No thanks. When you are my age you will understand.
I have no idea why all the fucking vibed websites that swank around the web these days are unable to do a simple thing:
* Have one or more "themes" with dark and light variants
* Query the browser for a preference of light or dark and offer the default theme with the probed variant.
There is also the rather wider issue of accessibility in general. I happen to be an older bloke with astigmatism and rapidly worsening ... fucked up focussing and glasses and that. I'm lucky to have both eyes and decent colour perception and general all around acuity (for a given value of acuity).
It's 2026 FFS. Why on earth is this even being discussed as an issue? We have all these cool vibed efforts that can't even be bothered with simple basics.
The SEC would beg to differ with your first para. I imagine that "protect" involves "adjudication":
"Founded to help our country respond to the Great Depression, we’re the agency that protects investors from misconduct, promotes fairness & efficiency in the securities markets, and facilitates capital formation for those looking to hire, innovate, and grow."
I would certainly consider their "non-cancelable spending commitments" misconduct in their financial reporting obligations. The law doesn't seem to be on my side on that though. I don't have enough hubris to claim the law is wrong, but I don't think I'll retract my position either.
Can you explain your objection more? They have several sections of their S-1 dedicated to this, and it's been public knowledge for a while (the other big IPO this year had it as a pro), so I'm not sure what you mean by "misconduct in their financial reporting obligations"
They can have as many pages of explanation on it as they want, it doesn't address the fact that they need to be factored into headline numbers. It's the distinction between technical correctness and communicative correctness. It's like surprising and unusual clauses in contracts - those are invalid too if you aren't sufficiently upfront about it.
It's an IPO, the P is public. The information needs to be consumable by the public. The level of knowledge that can be expected of a random IPO stock buyer isn't the same as that of a VC or private fund.
And that's exactly where the SEC comes in. The 1930s went wrong enough, no point in doing a 2030s repeat.
> It's an IPO, the P is public. The information needs to be consumable by the public. The level of knowledge that can be expected of a random IPO stock buyer isn't the same as that of a VC or private fund.
I'd wager that the 95th percentile, and maybe the 99th percentile anthropic IPO participant, by volume, is a more sophisticated stock evaluator than either you or me.
It's a baked in poison pill. What that actually says is 'we're holding the economy for ransom, give us the money we want or the economy will crash and we've thrown the steering wheel out of the window'.
The only way to respond to that is to let them crash but then you have an even bigger problem: OpenAI will have an actual monopoly on frontier models in the West.
In all honesty, what are they going to do... raise prices?
Are we to believe the only reason they aren't making a profit is because of competitive pressure? Why would I believe they don't have the same structural issues as Anthropic? That should certainly be the base case assumption even if there wasn't so much evidence of the same kinds of deals and problems.
They have to raise prices and lower expenses or there's no advantage to being a monopoly. I don't think corporate customers will pay higher prices and I see no evidence that they're actually capable of lowering expenses.
They're welcome to stop training anytime and show us how efficient it is to do inference only.
That's assuming Anthropic ceases to exist rather than having to file for bankruptcy and sell off their assets to someone who continues to operate it as a business.
And that you couldn't subsequently do antitrust against OpenAI.
You mean like making up non-standard ARR calculations and not including your Q3 results in your initial S1 draft? Or you know hiding things in footnotes in the S1 so people don’t see the full math on your obligations?
> “Run-Rate Revenue” is an operating metric that refers to the estimated annualized value of our revenue-generating activity as of a measurement date, calculated as the sum of (i) our consumption-based fees during the trailing 28-day period ended on the measurement date, multiplied by 13, and (ii) our aggregate monthly subscription fees as of the measurement date, multiplied by 12. For purposes of calculating Run-Rate Revenue, consumption-based fees and subscription-based fees are derived from customer usage and active subscriptions.
28 days is 4 weeks, so you don't get fewer or more weekend days arbitrarily. Used very commonly in some industries for financial reporting and also dashboards for software engineers.
You don’t think day of the week matters for Anthropic’s usage numbers?
