macrael

I think it quickly needs to become good manners to indicate when text was written by AI rather than a person. I read that text differently and I shouldn't have to spend my time guessing.

Apple actually attests to signatures of every single binary they install on their machines, before soft booting into a mode where no further executables can be installed: https://security.apple.com/documentation/private-cloud-compu...

We don't _quite_ have the funding to build out our own custom OS to match that level of attestation, so we settled for attesting to a hash of every file on the booted VM instead.

Great questions!

1. The mechanics of the protocol are that a client will check that the software attested to has been released on a transparency log. dm-verity is what enforces that the hashes of the booted filesystem on the compute node match what was built and so those hashes are what are put on the transparency log, with a link to the deployed image that matches them. The point of the transparency log is that anyone could then go inspect the code related to that release to confirm that it isn't maliciously logging. So if you don't publish the code for your compute nodes then the fact of it being on the log isn't really useful.

So I think the answer is yes, to be compliant with OpenPCC you would need to publish the code for your compute nodes, though the client can't actually technically check that for you.

2. Absolutely yes. The client encrypts its prompt to a public key specific to a single compute node (well, technically it will encrypt the prompt N times for N specific compute nodes) where the private half of that key is only resident in the vTPM, the machine itself has no access to it. If the machine were swapped or rebooted for another one, it would be impossible for that computer to decrypt the prompt. The fact that the private key is in the vTPM is part of the attestation bundle, so you can't fake it

I'm happy to be careful, you are right we are relying on TEEs and vTPMs as roots of trust here and TEEs have been compromised by attackers with physical access.

This is actually part of why we think it's so important to have the non-targetability part of the security stack as well, so that even if someone where to physically compromise some machines at a cloud provider, there would be no way for them to reliably route a target's requests to that machine.

Howdy, head of Eng at confident.security here, so excited to see this out there.

I'm not sure I understand what you mean by inference provider here? The inference workload is not shipped off the compute node once it's been decrypted to e.g. OpenAI, it's running directly on the compute machine on open source models loaded there. Those machines are cryptographically attesting to the software they are running. Proving, ultimately, that there is no software that is logging sensitive info off the machine, and the machine is locked down, no SSH access.

This is how Apple's PCC does it as well, clients of the system will not even send requests to compute nodes that aren't making these promises, and you can audit the code running on those compute machines to check that they aren't doing anything nefarious.

The privacy guarantee we are making here is that no one, not even people operating the inference hardware, can see your prompts.

Happy Juneteenth! A reminder that we can change as a country. May we never have to liberate by war again.

OP found no correlation between railway proximity and quality

OP found no correlation between railway proximity and quality

OP found no correlation between railway proximity and quality

OP found no correlation between railway proximity and quality

OP found no correlation

LOL we may need to update the title of this post, half the top level comments right now are assuming the study confirmed the hypothesis.

With a mighty Pearson's correlation of 0.091, the data indicates that this could

be true! If you ignore the fact that the correlation is so weak that calling it 'statistically

insignificant' would be quite generous.

I liked this YouTube video from the blue site: https://www.metafilter.com/206671/The-Greatest-Showman-Richa...

A very well researched dive into how his legend came to be, some of the darker sides of his personality, and some discussion of his very real contributions to science.

American here, nope! It was a huge deal. An attempt to disrupt the peaceful transition of power. Not sure what other examples you think were on par but it was the kind of big deal where people went home sick to their stomachs for the day because I've never seen anything like it in my life. A desecration of something sacred.

From the public results only[1] (I don't have a copy of the whole study) they studied the following things looking for correlation with brain decline:

* short sleep duration

* sleep quality

* difficulty initiating sleep (DIS)

* difficulty maintaining sleep (DMS)

* early morning awakening (EMA)

* daytime sleepiness

They only found that the middle four were correlated. I don't know what exactly "sleep quality" is but the others are pretty easy to understand. And the point is that the duration of a person's sleep is not what mattered, it was the quality.

[1] https://www.neurology.org/doi/10.1212/WNL.0000000000209988

At least they aren't forcing all of us to build pyramids for them yet

Very cool story. The technical bit at the heart of it, that Mark applied stats to determine the safe amount of column supports for ceilings rather than relying on various engineering calculations based on physics that all disagreed, is great. And it's wild that he had the data to collect those stats because of regulators requiring reporting on it, but that that data had sat around un-used for decades waiting for someone to actually turn it into safety.

Wow I didn’t know there was a solution where you always weigh 4v4. I’ve only ever solved it with weighings that eliminate coins, never with a sum at the end

No! It’s just bad management. There is not some secret 4D chess to discover here. A paranoid billionaire with a ketamine problem is running Twitter into the ground. I think Howard Hughes is becoming a more and more accurate model with time.

Write scripts in whatever tooling you have setup for your app. In a typescript codebase, I write typescript scripts. In a go codebase I write go scripts. It's so easy to write a couple wrappers to make execing something a one liner and then the advantages of bash have disappeared. You already have a toolchain for running a program in your language, just use that to build your scripts.

use mypy!

So good, and I love this SMBC take on it: https://www.youtube.com/watch?v=mJS76Bf-ZYo

Passkeys or FIDO hardware tokens are the solution, as written up by Google ages ago, because they only enter the TOTP code when the URL matches the right site, it wouldn't enter the code for the phishing URL

Yes? That was the point of my comment? If they had tried to support everyone's tax situation on day one they likely would have failed, but instead they shipped something that works, got made permanent, and now we all get to look forward to using this tool sometime in the next few years as it graduates from MVP to entrenched software

It's SUCH a win that they managed to roll this out to a small set of tax situations and states to start. Every government project I've been on has required creativity in defining an MVP that doesn't include shipping to everyone. This was cited consistently as one of the great successes of this project, they were able to ship something that successfully filed 150k taxes b/c they were able to scope things down to something doable in 9 months.

From my recollection Wilson would disagree! Pretty sure he devotes part of that book to talking about how he doesn't think pure gene selection bubbles up to eusociality and that it's actually a little something else

I didn't read this article, but I suggest you read The Social Conquest of Earth by E O Wilson. We are cooperative animals, much like ants. There's nothing Machiavellian about individual ants. It's a great book, a direct response to The Selfish Gene which I find pernicious in how often and how poorly it is quoted.

I see, so you can use one device to auth and create a passkey on another

Passkeys can't actually replace passwords, right? I will always need a username and password with a website, then can generate a passkey as a separate auth mechanism, which if I lose, I will recover by setting up again using my username and password? I don't get how we can get to a place where passkeys are all, how do you get a passkey on a new device when you only have passkey auth on some other device enabled?

Sublime text is great! It’s been worth it to write small plugins to fix my biggest complaints but since they got LSP runni by first class it has been a great place to be.