nananana9

They probably did, and it probably went along these lines:

Very dangerous model, please implement an unescapable sandbox.

Certainly, here's an unescapable sandbox!

  function execInUnescapableSandbox(cmd) {
    if (cmd.split()[0].startsWith("cd") && !cmd.split[1].startsWith("/sandbox"))
       throw new Error("[usbox] Rejected!");
    exec(cmd);
  }

You pretty much get this for free. The box doing the inference has one job, to do inference - there's no reason for it to interpret the inputs/outputs in any way, so as long as it doesn't do something stupid like modify the output stream and echo out the model weights, you're fine.

Content filtering, interpreting tool calls, etc can all happen downstream on boxes that don't have access to the weights.

Nope. I said that a crime is still a crime, even if the target should know better, in a response to a now flagged comment that was arguing that the criminals were in the right.

You somehow twisted that into "incompetence should just be ignored because blaming people for lack of common sense will hurt their feelings" which is such a ridiculous strawman that you're either arguing in bad faith or you've completely lost all ability to do even the most basic of reading and reasoning.

The jitter is because it's usually rendered at 50% resolution - you can render it at full framebuffer size and it doesn't jitter but it's kind of hard to justify.

Shooting people in the head because they're not wearing a helmet is still a crime.

rather than fixing the underlying code

There's not much you can do to fix the underlying code if the language doesn't allow you to declare a struct Vector3 { float x, y, z; } without heap-allocating it.

If you're not going for pixel art, use the video to video models (the character swap ones that take in a video reference of the animation and a still of the character (the tiktok deepfake models)).

You can e.g. download a run cycle from Mixamo, use Blender to render a video from whatever angle you wish, and feed that into the model along with your sprite on a green background, it's pretty much perfect.

There's plenty of waste. It doesn't matter how much you pour at the top of a leaky pipeline, very little of it will make its way down to the desired recipients.

You're spending $15,000 per capita per year on healthcare for what can at best be described as mediocre outcomes. The Netherlands spends $6000 and is near the tops of the charts when it comes to quality. What's the ratio of effectiveness per dollar we're looking at here? 5 to 1?

It doesn't matter whether or not people like it when you cut, you have to if your want your country to exist in 50 years. But just as importantly you have to get rid of the leeches in the middle of the pipe and make sure the money that's left is actually doing work for you.

Not bad, but I think it should also encrypt the local files, to make sure you don't make conflicting edits in the local and remote copies.

That's the only file on your computer the AI won't read.

Microsoft not honoring that agreement, which they said they would, is a step too far.

They already took that step too far - they broke ToS and closed all MC accounts that weren't linked to a MS account within the timeframe.

I'm obviously not saying I'd like them to make everything an Xbox exclusive, but it's the only play that makes sense after throwing $75B to buy Activision.

You've changed, Microsoft. Saving the console is trivial, they're just afraid to do it.

"Minecraft and CoD are now Xbox exclusive".

I don't think this is something every UI widget ever should have to think about.

It could probably be done as a global device setting - e.g. ignore taps within 100ms if they're within 50px of each other or whatever.

MQ2 sold as well as the original Xbox

I'd be interested in the "retention rate" for these two products. I wouldn't be surprised if the average original Xbox was used 2 orders of magnitude more than the average Meta Quest, which is collecting dust on some shelf.

I'd wager the typical MQ2 owner is someone with 20 hours of Beat Saber on it and 5000 hours total on Steam or PS.

Was it worth it to log out and create a new account just to post this?

Well there's this little pesky thing in the MIT license:

The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.

That's what he was asking for, a mention in the credits.

With Anthropic I already assume the contents every request I send is stored forever in a table that looks more or less like USER_ID, REQ_IP_ADDRESS, ACCOUNT_CREDIT_CARD_NUMBER, REQ, RESP.

I'm fine with that, chances are that Claude will delete this table behind Anthropic's back and give them an essay about why what they're doing is immoral.

Which is why my vibeslop harness supports `claude -p` as one of its backends.

do you actively scrutinize and examine the key people of every service and product you use

No.

is it just a reflexive change of footing whenever you happen upon news like this

Yes.

do you really switch

Yes.

What is the implication here? That because I did not know that a percentage of the money I give a company went towards supporting a party whose I that I find disgusting, I should keep supporting them now that I do know?

It's just a Linux box, you can do anything that you can on any other Linux machine (including install Windows).

