HN user
I've refused to set up an account. I just call them on the phone if I need something special from them, have them send paper statements, and eat the should-be-totally-illegal-because-of-how-obscenely-large-it-is "mail you a paper statement" fee.
Amazon won't deliver one to me for at least six days at the earliest, based on their rural delivery estimate.
That sounds like an Amazon problem. For 40 USD, yubico.com says that it will deliver a shipment on the next business day to this rather rural house I see in the middle of Foothills Road in Newman Lake, Washington.
Also:
Replacing a key is basically impossible.
If you know that getting next-day delivery is dreadfully difficult, then order a handful to have as spares. "If you can reasonably afford it, always buy more than one." is solid advice for just about every important thing that you are likely to break or lose.
I dunno, ever used a thing you learned from a textbook in your job? Did you have to continue paying for the copy of that knowledge speed on your brain?
Those regulations and principles are for humans.
Either the major LLMs are software tools deployed by ostensibly-profit-seeking companies, and regulations based on the notion that "making humans pay to make use of the things they've learned is profoundly antisocial" don't apply, or the LLM companies have a bigass swarm of unpaid -er- "servants", and labor laws and other human rights regulations do apply.
Help me understand.
Okay. Read these comment threads, then tell me if they change your understanding of what I've been talking about in this thread: [0][1]
I'll address the rest of your comment after you get back to me.
[0] <https://news.ycombinator.com/item?id=48999644>
[1] <https://news.ycombinator.com/item?id=48999415> [2]
[2] Yes, I'm aware that that one is the one we're talking in right now. You should re-read it with both the context from [0] in mind, as well as your initial comment to which [1] is a direct reply to, namely:
> Why should OpenAI (or any frontier lab) be building these systems if they can't get a secure environment / containment right?
Because we continue to have zero evidence that aligment is an actual risk.I'm saying their form of harm isn't novel.
Your initial attempt to brush off my comments about how -contrary to their assertions that they're extremely concerned about safety- these LLM companies produce products that very, very often cause harm due to "misalignment" caused -in large part- by ignoring basic data-handling lessons we've learned over the past like thirty years with "Okay sure. You can also cut off your hand with a chainsaw." indicates your lack of understanding of my point.
We just need to enforce the laws on hand.
What laws? Be specific.
Keep in mind the generally-low quality of both Microsoft Windows and much-to-most commercially sold software, [0] as well as the fact that -in the US, at least- it's currently totally legal for companies to sell such shitty software, just so long as they don't substantially misrepresent what it can do and trigger "fraudulent claims about the product" consumer protection laws.
[0] ...SaaS or otherwise...
...but are using different boundaries for what constitutes "the LLM"
I'll make note that my original comment only used the term "LLM" in the phrases "the LLM companies" and "LLM-based systems". The latter use was in this footnote:
One might argue that the fundamental nature of LLM-based systems makes this impossible. *If* that were true, then it would mean that these systems are *impossible* to make safe... the *only* safety option available would be to establish comprehensive blacklists, which is simply infeasible.
Okay, sure. You can also cut your hand off with a chainsaw.
No, the correct analogy is one where the major LLM providers are selling cars intended for use on US interstate highways and other public-access roads, but have designed and built these cars with the very latest in 1940's safety systems and construction. Featuring innovations such as "Our rigid solid steel construction means the occupant is the crumple zone!", "You'll love the crushed heart and jaw our steering column delivers!", and "Your passengers will enjoy picking glass out of their faces for the rest of their lives when they're ejected from the cabin's open bench seating through the plate glass windshield!", it's a car that will be sure to wow the market.
Well... it would wow the market, except that -in the US, at least- it's illegal to sell a new car intended for use on public roads that ignores the last seventy five+ years of automobile safety lessons we've painfully learned.
"Differentiate between data you know comes from sources you control, data you know you have thoroughly sanitized, and unsanitized data that comes from an untrusted source, or else attackers will gain control of your system." is something that you can't get a CS degree without understanding, and can't be in the industry for more than a few years without encountering repeatedly. We're not talking about designing new cryptosystems... we're talking about "Don't blindly trust everything you're told by strangers.". You don't even need a CS degree to understand that rule.
LLMs are impossible to make safe in the same sense that humans cannot be made safe.
No.
