131–140 of 436 posts
Earlier quoted context omitted.
Youtube wasn't launched by Google, it was purchased.
Youtube launched 1 year and 8 months before being acquired by google.... It's largely semantics to say that what Youtube is today, isn't a direct result of Google's ownership for nearly 20 years now....
>Comments should be passed to the model with clear role boundaries that prevent them from being interpreted as system-level directives. Well, such clear boundaries would solve lots of problems. But those don’t exist, do they?
You can get rid of 99.9% of those attacks by simply dispatching the data consumption to a different instance of the LLM, see, for instance, some of the later patterns in https://arxiv.org/abs/2506.08837
Earlier quoted context omitted.
I really feel like this genre of comment should fall under this "don't" from the HN guidelines: > Please don't complain about tangential annoyances—e.g. article or website formats, name collisions, or back-button breakage. They're too common to be interesting. You're willingly disabling a part of web atandards.
The web really doesn't, and shouldn't, depend on these things. I use a JavaScript whitelisting tool, so that I can allow JavaScript on pages where it's merited, when the trust for that functionality has been earned. Nowadays it's used for things that have been possible in plain HTML for decades. In this case, text has been added to HTML that causes otherwise visible text not to display, presumably so that it can fade…
Earlier quoted context omitted.
Yeah, if going to site and just clicking a link given to me by the site itself is getting socially engineered, then something is very wrong with that site.
Youtube comments are also links given by the site. I think in this case it's not necessarily the prompt injection that's the issue but the fact that untrusted content allows formatted links. YouTube doesn't allow clicabkle links in comments iirc, so the same needs to be applied here.
The second report, by contrast, is clearly not a social engineering attack and I have no idea what Google is talking about.
This is not to say this isn't a bug. The author has to find a way to escalate the impact. If they are able to achieve the same impact without user interaction the impact will be high enough for bounty.
Earlier quoted context omitted.
I feel like things have become so much more cynical in the last 5 years, in this regard. I feel like part of it is the "over-systemization" of promos. I see the logic behind it to some extent - if there's a system, it's "fairer"/"more democratic". But, then we end up with ridiculous gamified promo systems.
objective systems become gamified subjective systems become politicized pick your poison
Earlier quoted context omitted.
Youtube wasn't launched by Google, it was purchased.
Youtube launched 1 year and 8 months before being acquired by google.... It's largely semantics to say that what Youtube is today, isn't a direct result of Google's ownership for nearly 20 years now....
I don't think it was distinct enough from the Google culture like Android was at the start of the acquisition but it seems they had leeway to do their own thing.
Earlier quoted context omitted.
Of all the fucked up things in this comment, giving a single Engineer lifetime responsibility for all bugs in code they wrote is probably the dumbest. And it's slowly becoming the norm. The last place I worked at, a large and well known Tech company, didn't even roll with QA's. That just wasn't a role anywhere in the division. You are fully responsible for all the bugs in all the code you ever wrote Cute at first. Un…
I disagree with this pretty strongly. If you’re not going to take responsibility for your bugs I don’t want to work with you. Don’t make other people QA your work; if you’re not able to figure out how to do that yourself while you work you’re legitimately bad at your job. Once you leave an employer obviously you have no obligation to fix bugs in IP you don’t own or anything.
I don't want to be responsible for a bug in my 8 years old code, which I probably even forgot how it worked etc. I probably don't even work anymore in the same team or on the same service.
Why the hell should I be responsible and how is this sustainable?
I am not even sure if your criticism makes any sense at all anymore nowadays. AI is writing 80% of the code, if not more. It's technically not even your code anymore, although there is your name on the commit. Why should I be responsible for that 3 years from now, when I have again moved team or service etc.
Accountability ok, but you should not retire with your code.