Hacker Newsnew | past | comments | ask | show | jobs | submit | rustyhancock's commentslogin

What's the problem exactly? Could you not follow the example in the text?

The standard text to build understanding in physics is University Physics by Sears & Zemansky.

It's worth remembering you're quite far from the ground in physics, and it's mostly taught with "neat" cases that give insight into physics. I.e. the thought experiment to show why kinetic energy must scale quadratically with velocity is carefully designed to show that conclusion. You shouldn't expect to have come up with it off the cuff.


> So if my theorem is correct, and Quake gutted id Software, was it worth it? Well I'd say yes absolutely. Games are more important than game companies, and Quake is an iconic titan of the gaming world.

Sandy's quote here buried unfortunately by X.


Sandy's original post to which John was replying: https://xcancel.com/SandyofCthulhu/status/206959220964578529...

Guess this is announced as part of epics state of unreal and if so this is already off to an amazing start even if this is all there is!


A curious approach, but I like it!

Wonder if this means just publishing vulnerablities without contact with curl team would be responsible (you have no other path to tell vulnerable users)


I think very few people would consider that to be responsible disclosure. The common practice is to allow 90 days as a minimum.


I think I'd personally develop a minimal patch and then publically disclose.

I'm not sure it's be reasonable to leave an actively exploited critical bug until August. Nor would I be too interested in playing middle man or paying for support from curl to get it out.


Disclosing an actively used exploit is is usually not treated the same as a typical vulnerability report.


Reminder that what you're describing is "coordinated disclosure", and that there are in fact plenty of people who consider "full disclosure" to be preferable in some or all cases.


It would certainly be irresponsible.

The responsible thing would have been to simply wait another month, considering you've been warned about the delay.


the vulnerability is there whether disclosed or not. if you find it, someone else has too. sitting on it is the irresponsible thing.


Given that most of those users will not be capable of patching it directly, no, that seems like it would be irresponsible.


Why not? Only a tiny fraction of curl user get it from the upstream website/repo. Most users get curl/libcurl from their OS/application vendor or package manager, all of them having their own maintainers. There is no reason a temporary patch couldn't be produced by them in the meantime.


Just publish early due to a documented lack of cooperation. They don’t have to answer, but you dont have to wait.

Naturally some people find that this offensive since this puts a price to that “bliss”.


Taking 1/3 of the standard time budget to get back to you isn't ideal, but it's not "a documented lack of cooperation".

And if you find something halfway through the month then oh no two weeks to reply, that's basically a standard business interaction at that point.


Why are you interpreting clear communication of a window of downtime with 2 weeks notice as a "lack of cooperation"? That's what cooperation looks like. It's not explicit but my read was that they're not even taking a vacation - they're just doing the rest of their job, a lot of which is probably going to be shipping fixes for vulnerabilities that are already triaged.


There are no "rules" for responsible disclosure. We have guidelines that we have broadly accepted, but at the end of the day whether or not you discussed responsibly is in the opinion of your peers.

There's no such thing as "responsible disclosure on a technicality". Don't be a dick, and work in good faith to keep users safe.


Wrong, but thanks for documenting how uncooperative you are.


> the White House intends to generally regulate Mythos-class models (whatever exactly that means)

This is not at all surprising. And I hope people don't make the mistake that it's a "this administration" problem.

It was obviously from the early days of these LLMs that the shoe was going to drop and we (as Joe public) would not retain access. I mean that once ChatGPT3 dropped it was clear there was some level of functionality at which we would be denied further access.

The only carve out will be as per older technical innovations the US is more concerned with foreign national access than US citizen access at home.

I don't remember the details with encryption but it was basically you have to ship a breakable version for the rest of the world, and you generally sometimes ship a backdoored version.

And Anthropic is more concerned by what they are asked to do to US citizens than the broader group.

Same story with encryption, CPUs, GPUs, blah blah blah.


Yet unlike CPUs/GPUs, there's currently zero way to lock down who has access.

Giving access to 'citizens', with the current way the Internet operates, is absurd. One back door into a desktop, workstation, and 'validated citizens' are now 'hackers from where-ever'.


>and 'validated citizens' are now 'hackers from where-ever'.

Yes, because knowledge is power, and information is meant to be free.


> I don't remember the details with encryption but it was basically you have to ship a breakable version for the rest of the world, and you generally sometimes ship a backdoored version.