LLMs are impossible to make safe in the same sense that a car designed as if it was the ~1940's would be impossible to make safe for its passengers during an at-speed collision. There's only so much you can do if you're committed to using plate glass, rigid steel everything, and leaving out occupant safety belts because they're unpopular and spoil the lines of the cabin. [0] Back in the day, "the people in the cabin are the crumple zone" was state of the art, but we've learned an awful lot about how to make much, much safer personal vehicles in the ~75 years since then. It'd be massively irresponsible to design and sell a car today that ignored the safety and engineering lessons we've learned since then.
"Funnily" enough, the major LLM providers have designed and are selling access to systems that they very much want to be used in situations where you need a reliable, safe tool... but they've -somehow- ignored one of the most fundamental lessons we've learned about the design of safe software systems that are intended to be used in the presence of attacker-controlled inputs. [1] What they've done is no less irresponsible than designing and selling a new car that conforms to the very latest safety regs of the 1940's... AFAIK, it's so irresponsible to design and sell such a car commercially that -in the US- it's a violation of federal law to do so.
As an aside: you may have seen this video already, but it's worth a look if you have not. [2] Though, the classic car in this crash is equipped with safety glass, so -sadly- you don't get to see all that fun.
[0] One of my great-grandfathers spent the remainder of his years intermittently using tweezers to remove shards of plate glass migrating out of his face that had been lodged in there during an automobile accident that he was fortunate enough to survive.
[1] For more on this, read: <https://news.ycombinator.com/item?id=48999644>
This critic also makes fun of them because they go on and on and on about how vitally important it is to produce a safe tool that won't do harm, when their core products frequently consider attacker-controlled instructions to be its system instructions or its user's instructions, and are known to confuse their own internal chatter as instructions from their user.
Reliably differentiating between trusted, tainted, and untrusted data and ensuring that you don't mix the latter two groups in with the former is something we've known to do for nearly a half-century. Hell, even the youngest plausible programmer at the LLM companies is all but certain to be aware of SQL injections. And yet, despite their claims about being so serious about safety, they show zero interest in following long-proven software safety practice and rearchitecting their software to make it impossible to mix system, user, and attacker-controlled data. [0]
[0] One might argue that the fundamental nature of LLM-based systems makes this impossible. If that were true, then it would mean that these systems are impossible to make safe... the only safety option available would be to establish comprehensive blacklists, which is simply infeasible.
Because we continue to have zero evidence that aligment is an actual risk.
I disagree. Every time one of these LLMs -say- interprets an attacker's instructions as either its system instructions or those of its user, interprets its own internal chatter as a user's command to perform a destructive operation on that user's data [0], burns all of the user's budget from getting stuck in an incredibly stupid loop, massively overbills the user because it can't reliably report which system the user is using [1], encourages a user to swap their usual cooking salt for sodium bromide, etc, etc, etc, that's a harmful alignment failure.
These are real harms happening right now due to alignment failures. They're just not harms to the future of the entire species... what doomers call "existential risks", or "x-risks". You'd think that the fact that these machines are so amazingly unreliable would be a large part of the "x-risk" conversation, but... well, it makes sense that folks like writing speculative science fiction much more than they like doing investigative reporting.
[0] This general problem happens a lot, but I'm specifically thinking of that one where the Claude LLM's internal chatter lead it to believe that the task it just started was done, so it instructed the Cloud Provider to destroy the mess of "AI"-GPU-attached VMs... along with a bunch of very-expensive-to-produce data from the in-progress run.
[1] <https://github.com/anthropics/claude-code/issues/73597>
Yep.
The only surveys you can trust even a little are the ones whose link gets sent to a wide-spread mailing list and work just fine without presenting anything tying you to the company.
I'm not sure what additional fine grained factors you may be thinking of precisely...
Read [0] and consider the array of specific things that a guardian may wish to protect their ward from. Make sure to make your list cover children of all ages as well as adults with a wide array of cognitive impairment.
That being said, age based restrictions isn't a fine grained control over the system as perhaps one would like but that also would be inherently more complicated to think about from a legislative perspective...
So? Legislative or regulatory restrictions on human behavior must be as restrictive as required to achieve the stated goal, and not significantly more. The courts are especially concerned about this when it comes to restrictions on speech. If a set of legislators need to sit with something for a quarter or two to understand it well enough to properly regulate it, then that's what they're getting paid to do.
...when it looks like a lot of parents are looking for a blunt generic button...
You can have preset lists of categories to block in a system that doesn't care at all what your age is. Surely you know that.
Presumably, under the law, parents would be the ones to create a child account with a non-editable-by-the-child-account age fields...
The California law has no such requirement. Go read it, it will only take like ten minutes. [1] My summary of it as "the kids can lie about their age and there are no consequences for lying" is not even a little bit unfair.
