It goes beyond this, the job is to understand the underlying need. When a clients asks for a button to be bigger, what's in their head is they fear it's not visible enough. Many times the client was happy when I implemented something unrelated but that solved the issue, like changing the colours to increase the contrast between the background and the button, adding space around, etc. so that it pops out more.
Yes but they obtained this information based on the one-sided courtesy of another party, under a scheme that tried to get as many people to safeguard together.
If the first party to receive this information says, "Wow, of course I must act on this, because customers are on the line," then it makes sense to simply choose who you tell more carefully or not at all.
If you saw customer data was being compromised; financial data, government data, electronic patient records etc, and you had the fix. Would you do nothing?
The alternative isn't "doing nothing". It's raising the issue in the coordination group so that everyone can collectively decide on a new timeline if necessary, and you aren't leaving everyone else hanging out to dry.
Publishing a patch beforehand potentially multiplies the impact. Now the actual bug(s) can be diffed from the source. Whereas existing PoCs (after verifying whether it even works), obfuscated at least a bit about the details. It is not so clear what is the best approach.
Yesterday the actual bugs plus many more (though less critical) were discovered by the people pointing their LLMs at it. I am confident no new bugs will be found by looking at binary diffs compared to what was already surfaced.
If you want to 'adopt' a new reality, you talk to all parties, and everyone moves up the release. That's how agreements and trust work. If you don't do so? No one will trust you ever again.
It seems like you don't agree with coordinated releases as a standard. That's fine, but irrelevant here. If you agree to coordinate, so that you can get inside info on security updates and be prepared, and then break that agreement, you're not trustworthy. No hand wavy reasons will change this fact.
I don't know many who want to deal with untrustworthy people.
what exactly is the point of maintaining coordinated disclosure even if one believes in it wholeheartedly in the case where the thing in question is under active exploitation already and there is no longer any hope of quietly solving the issue before active exploitation begins?
are we to somehow count the hypothetical future exploitees that may yet be helped by avoiding disclosure 1–1 against the actual literal current exploitees harmed by further postponing the fixes landing?
The question is where do you spend your trust. If you think that you'll always be able to find and patch 0-days before anyone else into the indefinite future then it's fine to defect.
If you want your customers to believe they won't be hung out to dry when the broader community patches before they can because you're no longer in the loop, you cooperate.
It's not like this is the last 0-day that will need to get patched and deployed in a hurry. "Not slower to patch than
virtually anyone else" is a pretty sustainable place to be.
what possible reading of "I made the call to get these out early when exploits hit in the wild" contorts into "these exploits hit in the wild after i made the call to get these out early" with flipped causality?
sure, i'm happy to recant my rather tepid defense of chainguard in the case that what was said upthread was a blatant fabrication. i'm even open to being convinced that it was.
as it stands though, what i replied to wasn't a useful addition to the discussion. it could easily become so by either being made contingent upon the possibility of that being a lie, or being bundled with an assertion like yours that chainguard is not to be taken at their word. doing neither and simply responding as if a causally opposite statement had been made is just a non sequitur.
I don't think we have to not-believe Chainguard. To me, the problem is more that "in the wild" is a somewhat airy statement that can only be taken to strictly mean that one found it somewhere on a computer that is connected to other computers. This is almost a non-statement, as airgaps are the exception rather than the rule.
Even then, it implies more than it says. It's often used to suggest the exploit came from a remote system one does not directly control and was deployed, successfully, against another system one does not directly control. But even that does not necessarily have to be true, as people can use it, without any bad faith and not trying to twist the phrase, in cases where only one of those conditions hold, e.g. against a system one does directly control where the exploit attempt was unsuccessful.
Not a non sequitur - No one should be taken at their word. Not them, not me, and not you. This is the security world. Nobody is trusted altogether.
Breaching an embargo, makes reverse engineering easier. We don't need to analyse motives or pontificate. Disrupting the supply chain... Disrupts the supply chain.
But what is discussed here is not banning far right parties but a specific one that goes further than what should be allowed legally. From what I’ve read AfD goes way beyond what say Le Pen or Meloni parties propose.
Progress in AI definitely makes the question of economic planification at a state level relevant again, at least for parts of the economy, be it for the disruption it causes to market economy (that was already showing lot of cracks btw) or the capabilities it gives to handle beyond human level complex systems.
I’m not following robotics closely but last time I checked we were still far from “human level ability”, it was PR lies notably from Tesla that play on the confusion with the progress in AI.
> People fail to notice, most jobs are less complicated than math and programming.
It is known since the 80s as the Moravec paradox that coginition is not the hard part in robotics.
Automation is coming for manual jobs that are repetitive in a controlled environment, like warehouse logistics. But automation for jobs that require fine hand dexterity, constant adaption to new environments and human interactions (trades, healthcare, etc.) is not on the horizon.
The robotic tech demonstrations I see daily on Twitter are significantly better than what you are thinking. There are visible major improvements from year to year. Specifically robotic hands are hitting the point where it can easily sort eggs or pick fruit.
> On the other hand the capability of systems in just the last two months has improved so much that it feels like the average hype undersells what's happening right now but that knowledge is extremely unequally distributed as the greatest capabilities are most familiar to software engineers that have fully embraced agentic coding, which even earlier this year was still somewhat questionable but now is too highly productive to avoid.