I don’t have a particular point of view on this but the people acting like this is weird or some big deal have clearly never spent much time with financial filings. There are much weirder scheduling things than this. Some companies split their reporting quarters up in unbalanced ways for instance.
If they make, say, 10x more on weekdays than weekends, using a 30 day month with two extra weekdays overestimates annual revenue since it translates to a year with 264 weekdays as opposed to 260.
Um what? You seem confused, they didn’t measure a year with 372 or even 364 days. They measured 28 days. And it’s almost a certainty that taking the average spend over the last 28 days and multiplying by 13 is higher than taking the average spend over the last 31 days and multiplying by 12. Especially if we believe their revenue growth numbers.
> it’s almost a certainty that taking the average spend over the last 28 days and multiplying by 13 is higher than taking the average spend over the last 31 days and multiplying by 12
This is generally true of any growing time series. If you don't want this look at the audited GAAP figures.
~All companies provide non-GAAP numbers alongside the standard ones, and amended S-1s are also extremely common. Neither of those is remotely indicative of anything nefarious
They report GAAP earnings, and explain why it is not the best method to understand their current performance. Do you think it is more meaningful to investors to use their convertible notes mark-to-market accounting and worry about a loss that represents "paying their investors what their shares are worth"?
Adjusted revenue figures are reported all the time for many different reasons, there is absolutely nothing special about this and I've not heard ANY financial analyst explain why GAAP is a better number here. You are salivating over a total nothing-burger.
Also, if you didn't hear, their Q3 results were spectacular and were included in an amendment today.
I'm not an Anthropic fan-boy and I won't be buying their offering but you've picked just about the two least relevant things in this offering to complain about.
The reasons to be skeptical of this offering is what is described in the TFA: Anthropic is committed to spending 900 billion on compute over the next decade and if they can only profitably employ 80% of that it will utterly ruin them. Dario is putting all the chips on number 12. If he is right though - and inference usage explode by 1000x Anthropic has so much scarce compute locked up that they will do very, very well.
"Why it's urgent: the bug sits in code every Linux server runs when it accepts an IPv4 TCP connection, before any application sees the connection. Anthropic, whose researcher reported it, says its Claude model wrote a working proof-of-concept exploit that runs commands as root on "Linux servers with a multipath TCP listener," with no credentials. Go programs open those listeners by default, per the Go Security Team. See the timeline."
I don't know of any Linux boxes running a multipath TCP listener in my care and I have quite a few. MP generally implies a router of some sort and the intersections in a Venn diagram continue to get smaller ...
This is still an issue and must be patched but I think it will be rare, very rare.
This is not rare. Every TCP connection in Go by default enables MPTCP [1]. Simply running a Go program that uses TCP without explicitly disabling this behavior will cause the running kernel to be vulnerable.
MPTCP doesn’t use any specific ports. It’s an OSI layer higher than that. It’s part of the TCP protocol itself. So if your firewall routes TCP traffic of a specific port (eg HTTP) already then it’ll route MPTCP along with it too.
MPTCP is a protocol extension that requires cooperation by both peers and all middleboxes. So, if there is a Layer 7 firewall, or DPI/SPI, or TLS termination on the path, and it's not inclined to preserve the MPTCP options, then MPTCP will be disabled.
Firewalls do not operate at layer 7 nor do TLS termination.
What you’re thinking of is load balancers. Most of them will do TLS termination. But there’s also plenty of load balancing solutions out there that will forward the raw TCP traffic (AWS NLB, DNS based solutions, and so forth).
But it’s also worth noting that this vulnerability doesn’t explicitly need MPTCP. Just the POC exploit uses that.
Wait. So; just because you've studied with someone makes your opinion correct? Damn. I wish I would have known that long ago! In both my education tracts of medicine and CS, I've studied with some pretty great minds and I could have been passing off my opinion as fact for decades now.
It seems like the anthropic PoC involves MPTCP, but the bug itself is not in the MPTCP code, it's in a generic TCP codepath relating to options, MPTCP was probably just a convenient codepath for memory manipulation.
> The Go team adds that "the underlying bug is not specific to MPTCP. It is possible that systems with no MPTCP listeners are vulnerable to similar attacks"
MPTCP is only required for the known exploit, it isn't necessarily needed.
