jrochkind1

I did not realize that "cyber" had become assumed short for "cybersecurity". So depressing.

In this case, effort has _not_ been put in to make sure the docs are of high quality, and the potential readers know that, which is surely relevant.

thanks! I obv knew less about violins than saxophones!

It's interesting you used both saxophone and violin as your examples, as they are very different historically.

Violins are basically ancient and evolved gradually over huge time spans, yes.

But saxophones -- invented by a guy named Adolph Sax and patented in France in 1846! It really was a kind of new thing, combining aspects of brass and woodwind instruments in ways that hadn't been done before. I think it's fair to say he invented it as a new instrument. (What legal protection that should get how is another story, I don't know that I like patents honestly). https://en.wikipedia.org/wiki/Saxophone

Sax was really mad about manufacturers reverse engineering and copying his saxophone without a license and tried suing them etc, for the period before his patent expired, but it was still being copied a lot -- it was a new thing people were excited about. Once the patent expired, it was definitely a free for all.

I haven't been able to see it even setting Chrome developer tools to crazy slow network speeds. Maybe chrome developer tools simulation isn't enough to see it?

The observations you are reporting are from images you created yourself and you know are in fact progressive jpegs? (not "regressive", although that's funny). There are of course other techniques to start with a lower resolution image that do "work" (in the sense of actually displaying a lower resolution image first at least).

So it was done on the clock as a project at Developer Relations team, I don't know if that should be called a personal project or not, maybe, it does seem Developer Relations projects could be one person's idea and execution, but just to be clear on what happened.

It was released 2 and a half months before Google IO.

The way I read this, they decided to announce it at Google IO because of the attention the project released by the Developer Relations team got. No one with inside knowledge has said the "official tool" (not from Dev Relations) was already planned when it was released. Maybe it was. Maybe a guy on the Dev Relations team would or should have known it was if it was. Easy for me to believe it was not however.

I just immediately went with the arrow keys on my MacBook.

I want to know if this was hand-coded or what; would love a re-usable template to make exhibitions like this! Very good online display of digitized materials with interpretative journey.

What, no plotting on a map?

Are we talking about the same twitter thread? This one? https://xcancel.com/JPoehnelt/status/2069482265953087602

I don't know that I'd call the repo "non-Google-affiliated", but whatever it is, it is still up [1] in a google-owned github organization [2], which also includes several other repos with the line "This is not an officially supported Google product," such as this one that's two years old [3].

So, yeah, whatever it is, I'd say it looks normal.

[1] https://github.com/googleworkspace/cli

[2] https://github.com/googleworkspace

[3] https://github.com/googleworkspace/redriveapp

I don't see anything about the product that made Google leadership look bad? I don't see that anyone else external to Google thought so either, before they fired him? Firing him makes them look bad, however.

I read the twitter thread, don't see any clear information about what the t's and i's even are, or if they were crossed and dotted.

but yea it's true he didn't dot the i's and cross the ts.

How do you know that's true? Do you have information the rest of us don't?

It doesn't look like anything has been taken down.

What about local models do you find preferable?

I guess "starting to find them preferable" suggests to me you think they work better, but this is surprising to me so I think I may have misunderstood, so I ask!

Like you're saying they work better than the proprietary models (in what ways?), or you find them mostly good enough and prefer the privacy or cost, or what?

I see now, thank you!

Why are they being told anything outside of the test? What is that for? Isn't “can you find this bug in this file?” also a test? It sounds like there are two kinds of tests? I'm clearly confused, I realize.

And, all of the bugs can be identified by several models if they are pointed directly at it and told what to look for.

This made me think, well, sure, if you tell them what to look for... but then:

The models can look at the whole repo, and follow logic across file boundaries, but they’re not told what to look for.

So okay, the first one was an accidental mis-statement?

Makes sense, and the conclusion would be that the goal of trying to ban or censor tools or information that could be used to exploit vulnerabilities is impossible and counter-productive in the first place.

You will end up actually helping the attackers maintain an advantage over the defenders, as they will still find illegal ways to access the illegal tools/information.

Which, I guess, that's really my suspicion, parts of the US government probably actually prefer for the attackers to have an advantage, they consider themselves the biggest baddest attackers and their right to have the abilities to keep attacking sacrosanct.

I admit I hadn't really thought about that before (I don't work specifically in security), but I see your point.

But, so... the solution people think is limiting people's ability to discover and patch vulnerabilities, and hoping the black hats won't find a way anyway? This does not seem like a sustainable or feasible plan. It does, to be honest, make me wonder how much of the government's motivation is ensuring that they have access to vulnerabilities that remain unpatched.

So the problem is not Fable's ability to exploit, but that they don't want people to have access to it's ability to patch vulnerabilties?

Wow.

the former nerd type was based on not having social and economic power. people wit social and economic power are inevitably drawn to be assholes (which is what nerds used to know).

Because encouraging a culture of disrespect and bullying is actually bad for security not good for it. Politely decline, please, no need to be rude because of your (not always guaranteed to be correct) perception of where someone (or some thing!) is coming from.

Shouldn't it get swapped out of RAM if it's not being used for a long time? My understanding was that modern memory management is very good at this, there's no need to be shutting idle things down and starting them up all the time. I could be wrong.

This whole thing seems kind of silly to me I must admit. It seems obvious that Claude Desktop needs a VM for security for the majority of it's actual real world use. VM's take up memory, yeah. Them's the breaks. If other competitors have managed to provide as good (or ideally better) security scenario with less RAM, that would be interesting, but just complaining about it seems weird and uninformed to me.

There is no reason you can't be gracious, courteous and polite while refusing to accept or even to review the PR. These things are not tied together. You can also refuse to be bullied by submitters, stop engaging altogether. But bullying is part of the problem, not the solution, normalizing bullying is the wrong direction and will not result in more secure code.

The worst part:

In addition, Williamson said that Giovannini (or his agent) had submitted patches that were incorrect and then "replied to objections with LLM-generated justifications that eventually overwhelmed the maintainer into merging the fix"

i wonder if they are running the proxy for external network connections in the VM.

If you're not going to give Claude access to anything on your machine, why are you using Desktop instead of web chat? (Real question, I don't use these much!)

If you are, obviously you need the VM.

this was a regulated monopoly, and if their customer satisfaction dropped below 96% (if I remember correctly) it could result in millions of pounds in fines.

OK, I'm still at the beginning and irrelevant to the article, but as a USA-ian, I am so jealous about that. Unheard of here.