nneonneo

Bonus: Here's what all of the tokens >= 0x80 render as, including the corrupt ones:

  128 0x80 b'END'
  129 0x81 b'FOR'
  130 0x82 b'NEXT'
  131 0x83 b'DATA'
  132 0x84 b'BYE'
  133 0x85 b'INPUT'
  134 0x86 b'DIM'
  135 0x87 b'READ'
  136 0x88 b'LET'
  137 0x89 b'GOTO'
  138 0x8a b'RUN'
  139 0x8b b'IF'
  140 0x8c b'RESTORE'
  141 0x8d b'GOSUB'
  142 0x8e b'RETURN'
  143 0x8f b'REM'
  144 0x90 b'STOP'
  145 0x91 b'OUT'
  146 0x92 b'ON'
  147 0x93 b'NULL'
  148 0x94 b'WAIT'
  149 0x95 b'DEF'
  150 0x96 b'POKE'
  151 0x97 b'PRINT'
  152 0x98 b'CONT'
  153 0x99 b'LIST'
  154 0x9a b'CLEAR'
  155 0x9b b'CLOAD'
  156 0x9c b'CSAVE'
  157 0x9d b'NEW'
  158 0x9e b'TAB('
  159 0x9f b'TO'
  160 0xa0 b'FN'
  161 0xa1 b'SPC('
  162 0xa2 b'THEN'
  163 0xa3 b'NOT'
  164 0xa4 b'STEP'
  165 0xa5 b'+'
  166 0xa6 b'-'
  167 0xa7 b'*'
  168 0xa8 b'/'
  169 0xa9 b'^'
  170 0xaa b'AND'
  171 0xab b'OR'
  172 0xac b'>'
  173 0xad b'='
  174 0xae b'<'
  175 0xaf b'SGN'
  176 0xb0 b'INT'
  177 0xb1 b'ABS'
  178 0xb2 b'USR'
  179 0xb3 b'FRE'
  180 0xb4 b'INP'
  181 0xb5 b'POS'
  182 0xb6 b'SQR'
  183 0xb7 b'RND'
  184 0xb8 b'LOG'
  185 0xb9 b'EXP'
  186 0xba b'COS'
  187 0xbb b'SIN'
  188 0xbc b'TAN'
  189 0xbd b'ATN'
  190 0xbe b'PEEK'
  191 0xbf b'LEN'
  192 0xc0 b'STR$'
  193 0xc1 b'VAL'
  194 0xc2 b'ASC'
  195 0xc3 b'CHR$'
  196 0xc4 b'LEFT$'
  197 0xc5 b'RIGHT$'
  198 0xc6 b'MID$'
  199 0xc7 b'\x00\t'
  200 0xc8 b'G.'
  201 0xc9 b'F4'
  202 0xca b'K'
  203 0xcb b'5'
  204 0xcc b'H\x03'
  205 0xcd b'`C'
  206 0xce b'JO'
  207 0xcf b'Mr'
  208 0xd0 b'J'
  209 0xd1 b'L'
  210 0xd2 b'Hr'
  211 0xd3 b'HU'
  212 0xd4 b'HD'
  213 0xd5 b'I'
  214 0xd6 b']'
  215 0xd7 b'Fa'
  216 0xd8 b'H'
  217 0xd9 b'\x10'
  218 0xda b'H'
  219 0xdb b'7'
  220 0xdc b'H\x07'
  221 0xdd b'GV'
  222 0xde b'R&'
  223 0xdf b'IH'
  224 0xe0 b'G\\'
  225 0xe1 b'R\x1f'
  226 0xe2 b'O\x05'
  227 0xe3 b'Wh'
  228 0xe4 b'I5'
  229 0xe5 b'G'
  230 0xe6 b'F'
  231 0xe7 b'E\x0f'
  232 0xe8 b'HA'
  233 0xe9 b'S'
  234 0xea b'I'
  235 0xeb b'R\x1a'
  236 0xec b'Dy'
  237 0xed b'"'
  238 0xee b'Wy'
  239 0xef b'*'
  240 0xf0 b'S|'
  241 0xf1 b'j'
  242 0xf2 b'T|K'
  243 0xf3 b'U\x7f'
  244 0xf4 b'C'
  245 0xf5 b'XP'
  246 0xf6 b'('
  247 0xf7 b'LF'
  248 0xf8 b"'"
  249 0xf9 b'LNFSNRGODFCOVOMULBSDD/0IDTMOSLSSTCNUFMO'
  250 0xfa b'Ck'
  251 0xfb b'@'
  252 0xfc b'C'
  253 0xfd b'e'
  254 0xfe b'G'
  255 0xff b'S\x00'

