While there is no proof that anyone knew about these weak keys for the year and a half that they were trusted by virtually everybody, and there's no evidence of MITM attacks happening in the wild because of it, you can imagine the payoff that a three letter agency would have if, for even 10 days, there was an opportunity to harvest credentials from important people in high places.
I have no evidence or proof, but I am convinced this wrap/unwrap key generation debacle was intentional and the weak keys were discovered and kept secret by the agencies or governments and used to exploit their adversaries.
You don't need to perform a traditional MITM attack _if you own the airport_ or you _own the free public wifi_. The traffic can be harvested in clear text and we have to come to terms with the _remote possibility_ that this was going on for over a year and a half. If not that long, then certainly for the past 10 days.
This would've been true a while back prior to major browsers checking for certificate transparency log entries as part of the handshake.
So, I do agree this could be problematic, on specific cases where people not using a major browser were accessing resources some is interested on, on a network they have control of. Makes the surface quite small.
The threat here is more so for 'backend' services than regular browser users.
This is misleading. In order to read traffic you would need to swap out the end-entity TLS certs being used. Phones and browsers (at a minimum) enforce certificate transparency, so connections would fail.
But the point of the OP is that git, curl, pip, python, etc don't use certificate transparency. That's why it's so egregious that apple still trusts these certs by default in these non-browser edge cases.
My point is less NSA and more NSO. The UAE was denied a root CA[0]. DarkMatter applied to be its own root CA until it was denied[1] over concerns raised about potential spying/espionage[2].
There are people from these CAs who were denied in the past explicitly for concerns about spying who now work at eMudhra[3,4].
Again, I have no proof. There may never be any proof. But I think it's time we think about who might have found out about this weak key when it was first issued a year and a half ago and trusted by the whole world and what they would have done with that information.
> I get almost physically ill when I work on a project with more source code files or at least general architecture than I can keep in my head, so I don’t get anything out of expanded scope
While I sympathize with your loss, this was always going to prevent you from holding down a job, even as a pre-LLM "coder." The majority of us have to work on systems, not just single files or cleanly isolated programs we can hold in our head.
Perhaps I didn't formulate this too well. Say, rustc is a gigantic program, but the parser alone, or the borrow checker alone, or the LLVM backend alone are small enough to work on individually, and from the perspective of any such unit all the others can be treated as black boxes, deliberately designed to have as small of a public API surface as reasonable and to be as predictable as possible. That's just architecture 101. With LLM code, I notice, such abstractions fall apart, and the interconnectedness, duplicated code, and unclear expectations make it impossible to reason about the result except as a giant lump. Of course, tech debt is nothing new, but at least it used to be held back by the physical inability to make progress once things get dire; with LLMs, this misery gets prolonged.
I don't think this statement implies they meant 'single files'? They could be talking about complex systems that they could fit into their head, and now they can't do that with new workflows.
This is a potentially polarizing (but very welcome imo) change to pi. I'm such a huge fan of the pi SDK, and just yesterday I was trying to wire up the pi mcp extension to be used in a project and sonnet told me about the ongoing work in the 0.99.x tags. Didn't realize the next day it would be merged! Fantastic news.
This is how AI is going to kill us all. It's not going to become superintelligent and harvest our biomass for energy - we're just going to assume it's moderately intelligent and those assumptions will lead to badly informed decisions and by the time we realize we are acting on bad information it will be far too late for anyone to do anything about it.
Responsible, no (as someone else pointed out). I don't know anything else.
AI technology was used to target Palestinian / Hamas targets (and often their families), ultimately there was a human behind the wheels that would do a thumbsup or down. They spent less than two seconds on many targets. Make of that what you will. https://en.wikipedia.org/wiki/AI-assisted_targeting_in_the_G...
I understand what you mean but the phrasing is unfortunate. The people and organizations who use AI are fully responsible for the outcomes of their use of AI.
Nice! The idea of having a friday leetcode problem for my team has been kicked around to try and keep us on our toes when it comes to solving these style problems and preventing atrophy of this part of our brain. Might try wrapping this cli in some kind of web ui or adding it to our slackbot
It's not clear to me from the article, are they asking sol to output bounding box coordinates with some kind of structured outputs?
Anecdotal but I've seen it use python to crop, zoom, and "enhance" (fiddle with sharpness and brightness) images to read sections of handwritten census data from the 1800s. Feels like that there might just be a mismatch of capabilities when it comes to straight outputting coordinates but I bet the model is better at actually finding the answer given any tools available. Which I get is a bit of an apples and oranges situation.
I've also tried to use it to identify an old pair of glasses and it didn't stand a chance, so I do think it's not quite there yet when it comes to some vision tasks.
I built macrosforhumans.com because I had been using cronometer since 2020 on and off and was familiar with tracking macros but always hated the entry. Measurement is something that you have to do regardless but the annoyance of having to suffer through their search/recipe/diary CRUD UI was unbearable. With MFH there is no mobile or web app. it's just a phone number that you text. This reduced the friction for me significantly and I've already lost a few pounds and, after recently turning 30, hopefully a few more with more diet and exercise.
I've been building this for a while but I'm working on getting my first 100 users now which is my first foray into the marketing/sales side of things and any tips would be helpful. Also I didn't realize until later that the name, while I think is pretty cool, might be extremely poor SEO? :-)
I also think that these kinds of post-app apps are a curious idea and will become more popular, although likely (hopefully not) through sms as the communication medium. I am off this week and plan to write some stuff about it but it feels really cool to remove the terrible CRUD UIs entirely from this part of my life. I tell my friends that even if it doesn't take off I'm never shutting it down because I enjoy using it over myfitnesspal/cronometer/macrofactor etc so much.
I have no evidence or proof, but I am convinced this wrap/unwrap key generation debacle was intentional and the weak keys were discovered and kept secret by the agencies or governments and used to exploit their adversaries.
You don't need to perform a traditional MITM attack _if you own the airport_ or you _own the free public wifi_. The traffic can be harvested in clear text and we have to come to terms with the _remote possibility_ that this was going on for over a year and a half. If not that long, then certainly for the past 10 days.