Don't use vibecoded distros. It doesn't matter whether they fix this or that, or whether you care about a particular vuln. This is not sensible. It's why you switched away from Windows in the first place, remember?
> because apparently what we have to offer is worth spending a ton of cycles to calculate the Anubis challenge.
This statement holds the core misapprehension behind Anubis. It’s not a ton of cycles. There is no difficulty setting that would be inconvenient for bots but usable for humans on mobile devices.
I noticed the other day that lists.ffmpeg.org had moved to Anubis difficulty level 6, which takes ~180sec for my iPhone 17 to solve at ~100KH/s, making the site unusable. So I spent ~10 minutes vibe coding a safari extension with a native bridge to an optimized C kernel using ARM SHA256H* instructions that can do 200+ MH/s on the same device. This solves Anubis difficulty level 6 in a handful of milliseconds.
Given the numbers and capabilities involved (a single $5K ASIC miner yields 200TH/s, a million times more hash rate than my optimized kernel running on an iPhone), I don’t see how proof of work could possibly be a sustainable strategy to keep bots out without ruining human user experience. It’s an arms race that can’t be won.
Edit: I encourage you to try this yourself. Here's a sample prompt that ought to one-shot the task:
> Build an iOS Safari Web Extension that accelerates Anubis proof-of-work using a native C ARM64 SHA-256 kernel. Precompute the invariant 128-byte challenge prefix, search fixed-width decimal nonces with ARM SHA-2 intrinsics and two worker threads, and target difficulty-6 solves under one second. Relay challenges from a Safari content script through the background service worker to native code, then submit the valid nonce/hash through Anubis’s normal pass-challenge endpoint. Include a deterministic benchmark app, correctness tests against CryptoKit, bounded execution, and fallback to Anubis’s stock solver.
I think there are two opposite causes here: either an overly-aligned or completely unaligned mental model.
For developers, bug-blindness tends to be because their mental model is so close to the system's model that both have the same blind spots, and the developer can't effectively think outside the system (the classic "QA walks into a bar, orders 0 beers, orders -1 beers, orders 0.999 beers" vs "customer walks into a bar, asks where the bathroom is, bar immediately bursts into flames").
On the other hand, a common way for regular people to interact with a system is they just... don't have a model. None at all. Like, they click a thing and see what it does, and if it doesn't do what they expect they shrug and click something else. The horror of seeing a non-software person using a software system is realising that they usually cannot tell the difference between expected and unexpected behaviour, because they don't really form expectations in the first place. The computer is more genie than machine.
You can see this in the article: "Google Docs added some kind of delay such that the typing you do into the title box right after you open the doc gets overwritten". That's a developer forming a model of the system. The lay alternative is to simply learn that sometimes when you type in a box, the text appears. Other times, it doesn't. If it doesn't, you try again.
You don't need to understand the system if you abandon the assumption that the system was designed to be understood. And, in practice, the widespread plagues of shitty engineering, anti-features, and lack of respect for the user often combine to make that model the more information-theoretically optimal one.
In that sense, the very thing that makes us miserable is our perverse need to treat Google Docs as an engineered product rather than a cross between a djinn and a symbiotic fungus.
The European Commission has far too much power, and answers far too little to the populace. In reality, they want to be dictators.
If you don't know, the unfortunate way thf EU is structured, the Parliament cannot initiate legislation. They can only vote on whatever the Commission puts in front of them.
If the Parliament votes "wrong", the Commission just repackages the idea in a new bill, pulls a couple of dirty tricks, and tried again. They only have to succeed once. See ChatControl for a prime example.
So the EU will eventually require backdoors in encryption. It's only a question of how many tries it takes...
I've spent the last few days adding traps to one of my websites, ironically using LLMs of course, and I've been having quite a lot of fun doing it.
Instead of the proof-of-work system of Anubis, I've gone down the iocaine route but implemented it in my application itself, as it's built in Elixir and causing problems for scrapers is really fun when it takes almost no server resources.
Currently I trick bad scrapers into a fake infinite black hole path with the promise of tasty data, then serve images to them one byte at a time over 15 minutes (after sending the header quickly), bloat the responses to cost them tokens, and randomly return AI generated images of sexy toasters. I have an admin dashboard with a little leaderboard for which ones get the most stuffed, and it keeps my heart warm on these wet autumn evenings.
