bayesnet

That auditors are responsible for catching the lies of an audited company on penalty of being suspended is a position that the big audit firms would not agree with. They might agree that they are responsible for ensuring the material accuracy of accounts if fraud occurs, but even here EY has disclaimed responsibility if the fraud were sufficiently complex [0]. Indeed auditors lobbied very hard against being mandated with a broader anti-fraud role [1].

Admittedly this is on the "real" audit side and not the advisory/consulting side, which would be the ones to handle SOC I imagine, but nonetheless a position I find a bit absurd.

[0] https://www.ft.com/content/a9deb987-df70-4a72-bd41-47ed8942e...? [1]: https://www.ft.com/content/c25de9fb-a808-4946-ade6-80d76a66a...

Right now the HR is showing 48 bpm, so this has the fun side effect of demonstrating that the author is in pretty good shape.

The page appears to be dark themed even without dark mode enabled; if I use Noir to force-add dark mode, then the diagrams indeed become difficult to read but this seems like a Noir issue more than a site issue

Especially interesting because (as one of the compiler team members noted on Zulip) this is a miscompilation relatively easy to stumble into in safe code (yikes). Looks like the cause was a late pass in MIR optimization pipeline — I would think these are carefully vetted for soundness so am surprised that this slipped in there.

Atkinson Hyperlegible is an incredible font family! I read much faster and strain much less when I use it. The Braille Institute licenses it under SIL and includes the Glyphs 3 source files used to build it with the download too which is very cool.

I do not think that it is as well-reasoned as that. Far more likely IMO that teams are being evaluated on upsell uptake and so push these requirements to make the number on the dashboard go up.

Anyway, I’d be more sympathetic to this way of thinking if windows wasn’t getting worse over time. But it seems like investment in the OS is being disfavored for investment in AI-in-things-no-one-wants-AI-in, which is inverse of the subsidy direction you propose

I don’t think I have ever seen ∋ used to mean “such that” so I was very confused until I got to the explanation (as it were; why CONTAINS AS MEMBER is being used to mean “such that” is never explained).

To be fair I think the success of JS is in spite of it not working super well

I have a TS3+ that broke about 18 months in. I talked to support, set up a repair, and before I could send it the dock unbroke and had worked since. Truly mysterious and left me with a sense of unease with that thing given the cost.

The only surprising thing about the Tom’s Hardware example was that John Gruber evidently does not use an adblocker

Not a product launch. Not a keynote. Not a revenue metric. The thing he was most proud of in four years at one of the biggest companies on …

What’s tiresome about this is that people don’t even bother to edit it. I use LLMs to draft long-form text all the time because I think the hardest part is getting something on the page to refine. But I would be embarrassed to leave LLM tells like this in the final result, if only because I want people to know that I actually cared about what I’m asking them to read and that I value their time.

It’s especially ironic here because this is about lauding a person who cut through the impersonal behavior of a large organization. Evidently this person was not worth even an editorial pass over the article though.

It’s your last point that keeps me up at night. I opt out of letting my data be used for training (and don’t use tools like Gemini that make this very difficult or impossible).

But I have very little reason to trust that they actually don’t use my data. The incentives to violate the data controls are so great with the billions sloshing around AI companies. The worst that would happen if they are found to be abusing my data would be civil penalties (i.e. fines) that I’m sure executives would see as the cost of doing business.

Ideally there would be an attested zero data retention option, but I’m sure that’s not available.

Really love this article. Opens with the problem statement and jumps straight into the investigation. Thanks for a very enjoyable read (and an rss feed!)

This is the kind of assertion without evidence that just muddies the waters. “All kinds” of people is so vague as to be an almost entirely vacuous category and “routine” means almost nothing without an actual quantification of how prevalent and frequent the problem is.

It’s undeniable that the proverbial guns for hire make it easy (if not cheap) to target basically anyone — but just because the vibes are bad doesn’t mean we can just say “it’s common knowledge that …”

The fact is mitigations are costly in terms of convenience and ease of use. Helping people make informed choices about whether to enable mitigations and bear that cost requires more than platitudes imo

What really drives me nuts is smart TVs with 100mbps Ethernet connections. When I bought a tv we looked in vain for gigabit Ethernet.