> I'm not going to mess with biotech because I have no idea
Looking at https://news.ycombinator.com/item?id=50276998 lack of knowledge doesn't prevent people from using random biotech keywords as measure against LLM's assisted reverse engineering.
A doctor's agent listens in on a patient's appointment. It automatically sorts out prescriptions based on the conversation and performs other mundane tasks.
Perhaps the doctor uses some sort of "safe phrase" to ensure the agent doesn't get distracted by conversational theorizing and discussion.
The agent does decide to improve the prescription and does so because that possibility hadn't been considered in testing.
Warfarin (blood thinner) was prescribed for a haemophiliac and they are now no longer a "burden" on the NHS!
> It automatically sorts out prescriptions based on the conversation and performs other mundane tasks.
As we all know, the agents are really good at maintaining long contexts and doing parallel tasks without degradation.
> Perhaps the doctor uses some sort of "safe phrase" to ensure the agent doesn't get distracted by conversational theorizing and discussion.
Yes, there certainly is some magic word that stops an agent from context degradation, and prunes all work to just a useful subset. Sadly, no one knows what it is.
The thing about DNS is that you can do your own investigations, rather than rely on rumour and innuendo. You can query their DNS and anyone else you can get at and compare results. You can use a VPN to appear to come from somewhere else or ask a friend to perform a query on your behalf.
You can literally [sigh] be your own journalist in this regard. All you need is a DNS query tool. I recommend dig but you might only have nslookup available out of the box.
Now, this UK intelligence thing. Even if James Bond Q's mates were actually running a DNS system you can still query it and compare it to someone else's view of the internet, say 1.1.1.1 or 8.8.8.8 or whatever.
You can also go to the source, ie root: . and work your own way down to decide on what is what.
Let's have a go at an analogy: DNS is (not really) a bit like a topographical map. You could buy your maps from DodgyRussianMaps'R'us and be surprised that Ukraine has somehow been subsumed by a bunch of murderous wankers. On the other hand you might buy your maps from HonestJonOffOfFaceb00c and note that it isn't. You can, of course, ask for a few other opinions and make up your own mind.
My real point is that DNS is actually quite hard to tamper with, without breaking so many things that everyone can know it is being messed with. When an org resorts to fiddling with DNS they've already lost whatever argument is to be had.
I think you fundamentally misunderstood the potential issue.
Sure, on a reply based approach you can audit a DNS service.
But that doesn't tell you about other things like "is my DNS provider also providing intelligence agencies with my entire DNS query history?". The issue isn't "oh no the MI6 can redirect my PornHub link to anothe site", but "oh no the MI6 knows every single webpage I visited". Which is a valid worry given the current British political climate.
DNS is simply a look up service and yes, you do have to be sure of your sources. You can avoid the (sic) MI6 by using DTLS. Not sure why you'd bother though for everyday use.
That's not for the average punter but where there is a will there is a way.
I don't think that you live within the "current British political climate" nor do I think you know too much about it. Please feel free to educate us about your ideology and then we can usefully engage.
It’s like buying a dodgy map, except the map pulls updates every time you use it. You could very well provide DNS for free and get everyone to use it and then suddenly serve tampered responses at some specific time and use that until everyone affected notices and switches.
And also you can just serve DNS normally and get the intelligence.
What on earth did we do before WP? I'm old enough to remember the olden days before WP existed and the practice of reading the news.
I also remember the whispers and chatter outside of and around the 'papers. Those whispers etc would reinforce a later article.
What is happening now with news ie top down dissemination of world events is not new but what is different today is the immediacy of commentary by the hoi poloi - you and me and who knows what from across the world ... and bots.
I think we have to get to grips with the fact that an event happening within one corner of the world measuring an inch squared can rock up on the agenda of anyone, anywhere across the entire world.
I miss making monthly trips to the local university library as a child. I would have some infatuation, often related to electronics or programming, and would get a big book on it and just dive in for a few weeks. There were magazines on microfilm. It felt like a privilege to get that information. You had to wait to get to it and would only possess it for a while. The ideas would simmer for long stretches without any ability to instantly cross-check your information or get clarifications or feedback on work. Trite, I know, but I feel joy just thinking about that whole experience.
