pevey

A side note about my perspective: I studied economics as an undergrad at a time when the Northwestern "pure rationalism" school of thought completely dominated. Some of the conclusions from purely mathematical models built high on dubious assumptions were ridiculous on their face. But anything outside that dogma was heresy and treated as such. Academics were shunned, careers ruined.

It was a few years later that "behavioral economics" began to make inroads. The moniker of "behavioral economics" itself was to distinguish it from "real economics." Alas (for the establishment), behavioral economics proved very popular, and the genie was out of the bottle. It turns out mathematic equations are not all-powerful when it comes to describing certain phenomena, especially when it comes to individual or collective human behavior.

Collective blind faith in models built on dubious assumptions is what gave us the mortgage crisis.

This is a non-fiction piece, not really a news story. So not everyone's cup of tea. Joan Didion style. I enjoyed it.

I would summarize it as not being about AI per se. It's nominally about "rationalism," or the inclination to boil everything down to mathematics to an extreme degree. The story points out a growing subculture of rationalist who have become quite radicalized.

For a community like HN, which (rightly, IMO) places high value on rational and critical thought, it can seem strange that there could be a degree at which that sort of thinking is harmful. But there are a lot of examples where taken to an extreme, it can allow people to "rationalize" all sorts of actions. And the article goes into detail about some of the pitfalls this small group fell into.

And then the software would never be widely adopted.

FOSS is what it is and the dynamics around it haven't really changed.

What has changed is people wanting the rapid adoption rate possible from being FOSS without actually... being FOSS. I'm sorry, I have zero sympathy. If you want your product to be a paid product, just charge for it. What's that? No one would try it? Just give a free trial. What's that? Not enough people would use it for there to be this large community of people providing help, and tutorials, and addons/extensions/plugins, etc.?

The freeloaders are the people releasing their software as FOSS, using the community to get big, and then wanting to change their minds about it.

https://archive.ph/4yLNR

You can also use webhooks to deploy with each GitHub push. The advantage over GitHub actions is you don’t have to store any secrets on GitHub or with integrators like Vercel. Just send a payload to your own endpoint each time a commit is made, and that can trigger your shell script to rebuild and deploy. Using symbolic links helps make it more robust to errors. Trigger a pull of the repo, and build. Only if the build is successful, move the symbolic link of your production app to the new build. This also allows keeping some history of builds in case you ever need to troubleshoot.

Larry Summers has a track record of not believing in market failures, just market opportunities for private interests. Economists vary vastly in their belief systems, and economics is more politics than science, no matter how much math they try to use to distract from this.

This doesn’t seem like a real fix for the issue. This brings the number of spoofable sites way down from all MC users to just those who send mail through CF. But it is still a big vulnerability.

For any domain that is using mailchannels through cloudflare, you can see what region they are using. And you can continue to spoof them. You just have to do it from the same region.

And this is terrible positioning from Cloudflare’s POV. Why would anyone send email through a CF worker since it requires advertising through a public record (DNS) that is by design accessible/scrapable by bots that you are using an insecure service. It’s like asking people to spoof you.

I don’t get why CF doesn’t do something more sensible, like limit sender addresses to domains that are already set up in the cloudflare account where the worker was created. Basically every other provider does this.

This might be the impression on first glance because it uses the word "state." But keep reading, and its much more akin to what Solid is doing. In fact, the new docs openly credit the work Solid's team is doing. They also credit Knockout's approach form way back in 2010.

At any given level, people in startups tend to have more actual power/authority, with fewer or no processes or procedures already in place to slow them down. This is part of why startups are effective at building/changing things, but it's also a social engineer's dream.

I used to think info about whether an account exists should not be leaked in the password reset flow, and I designed sites this way, but then someone pointed out that in practice a hacker would then just move to the account sign up flow to check for the existence of an account. (If account exists, you cannot make another with that email on most sites.) I never had a good response for that. I now lean toward the idea that not providing info is just not worth the bad UX.

