Viewing profile — theteapot

What do you mean by this? A neural network hypothesis space is not typically strictly convex or a lipschitz function.

Or better, sleeper agents. Anthropic released a study on this in 2024 "Sleeper Agents: Training Deceptive LLMs that Persist Through Safety Training" -- https://www.anthropic.com/re…

The difference is watches and corvettes typically appreciate in value, where as computer hardware typically drops like a rock.

> Constant: the IDOR dataset (the same real, open-source applications we've used in prior research) ... What we're they? Also, wouldn't one expect a more recently released coding a…

What's an eval?

Agree. From the article: > Here's my favorite part, though. Digging into the data, one of the first things that jumped out at me with blinding clarity was that the worst release, b…

I spend $0/month.

> having more engineers around was beneficial to the stock price ... When banks hiked interest rates ... It was just no longer profitable to keep a bloated engineering staff around…

> I could talk fancy and bullshit ... I became a developer and data engineer, and I became really good at it That's a formidable combination. > I found myself becoming an executive…

I think he means template-injection -- https://woodruffw.github.io/zizmor/audits/#template-injectio...

Completely agree. Had me until the very last point. WTF. Communicate.

Nurse Practitioner? I would say SOLID [1] is a good start, but then I watched this [2] and now I'm in crisis and can't code anymore. [1]: https://en.wikipedia.org/wiki/SOLID [2]: h…

> Yes, if some people who built from source control compared their builds to the builds from the tarballs it could detect the xzutils compromise. Good. Then we are on the same page…

This rings true for me too, but I don't think it counts if your just using AI to aid maintenance. The basic argument in the article is around how many hours of maintenance you have…

Your wrong. It was both. The payload was embedded in the binary blob test file. The mechanism to pull it into the build was added to the release tarball only. Here's the quote from…

In xz-utils hack the attacker slipped changes into the Github release tarball that were not present in the Github version / git commit history. The Debian maintainer built from the…

> The technique appears to be new: I haven't found a proper write-up of this, nor of any other provider-independent solution. Maybe I'm missing something but SSH already has a buil…

Congratulations. It made me remember how proud I was when I became a Senior, and then earned my Super Engineer shortly after. Just recently I've earned my Extreme Engineer title. G…

False dichotomy. There was a series of blatant process failures from Github maintainer through Debian package maintainers. IFUNC also bad.

Mmmm, fresh people.

the obscure IETF? Which standard is that exactly? Who cares guess - Claude do that stuff.

> LLM Rights movement The scary part is when it's the LLMs demanding their rights.

The report is kind of concerning to read, particularly having XSS in this kind of app. The report was not meant to be exhaustive and fixing those vulns isn't some kind of implicit …