Well I'm a Finn and have reported my findings to the FCSC. Zero hassle. The folks at Traficom are a really nice and smart bunch, I have had chats with them face to face a couple of times. They are very well versed when it comes to potential issues or hassles with disclosing exploits. From what I've seen, everyone at Traficom really just wants to keep internet and information systems safe, and to provide the best support possible for IT professionals regarding cyber/information security.
This is what their privacy statement says: “Data breach information, including personal data, can be exchanged confidentially with other authorities relevant to the breach when required or permitted by law. The person who fills out the form is asked if they consent to the transfer of information to another authority."
Having been writing a lot of AWS CDK/IAC code lately, I'm looking at this as the "spec" being the infrastructure code and the implementation being the deployed services based on the infrastructure code.
It would be an absolute clown show if AWS could take the same infrastructure code and perform the deployment of the services somehow differently each time... so non-deterministically. There's already all kinds of external variables other than the infra code which can affect the deployment, such as existing deployed services which sometimes need to be (manually) destroyed for the new deployment to succeed.
Hmm but that sounds pretty much like how I currently understand how our brains work. Not sure how factual this is, but I remember watching a video about how our brains essentially lie to us.
I think there was a ping pong example in the video. It said something like you think you watch the ball come towards you and you think that you are making a decision and action to move the paddle on the ball's trajectory, but what really happens is that most of that is pre-observed, pre-decided and pre- acted upon subconsciously.
So the subconscious part does most of the work and then when your conscious part catches up and you feel like you are doing the reacting, it's actually your subconsciousness lying to you that this was your observation and your decided reaction.
Again, not sure how factual any of that is, but it made sense to me when I thought about how complex the task of observing+deciding+acting is in e.g. ping pong and how very little time there is to actually do all of that. Is it really possible to consciously observe, decide and act to a ping pong ball with so very little time there is to do all of that?
So based on that it does seem like we are the observer and our subconscious is the actor which also lies to us to make us feel like that the actor is us.
I can introspect, but that could just be my subconsciousness doing it and lying to me that it was by own conscious introspection.
I'm Finnish and in in Finnish we translate "call" in function context as "kutsua", which when translated back into English becomes "invite" or "summon".
So at least in Finnish the word "call" is considered to mean what it means in a context like "a mother called her children back inside from the yard" instead of "call" as in "Joe made a call to his friend" or "what do you call this color?".
My 5 cents would be that LLMs have replaced all those random (e.g. CSS, regex etc) generators, emmet-like IDE code completion/generator tools, as well as having to google for arbitrary code snippets which you'd just copy and paste in.
In no way can AI be used for anything larger than generating singular functions or anything that would require writing to or modifying multiple files.
Technically you might be able to pull off having AI change multiple files for you in one go, but you'll quickly run into sort of "Adobe Dreamviewer" type of issue where your codebase is dominated by generated code which only the AI that generated it is able to properly extend and modify.
I remember when Dreamviewer was a thing, but you essentialyl had to make a choice between sticking with it forever for the project or not using it at all, because it would basically convert your source code into it's own proprietary format due to it becoming so horribly messy and unreadable.
Regardless, AI is absolutely incredible and speeds up development by a great deal, (even) if you only use it to generate small snippets at the time.
AI is also an absolute godsend for formatting and converting stuff from anything and to anything - you could e.g. dump your whole database structure to Gemini and ask it to generate an API against it; big task, but since it is basically just a conversion task, it will work very well.
This to me seems like one of those things that makes me think why is this considered such a problem that it needs a "proper" solution like this.
If I have a function written in TS which takes a string type parameter called a hash... isn't it already obvious what the function wants?
Furthermore when the function in question is a hash checking function, it is working exactly as intended when it returns something like "invalid hash" when there is a problem with the hash. You either supply it a valid well formed hash and the function returns success, or you supply it any kind of non-valid hash and the function returns a failure. What is the problem?
In case the function is not a hash checking function per se, but e.g. a function which uses the hash for someyhing, you will still need to perform some checks on the hash before using it. Or it could be a valid hash, but there is nothing to be found with that hash, in which case once again everything already works exactly as it should and you get nothing back.
It's like having a function checkBallColor which wants you to supply a "ball" to it. Why would you need to explicitly define that you need to give it a ball with a color property in which the color is specified in a certain way? If someone calls that function with a ball that has a malformed color property, then the function simply returns that the ball's color property is malformed. You will, in most cases probably, have to check the color property in runtime anyway.
I've used TS based graphics libraries and they often come with something like setColorHex, setColorRGB, etc. functions so that you know how the color should be given. If you supply the color in a wrong way, nothing happens and I think that is just fine.
Sorry for the rant, but I just don't get some of these problems. Like... you either supply a valid hash and all is fine, or you don't and then you simply figure out why isn't it valid, which you will have to do with this branding system as well.