I work a lot with startups/small companies, but not necessarily tech savvy ones. They have a hard time understanding at first why they are so targeted with phishing attempts. Often times, leadership comes from big roles at larger companies, and they are anchored in their previous experience at big company. They don't understand why anyone would bother targeting little co.

I try my best to explain why little co is actually a far more ideal target. They are hiring quickly, and unlike at a big company, it is likely that even junior new employees might expect to have some interaction with the CEO. An email supposedly from the CEO at big company would be obvious spam for most employees, but not at a startup. And the information exists to make these targeted emails believable, and IT ALL COMES FROM LINKEDIN.

As soon as a new hire updated their employer to little co on LinkedIn, they would be targeted relentlessly.

React borrowed these concepts from Solid, SvelteKit, and Remix.

Not that there’s anything wrong with that. It’s pushing things forward. (And by forward, I mean, yes, also a little backward. We had server-side dominance with php, etc., then frontend-only with Vue/React… Now we finally get to serve our cake and consume it, too.)

I sometimes hear snarky comments about the proliferation of all these frameworks. But here is the tangible benefit of that “competition.” (Really more cooperation than competition)

A quote of interest: "When offering a generative AI product, you may need to tell customers whether and the extent to which the training data includes copyrighted or otherwise protected material."

I'm not saying this is acceptable in any way... But there IS something you can try to get resolved fairly quickly if it ever happens again.

Be sure to claim domain ownership in the Google search console. If there is a flag of some sort, it will show up there. And you can address it there.

I worked for a financial services company where this happened. The public-facing .com domain was set up first, before I got there. Later, I added the .net domain behind zero trust to serve as our entry point for internal apps. Google marked the .net as a phishing domain. Verifying ownership of both under the same google search console account and then contesting the flag got it removed.

I get that there are pros and cons of different licenses, and reasonable people my disagree, but this is the first time that occurred to them? This far down the road?

No one forced them to be open source. They did it for certain benefits. They would have gone nowhere in the early days with this new license, most likely. I can only see these moves as bait and switch. Encourage everyone to use it, allow and maybe even encourage companies to build offerings on top of it to help with traction/mindshare... and then oh btw we changed our mind. It may be their right, but I'm glad people are talking about the implications.

Quite possibly a very fair point. I don't use Terraform or Spacelift or care at all about these particular companies. I DO care about open source, and I care about BSLs and CLAs and the dilution of what open source actually means. Legal or not, it feels like bait and switch. The CLAs supposedly make it legal. They have no place in truly open source projects unless at most it is to say a license is granted to the project in perpetuity under the same license as the project is licensed at the time of the PR.

It’s also worth remembering that Terraform itself is built on top of multiple open source libraries and an open source ecosystem. Without the volunteer work of hundreds of unpaid individuals, HashiCorp products would not be successful, there would be no ecosystem, and the company would not exist.

Hear, hear! (edited, thx)

EDIT: Also, if you are contributing to open source, read carefully before submitting that PR. Do not contribute to projects that make you agree to a CLA. It's becoming more and more common for projects to include one or two lines in the README and that's it. All your code are belong to us. I don't know if that would hold up, but why contribute your time and effort?

Yes

Both

And also the more mundane reason that an extra hoop to jump through is unnecessary and does more harm than good.

If that is the standard, only homeopathic stuff should be available OTC. No [side] effects at all. :)

I'm going to take a wild guess you have never been prescribed BCP.

No, no one explains it. They expect you to read the instructions, which is not an unreasonable expectation.

Oral contraceptives do have side effects, including effects on mental health. Sometimes the effects seem to be positive. Often, they are quite negative.

These effects are not taken seriously/acknowledged by the vast majority of medical professionals, so I don't see how it is relevant to whether the pills have to be prescribed. It is a separate issue.

People should be free to make their own choice without going through a gatekeeper who adds no value. Most often, women making the choices are more informed (by their social network) of the wide range of potential side effects than their doctor is, who may or may not have a uterus and may or may not take reports of side effects seriously.

