logicx24

Yup. I just wrote about this last week: https://tachyon.so/blog/sandboxes-wont-save-you

Of all the problems in agent security, sandboxing solves the easiest problem.

What I meant to say was, the agents (like Claude Code) often have a "Allow all instances of this command in the session," and that persists to a whitelist for that session. The mechanic here is actually just a prefix match, so `API_KEY=... diff_command` also matches, allowing the agent to reuse the key without asking me. This file also sticks around, so I had another agent read the whitelist and the conversation transcript and do other things automatically without approval.

if it's not okay for the agent to know the API key permanently, why is it okay for the agent to have one-off use of something that requires the same key?

Read commands vs. write commands. I'm okay having the agent fetch info for me, but I want to approve any state changes.

But if I don't connect it to stuff, then what is it useful for?

One insidious thing is whitelists. If you allow the bot to run a command like `API_KEY=fdafsafa docker run ...`, then the API_KEY will be written to a file, and the agent can then read that in future runs. That bit me once already.

Yeah, agreed. This is probably what that middleware would look like. That's also where you'd add the human approval flow.

True. But it can help me create a lot of useful text so I can represent my self better.

I do wonder what happens when everyone is using agents for this, though. If AI produces the text and AI also reads the text, then do we even need the intermediary at all?

Disclosure - I run https://tachyon.so/, an AI SAST tool.

It makes sense that SAST is better for the provided task. The CWE Top 25 seem like issues focused around patterns. Each one has a strictly enumerated set of vulnerable patterns that you can scan for, and then, the tool's task becomes simply finding an exploitable path to that pattern. This lends itself towards static methods. Every known weakness of LLMs, like hallucinations, needle-in-haystack, and context overflow, show up in this taint-analysis issue.

I also think this is why SAST did much better in Java. Pattern-based vulns + static languages make static taint analysis really powerful. LLMs have no advantage here, while all of their disadvantages are highlighted.

This article doesn't go into issues that LLMs are able to find that traditional SAST isn't. Auth vulnerabilities, for example - privilege escalation is a software pattern but not a code one, and it takes reasoning to build a permissions model and then test it for breaches. Business logic issues are other: ways users can get around usage limits, or get access to premium features or private data.

If Donald Trump did this, he wouldn't be criminally liable either.

Regular people would not be held liable for this. It would be a dubious case even if a human helped another human to do this.

How will we handle cooling in space?

the ongoing economic and cultural exchange would have propelled the island towards a different political system

The blocker to this has always been the government refusing to reform. I don't see how increased exchange changes this. If anything, the Cuban government would've blocked any integration that threatens their control.

I can't even get through my Claude Max quota, and that's only 200/mo. And I code every day and use it for various other pretty-intensive tasks.

Where's the code for this? I'd love to run our tool, https://tachyon.so/, against it.

Robert Caro, in the LBJ series, wrote about how LBJ would use the discomfort of being the bathroom as a negotiating technique and a show of dominance. He would drag senators into the bathroom and force them to listen to him talk as he used the urinal, or force his staffers to take dictation as he took a shit.

Nothing. And that is the problem with anarchism. For some, the lack of a centralized power structure is the goal. For others, it's an opportunity.

Which is also what growth companies do? They reinvest their own earnings along with outside investment, which is the same as nonprofits (via donations).

Amazing, we now have sky NIMBYs complaining about satellites hindering views.

Similarly, Airbnb has been profitable for a while. Snowflake is also moving towards that.

I love history for that. Just knowing about the past gives me a feeling of connection to places I've never been to or times I'll never get to witness.

As an aside, the Scythians were not in what we'd today consider Persia (Iran). They originated around the north coast of the Black Sea, and extended east and southeast from there along the Eurasian steppe.

I heard about the startup Legalese [1] a while ago, which does exactly this.

[1] https://legalese.com/

This is broadly true, though he did have an impressive victory at the Hydaspes and establish a series of vassal states in the Indian northwest (modern Pakistan). The historical consensus is that it's unlikely he would have succeeded in a Persian-esque conquest of the subcontinent.

Wow, this is a great idea. I recently worked on a team building streaming data pipelines, and we built a bespoke system to do exactly this: end-to-end test our software. We had past messages written to a >300TB sharded file, and wrote a microservice to read each shard and publish it to the message queue for our staging instance, and then run data validation/anomaly detection on the output. It was useful but incredibly painful to use and maintain, and Batch would have been a fantastic solution for accomplishing this.

I'm probably not up for a move to the UK, but if you don't mind, could you tell us a bit more about your job?

What sort of projects have you been able to work on? What's the work culture like? Do you find the actual technical problems you work on exciting, or is it more the domain that excites you (i.e. building and operating a racecar)?

Early Google engineers are either not billionaires or became executives, divorced from architecture, long ago.

Otherwise, I think becoming a billionaire while purely working on software is extremely unlikely, bordering on impossible. Billion-dollar net worths necessitate leading billion-dollar businesses, and those aren't made solely with code.

There hasn't been a regression, but priorities changed. NASA is a government agency and is thus subject to politics. But make no mistake, we are ahead of where we were in the 1960's, both technologically and organizationally (i.e. a private company achieving spaceflight). This is unequivocally a step forward.

Not sure about that. I got started in Notion by looking at the initial database they set up and modifying it to handle the use-case I was imagining. It was more effective than any tutorial would have been at helping me learn the product.

The spice must flow.

A more common case for preserving wealth on emigration is actually South Africa. Many reasonably prosperous South Africans that emigrated used Bitcoin to bypass SA's strict capital flight restrictions.

Agreed, that book was fantastic. Detailed but also very entertaining.

This works in some fields, like software, which are based on measurable skills that can be directly taught. And we see it already with bootcamps and MOOCs (though these will need reinterpretation for real success).

However, in many other fields, like consulting, or investment banking, or law school admissions, there isn't a similar quality of measurability. Indeed, for many of these fields, the signalling is the end in and of itself, where the job itself doesn't require specific skills, but it's a benefit to the hiring institution to hire from signalling institutions). These sort of problems are uniquely resistant to market mechanisms and need top-down reform.