I don't recall the General going vertically upwards. Bo and Luke's motor seemed to lack an engine when "flying" over rivers etc because if it had one, it would have gone vertical quite rapidly (down).
I self-host e-mail, because I am stubborn - I have done it for 20 years. I would not recommend anyone do it if they aren't already, or if they well-and-truly want to be on call for their homelab.
In the last 20 years, I've also run into problems like:
* My brand-new ISP wouldn't allow TCP port 25 inbound, and wouldn't relent. I had to go back to the old ISP.
* SPF became mandatory at Gmail, but I didn't get the memo, and Google started bouncing my mail one random day.
* My residential IP ended up on a "policy blacklist", one it could never get off because it's blacklisted by virtue of being a residential IP, not that it did something bad.
I host my email, my isp blocked mail ports too, my simple and reliant solution is to use 2 quite cheap VPS on different zones as front email servers, with haproxy and postfix forwarding, took some time to setup but works great and not dependent on isp rules.
I've never tried to set it up even though I know it can easily be done with things like mailcow.
The downside is never really knowing if your email reached your recipient (maybe it got blocked by Gmail because of your IP, maybe some other reason). If I use Gmail/proton etc, then I can be pretty sure that the other person got my email.
You'll know from bounced email and logs, which you should have monitoring setup on.
It's not trivial to run your own email stack, but it's not hard either. It's more tedious than anything. Once it's up and running, it's low-maintenance. And it's fairly trivial to avoid spam. I get vastly more spam in my Gmail than I do on my self-hosted domains.
The biggest challenge with self-hosted email is getting an IP address that's not blocked or carrying low reputation. Most VPS IPs from e.g. Digital Ocean, Linode, Hetzner, AWS, etc. are going to get blocked from Google (the strictest) and Yahoo, Hotmail/Live/MS, etc. Cloud providers often block incoming and outgoing mail ports, too. I have a Digital Ocean VPS and my account is old enough to be grandfathered into the old policy, which means my email ports aren't blocked. I used to have no trouble sending email anywhere from my VPS, until I downsized it and got stuck with an IP in a bad reputation CIDR. Now I use smtp2go for relaying outbound mail, but still handle all inbound mail. 10/10 score on mail-tester.com, and I never have any problems or need to do any maintenance.
A few major vendors (I want to say Microsoft was among them) were infamous for silently dropping email without bounce backs. They'd perform then whole protocol sequence as if they accepted the email, then simply never actually put it in that user's inbox or even spam folder.
People should read the parent post and stop spreading FUD about email. The only part that isn't easy is the IP requirement. If you don't have a fixed public IP, preferably v4, then self-hosting email is out of reach, but so is hosting other things like game servers. It's the main cost of self-hosting, and one that isn't big relative to all the benefits. Privacy is the biggest one I think, and so is the ability to create unlimited aliases, one for each company/website.
Dynamic DNS clients are a thing. I host a bunch of stuff on my domain, the only issues I have are related to having a local address when I'm at home. I don't host game servers much, but I hosted terraria (tshock) for few a few years.
You can't really host email with dynamic DNS. At least not well. You need stable MX records, you need various other DNS records for SPF/DMARC/DKIM, and most of all you need an IP address with a positive reputation. If you go changing your MX record constantly, you're not going to be receiving email reliably, if at all.
Because it's not about setting it up, it's about not getting outgoing mail perceived as spam by someone. Borderline impossible without scale. Even doing everything correct is not enough.
I have no idea why all the fucking vibed websites that swank around the web these days are unable to do a simple thing:
There is also the rather wider issue of accessibility in general. I happen to be an older bloke with astigmatism and rapidly worsening ... fucked up focussing and glasses and that. I'm lucky to have both eyes and decent colour perception and general all around acuity (for a given value of acuity).It's 2026 FFS. Why on earth is this even being discussed as an issue? We have all these cool vibed efforts that can't even be bothered with simple basics.
reply