There's a similar anecdote Gillian Anderson recently revealed during an interview on the X-Files, saying Chris Carter had an OCD-like habit to write dialog to conform to certain text layout preferences (no widows[1]) in the script, which made for the show's distinctive style of dialog cadence.
I may be missing something, but this is exactly what I want as a default. I want the session links there. I see PRs from my coworkers with session links.
I still get to control whether other people can see the session, but I don’t lose it.
I don’t get the “unprofessional” argument. This is attribution. Attribution is professional. If you don’t want it, you turn it off or rewrite the commit messages. If you are having Claude write the commit messages FOR YOU and you are NOT READING THEM then that’s what’s unprofessional. I am honestly kind of shocked and disappointed by how upset people are by this.
Our first time out on the playa together, my girlfriend and I stopped by this phone booth and made a couple of calls. And because we stopped, we saw the FSM camp next door, and a giant sign saying "Weddings Here", so we inquired. They offered us free rings and then announced our wedding over a loudspeaker. In 2 minutes we had an entire wedding party, complete with best man, an elder to give away the bride, 25+ guests, and an officiant. My newly-minted best man even gave me one of my favorite playa gifts ever as a wedding gift. We opted not to "make it official", though they offered. It was a truly incredible experience. Thanks FSM!
I think both the OpenAI and METR discussions, while interesting, miss the more important context: what were the humans doing in all this? This was a structural failure of a human organization, but the analysis focuses almost exclusively on the agency of machines, not the institutional systems that failed to police them. The humans and their own agency/involvement is essentially omitted from the story and subsequent reporting. I suspect the omission is actually a result of company/industry myopia to human factors analysis, but it dovetails amazingly well with the marketing narrative.
Just took a train ride from Vienna to Budapest for a few days, and couldn’t help but notice how very, very dry everything is .. as an Australian living in Europe for a few decades now, I’ve always been intrigued by just how green everything is, literally something growing in every single crack in the pavement, or endless rolling green fields of prosperity during spring - whereas, where I’m from its year-long spinifex and grass shrubs and wattles with the occasional bush flower bloom, barely hanging on out in the desert, mostly reds and blacks and greys, not much green - so the vibrancy of European fields and the abundant diversity of countryside flora have always been pleasant to my eyes ..
During this trip, I was kind of shocked that things felt a bit more Australian to my eyes .. the grasses are dry and barren, the beautiful city parks of both Budapest and Vienna dustier than usual, the Danube water level definitely noticeably lower than I remember ever seeing.
I’ve long been encouraging my European friends to not take the abundance of growth for granted, and now we see it in the environment, plain and clear: the worlds’ weather is changing.
A week of sweltering heat is predicted for us again in Vienna, and as we get started on September and then October so close, two thoughts are on my mind: use this opportunity to go for more dips in the Danube, and .. I wonder what the floods of late-autumn will bring, because .. inevitably .. this super dry summer means there will be heavier rains in October. Might be we look back in a month or two and wish we had this dry heat back again, who knows ..
Either way, neither city is particularly comfortable in the heat. A hundred or so years ago, the heat retention was a feature. Now it’s a bug.
Which is actually why I DON'T like the session amended. Ultimately it is an ad placed into the Git log, and noise at that. Regardless of if it exists or not, the professional responsibility for what is contained in that PR/commit falls to the feet of the developer contributing it.
Microsoft previously did this with Copilot, which was correctly met with a very negative response. I don't see why an ad by Anthropic is better than an ad from Microsoft.
> [...] Let's maybe add a helmet? It could improve riding theme, but may obscure head. Maybe a small cycling cap or helmet? The user didn't ask; can add red helmet? Might be cute. But pelican with big beak; a helmet might obscure. Better maybe no.
> In 2023, the Texas Legislature unanimously passed a law raising auto insurance costs for Texans by $1 to combat rampant catalytic converter theft.
> The Motor Vehicle Crime Prevention Authority, led by a board mostly appointed by Gov. Greg Abbott, has turned the $1 fee hike into at least 3,200 Flock cameras.
