billyoneal

People lost their minds over the mythos announcement specifically because they found something in FreeBSD, which had a reputation as being one of those picked over code bases.

I am also a signing fanboi but I have to point out that the security problem of curl into bash is not really addressed by signing. Signing proves that the component was produced by who claimed produced it. It says nothing about that component being legitimate or non-malicious. As long as the curl bash uses TLS it’s going to be pretty similar for all practical purposes.

No. The goal posts are not disproving their marketing. The burden of proof is on the people doing the marketing.

An actual PoC is often very helpful in prioritizing getting the bug fixed, in demonstrating that the bug is real, and in providing something that devs can see happening in their debuggers.

The claim has never been that the new model could not do impressive things. The claim is that the new model is not the existential crisis Anthropic’s initial announcement post made it out to be.

There are places that will pay bounties on even very flimsy reports to avoid the press / perception that they aren't responding to researchers. But that's only going to remain as long as a very small number of people are doing this.

It's easy for reputational damage to exceed $1'000, but if 1000 people do this...

I think you are in the minority of people who use that phrase.

The complaint isn't about stating the source. The complaint is about asking for advice, then ignoring that advice. If one asks how to do something, get a reply, then reply to that reply 'but Google says', that's just as rude.

The big place where it happens in modern environments are for pointers to members, where 0 is a bad nullptr value because the member at index 0 is legitimately a thing you want to name. MSVC uses -1 for nullptr in such cases.

1. What empirical data we have suggests that the 'good suffix' rule engages fairly rarely; that's why the -Horspool variant wins most tests. (It isn't just that you don't have to build Delta2, it also saves a lot of comparisons in the algorithm itself for most inputs.) 2. Because the standard says this is the Boyer-Moore algorithm :D

He meant the original paper for calculating delta2 which was merely referenced by the original BM paper.

Sadly this seems to be the pattern for most everything coming from 'academia' ever.

You need a needle that triggers the problem, AND a haystack where the delta2 table matters, AND the algorithm to stop at a problematic index where it uses a bad delta2 value.

There's a reason the published version even in 'the papers' was wrong for 3 years.

We are unaware of any such bugs requiring such a suppression; please create a self contained repro and file an issue.

Now, can anyone ELI5 the high-level goal of this exception?

I am not a lawyer; this is my extremely limited understanding.

1. Normally the Apache license requires attribution, even in binary forms. We can't say "You said #include <string>, now you must staple this to all your binaries". libstdc++ has a similar exception to the GPL for the same reason: http://gcc.gnu.org/onlinedocs/libstdc++/manual/license.html

2. Keep GPL folks happy :)

The sources for debugging are included with the product; these sources are more or less the same as in $/VC/Tools/MSVC/ (version) /crt/src/stl

That is near the top of the list of things to replace when we can break ABI next. It's... not amazing.

We regularly recommend customers use Boost if you need an API compatible version, or something like RE2 if you just need a fast regex engine.