Hmm, based on the (handwritten!) notes on Table F-2 in http://bitsavers.informatik.uni-stuttgart.de/pdf/exidy/DP500..., it looks like pressing Graphic+key would allow you to enter BASIC tokens from 0x80 to 0xBF, while pressing Graphic+Shift+key would allow you to access 0xC0 to 0xC6. By inference, it seems like Graphic+Shift+key should allow access to the entire 0xC0 to 0xFF space, but most of those keys are undocumented.

Based on this, I wonder if it's worth trying the following:

    10 REM [Graphic+Shift+=] [_] [(] [Graphic+Shift+NumpadPlus] [2] [Graphic+Shift+NumpadEquals] [Graphic+Shift+Numpad6] [Graphic+Shift+0]

Given the wild but apparently "consistent" numbers I wonder if we could reverse-engineer the wrong algorithm with enough data points? Maybe the proper cost estimate has some relationship to the reported cost estimate.

https://archive.is/zduXN

A Russian friend living in Japan noted that, at least as of a decade ago, a decent number of government services (for citizens) allowed something like 6 characters max for the entire name. This is because Japanese names are normally written compactly in Kanji, but it becomes a problem when your name is 15 Katakana or 25 Latin characters long.

This is a dense article but what seems reasonably clear is that someone is pushing hard for an insecure standard.

There’s no reason at this point to put all your cryptographic eggs in the post-quantum crypto (PQC) basket. Elliptic curve crypto (ECC) is widely studied and understood; while it’s more vulnerable to quantum cryptanalysis, this is mitigated by the hybrid ECC+PQC proposals (except a bit of lost performance). On the flip side, the PQC stuff is new enough that new attacks are still being devised, so relying fully on that seems like a bad idea. Someone is trying to force the standardization of a PQC-only standard under the claim that it is secure enough, but ignores evidence from quite recent work showing that attacks continue to improve. This is before getting into the fact that PQC implementations are harder to get right and that popular PQC implementations have had nasty side-channel attacks.

You may want to consider that your Group B employee may be conscientious and reliable because they use an apparently “frustrating and inefficient” process. Productive friction is a thing: processes which force you to slow down enough to put careful thought into what you’re doing and why. And if they’re stuck in a loop of doing frustrating work - you may well consider why they’re doing so much frustrating work. Maybe that can be resolved at the managerial level!

I’m guessing the obvious fakeness of the request is part of it: they’re testing to see if anyone is paying attention. Maybe the author doesn’t care if it gets taken down after four years; maybe they see a super fake request and assume it won’t succeed (or read it as spam). It also costs them nothing and has zero legal liability because there’s nobody to prosecute for such a fake request.

TBH - for me, it’s an opportunity to do a different kind of exam, with a level of interactivity and realism that isn’t possible with paper exams. It is possible but much more annoying to run such exams in a BYOD setting: for example, the lack of consistency between people’s machines, and the risk of device failures, are just two reasons why BYOD is hard even before you get into the cheating aspects.

I'm reminded of TIS-100, a game where you program a cluster of tiny, parallel CPUs using a custom assembly language. It's painful to get basic stuff done, but you can do some amazing things with some effort.

I'm sure you're exaggerating, but the exam process in a CBTF is pretty lightweight. Students arrive, drop off their bags and phone etc., check in (swipe an ID card, get their picture matched), log into the computer and the exam website. When the exam starts, they refresh the site and do the exam; we've got proctors in the room as usual to watch for any conventional cheating (using a phone, consulting a friend).

If you find that onerous, I guess a paper exam would probably also feel pretty depressing to you.

The machines are connected via Ethernet (reliability!) but our exams are hosted on Internet sites like PrairieLearn and Canvas. Those are a lot easier to work with than, say, having to load exams onto a machine accessible on a private LAN.

