oskarkk · HackerTrans

oskarkk

519 karmajoined 3 tahun yang lalu

comments

20 hari yang laludiscuss

Is a data center satellite really that different from a communications satellite? Starlink sats must have some significant processing power and nontrivial control system, and they work without physical maintenance. One data center sat is like one server rack, if it fails, it's fully lost and you just deorbit it, as it's done with Starlink sats. They sent 12443 Starlink sats to space, deorbited 1684. The thing that matters is failure rate, and the economics resulting from that. And also the cost of specialized resilient hardware.

2 bulan yang laludiscuss

Taking a 10% stake in a company is far from nationalization. And the big increase in Intel's stock price happened months after that.

2 bulan yang laludiscuss

You're commenting under an article about politics, not about diabetes research.

2 bulan yang laludiscuss

NASA mostly runs on SpaceX, so it depends if you consider ISS to be critical. But I wouldn't say it would be mind boggling.

2 bulan yang laludiscuss

So, your link shows that they probably have like $1 billion in sales per month (but they publicly overstated this by 30%), and that's the struggle to find customers?

There are tons of posts and reporting about Anthropic's problems with meeting demand, usage limits (on paid plans, especially during peak hours), fast growth (your link confirms that), and problems with infrastructure.

Some links:

https://uk.finance.yahoo.com/news/anthropic-throttles-claude...

https://techcrunch.com/2026/03/28/anthropics-claude-populari...

2 bulan yang laludiscuss

> a technology that already deeply struggles to find customers

As far as I know it's the opposite, Anthropic struggles to satisfy demand, they have tons of paying customers and their customer base is growing fast.

3 bulan yang laludiscuss

Starship V2 heat shield was good enough to allow the ship to perform a landing on the ocean in one piece, in a precise spot. But a safe landing is not enough, the ship needs to be in a good enough condition to be flown again, with low refurbishment costs. We still don't know what condition Starship is in after landing (they need to actually land it on land first). I wouldn't say the heat shield is failing, it didn't cause any failure of the ship, it protected it successfully to the sea level.

But the heat shield is just not mentioned in this article. They actually made significant changes to it in the new version. They added added new seals between the tiles, improved attachment points, and redesigned the shielding in specific areas.

A big problem with their work on the heat shield is that they lost the ship before reentry multiple times for various reasons. They were making changes to the heat shield on previous versions, but couldn't test them as they were repeatedly losing the ship before the heat shield was actually used.

Also, from their description of the planned launch of Starship V3:

> The Starship upper stage will target multiple in-space and reentry objectives, including the deployment of 22 Starlink simulators, similar in size to next-generation Starlink satellites. The last two satellites deployed will scan Starship’s heat shield and transmit imagery down to operators to test methods of analyzing Starship’s heat shield readiness for return to launch site on future missions. Several tiles on Starship have been painted white to simulate missing tiles and serve as imaging targets in the test.

> For Starship entry, a single heat shield tile has been intentionally removed to measure the aerodynamic load differences on adjacent tiles when there is a tile missing.

https://www.spacex.com/launches/starship-flight-12

So they're still working on the heat shield. Things like space data centers may be economical only if Starship is fully reusable, otherwise the idea is dead on arrival.

3 bulan yang laludiscuss

14.3 seems to come from some Red Hat-specific GCC version, which can be reported as "gcc (GCC) 14.3.1 20250617 (Red Hat 14.3.1-2)". See these random examples I found by googling:

https://github.com/anthropics/claude-code/issues/40741 (gcc version "Red Hat 14.3" included in system version at the bottom)

https://docs.oracle.com/en/database/oracle/tuxedo/22/otxig/s...

3 bulan yang laludiscuss

Strange that it's not classified as "high", which specifically includes "local root privilege escalations".

> High: A significant problem, typically exploitable for nearly all users in a default installation of Ubuntu. Includes serious remote denial of service, local root privilege escalations, local data theft, and data loss.

3 bulan yang laludiscuss

In TFA: https://copy.fail/#mitigation

> Before you can patch: disable the algif_aead module.

> echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf

> rmmod algif_aead 2>/dev/null || true

Edit: and I can confirm that on my system with kernel 6.19.8 the above fixes the exploit.

3 bulan yang laludiscuss

You're not contradicting my comment, I was talking specifically about the key with full permissions that the LLM found (the article doesn't talk about other keys that LLM could have had, unless I missed something).

Somewhere in the files there was a key with full API permissions. The author had no intent of having the LLM use that key, and wasn't aware that LLM can access that key. That key was created to manage some domains, and that was unrelated to the LLM's work. The author wasn't aware how dangerous the key was and is surprised that it could be used to delete a volume.

Essentially I agree with gwerbin that the situation comes down to mishandling of the key. The author makes it seem like the key was allowed to do something that it shouldn't be allowed to, but it was just a full access key, no scoping possible for that type of key (Railway has also other, less privileged types of keys/APIs).

