A friend’s PhD advisor has been chasing non-sofic groups for 25 years (and was shown a preprint of the results by openai to verify them). He believed a solution would be Fields-worthy
The wonderful thing though is that you can just run the model multiple times (even in parallel). Some instances might get stuck but as long as some find the bug and you have a good way to filter outputs (e.g. with another llm that tries to create concrete exploits) even a very small success rate on stage 1 can lead to reliable exploits
I think there’s something very interesting here and would be interested in hearing more about the date discrepancies- it’s a shame the article is mostly just the raw output of gemini instead of more commentary
Right, you can’t actually guess a letter (byte) at a time but you can guess a token at a time (I believe the vocabulary is 200000 possible tokens in gpt 5)
So you could send each of the 200000 possible tokens, see which is cached, and then send 200000 more tokens to find the next cached token
Certainly less efficient but well within the realm of a feasible attack
It's a good call out re: tokens vs letters, but I think you might have misunderstood my point - you can't do it a token at a time unless the intermediate KV cache is stored after each token is generated.
This won't be the case in any non toy implementation, as it would be unneccessary and slow.
Ah, fair enough. Anthropic caches at a block level (basically a single message) so for non-trivial messages this is really less of a concern, although I definitely understand why they still scope cache to a single tenant
A remote code execution bug in ios is valuable - it may take a long time to detect exploitation (potentially years if used carefully), and even after being discovered there is a long tail of devices that take time to update (although less so than on android, or linux run on embedded devices that can’t be updated)
That’s why it’s worth millions on the black market and apple will pay you $2 million dollars for it
An XSS is much harder to exploit quietly (the server can log everything), and can be closed immediately 100% with no long tail. At the push of an update the vulnerability is now worth zero. Someone paying to purchase an XSS is probably intending to use it once (with a large blast radius) and get as much as they can from it in the time until it is closed (hours? maybe days?)
What do you use for the other controls? Start, select, exit, confirm... I have an older L-Tek and I really wish I had one with all nine step buttons (for other dance games) plus control button on top. Also kudos for not using a cheater bar :D. I don't see the old-school no-bar playing much anymore but I find it much more impressive.
I have a wireless keyboard nearby that I used to select songs.
Yeah I have never used the bar. Probably because I learned to play at home, starting on a basic foam pad, and so obviously didn't have the bar available.
To be honest I've been using the same Stepmania 3 installation for decades. Never updated to Stepmania 5 because the step chart format changed and I didn't want to find all the songs again. I have not kept up on recent developments.
L-Tek is probably the best option by far that is somewhat affordable.
Definitely penny-mod them too (just remove the panels, tape washers under the edge of each metal contact point - it makes the pads way more responsive and more fun to use).
You can also buy a portable barre bar on amazon, that's what I use. Super stable and easy to stow away. A bar lets you maintain form on crossovers/jumps, and I recommend for anyone not super casual (playing 12+).
Lastly, if you are really serious, you can buy a replica DDR pad from China for about 4-5k, or a used real pad for similar. The arcade feel is much better than L-Tek, but you need a lot of space for these. [1]
This was not a problem that was for sale