Yes, said machine could have both the LAN connectivity and WAN access, and we could set up the whole exam website on it, but we would lose out on the flexibility to let profs choose the platform that works best for them.

Worth pointing out - modern multimodal LLMs (properly called VLMs, etc.) can easily take pictures as input and describe them in text. In fact, the CLIP model - one of the predecessors of modern VLMs - is entirely designed around being able to caption images with text.

That said - requiring students to hand-write answers is reasonably effective. It's a lot more boring to hand-copy text out of an LLM answer than write it yourself, and it makes the "cheating" significantly more visceral.

Speed is an asset, and I think it's an underrated one. Timed assessments are, in part, a speed challenge; students who understand the material more thoroughly can apply it faster and more accurately, giving them more time to complete the exam and to review it.

Yes, students can raise their score by cramming, but won't be as fast or as fluent as a student who has learned and internalized the material over the term.

Using a special computer works too. I do my exams with our institution's Computer-Based Testing Facility, a bank of computers with fixed software and firewall rules that only permit connections to the exam site.

As a result, I've been able to challenge students to solve interactive software security challenges on the midterm and final with automatic grading - something that would have been impossible with pen and paper.

Scalability is really the major challenge. We're rolling out more CBTF rooms and rolling out access to other departments due to demand, but it's definitely more resource-intensive than pen-and-paper. One possibility is to treat CBTFs as computer labs when not actively administering exams (or maybe even vice-versa), something we're looking into doing.

No, you don't understand! Meta told us the LLM itself "worked properly and functioned as intended" and it was only due to a bug in a "separate code path" that made this attack possible. Don't go around blaming innocent LLMs!

(/s)

The AI agent's operator couldn't be arsed to get in there and clarify anything despite their seeming urgency, and only wound up speaking up for themselves after the financial damage was done.

Plus - the agent had clearly malicious intent - port-scan this volunteer-run network with seriously overpowered hardware on an hourly basis. What the DN42 folks decided to do is not much different from deploying a tarpit or honeypot against a malicious crawler.

(spoilers for the little -ooze puzzle: for rhymes, booze choose brews blues ruse shoes cruise; for non-rhymes, snooze loose pews plagues obtuse toes guise; many others are possible, and rhyming or lack thereof may depend on accent).

Just today the NYT Strands puzzle gave a great example: you can find one set of prefixes that make each of the following rhyme, and a different set of prefixes that make them all sound different:

-ooze -oose -ews -ues -use -oes -uise

You can do this purely with prefixes ending in consonants, i.e. not by turning -use into -ouse, for example.

University education is weird. Research profs (who make up a large fraction of all profs in a typical R1 institution), are hired for research ability and are only minimally evaluated on teaching ability. Furthermore, few research profs actually receive any kind of mandatory training on how to teach; a typical research prof might be assigned a course to teach and then just let loose to do so on the first day of the semester. If a prof actually cares they may attend some optional teaching training - but I stress that these are optional at many of the institutions I know of. (I suppose if someone gets really bad teaching evals they may be advised to attend said trainings - but for a tenured prof, that's just advice).

Worse, a decent chunk of research profs will treat teaching as a burden that just has to be done - a distraction from their exciting world-changing research. So, you get attitudes like the ones you mentioned.

I'm actually not sure why the system is set up to assume that profs who are good at research are automatically suited to teach classes, but that is how it's setup.

It's too damn tempting to not use. You have a magical machine that, on command, will spit out the answer to your question in 10 seconds, whereas you'd need to spend hours to do the assignment the Good Old Fashioned Way. Even students who aren't just there for the prestigious degree are falling victim to this.

When you're up against a deadline - and unless you're very good at time management you're frequently up against a deadline - it's going to be an irresistible lever to pull.

In times past, cheating would mean copying an answer off the Internet or off a friend, both of which are easy to detect. More sophisticated cheaters might spend an hour rewriting the solution to make it less obvious they cheated, but at some point the cost of cheating (time + risk of getting caught) starts exceeding the cost of just doing the assignment. AI changes this - you get a customized answer that doesn't show up in a database with no extra work.