I do remember the details: the result of Bernstein v. United States was that you have a First Amendment right to publish code because it is a speech act and so the USGOV cannot prevent you from publishing effective encryption algorithms. Will model weights be afforded the same protection? What about serving a model without publishing its weights? We shall see.


    > This is not at all surprising. And I hope people don't make the mistake that it's a "this administration" problem.
It seems logical for govts to want to regulate AI/LLMs. In the US, would it be FCC (comms) or something new?


[flagged]


Your anti-semitism is vile and you should be shunned by any upstanding person in society.


For now all one can say is transmission is assumed to be dramatically reduced.

The bigger risk is likely that in some the suppression is temporary or transient flares of replication under some circumstances.

The other question is, does this avoid all the sequela of HBV. It seems to reduce risk of cirrhosis atleast.

For hiv, it took many decades to be able to make the clam undetectable = untransmittable using serodiscordant couple studies.


Ikeas instructions are such an oddity.

It feels like there is precisely enough information to deduce each step. But only just enough miss one clue and you have something on upside down on step 7 that you won't notice until step 37.

I feel whoever makes them could probably make a wicked NY Times Crossword puzzle.


IKEA instructions are the best in the industry - so imagine what the other companies are giving out.

They’re also actually good if you know to follow them exactly: double check every side, every hole, every screw and you won’t go wrong.


So far I’ve found several mistakes, instructions that relate to no longer available items and a couple of ambiguities.

They may be good for the flat pack industry but they are a long way from perfect.


I agree.

You don't learn or know C++ in the way you learn or know C.

You never have the total language spec in mind. Much of it you will never (and for some of it should never) come across.

The way I think of it

C is an abstraction of the machine, so thin it's nearly transparent.

C++ is an abstraction over programming paradigms, letting you pick how you think.

Everything else abstracts the machine away, replacing it with a VM, runtime, or model of its own.

The same way a good project has a clear model of the problem it should have a clear C++ pattern in use.


> C is an abstraction of the machine, so thin it's nearly transparent.

-Werror might help with that


> C is an abstraction of the machine, so thin it's nearly transparent.

Looks like someone fell for the C abstract machine trap yet again. No, C is isn’t an abstraction of the machine.


C Is Not a Low-level Language: Your computer is not a fast PDP-11.

https://spawn-queue.acm.org/doi/10.1145/3212477.3212479


As a corollary, all processors are C VMs, anyway.


It may not be an abstraction of a real machine. But the C abstract machine is very close to the foundational idea of how a computer work. And it’s quite easy to bootstrap.


Importantly my work involves me often being able to look at C and think about the assembly and back and I regularly work on ESP32, ch42(riscv) and atmega avr8.

I couldn't do that with mciropython on any platform.

C is a thin abstraction, python isn't.


How much of it are C extensions not covered by the language standard?


they're technically not wrong. C is literally an "abstraction" of the machine. As we know, the whole point of an abstraction is to ignore the multitude of details :-)


Does it say what happened?

Died of sadness did make me wonder about something self inflicted.


That's always a possibility but I've seen my Grandpa die of a broken heart after my Grandma died. The night of her funeral he asked his children if they thought someone could die of a broken heart and after that it took him less than a year to go himself. I'd never considered that saying to be true until then but I watched it happen.


https://en.wikipedia.org/wiki/Takotsubo_cardiomyopathy

"It usually appears after a significant stressor, either physical or emotional; when caused by the latter, the condition is sometimes called broken heart syndrome"


Probably happens to other social animals too.


Yes, I also took it to be a tactful-as-possible way to say that.


Same here but was curious about stats of broken heart syndrome anyhow.


I'm curious about it too.


Don't know the details, didn't read the comic, and don't really have a personal interest on the history so what follows is just general speculation. She looked depressed enough to commit suicide. Is a fact also that people that orbit around drugs, tend to die younger, by suicide or by the effects of the drugs.

In any case if two relatively young people die in a short interval of time would be wise to look for environmental effects. Oil pigments have chemicals, and some colors were removed for being notoriously unsafe. Going further, slow poisoning to eliminate opponents with the benefits of plausible deniability is trendy among some criminals unfortunately. If somebody "dies of grief", research for discarding a hidden toxic should be started, just to be safe.


That maybe the steroids I'd imagine!


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: