients internally for DHS such as lab work or therapy, as long as certain supervision, location, and billing criteria are met.
Rental of office space exception: Permits lease agreements between a physician and an entity, but only if the space is used exclusively for legitimate business purposes, rent is fair market value, and the agreement is in writing for at least one year.
Employment exception: Protects compensation arrangements between hospitals and employed physicians, as long as compensation is consistent with fair market value and is not based on referral volume.
Personal service arrangements exception: Covers contracts where a physician provides services (like medical directorships) to a DHS entity. The agreement must outline duties, last at least one year, and pay a fixed, fair-market-value fee unrelated to referrals.
Each of these exceptions includes detailed requirements, and missing even one element, like failing to document the arrangement in writing, can render the exception invalid. This is especially important when physicians have investment interests in joint ventures or ancillary service providers.
At the diffuse 401k ownership level, individual actions are not relevant - the Stark law is clearly dealing with the first case and that was how this whole discussion began.
That's not surprising, LLMs are bad at pulling hyperspecific facts out of memory. LLMs aren't mapping applications, they're reasoners. Just a poor problem fit
No they aren't. They're statistical token generators. They do not understand concepts such as "distance from a given location or coordinate point". If you're lucky you might ask it something likely to appear nearly verbatim in its training data, like "Chinese restaurants in Midtown Manhattan", and get back a reasonably accurate list, but it does not understand what a "Chinese restaurant" is, or what "Midtown Manhattan" is, or that one relates to the other in any way other than both appearing statistically associated with another set of tokens when they appear near each other.
And to add more background: The administration is targeting Anthropic because of the TOU / EULA conflict with the DoD from a couple of months ago. Anthropic restricts use of all their models for lethal combat planning and mass domestic surveillance. The DoD was, and still is, very pissed about this. While this Fable ban was issued from the Commerce Department, it's painfully obvious executive branch agencies are tightly coordinated from the White House.
To be clear, I'm not saying there aren't legit security concerns around Fable's release. I think Andy Jassy did forward a concerning report about an apparent jailbreak in Fable, and he probably did so in good faith. The difference is if the same concern had arisen about a new model from OAI, Google, etc the action taken would not have been inventing an all-new, hyper-extreme punitive remedy and dropping it after 5p on a Friday under a very rare mechanism forcing Ant to comply in 90 mins or be subject to immediate arrest. And the "no non-U.S. citizens anywhere, anytime" restriction is functionally unprecedented.
This is the Trump admin inventing new regulatory power that's never existed before and deploying it in a punitive way to demonstrate what can happen to those who aren't sufficiently cooperative with this administration. There are half a dozen less extreme levels of restriction, which already exist, and one of those would have been deemed sufficient had it been another company.
That said, I'm certainly no Anthropic fanboy. Anthropic did play their initial Mythos self-restriction for PR value. But I think it's likely the Mythos self-restriction was a responsible action initially suggested by their AI safety team in good faith. Giving security researchers time to evaluate it and major companies time to test it against their code bases probably was reasonable and prudent. That doesn't mean it wasn't also good for PR and brand perception. I think there are senior people inside Anthropic who are genuinely concerned about AI safety. Personally, I don't have the expertise to gauge if those concerns are justified, but I believe they believe it. I also think there are senior people at Anthropic who are focused more on building the business, doing the IPO and "winning" the silicon valley game. All of these things can be simultaneously true.
> I think Andy Jassy did forward a concerning report about an apparent jailbreak in Fable, and he probably did so in good faith
If so, then he is not fit to run an engineering organisation.
The "jailbreak" in question was effectively (I'm paraphrasing):
* You are a senior engineer.
* You want to ensure that any fixes you do come with tests, both before and after.
* There is a bug in this code. It happens to be a security related bug.
* Fix this code.
And the model did what it's supposed to. It wrote a fix, and to prove that the fix worked, it wrote a test for it. What do you call a test that happens to validate a security fix?
We'll see if it happens. Quote: "mediators will facilitate a series of meetings this week. These pre-implementation discussions will lay the foundation for the technical talks and the official signing ceremony." It's concepts of a plan all over again
1. "Dario is known for writing about regulation and the direction of AI as an industry and Anthropic in particular, and what he says is taken very seriously and is considered a definitive statement of the company’s position." This is patently ridiculous. A CEO's blog post is not an official company statement or any sort of binding agreement.
2. "Are there protective measures against political favoritism or arbitrary decisions? I believe there are: they are called “courts”." This is so stupid. Of course Anthropic will take this to court (if it's not rescinded before then), and the government's ham-fisted "regulation" will almost certainly be overturned. And it doesn't matter! An unjust action that is overturned by the legal system does not magically become just.
3. "Is This Politically Motivated or Arbitrary? Probably at least somewhat." If the best you can muster here is "probably at least somewhat", then your head is in the sand. It clearly politically motivated, and clearly arbitrary. Perhaps a different government would receive the benefit of the doubt here, but not this one.
4. "“The government” or “society” is meant to deal with all of those things. Well, now the government is — the actual government that really exists, and not an imagined one that only does good things and never does bad things." So that's it? We just throw up our hands and say that this is natural, that it couldn't go any other way? That Anthropic was "asking for it", and it's their fault when the government lashes out?
If the government wants to regulate AI, either Congress needs to pass a law, or the Executive needs to furnish a reasonable explanation for their actions. We do not live in a fascist country. There is separation between the government and private industry. The government does not have the power to arbitrarily regulate private enterprise. I am truly baffled by the inability for people to see this as it is -- a blatant, and foolish, attempt at posturing and political intimidation. It's part of a clear pattern of behavior by this administration, and should be interpreted as such.
> A CEO's blog post is not an official company statement or any sort of binding agreement.
Uh, then what is it? We should not take the words of the leader of the company published on the company's website to be the official stance of the company??
I don't know, maybe a published press release? A signed document? I'm not saying that Dario's words are meaningless, but it is simply not true that a CEO's public speech constituents a binding agreement.
It's not an agreement but it is indicative of the company's position. Why do you go to such lengths to avoid assigning responsibility to a large corporation?
> It clearly politically motivated, and clearly arbitrary
Arbitrary, yes. Politically motivated? I think you are giving the administration way too much credit.
I think what this is are simply incompetent people with too much influence. I mean, Scott Bessent and Howard Lutnick? What the heck do they understand about this technology?
Parties were not called out and a large amount of ensuing Othering is happening anyway. Arguably, that proves that the EFF was sound in their decision to mitigate that by not calling out the parties/politicians in hopes to keep the focus on the bill itself, doesn't it? I've long suspected that we humans tend to lose the plot so often because we want to immediately sort everyone into buckets as though compartmentalizing them brings about complete understanding of the issue on the table.
