You're absolutely right, and that is a fair critique! You have discovered a load-bearing gap, full stop.
In all seriousness, many people here, including myself, regularly receive 5 to 10 page long AI generated "documentation" where it is clear the "author" never made it past the first paragraph.
You're wrong for OpenAI, their 5x/20x always referred to the full weekly limit, and my (and others') multiple tests confirmed it empirically multiple times by calculating API-equivalent prices, especially when going from one subscription tier to another.
You're right for Anthropic though, their 5x/20x is mostly for 5h limit.
Meta already serves its own models on Azure under their real names. azure/avocado-compaction-v1 and azure/avocado-memory-flush-v1 are in the same catalog. Those sessions do not come back as gpt_responses_v1 items with rs_ ids and encrypted reasoning.
> Peer authentication in the connection handshake is broken and allows impersonation. An attacker can connect to your node and present a Node ID that is not its own. Private repositories are shared only with allow-listed Node IDs. An attacker who fakes an allow-listed Node ID can fetch a private repository directly, without being on the network path. This was reported to us by cryptocode on 2026-08-12. We proposed a fix upstream, see this pull request.
They are trying to sweet write it as much as possible. But basically there is neither encryption nor authentication. The person who made the protocol/program simply didn't care.
I find this to be very telling about what kind of people they are. If you make a mistake this big you need to own up to it. BS all you want, maybe you think that works for you.. but people see through it.
Honestly issues like this crop up pretty commonly. JWT alg:none for example. Or even older people forcing SSL to downgrade to encryption null.
In any system that provides security it should only be designed to run if the security is in use, and to fail immediately with no further action if the security is not used.
I was very surprised when I realized what defaults postgres uses when it comes to SSL. I can see how people consider it a pragmatic choice - but still...
That's a great approach, I think byte matching is just popular because it's extremely easy to test in the end: are the bytes the same? While your approach requires putting far more trust into the tests.
reply