The thing is, students fail to realize just what using AI robs them of. Struggling with the assignment is the entire point. You don't learn if the assignments are too easy; you need to have some challenge to push your brain to understand the material more deeply and to build those pathways to apply the knowledge in novel ways. You become more efficient and effective over time as that knowledge settles in and you get more proficient - one of the reasons why time-bounded exams still make sense (being fast is also a proxy measure for understanding).

Pinyin is also the main way people input Chinese into computers, so it's rather important in that regard.

For some, I think there’s that satisfaction that comes with saving money (like you’re somehow “cheating the system”, even when it’s just a coupon that gets you to buy something you wouldn’t otherwise). In some cases, that satisfaction grows with the amount of time or effort expended to save the money in the first place, which is ironic because that money-value-of-time probably far exceeds the actual amount saved. Practically every engineer here probably has a story about spending a ton of time or effort to optimize something by a tiny amount; saving money can be like that too. It’s a little joy in life, and so long as it doesn’t outright prevent you from spending money when you should (or impose excessive optimization costs), I think it’s fine.

The maladaptive part is when you start regretting not saving money, because it has two knock-on effects: it makes the decision to spend much more emotional (which negatively impacts rational decision-making) and it can negatively impact the enjoyment of the thing itself. For example, the maladaptive part might take the form of being reminded of the cost every time you look at the repaired phone.

BBEdit is wonderful. I got hooked by TextWrangler and eventually bit the bullet to upgrade, and it was a great decision.

I’ve used Sublime (3 and 4), VSCode, Notepad++, vi, etc.; even made some plugins for Sublime, and I still vastly prefer BBEdit.

One big reason is sandboxing - the native dialogs can view the entire filesystem hierarchy and automatically grant access to selected resources to the calling app. Non-native dialogs are restricted to whatever the app has access to, which means you often have to give the apps Full Disk Access to make them work properly.

Accountability and responsibility for the AI chatbot/tool/agent still lie solely with the human operator. This is an excuse to try and deflect blame, rather than actually identify and prevent the root causes which led to the error.

If the human operator cannot provide the necessary level of accountability - for example, because the agent acts too quickly, or needs high-level permissions to do the work that it's been asked to do - then the human needs to make the tool operate at a level where they can provide accountability - such as slowing it down, constraining it and answering permission prompts, and carefully inspecting any dangerous tool calls before they happen. You can't just let a car drive itself at 300mph and trust the autopilot will work - you need to drive it at a speed where you can still reasonably take over and prevent unwanted behaviour.

Also: AIs cannot confess; they do not have access to their "thought process" (note that reasoning traces etc. do not constitute "internal thought processes" insofar as those can even be said to exist), and can only reconstruct likely causes from the observed output. This is distinct from human confessions, which can provide additional information (mental state, logical deductions, motivations, etc.) not readily apparent from external behaviour. The mere fact that someone believes an AI "confession" has any value whatsoever demonstrates that they should not be trusted to operate these tools without supervision.

There's some troll making a dozen accounts on here to spew alt-right/MAGA nonsense, then deleting their comments (editing them to ".") once their account is burned.

Don't reply, don't feed, just flag and move on.

virtual reality products with no legs

This is the most incredibly apt description of Horizon Worlds possible. How is it that I've missed this joke until now? Thank you!

There's an instructive example on the page. Suppose a page creates the databases `a,b,c,d,e,f,g,h,i,j,k,l,m,n,o,p`, then queries their order. They might get, for example `g,c,p,a,l,f,n,d,j,b,o,h,e,m,i,k`, based on the global mapping of database names to UUIDs.

The key vulnerability here is that, for the lifetime of that Firefox process, any website that makes that set of databases is going to see the exact same output ordering, no matter what the contents of those databases are. That makes this a fingerprint: it's a stable, high-entropy identifier that persists across time, even if the contents of those databases are not preserved. It is shared even across origins (where the contents would not be), and preserved after website data is deleted -- all a website has to do to re-acquire the fingerprint is recreate the databases with the same names and observe their ordering.

Curious - does Vancouver have an especially bad reputation for medicine, or did you pick the city/country arbitrarily?

Canada's medical training program seems to me to be reasonably rigorous; as an outsider it doesn't seem worse than a typical American medical program. Unfortunately it also suffers from severe (artificial!) shortages of doctors.