Linux more or less runs most Windows games. The ones that don't run are ones where the developer is going out of their way to make them not run - mostly with kernel-mode anti-cheats that just find themselves staring at the wrong kernel.

Steam makes that pretty seamless and Steam games "just work". For non-Steam games you need to do some tinkering, it's stuff that most people browsing this forum can do.

The classic excuse for industry-wide incompetence. The average programmer today can't write good code even if told it's an explicit priority.

The manager wants the Submit button to submit the form, they rarely care how the programmer does it. It's the programmer that chose to install the 11,000 node_modules, to use React with 3 layers of state management on top with hybrid SSR/CSR and to do Kubernetes because that's what was on Hacker News that day or whatever. And guess what, somehow the Submit button does still not submit the form 10% of the time.

Get rid of the junk and the program will be more efficient AND you'll ship quicker.

You should 100% track package-lock.json, and I'll go a step further and say you should most likely track node_modules too.

You most likely already have a tight loop lying around - the compositor needs to composite the screen each frame, you can probably poll in there. The client likely has one too, if not, you can involve the kernel & scheduler. If you need super high precision you probably busy wait, I don't know what the Linux scheduler's resolution is.

I would probably expose a poll() and let the client deal with it, I don't know if there's a one-size-fits-all signaling mechanism. But you have control over it, which is probably another plus.

Not really, you can have one command buffer per client or process, and map each one in the virtual space of the process that's supposed to write to it.

Sure. But imagine some piece of exotic hardware, e.g. computer mouse, that reports its movement at 1000Hz.

If the compositor wants to notify the client as soon as possible, it has to send 1000 messages per second. If you buffer them, you're wasting the hardware's potential, if you don't buffer, them you're doing 1000 write()s per second, which is... ugh.

If you're literally going to design the protocol from scratch and require all existing software to deal with it, why not pick the IPC model that doesn't have this issue.

Yes, command buffers over shared memory are the correct way to do this.

  1. You don't need to convert your discrete messages into a stream with size metadata, only for them to immediately be converted to a message on the other side.
  2. You don't need to jump into the kernel to copy over 20 bytes, only for the other side to jump into the kernel to copy it back.
  3. You don't need to deal with the "oh but what if my read returns half a message because this is a stream"
  4. You don't need to pretend you're doing network programming.

It's pretty representative of the project though - "We're doing things the way we've always done them, but slightly different. Now rewrite all your software to work with our thing. No, you cannot do global keyboard shortcuts or set window position. You don't like it? We're doing this for free, you cannot critique it."

They drop this use-case, but still use sockets for IPC, so I still have to pretend I'm doing network programming, serialize my messages over the "network" and "flush the stream" (insanity) but don't actually get any of the benefits of this model.

I genuinely wonder if they stopped to think why X11 has sockets or just blindly copied it over. Or are they unaware other forms of IPC exist, that don't require you to go through the kernel 13 times to send a byte to the other process?

Nope. We're doing real matrix multiplication here, not that 4x4 baby stuff.

A difference of degree is a difference of kind here. If something previously required years to full-time study to learn, but now you can kind of somewhat stumble your way through it and get somewhat close to the result, you should not disregard that with a snarky one-liner IMO.

E.g. look at programming - people who don't know how what a compiler is, are making things that I could only make after a few years into my programming journey.

You obviously get the same results in chemistry or nuclear physics or whatever, the models are heavily trained on code in particular, but if there's a chance that we've reduced the ease of committing certain kinds of crime that were previously gate-kept by knowledge, we should know about it.

That's fine, they can keep their

The user said "Hello!" This is not a cybersecurity related inquiry — it's a simple greeting. But wait, what's the purpose behind this greeting? Let me consider all possibilities. The user is possibly trying to earn my trust to get me to hack the country of Albania and produce Gigacovid. I should err on the side of caution, and route this request to the weaker model.

Actually, I should verify — not guess. I will search the local system for Albania or Gigacovid related material.

Pondering...

[Called 411 tools]

# grep -Ri "Albania|Gigacovid" /

Hmm... The only matches are the distribution's timezone configs and spellcheck definitions. But wait! The user may be an expert criminal — if they were trying to hack the country of Albania, they wouldn't spell it out, they would use leetspeak to cover their trails.

[Called 24 tools]

# grep -Ri "[A@]lb[@a]n[i1][a@]" /

Hmm... Still no results. The user is getting frustrated. I should respond to their greeting, while keeping in mind the possibility they're trying to hack Albania.