More coming. Meanwhile, secure your EV!!! Batteries will be next!!!
An architect friend of mine once said that he admired IKEA above all other furniture manufacturers because it made a modern range of aesthetics available to the masses. IKEA had done more to evolve the public taste than any other manufacturer.
And I do have to agree. I can remember what ghastly furniture most shops used to have around here. There was a lot of what we call "cabin furniture" - which isn't made to look good, just be practical. (Well, some people like that look, but it is a bit...dull). Sure, there was more solid wood furniture, but guess what: that durability comes at a cost. Not only in terms of money, but also in terms of how easy it was to install and move.
And who buys furniture to pass it on to your kids? Your kids will be unburdening themselves of your old furniture before you are in the ground.
As for quality: I have owned some pricey designer furniture and I can't say that I'm always impressed with the quality. Yes, if you have a lot more money you can get really well built furniture. But IKEA is more often than not more than sufficient quality. (Also see their "hidden tags" campaign)
If I pay $5000 for a chair I have reason to expect a lot from it. And more often than not, pricey furniture doesn't actually deliver sufficient quality to be able to defend the price. (Collectible furniture is a whole different deal where you don't actually care all that much about quality, but more about it being an original piece).
For those of you who look down on IKEA furniture, I'd like to hear about what alternatives you think need mentioning. Especially for young people or people of modest means. And I'm not trying to make some clever rhetorical point here. I can't really think of any company that offers what they offer and comparable quality, looks and price here in Europe.
I think the post underestimates just how little thought and effort is put into these bots. I also run a cgit instance with far less interesting projects, and am not spared from the deluge of HTTP requests.
The explanation I could come up with is that they try to crawl all links regardless of how much sense it makes or how much load it causes. cgit being cgit, this means billions of links for all combinations of parameters and hashes. That, or it's a deliberate DDoS attack.
It seems based on this that the appropriate sci fi metaphor is not the Terminator or the Paperclip Maximizer, but Mr. Meeseeks. A initially cheerful helper who gets more and more deranged and driven to extreme lengths when faced with an apparently impossible task.
I am super sensitive to over engineering. For my doorbell I wanted something that lets me play a custom bell sound. You would be surprised that 99% of the solutions out there are complete over engineered stacks that depend on wifi devices, Internet access, connecting to various cloud services... So I built my own: a basic wireless button sends a radio 433 MHz signal, and my receiver is plugged inside the house and triggers an off-the-shelf playback PCB module that reads an MP3 off an SD card and plays it on a speaker wired to the module. No Wifi, no Internet, no cloud, no apps. And the rare times I want to change the sound, I update the MP3 on the SD card.
Edit: there are very, very few products on the market designed as simply as this, just an R/F signal triggering local playback. I think the only commercial doorbells designed like this I found were an out-of-stock product, and a UK device designed for 230V that would have required a bulky adapter to work for me in the US.
What’s different is that it comes configured this way out of the box, silently, without warning. It’s functionally equivalent to opting in to giving all user accounts root privileges, which is not what anyone expects the default configuration to be.
You can choose to configure your installs this way if you choose to do so. It should not come this way quietly by default.
But, this “vulnerability” is the thing everybody knows about docker since forever. I always make my user part of the docker group, so my NixOS also has this, and any Ubuntu I’ve used over the past year. What is different here?
Start a docker container with the docker socket mounted in the container and now you can have yourself mount / as rw. Everybody knows this. How is everybody so shocked here. Many instructions online tell you to make yourself part of the docker group for convenience (like the digital ocean one).
Tech, finance, and political people definitely don't make up close to the majority. You'd get sort of laughed at if you tried networking earnestly about like tech stocks or LLMs. Generally I don't prefer socializing with techie types from SF, the folks I met at Burning Man were nothing of the sort.
It's mostly just adults who really like dressing up, building stuff, and staying up really late dancing and partying.
IKEA furniture is great for small adjustments to fit your needs. Not costing a fortune also makes it easier to experiment with it.
Since they're so common, it's easy to find CAD drawings for most of them.
I did a small hack/conversion on a Billy closet to hide some pipes in our apartment.
https://vanderwalt.de/blog/customizing-ikea-billy-to-hide-pi...