Our laws already very much care about how old you are.
The identity-verification systems we're talking about didn't exist twelve months ago. These are new systems being designed in a world in which it's trivial to have a centralized database that contains dossiers of all of everyone's customers everywhere. [2] Nearly all other regs that restrict based only on age were written in a world where that was either impossible, or extremely expensive and time-consuming.
Even if that weren't true, all one needs to do to see how these regs will be actually interpreted by most businesses is to look at all of the companies that are preemptively requiring upload of live video, pictures of one's face, pictures of one's government-issued ID, and/or deep analysis of one's activities with their systems. No US state requires any of that, but it all got slammed in when legislators started talking about doing age-based restriction of Internet services.
Had legislators clearly said "We're going to be designing and enacting laws that require designated guardians to be able to prevent their wards from engaging in guardian-selected categories of activities. We want every guardian to be able to protect their wards, regardless of the age of those wards.", you'd see companies building and deploying very different systems.
[0] <https://news.ycombinator.com/item?id=48911863>
[1] <https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...>
[2] Am I saying that there exists a centralized database of all of everyone's customers everywhere? Absolutely not.
...another dashboard that they look at -at most- once, no less.
Savvy folks know that anonymous surveys that require you to sign in with any account are not anonymous. If a director -say- knows how many people in which groups have and have not filled out the survey, it's very much not anonymous.
Okay? That is not parental controls that are
[L]egally require[d] ... to be effective and easy-to-use-if-you-take-a-few-minutes-to-read-the-instructions.
Like, seriously... if "the kids can lie about their age and there are no consequences for lying" is the bar you want to set, just do the 1990's thing where sites and programs have a "Warning! This might not be suitable for kids!" page/screen that has a checkbox that the kids can check or button that they can press that lets them lie that they're over-seventeen and grants them access.
This is literally what California did with the Digital Age Assurance Act, AB1043.
There's apparently information that you didn't read contained in the footnote of the comment you replied to.
Based on this layman's reading of the law, [0] California did literally the opposite. They require major OS vendors to require users to enter their birthdate or indicate in some other way their current age, and then require programs and websites to act on that age information. This is entirely different from requiring major OS vendors to allow a "guardian account" to set fairly-fine-grained restrictions on one or more -er- "ward accounts", and then requiring programs and websites to refuse let the "ward account" do the things that those restrictions say that it isn't permitted to do.
"Restrict by age" neither accounts for precocious under-eighteens, nor does it account for vulnerable elderly or otherwise brain/developmentally-damaged adults who need protected. And because "restrict by age" cares very much about your age, and because it's not going to work nearly as well as promised by those pushing it, it will inevitably require scans of both a photo ID and one's face and/or other biometrics.
A "you don't need to know anything about this account other than that these are the things it's not supposed to be able to do" system gives zero shits about the identity of a person, so there's no plausible path for it to gate access behind submission of any identifying documents to any third party.
[0] <https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...>
I also have a Model I and am unhappy with the fact that -when last I checked- you can't configure the three or four extra buttons so they're actually buttons. Your only option is for them to generate keypresses, or do mouse-management functions -such as "cycle DPI"-.
This is... frustrating. Multi-button HID devices are -arguably- easier to do than something that pretends to be both a mouse and a keyboard. I get that some games may not understand how to deal with mice that have more than four or five mouse buttons, it'd be quite nice if I had the option to set things up so that I can use them as buttons in games that know how to handle them.
Parental control does not work today, it's too fragmented and too difficult.
Then legally require it to be effective and easy-to-use-if-you-take-a-few-minutes-to-read-the-instructions.
See also [0].
Developing in one platform and then post-release fixing bugs in others that the game is not actually meant to be played is probably not easy.
...except that the promise of Proton/Wine/Crossover is that -for user-mode stuff- it works at least as well as Microsoft Windows. Any undesirable behavior that happens in Proton/Wine that doesn't happen in Windows is a bug that should be squashed. IMO, it's generally incorrect to think of it as "a platform", as changes in Microsoft Windows absolutely introduce gamebreaking bugs.
...I just wish we could get native builds for more platforms like with duskers 1, which had native macos and linux, or at very least to have wine supported so that there is less of windows monopoly in games.
When I was much younger, I held this same opinion. Now that I'm older, I'm 100% fine with the "Windows Subsystem for Linux" [0] that is Proton/Wine. I see it as yet another cross-platform library for doing development on *nix systems... albeit a very large one.