Isn't the whole point of the term "invariant" that it describes something as unchanging under specific circumstances.
e.g.
The sum of the angles of triangles is 180 degrees in the context of euclidean geometry. However, if we project a triangle on a sphere, this no longer holds. So the sum of the angles is an invariant under euclidean geometry.
On the other hand, the value of PI is a constant because it stays the same regardless of the circumstances. That's why all the numbers themselves are constant as well - the number 5 is number 5 absolutely always.
So if you have a value that changes over time, it is definitely not a constant. It could be invariant, if you, e.g. specify that the value does not change as long as time does not change. Your value is now an invariant in the context of stopped time, but it can never be a constant if there is any context where it does change.
Surely their research is not about shipping broken software though, then your goals would be in conflict.
I suppose your point is that the researcher's goal in not exactly to ship working software either, but wouldn't that put the researcher's goals at worst neutral then?
Likewise your goal is not to publish research, but it is also not to actively work against it either. From their standpoint you're also at worst neutral.
It's also worth pointing out that the motivating factor doesn't necessarily have to be the same for each party to have a common goal. I'd argue that this is how it actually is most of the time.
I do work for a customer so that my boss doesn't fire me and I get my paycheck, whereas my boss does work for the customer to bring money to their company and to not go bankrupt. The customer helps with the work we're doing for them because they want something out of the project that is their money's worth. Our motivations are different, but the goal is the same - to build a thing that works.
My point is that it just seems very likely that some common ground can be found between you and the researchers, regardless of your individual motivations and since there's really no inherent conflict either.
I've been following a data science course called "The Data Science Course 2023: Complete Data Science Bootcamp" at Udemy.
The course starts all the way back from basic statistics and goes through things like linear regression and supposedly will arrive at neural networks and machine learning at some point.
So I don't know if something like this is exactly what you're looking for, but I think that, in general, if one wants to learn about (the history) AI, then it might be a good idea to start from statistics and learn about how we got from statistics to where we are now.
On another note, I think something like this should come with some kind of zero knowledge proof of the future encrypted thing being what it is claimed to be, so that one doesn't have to wait for a long time just for the secret to encrypt into nothing.
I don't know if I disagree with this, but this reminded me about one thing that for some reason stuck to my mind once.
It was about statistics and probabilities. I think I was talking with ChatGPT about superpositions or something and somehow we got to talking about how e.g it might be impossible to make a system which could predict everyone's favourite flavour of ice cream.
Interestingly enough though, it is perfectly possible to gather data about people's favourite ice cream flavours (and we could even go as far as to say that we could ask every single human on the planet) and make a statistical model which is able to answer what is most probably everyone's favourite ice cream flavour.
I find this really interesting. We could think of one person's flavour as essentially random and impossible to predict, but when we gather enough of these random data points, we are for some reason able to build a relatively accurate system to guess someone's favourite flavour. I don't think this is obvious at all.
Anyway, I didn't have any real point here. I just wanted to share one example of interesting thing that I think is an example of "emergent behaviour" and seemingly magical at that too.
I've began to question the complexity of many of these paradoxes I run into these days.
In this case, isn't this just a matter of the definition of a "heap of sand"? The article seems to sort of forget to define a heap and just proceeds to make a problem out of it and asking questions like "when does a heap become not a heap?" when it was never even defined why would we call something a heap in the first place.
So I think the real question there is just that why are you calling something a heap in the first place and when you have an answer to that, that same answer will also help you with figuring out when the thing you call a heap is not a heap anymore.
I totally get it, when I think of it from a privacy and personal security point of views.
With wikipedia, it really is a sort of "He who controls the information, controls the world" type of scenario.
Imagine being a Wikipedia admin and editing something that can be viewed as very volatile, such as something religious or political with your own real name visible in the log - that's really scary!
It's not at all a tinfoil hat thing to say that there are people who have the will and the means to take down people such as Wikipedia admins for publishing information which doesn't align with everyone's worldviews.
It doesn't even have to be so political or religious. There are also people who go absolutely crazy over something like someone "disrespecting" their idols or favourite singer or something. If they knew where you lived, they would absolutely drive across 10 states to let you know what you did.
I'd figure it wouldn't be too hard to record couple of hundred of hours of different kinds of fires burning, maybe "re-encode" / transform all the frames from pixel data to a more convenient representation like motion vectors or something and turn that into some sort of model.
Maybe a ControlNet- or motion model to use with Stable Diffusion? Or some kind of proprietary output model which could be used with video editing software / motion capture?
Usually the hardest part with AI seems to be coming up with the data to train with. In this case, that should be the least of one's problems.
You could even record fires in front of a green screen and, hell, setup it like so that you can control variables like wind direction with fan(s), intensity of the fire, temperature of the fire,...
