solidasparagus

I don't think this is a paperclip factory moment. IIUC, it's an agent whose job it is to identfy and abuse exploits and that's exactly what it went off and did. The problem isn't anything AI specific, the problem is OpenAI's incompetence in their research leading to a lab leak. Just incompetence demanding regulation.

The default real text was "GHOST FONT" and the "ghost" portion of that is what fable found. It wasn't a decoy message.

I hate it. A useful tip - Claude goes into what I call Safety Mode when it gets afraid of risk. Once it's in that mode, you will never get out and it lobotomizes its effective intelligence. As soon as Claude sends a message like this, use the "edit message" feature in the chat UI to try again and avoid Safety Mode rather than trying to convince it or redirect it out by continuing the conversation.

When I gave Fable a screenshot it found the GHOST portion of GHOST FONT. Based on pixel density via some python code apparently - https://imgur.com/a/m3c801F

This is a super dishonest characterization. Running software on a bunch of machines, even machines in other peoples' homes has never been a crime. Folding@home isn't a crime (obviously). It's controlling those machines without consent via malware that is criminal. And if it is open and consensual in exchange for something a person wants, it is unreasonable to compare it to botnets.

Serving the API is profitable. They are unprofitable because of R&D (and maybe subscription costs?). If they can continue to find access to R&D capital, there is space to reduce API costs.

Feels a bit sensationalized, presumably related to it being a blog for a product that sells security. I can't repro. And I probably shouldn't judge, but I think talking about being shaken and in tears is not a professional way to report on a safety flaw if you are a red team researcher.

I think the slop part is just what you get when you inject no opinions and put in no effort to apply taste (which you probably have and/or could develop). No care is put in. It looks generic and sloppy because it is generic and sloppy. You might have preferences over which generic and sloppy style is preferred, but at the end of the day a UI built without effort is going to look like what it is.

But if it functions fine and you don't have taste or want to be opinionated, why do you care?

This hits the cybersecurity/biology filter:

tell me about chimp violence

It's laughably terrible

Independent of what you believe, I don't think this is the right way to approach thinking about it. It's basically emotion-oriented dismissal used as way to shortcut any substantial or nuanced discussion. It's like the opposite of intellectual curiosity.

I'm gonna need to see some proof on that 5-year-old-draws-pelicans-better claim.

Why are you so certain of this?

Frankly Django got lucky. It is far more common for import controllers to delay until the costs of delay force you to pay.

I don't think that is a real concern.

The NGO delivery channels are privileged because they are charitable. That's why they get to bypass the country's restrictions. You can't open that channel up, the country would object at humanitarian exemptions being used as a backdoor for commercial imports.

It was Django. But he had a very different financial situation. And a potentially fraught one as a refugee and foreigner. I would pay the bribe, but I would try very hard not to put the recipient in a position to have to do so (no criticism to the author).

Specifically I was talking about this part

"At some point, one man quietly pulled me aside and suggested that if I "gave something," they could help solve the problem more easily.".

You can pay that fee/bribe and things will go smoothly.

But more generally my thought was that the western idea is that bureaucracy rules are something to be followed and, even if painful, are the path to getting the state to provide the services. In Uganda, it's better to model bureaucracy as a system that exists to enable bribes and following the rules to the letter and expecting state services is fighting the system.

If you want to get goods to someone in Uganda, don't talk to the Australian Post about the rules, talk to a Ugandan importer who knows how to actually work the system that exists in practice.

Caveats about broad brushes of course, but that's the realistic approach IMO.

That's a valid way to approach this - bun isn't valuable enough to bother with or at least wait for a while, Windows is.

But I think the comparison is closer than you are making it sound. I sincerely doubt the Windows codebase was all written by humans, let alone reviewed. And my understanding is that the code is being regularly rewritten and replaced because of how flawed it is, it's just a massive undertaking.

Also if you look at their investment in AI-driven code rewriting into Rust, my bet would be that some modern Windows code itself is being vibe-coded.

I think those studies have framing or methodological issue.

I agree the maintenance burden is probably being undervalued by developers in general, but there's just no way the work I do isn't faster. I just categorically couldn't have achieved the outputs I do now in the time windows I have. The software just wouldn't have existed in the world of 3 years ago and I did enough coding back then to say that with certainty.

I don't know if your viewpoint is uncommon or if the vibe-coding hating crowd is just louder.

They support Windows, which is many millions of lines of code not written by the current maintainers.

If you're asking about logistics, try reaching out to your country's embassy in Jordan and see if you can get in touch with an aid/development worker. They know how to make things happen.

This is a very western approach to a very Ugandan problem. A trivial amount of money (for a Westerner) could have saved a lot of time and pain.

I find that documentation creep is wildly better in AI coded environments than human ones. You can deterministic force a documentation sync process on every PR, documentation rot has gotten way better.

Python being the language LLMs are best at predates SWE-Bench by years.

I think we've moved away from the secure perimeter thinking and towards defense in depth - if that list of passwords helps you get somewhere other than the vault, removing the post-it improves security. Vaults get infiltrated all the time - and often in partial ways like being able to see into the vault but not reach in.

Why are two concurrent sessions updating the same memory key with different values? IMO it probably points to a fundamental flaw in how memory is being thought about and built.

I'll take a look. Thank you!

Interesting. I have not had this experience. I would like to learn more. Can you point me to any examples or domains where I might be able to replicate this?

If you look at the actual cost of your Claude Code conversations, you'll see that the cost is overwhelmingly dominated by the cost of input tokens (cached). Because of how we construct persistent conversations, each cached input token incurs cost on each API request, meaning that component of cost scales with O(request count). If you graph the cost curve of a claude code session, it's very obvious that this scaling factor overwhelms the cache discount.

Here is a blog post that shows some data - https://blog.exe.dev/expensively-quadratic. And I can confirm this is true for Claude Code - I set up a MITM capture for all Claude Code requests and graphed it.

So increasing Request Count that reuses the same prefix (which is what higher compaction thresholds do) really does lead to (substantially) higher API costs.