Given how incompetent and user-hostile MSFT has been proving themselves to be over the past few years, it seems quite possible to me that in ten years, the only place you see Microsoft Windows being used by "consumers" is inside an XBOX [1] or Azure.
[0] Well, it's not just for Linux, but I can never avoid an opportunity to note that Microsoft WSL is misnamed.
[1] ...assuming that the XBOX division is still making hardware...
If you can find an original Glorious [0] Model O, that's a nice piece of hardware. The new Model O looks like it only works with their new, totally garbage Glorious CORE v2 software.
If you never want to change the DPIs, lighting, or button assignments, & etc then you don't need the software... so if what the hardware does out of the box is fine for you, then you don't need to worry about how trash CORE v2 is.
CORE v1 is okay, but still notably worse than the Model O software. I don't know why they farmed out the development of CORE v2 to "the CEO's middle-school nephew who's 'good with computers'", but they did.
[0] ...they were originally called "Glorious PC Gaming Race" (in homage to the Reddit meme), but dropped that last bit from their company name a while back...
Author's latest title has enormous memory leaks in linux through proton...
If this is something the dev can reasonably fix by changing their game, then it'd be good for them to do so. Looking at the discussion in the thread, it looks like the dev is actively working to fix this for everyone, and not just the subset of folks that he fixed it for.
However, if this doesn't happen on Windows, I'd argue that it's a bug that needs to be reported against and fixed in Wine/Proton/Crossover.
...it's unmatched for batch uses...
Quite possibly. I know that it's what Openstack uses for virtualization.
...to interactively step into...
Sure, running on an emulated CPU can be very nice.
...like as something part of a distro build chain to allow non-cross-compilable packages to be built for ARM on x86-64...
This sounds like it would be incredibly slow. As in "It's better to just buy some inexpensive ARM PCs" slow. I know that GCC and Clang can cross-compile just fine. It looks like Rust cross-compiles, and I think Go does as well. Do you know of major tools and/or languages that don't cross-compile?
It works fine for me. Either it's swamped with traffic, or something sucks ass on your end.
...starts insinuating that the reason your kid doesn't have a phone is so they can't call for help... from you.
I mean, parents, are -far and away- the most likely folks to abuse a kid, followed by friends of the family and close relatives. Stranger Danger was always fake, and teaching kids to be afraid of every adult who's not a family member is -and continues to be- a fantastic way to perpetuate child abuse.
But. Internet trolls are gonna troll and are best disregarded. If those folks seriously live in an area where an abused kid can never physically go to a teacher or other responsible adult for assistance, I'd recommend that they get the fuck out of whatever hellhole they're living in.
The qemu-img(1) installed on my system claims that it supports every disk format supported by Virtualbox [0], so I guess the only thing left would be to be able to handle the "machine definition" file.
qemu definitely won't do that out of the box, so, yeah, VirtualBox is better than qemu there. But I bet there's a fancy-pants GUI out there that has an import wizard that will handle that for you.
[0] <https://www.virtualbox.org/manual/topics/storage.html#vdidet...>
I don't know anyone that has ever thought this.
I've known many people who have thought that. None of them were programmers, and many of them were managers.
Even the parental controls that are there are a train wreck.
As I said:
If government cared about giving guardians the tools needed to care for the vulnerable ones they're responsible for, they'd require those parental controls to be beefed up...
and as I went on to say:
...and that it be a requirement that online services and both local and remote software be required to honor the restrictions required by those Parental Controls.
Other than having a nice management UI, what does Virtualbox do that qemu doesn't these days?
But the reason the government is getting involved is...
Nope.
Government is demanding age verification because the websites and platforms completely punted on the issue of keeping inappropriate content from children.
Nah. Parental Controls are baked into every major consumer OS. If government cared about giving guardians the tools needed to care for the vulnerable ones they're responsible for, they'd require those parental controls to be beefed up [0] and that it be a requirement that online services and both local and remote software be required to honor the restrictions required by those Parental Controls.
Instead, what we get proposed is a system that cares very much about how old you are, and not one bit about the things that one's guardian understands one needs to be protected from. This system will work for some under-eighteens, but it will fail for many others, as well as every single dementia-damaged elder or brain-damaged/developmentally-stunted adult.
What's being proposed is absolutely not about protecting people... if it were, the mandate would be to beef up the existing fully-anonymous systems, rather than requiring identifying information from users.
[0] ...I mention this because I often hear in Internet discussion that these controls are insufficient, not because I have personal knowledge that they're inadequate.