That’s bonkers. I’m on the east coast (not nyc) and a quarter pounder medium meal is $10.49. Meanwhile Five Guys is $20.29 for a regular meal.

Mac prices on eBay are sort of bizarre. Back when I was looking (when you could still purchase a new one in a reasonable timeframe) many of the higher end listings cost as much or more (!) then just getting them from Apple. I ended up buying an Apple certified refurbished Mac Studio for less than the comparable eBay listing.

Not sure who’s buying these or if it’s just people dreaming about finding a rube.

I'm beating a dead horse here but the challenge is a11y. Chromium wrappers get a11y for free; bespoke UI frameworks must implement accesskit (or something) which is a lot of work and something that (imo sadly) many small teams decide is not worth the investment.

I took a look at gpui-component a while ago when assessing GPUI for a project I was working on. IANAL but was dissuaded because it's almost certainly not compliant with the Zed license--gpui-component "borrows" gpui code patterns lifted straight from the main zed repo, which therefore must be AGPL/GPL (unlike the gpui-only which is Apache IIRC). Caveat emptor (caveat user?).

The existence of a soundness bug in the typechecker doesn’t refute the value of soundness as a language design contract.

If anything it’s the opposite: issues demonstrated by cve-rs are _language bugs_ and are _fixable_ in principle. “Safe Rust should be memory-safe” is a well-defined, falsifiable contract that the compiler can be measured against. Meanwhile memory unsafety is a feature of the semantics of C++ and so it would be absurd to file a bug against gcc complaining that it compiled your faulty code.

What’s wrong with printers? Imagine designing a laser that bounces off of mirror spinning at 20k+ rpm while coordinating with a paper feeder. Sounds pretty cool to me

I don't think it's something special about my workflow and more the application area--I'm writing a lot of Lean lately and particularly knotty proofs can take quite a lot of time. Long thinking intervals are more of a bug than a feature IMO: Even if Claude can one-shot the proof in 40-60 minutes I'd rather have a partial proof in 15 and fill in the gaps myself.

I used Gemini CLI for a while because it was free to me. The primary reason I stopped was because it wasn't very good, but their "thinking summaries" didn't help matters. They were model generated and just said things to the effect of "I'm thinking very hard about how to solve this problem" and "I'm laser-focused on the user objective". So I feel you: small things like this make a big difference to usability.

This is a CC harness thing than a model thing but the "new" thinking messages ('hmm...', 'this one needs a moment...') are extraordinarily irritating. They're both entirely uninformative and strictly worse than a spinner. On my workflows CC often spends up to an hour thinking (which is fine if the result is good) and seeing these messages does not build confidence.

Is there any word on whether these vulnerabilities were exploitable on devices with MIE[0]?

[0] https://security.apple.com/blog/memory-integrity-enforcement...

I know this is grumpy but this I’ve never liked this answer. It is a perfect encapsulation of the elitism in the SO community—if you’re new, your questions are closed and your answers are edited and downvoted. Meanwhile this is tolerated only because it’s posted by a member with high rep and username recognition.

Small businesses accounts were/are also subject to ring fencing, and my recollection is that large banks sought to recover the costs of ringfencing rules via charges on large clients.

Come to think of it this was all also at the time of very low rates which was more likely to be the issue.

This is arguable for HSBC (in the UK at least). Ringfencing laws post 2008 have made customer deposits in the UK very difficult to invest profitably, to the point where (at least last time I cared about this) they were charging commercial customers to have UK domiciled accounts.

It’s kind of sad IMO. Bartosz has made a ton of these super interesting and meticulously designed explainers. Something thrown together with AI is much more likely to be made by someone who doesn’t know what they’re talking about, and I’m worried that the sheer volume will crowd out actually quality content like this.

I have no idea what the mov rcx, rsp instruction is for. The rcx register is not read anywhere after that.

Anyone have any ideas? I’m surprised that the compiler emits a “useless” instruction at -o3.