Btw, I partially agree with author's criticisms, ideally these keys should be scoped, and maybe the UI should give more warnings when creating that type of key. But this situation could still happen as long as you put a wrong key in a wrong place (and specifically a place accessible to LLMs).

3 bulan yang laludiscuss

> what they thought was a narrowly scoped API token, and they very clearly state that they never would have given an AI full access if they realized it had the ability to do stuff like this with that token

It sounds like the token the author created just didn't have any scope, it had full permissions. From the post:

> Tokens are not scoped by operation, by environment, or by resource at the permission level. There is no role-based access control for the Railway API — every token is effectively root. The Railway community has been asking for scoped tokens for years. It hasn't shipped.

So it wasn't "a narrowly scoped API token", it was a full access token, and I suspect the author didn't have any reason to think it was some special specific purpose token, he just didn't think about what the token can do. What he's describing is his intent of creating the token (how he wanted to use it), not some property of the token.

Author said in an X post[0] that it was an "API token", not a "project token", which allows "account level actions"[1], with a scope of "All your resources and workspaces" or "Single workspace"[2], with no possibility of specifying granular permissions. Account token "can perform any API action you're authorized to do across all your resources and workspaces". Workspace token "has access to all the workspace's resources".

[0] https://x.com/lifeof_jer/status/2047733995186847912

[1] https://docs.railway.com/cli#tokens

[2] https://docs.railway.com/integrations/api#choosing-a-token-t...

3 bulan yang laludiscuss

It sounds like the keys just don't have any scoping. From the post:

> The Railway CLI token I created to add and remove custom domains had the same volumeDelete permission as a token created for any other purpose. Tokens are not scoped by operation, by environment, or by resource at the permission level. There is no role-based access control for the Railway API — every token is effectively root. The Railway community has been asking for scoped tokens for years. It hasn't shipped.

So every token that can be created has "root" permissions, and the author accidentally exposed this token to the agent. What was the author's planned purpose for the token doesn't matter if the token has no scope. "token I created to add and remove custom domains" - if that's just the author intent, but not any property of the token, then it's kinda irrelevant why the token was created, the author created a root token and that's it. Of course having no scope on tokens is bad on Railway's part, but it sounds more like "lack of a feature" than a bug. It wasn't "domain management token" that somehow allowed wrong operations, it was just a root token the author wanted to use for domain management. Unless Railway for some reason allows you to select an intent of the token, that does literally nothing (as "every token is effectively root").

3 bulan yang laludiscuss

Not exactly, it was a normal solar panel business started by Elon's cousins (SolarCity), but it wasn't going well, and in the end it was bought by Tesla for much bigger money than it was worth (let's say it was a bailout for Elon). Today Tesla solar panels are maybe 0.1%-1% of the business, they stopped giving any data on it years ago.

4 bulan yang laludiscuss

Well, I only said that if we're considering a ~fully renewable energy generation in the UK, with supply evened out by massive pumped storage projects, then locating all the storage in Scotland isn't ideal for the efficiency of the system. But yeah, I looked up the losses on HVDC lines, and it seems to be a non-issue (at least from a technical point of view). I also looked at a map of wind power[0] - seems concentrated on Scotland, so the distance from generation to potential storage would be quite short.

[0] https://globalenergymonitor.org/projects/global-wind-power-t...

4 bulan yang laludiscuss

600km is roughly the distance from the hilly parts of Scotland to the south of England.

4 bulan yang laludiscuss

If you're talking about uranium enrichment, that's like saying we increased the amount of gasoline on earth (by refining crude oil). Natural uranium is ~99% non-fissile, and ~1% fissile, and we're only removing part of the non-fissile isotope to obtain 5% concentration of the fissile isotope. Uranium still needs to be mined, spent fuel can be partially recycled, but you need some new natural uranium input in the end. That said, non-renewability of uranium is a non-issue IMO, compared to the huge amounts of other non-renewable resources we're extracting.

4 bulan yang laludiscuss

> Isn't pumped hydro severely limited by geography in many places?

Scotland seems to be a perfect place for pumped storage. I see that UK has 4 pumped storage stations, 2 in Wales, 2 in Scotland. But Scotland being quite far from most of UK's population may not be ideal if we're talking about supporting the whole country with pumped storage. It would be like 600km to the south of England.

4 bulan yang laludiscuss

>England is 90% renewables

The thing is, it's nowhere near 90% in general. 90% is the generation right now, with sunlight and good wind. On the site you can see that renewables were 66% in the last 24h, 46% in the last week, and 42% in the last year. I don't think it's possible to have 90% renewable generation overall without massive energy storage.

4 bulan yang laludiscuss

The title may be misleading, but IMO not for the reasons you mentioned. "90%" is based on generation right now, live. On the site from the post you can see that for the last day (24h) renewable generation was 66%, for the last week 46%, for the last year 42%. So it's nowhere near 90% renewable in general, but it is 90% at the moment (there's sunlight and good wind). Emissions on the website from the post are lower than on the website you linked - 107 g/kWh for the week, 124 for the year - but I don't know why that is.