How does the pill being prescribed by a doctor help this? Do you think doctors are actually explaining this to patients? They are not. They don't have time. The PE firms who own them won't let them take the time.

That is ridiculous. It's not like a doctor properly screens you for cancer before prescribing BCP. It's all about gatekeeping. It's not about health.

Your take on the first two points is not uncommon and just underscores why academia is broken. The research being produced today is often of zero or negative value.

Your take on the last point is not so different from mine. I think you misunderstood. The incentive to change data to avoid a finding of no significance is very great. The risks are small. Yes, good science would be to report it accurately. It almost NEVER happens. It is widespread. More so than people think. These two dishonesty researchers are just the tip. A lot of people in academia are staying silent because they don't want people looking into their own research. False data is not the exception. It is endemic.

Most academics won’t falsify data — from a pragmatic perspective, that’s their career on the line

In my experience, this is absolutely not true. I mostly only have first-hand observations in the economics, finance, and marketing disciplines. They left me EXTREMELY cynical about all academics.

I have seen:

1) A well-known professor at an Ivy-league B-school openly talking to his class about how the NAR funded his latest study on the real estate market, which (of course) found that the market was not overvalued. This was 2007. The co-author on the paper was the dean of the B-school. He is no longer the dean, but only because he seems to have moved on to more lucrative consulting roles.

2) An older professor, who was one of the first to be in the group labeled "behavioral economics," when asked why he wasn't writing a book focused on more mainstream readers like some other such big names were at the time, STRONGLY hinting if you filled in the blanks although not outright saying that their ethics were questionable, they were all forming hypotheses that were useful for for consulting dollars and dredging up data to support it, and he was too old school (and too old) to be interested in playing that game.

3) A full cohort of marketing grad students (6-7) talking openly about how the system is messed up, and to get a job, you absolutely have to have a good dissertation with a strong results, but to avoid p-hacking allegations, you have to shoot in the dark. So you're left in this situation where you commit financial and career suicide if you DON'T make up data to support your thesis. It is not rare. It is an open secret. No one likes it. They hate it. But they also feel like they are the stupid idiot if they try to fight against it alone. It is how the system works. Only a true saint would accept data that actually does NOT support their hypothesis because it makes it unlikely they will get a job in a very competitive market. Some people do report non-findings, but they are rare. IMO, academic departments should specifically seek out graduates who were willing to report that and stuck by it. But that is not the way the world works. As another poster pointed out, we all like stories, and no significance means no good story to tell.

The “glitch” in most ransomeware and AP fraud attacks is an employee clicking on something or believing something they shouldn’t have. LinkedIn facilitates this, because it makes it easy to understand the org chart of a company and target newer employees with urgent, personalized requests from the “CEO.” One person at a place where I recently worked actually fell for it and was at a store buying a SECOND round of gift cards with his company card before he finally got a twinge and pinged someone to see if—perhaps—this might not be legit.

Training can only do so much. People have no attention span these days, and all warnings go in one ear and out the other, even in they are well-intentioned people (as this employee was).

I was coming here to say the same thing. It's really amazing that they used their own domain name to receive the payload from this malware analytics code. Possibilities are (1) all of the people associated with this company are not real people (faked LinkedIn profiles and everything), (2) they are really, really dumb, or (3) it was a roque employee/contractor who saw an opportunity to set this up and skim some cream.

In the US, truthfulness of a statement is an affirmative defense to libel/defamation, but believe it or not, that is not the case everywhere. Specifically, it is not the case in the UK.

Just open the link in a private/incognito window

The main goal of raising children, after keeping them alive, is teaching them the skills they need to survive and (hopefully) thrive in their world. These skills have changed over time and vary based on environment, society.

Today, that means teaching kids how to cope with social media. It is in their world. It’s not going away. As a parent, I can understand the temptation to just want to ban it. I wish I could ban a lot of things I would rather my kids not have to deal with. But parenting just doesn’t work like that. They need to learn to deal with it, and it’s my job to try my best to help them do that.