100% agree. Wow I can’t believe how many think sandbox builds is an actually good idea, on a per language basis too. There are completely standard QoL issues in cargo that have been open for years and nobody is working on. Maintaining a sandbox for idk 3 operating systems minimum that have virtually no sandboxing support? For extremely diverse workloads that typically invoke commands? I mean.. good luck.

There are still elephants (or rather mammoths) in the room for supply chain security, such as having 1500 nested deps for a standard project. It’s like we never woke up from the nightmare of leftpad.

If your project had code from 100s of individuals, new versions can be pushed instantly, and nobody wants to review the code, then you have a time bomb. And also other problems.

I believe that in all of EU you can just look at the ”comparison price” which is per-weight and listed below the normal price. It’s also very useful for quickly comparing similar products directly in-store. It’s a great piece of no-nonsense regulation that counters a lot of the deception, and instead favors competition on the price-quality axis, ie healthy market dynamics.

The US also commonly has per-unit prices on the shelf tags. I think that practice started in the 1970s after some studies suggested it was beneficial.

The per unit price tends to be pretty small print though so you need to actively look for it which means that deceiving customers via shrinkflation is still possible as most repeat customers will only look at the physical packaging size and the sticker price which can both stay the same while decreasing fill size and increasing per unit size accordingly.

And you also sometimes get different units being used for related products. And of course then there are cases the the amount of product is not the relevant unit for price comparison because different competitor formulas need different amounts for the same effect. Still plenty of tricks that unscrupulous companies can use in the EU.

1000%. If you have the luxury/curse of _building_ the house on empty land simulating light is extremely important imo. It determines everything from layout of rooms to window placement to furnishing etc. (You probably don’t want eg sun behind TV). Even ants orient their dwellings with respect to sunlight.

This reminds me of this argument with libertarians/ancaps:

A: rich people pay less % in taxes than wage workers, we should close the loopholes

B: but taxes are immoral to begin with

A: ok, but can we do something now about the unequal enforcement? Unrealized gains, tax havens, trusts, fake charities, etc?

B: well a society based on property rights… ackhully you should read this book by Mises/Rothbard/Rand

Never really understood how libertarians expect to have someone making guns for their fiefdoms when there is no one to enforce property rights for said gun elements and manufactories.

Libertarianism is not a philosophy. It's selfishness taken to extremes and trying to find ways to justify it at a societal level. The only reason we're the top species is because we're ultra social and have culture, which is inherently a social trait (don't eat those red berries, they're poisonous). Libertarianism want all the benefits of working together with no actual thought into how that working together happens in real life, including punishment for bad behavior.

Yeah its wrong in very very similar ways to communism.

What very very similar ways would that be?

I guess they presume it requires on the good will of everyone to live peacefully without violating (non-existent) property laws over, say, robbing you in your sleep.

It doesn't require that at all, on the contrary. Why don't you educate yourself on these basic assumptions?

Your comment says basically nothing, no explanation of your point whatsoever, and either way I was talking about what I think they believe, not what I personally believe.

> Maybe the more interesting thing is how far people are going to 'fight' against AI?

All ”AI resistance” I’ve seen is not against the tech, but against human bad actors behind AI: unethical procurement of training data, reckless application, low effort high volyme spam, replacing humans, centralization of power, dependency on megacorps etc. I think a lot of people have become less tech-positive after the ad-tech era that brought us social media, unprecedented levels of surveillance, freemium rug pulls etc. It’s much easier to understand the resistance if you place it in that context, rather than imagining millions of sleeper agent luddites suddenly coming out of the woodworks.

There were two major flaws with the rollout of USB-C, none of them technical:

To have unmarked cables. This should have been explicitly forbidden by spec as non-compliant. Today unmarked is the norm, even with premium brands. And the few ones that actually mark their cables have their own markings (which I assume is because the official logos are so incredibly bad). So now instead of wondering if the charger will work, you’re wondering if the cable will work.

Secondly, the USB-C rollout was only successful on the sink (device) side. Almost all cheap gadgets come with an A-to-C cable, and chargers and PC ecosystems are very biased on the A ports for the host side. This created an awfully ugly side effect: devices are not always compliant with even basic charging. Since C-to-C should not have live 5V line active at all times, these devices don’t charge at all. I think they’re missing that resistor that tells a compliant charger to make it live. But in either case they only work with A-to-C.

Why stop there? If you _use_ handwritten products you’re ngmi. I only use vibe coded operating systems, JavaScript sandboxes, compilers, TLS libraries, databases, rendering engines..

This is cute reductio ad absurdum, but it does nothing to refute the basic point made

There was no point made. You couldn't find a shallower comment. Why are you even bothered to defend it?

Im not a security engineer at all and I have an instant gut reaction to floats in regular code. ”How big can this get? Is it deserialized? What arithmetic ops are happening? Any risk of rounding error propagation?” etc.

Now, I wouldn’t necessarily mean I deem it bad practice in security contexts since again, I don’t know. But if an expert doesn’t consider those things, I would be surprised (and a little scared).

In engineering you have tolerances to deal with non-determinism. ”Within these bounds” and ”given these assumptions then…” is the foundation of building something _on top of_ those things. LLMs are the same, it relies on heavily exact Turing machines as input but its output is entirely unstable. Even if you can get determinism it will never get anything resembling ”bounds” out of the box. That makes it a poor foundation for building on top of. Ie it’s not a screwdriver, it’s the monkey who’s holding it.

I do not understand the need to argue that monkeys are better than screwdrivers at screwing. Just let the monkey be the best version of a monkey.

You’ve clearly not seen monkeys. /sarcasm

I would argue that management is a better discipline to pull from for employing LLMs; It is better equipped to deal with non-determinism and going completely off the rails.

It’s not necessarily symmetrical, and in fact would be very surprising if it was. It’s a probabilistic algorithm on both sides, so the energy use to find any working program vs all bugs in a working program are fundamentally different search spaces. Not to mention the false positive rate and the human verification effort. Then even the idea of incremental security checks is potentially flawed since many security issues are non-local (ie not localized to a single module).