Telemetry is used to push service, which is the big money maker for dealerships. Roadside assistance, maps subscriptions, driving data for market research.
I spent about an hour looking at the code and found some glaring issues that should be fixed before trusting it with real money.
- Yahoo News is introduced twice (sentiment and news analysis) which double weights it
- Sentiment analysis prompt primes the model to be bullish on Nvidia.
- In the self learning loop there is a complex parsing bug that results in hallucinated memories when agents return truncated responses
- You can completely control sentiment analysis of a subreddit by simply maintaining a majority of the 5 most recently posted messages, regardless of any quality metric
- The reflection prompt states the agent must cite alpha, which in a market wide downturn causes it to think correctly placed calls were losses
To be fair, these are not prompted as has been described here. These are actually "few shot" examples in the sentiment prompt. It is presented as an example under "distinguish opinion from event" but not as "do-this" evidence. Still, hard-coded positive Nvidia/NVDA examples in a generic prompt are unnecessary prompt contamination. At best this a real bias risk, but not a strong deterministic bug.
There is also problem with underlying models. There was a study, where they always repest the same investing/management strategy: trust strangers, be open minded/adopt to new unproven ideas, prefer cooperation... Basically they were trained on disney-boomer bull(shit) market of last 15 years.
They have zero guards against market manioulations, and will get wiped without bull market!
That rebuttal held water 10 years ago, but fortunately we have made a lot of advancements since then.
DNSSEC was a solution trying to solve the problem of DNS security while still maintaining transparency for DNS operators to spy on queries. At the time, passive DNS was one of the tent poles of tracking malware and responding to security incidents.
We have since committed entirely to transport security in the form of DoH and friends. It solves the vast majority of problems we actually have.
The rebuttal is old because the criticism is old. If you give more up-to-date criticism, then more modern rebuttals are available.
”DNS security” can mean many things, but DNSSEC was meant to solve the problem of verification of DNS data, while still allowing for offline signing and secondary DNS servers serving pre-signed zones, without distributing the key everywhere. DoH/DoT do not solve this; they solve different problems.
DoH only secures the connection between the DoH provider and the client, not the response from the authoritative DNS server. It also isn't sufficient for DANE or similar. So DoH doesn't completely solve the problems DNSSEC tried to.
Authentication is precisely the problem DNSSEC is supposed to solve. And authentication is part of transport security.
TLS usually does provide authentication. The certificate is signed by a chain that leads up to a trusted CA, and content of the stream is authenticated using an AEAD encryption algorithm. But RFC 9539 specifically doesn't require the certificate to be signed by a CA (and recommends using a self signed cert) or the client to verify the authenticity of the certificate used by the server.
This means that an active MitM could return whatever it wanted to the recursive resolver. Pulling that off is admittedly more difficult than a MitM on a public wifi network at a coffee shop, but it's still a gap in security.
And no, you can't just use Web PKI to verify connections to authoritative DNS servers, because Web PKI relies on DNS to confirm domain ownership.
> Had DNSSEC been deployed 5 years ago, Muammar Gaddafi would have controlled BIT.LY’s TLS keys.
Yupp. Which is why using bit.ly is a terrible idea unless you live in Lybia
Did you read the article? It's saying that DNSSEC as an implementation to prevent MITM is flawed; other solutions that protect against MITM are proposed.
I think the comment you replied to was referring to the fact that when Twitter was taken over the entire Trust and Safety team was done away with. This has allowed child sexual abuse material to flourish on the platform.
It was referring to the feature they added where you could give a picture of a child to an AI module and ask it to undress it and it would comply, and millions of people did just that.
> but are they functionally useful or helpful to anyone currently?
I've been building a SaaS that deals with data that can't be distributed to third parties. Some of the useful AI stuff I can add is not time sensitive and can run overnight. Things like this allow me to use higher quality models without selling my house for GPUs.