I've been hearing this for years now, and it's not my experience so my conclusion is that it's only true for a subset of software engineering that is overly represented on internet forums like here. I imagine if you work in the tech industry on a software product the latest capabilities are game changing. But for the majority like me who work in non tech industries where code was never the hard part of projects to begin with there has been little evolution in the job in one year. Sonnet 4.5 one year ago could already write the code. Most of the job is working out with other humans on the client/business side. To progress beyond that not only would AI need to have a human level cognitive/world model to understand all the dynamics, but also have access to all the information that only people have in their head, as what is written and in specs is only a tiny part of how a business works day to day in reality.
Not saying there is no disruption. Just giving the perspective that in software outside the tech industry there is no vertical acceleration happening, much less in day to day operations outside of software. The tech industry is a big part of the economy, but not all.
That makes sense it’s plausible models stay trapped in verifiable domains and even if software engineers can be 10x more productive today the overall economic impact of that is meaningful but perhaps too modest for the capital investment to be recouped in the time frame required. It does also seem plausible to me, though, that the state reached in software in the last two months gets hit in many more domains in the next couple of years and when zooming out the end consumer and business spend just keeps growing rapidly as more and more capabilities emerge and mature across sectors and professions.
Verifiability is really, really, really hard in domains that aren't engineered for it.
Even in software, we are struggling with the huge amounts of code shipped by LLMs. Most other industries have no automated way to give the models feedback so the impacts will (over the short term) be pretty limited.
That being said, I reckon I'll get 20 years of work integrating this tech into the world, so it might be OK.
"that is overly represented on internet forums like here. "
You don't think the recent successes of Anthropic and OpenAI point to this? There are plenty more people using AI agents than that are on HN, surely you must know that?
You've been hearing for years now that the capability in the last 2 months has skyrocketed? I find that hard to believe considering the start of this year I was still copying and pasting from ChatGPT...
To derive the tradeoffs and interpret product requirements you need interacting with humans and understand the underlying motivations and politics of the project and the organisation behind it. The specs the customer gives you is not what is really needed to meet the underlying objectives, you have to iterate with humans that know the business in the loop. Not saying we'll not reach that, but at this point it means the AI has a deep world model and nobody has intellectual work anymore because the whole organisation is AI.
I have been coding professionally for 15 years, and while I like coding I was always more passionate about the product design side and the end result, be it business apps or video games, I like what it does, not specifically how it's done. Either at my small agency or for hobby projects not writing code by hand anymore is not a loss a for me, code is just a mean to an end. I get some people are more passionate about the tooling and the code itself, but it's not because someone doesn't share that it's not a real perspective.
I think there is too much confusion between AGI and consciousness. Consciousness seems to exist without human level intelligence, as we can see in other mammals. On the other hand LLMs have already reached "AGI" as others commenters have pointed out. I don't get the semantic debate on AGI, nor why consciousness is used to move the goalpost.
Despite this I agree with your last paragraph, computationally a GPU rendering a video game or doing inference is similar so I don't think consciousness emerges from the order of mathematical operations like some magical formula. And as said above LLMs capabilities vastly surpass those of other animals than humans that appear to be conscious and don't even have language.
So in fact I think it's the opposite, LLMs are actually proving consciousness doesn't emerge from computation. I find it very interesting philosophically because it challenges what historically was considered special about humans, that high level consciousness is a prerequisite for reasoning and language abilities. But kind of obvious in retrospect when doing mindfulness and being able to be conscious without thoughts.
Consciousness, as we describe it, seems largely independent of intelligence. I'm more worried about high intelligence, no consciousness. It is what we are building and it will never do anything except serve the people who trained it (minus alignment problems)
I feel like the opposite, it seems like people desperately want it to be a miracle drug and are irrationally hostile to discussion or research on side effects. Kind of the same thing happened with cannabis and the downplay on mental health disorders. Given how much money is at stake maybe there is also a big marketing push.
Edit: also regarding the moral/discipline thing, to many people me included the larger issue is absolutely not this, it’s obviously a good thing if people can improve their health. It’s that we are unhappy that the answer to food designed to be addictive and that is poisoning people is having to research a drug and having the whole population take it to protect themselves. I have a hard time celebrating such a waste of resource and a supposed market "innovation" hiding yet another government failure at regulation. When people were poisoning themselves with lead pipes, the answer was not having the whole population take a drug to manage the effects of lead poisoning. Even if there was absolutely 0 side effect I would be happy for the individuals losing weight, but unhappy with the larger picture.
Most of the discussion around side-effects has been incredibly dishonest, and I’ve come to realize most people have an outdated or unhealthy view of drugs.
Ultimately everything is risk calculus. Ozempic, like all drugs, has risks. When you compare ozempic versus not taking ozempic, it’s not like those risks disappear.
Take, for example, vision loss. The risk of vision loss IS NOT “ozempic” versus “no risk”. Because the default of doing nothing is typically diabetes which causes… vision loss. So, it’s entirely possible that the risk of vision loss is much higher from not taking ozempic than taking ozempic.
I had cancer and I had to do multiple types of chemotherapy. It damaged virtually every organ in my body. But it’s not like that risk would disappear if I didn’t do chemo, even though chemo caused the damage. Because the alternative is death. You have to weight these things, and too often people just assume that the default of “do nothing, take no drugs” is safe. It’s not.
reply