I might even be possible to train the model "in reverse", in such a way the the goal for the AI is to come up with correct set of motion vectors, when given wind direction and speed, intensity and temperature as inputs. Since you can control these variables and record the real result, you have the ground truth for something like reinforcement learning.
So the question is; am I just overly optimistic and dumb, or isn't this a relatively easy thing to do?
The process of aggregating and formatting searchable information from many sources.
When you simply Google something, you're presented with blogs, articles, stackoverflow pages, github repositories, documentation, ... you're still left with the manual process of parsing all of the results, e.g. turning what you've read into runnable code, summarising and taking notes in a format that is easy for you to follow.
Furthermore ChatGPT allows you to have a dialog about the results. Maybe you have two equally interesting results and don't know which one to go with? Usually you'd have to do "sub-googling" in cases like this and once again parse, aggregate and format those results. With ChatGPT you can basically just ask it to expand on the previous results and help you figure out what to do.
Makes me think if survivorship bias (or similar) applies here. While it's not fun to see LP having a lot of incidents in its history, maybe those could be viewed as something that has made LP stronger over the years?
I'd be more worried about a password manager that has never seen any security incidents - is it because there really aren't any, or that they haven't been caugh? Surely a security incident on a password manager serves as a major motivation to harden shit up?
I'll go ahead and say that a sprinkle of humor would help a lot here.
If a coworker comes to you with a problem that is trivial to you, it shouldn't be a problem in the first place for you to say "Oh just do X".
The problem lies in how the other person takes it and most importantly if the environment allows people to safely "confess" they don't know something, regardless of how trivial it is.
If it does, there shouldn't be any problem. The dialogue can continue in multiple positive ways such as "Oh that didn't cross my mind, thanks!", "I don't know how to do X", "Can you show my sorry ass how to do X?", "Just do X huh... How do I do X again?“, "See the problem with X is that I don't know how to do Y / how to apply X in this case" and "Well obviously I should do X! I was just testing you"
If it doesn't, the problem is with the environment.
When you have a problem with the environment, you shouldn't try to "solve" it by making it impossible for the problematic thing to enter the environment (censoring comes to mind), but instead teach the environment how to deal with the problem when it eventually and inevitably enters it.
You're right. At the risk of sounding kind of hypocritical, after a decently long career in software engineering, I've learned that some carefully chosen future proofing is one of the things that makes a great developer and it's also something where one learns to eventually "see" where it is needed.
My "if nobody cared to mention..." part should have probably said "if nobody cared to mention, even after several specification meetings, that the software should be able to do X..." as I agree it's definitely part of your job to assess the needs.
This post is a bit weird though. It's as if someone is ranting about how hard it is to hammer nails into wood with a shoe or 15 other things, when you could just use a hammer.
If your use-case is that the user can select the crust, sauce, cheese and toppings for a pizza, just pass that shit to the make_pizza function with the help of enums and arrays. If you want to have predefined pizzas, you'd simply make a dictionary of pizza templates with all the options that the make_pizza function needs and/or if you wanna be fancy, you'd make a separate make_pizza_from_template function, but definitely not a make_pepperoni_pizza function, because that's just encoding data as a code in a silly way that arguably not even a factory pattern.
No solution will be able to cater to requirements that don't exist at the time of developing this pizza-application. You build it according to the requirements that exist and that is enough. It's not your fault if nobody cared to mention that the user should be able to arbitrarily subdivide the pizza and select options sepatately for each subdivision - that's a feature update and it's OK if the original program hadn't though of that. Just like you wouldn't scaffold ecommerce capabilities into a webpage "just in case", if there had been zero mention of such a need.
Well, we already have more than enough ways to pay for stuff digitally and most of them are already very easy to use, very fast and secure enough. Therefore I think it's relatively safe to say that blockchains, at least for payments, is not the next big thing.
If you work in the field, you could simply look out for things that are expensive, slow, hard, or all three and if someone is trying to fix thay.
One thing that comes into my mind are private cloud services. There aren't any good locally installable cloud platforms. There seems to be a rising need for private clouds and/or "user verifiable cloud services" aka. more or less "locally installable AWS" or a way to be sure that when you buy some cloud service, there is no way your data can leak anywhere at any point.
Speaking of verifications, guarantees and such, one interesting concept I've been looking into lately are zero knowledge proofs. Simply put, they would be a way for person A to prove to person B something about X, without revealing anything (sensitive) about X.
You can also submit anonymously and/or via secure email: https://www.traficom.fi/en/contact-details/sending-secure-em...
This is what their privacy statement says: “Data breach information, including personal data, can be exchanged confidentially with other authorities relevant to the breach when required or permitted by law. The person who fills out the form is asked if they consent to the transfer of information to another authority."