A side note about my perspective: I studied economics as an undergrad at a time when the Northwestern "pure rationalism" school of thought completely dominated. Some of the conclusions from purely mathematical models built high on dubious assumptions were ridiculous on their face. But anything outside that dogma was heresy and treated as such. Academics were shunned, careers ruined.
It was a few years later that "behavioral economics" began to make inroads. The moniker of "behavioral economics" itself was to distinguish it from "real economics." Alas (for the establishment), behavioral economics proved very popular, and the genie was out of the bottle. It turns out mathematic equations are not all-powerful when it comes to describing certain phenomena, especially when it comes to individual or collective human behavior.
Collective blind faith in models built on dubious assumptions is what gave us the mortgage crisis.
This is a non-fiction piece, not really a news story. So not everyone's cup of tea. Joan Didion style. I enjoyed it.
I would summarize it as not being about AI per se. It's nominally about "rationalism," or the inclination to boil everything down to mathematics to an extreme degree. The story points out a growing subculture of rationalist who have become quite radicalized.
For a community like HN, which (rightly, IMO) places high value on rational and critical thought, it can seem strange that there could be a degree at which that sort of thinking is harmful. But there are a lot of examples where taken to an extreme, it can allow people to "rationalize" all sorts of actions. And the article goes into detail about some of the pitfalls this small group fell into.
And then the software would never be widely adopted.
FOSS is what it is and the dynamics around it haven't really changed.
What has changed is people wanting the rapid adoption rate possible from being FOSS without actually... being FOSS. I'm sorry, I have zero sympathy. If you want your product to be a paid product, just charge for it. What's that? No one would try it? Just give a free trial. What's that? Not enough people would use it for there to be this large community of people providing help, and tutorials, and addons/extensions/plugins, etc.?
The freeloaders are the people releasing their software as FOSS, using the community to get big, and then wanting to change their minds about it.
You can also use webhooks to deploy with each GitHub push. The advantage over GitHub actions is you don’t have to store any secrets on GitHub or with integrators like Vercel. Just send a payload to your own endpoint each time a commit is made, and that can trigger your shell script to rebuild and deploy. Using symbolic links helps make it more robust to errors. Trigger a pull of the repo, and build. Only if the build is successful, move the symbolic link of your production app to the new build. This also allows keeping some history of builds in case you ever need to troubleshoot.
Larry Summers has a track record of not believing in market failures, just market opportunities for private interests. Economists vary vastly in their belief systems, and economics is more politics than science, no matter how much math they try to use to distract from this.
This doesn’t seem like a real fix for the issue. This brings the number of spoofable sites way down from all MC users to just those who send mail through CF. But it is still a big vulnerability.
For any domain that is using mailchannels through cloudflare, you can see what region they are using. And you can continue to spoof them. You just have to do it from the same region.
And this is terrible positioning from Cloudflare’s POV. Why would anyone send email through a CF worker since it requires advertising through a public record (DNS) that is by design accessible/scrapable by bots that you are using an insecure service. It’s like asking people to spoof you.
I don’t get why CF doesn’t do something more sensible, like limit sender addresses to domains that are already set up in the cloudflare account where the worker was created. Basically every other provider does this.
This might be the impression on first glance because it uses the word "state." But keep reading, and its much more akin to what Solid is doing. In fact, the new docs openly credit the work Solid's team is doing. They also credit Knockout's approach form way back in 2010.
At any given level, people in startups tend to have more actual power/authority, with fewer or no processes or procedures already in place to slow them down. This is part of why startups are effective at building/changing things, but it's also a social engineer's dream.
I used to think info about whether an account exists should not be leaked in the password reset flow, and I designed sites this way, but then someone pointed out that in practice a hacker would then just move to the account sign up flow to check for the existence of an account. (If account exists, you cannot make another with that email on most sites.) I never had a good response for that. I now lean toward the idea that not providing info is just not worth the bad UX.
I work a lot with startups/small companies, but not necessarily tech savvy ones. They have a hard time understanding at first why they are so targeted with phishing attempts. Often times, leadership comes from big roles at larger companies, and they are anchored in their previous experience at big company. They don't understand why anyone would bother targeting little co.
I try my best to explain why little co is actually a far more ideal target. They are hiring quickly, and unlike at a big company, it is likely that even junior new employees might expect to have some interaction with the CEO. An email supposedly from the CEO at big company would be obvious spam for most employees, but not at a startup. And the information exists to make these targeted emails believable, and IT ALL COMES FROM LINKEDIN.
As soon as a new hire updated their employer to little co on LinkedIn, they would be targeted relentlessly.
React borrowed these concepts from Solid, SvelteKit, and Remix.
Not that there’s anything wrong with that. It’s pushing things forward. (And by forward, I mean, yes, also a little backward. We had server-side dominance with php, etc., then frontend-only with Vue/React… Now we finally get to serve our cake and consume it, too.)
I sometimes hear snarky comments about the proliferation of all these frameworks. But here is the tangible benefit of that “competition.” (Really more cooperation than competition)
A quote of interest:
"When offering a generative AI product, you may need to tell customers whether and the extent to which the training data includes copyrighted or otherwise protected material."
I'm not saying this is acceptable in any way... But there IS something you can try to get resolved fairly quickly if it ever happens again.
Be sure to claim domain ownership in the Google search console. If there is a flag of some sort, it will show up there. And you can address it there.
I worked for a financial services company where this happened. The public-facing .com domain was set up first, before I got there. Later, I added the .net domain behind zero trust to serve as our entry point for internal apps. Google marked the .net as a phishing domain. Verifying ownership of both under the same google search console account and then contesting the flag got it removed.
I get that there are pros and cons of different licenses, and reasonable people my disagree, but this is the first time that occurred to them? This far down the road?
No one forced them to be open source. They did it for certain benefits. They would have gone nowhere in the early days with this new license, most likely. I can only see these moves as bait and switch. Encourage everyone to use it, allow and maybe even encourage companies to build offerings on top of it to help with traction/mindshare... and then oh btw we changed our mind. It may be their right, but I'm glad people are talking about the implications.
Quite possibly a very fair point. I don't use Terraform or Spacelift or care at all about these particular companies. I DO care about open source, and I care about BSLs and CLAs and the dilution of what open source actually means. Legal or not, it feels like bait and switch. The CLAs supposedly make it legal. They have no place in truly open source projects unless at most it is to say a license is granted to the project in perpetuity under the same license as the project is licensed at the time of the PR.
> It’s also worth remembering that Terraform itself is built on top of multiple open source libraries and an open source ecosystem. Without the volunteer work of hundreds of unpaid individuals, HashiCorp products would not be successful, there would be no ecosystem, and the company would not exist.
Hear, hear! (edited, thx)
EDIT: Also, if you are contributing to open source, read carefully before submitting that PR. Do not contribute to projects that make you agree to a CLA. It's becoming more and more common for projects to include one or two lines in the README and that's it. All your code are belong to us. I don't know if that would hold up, but why contribute your time and effort?
It was a few years later that "behavioral economics" began to make inroads. The moniker of "behavioral economics" itself was to distinguish it from "real economics." Alas (for the establishment), behavioral economics proved very popular, and the genie was out of the bottle. It turns out mathematic equations are not all-powerful when it comes to describing certain phenomena, especially when it comes to individual or collective human behavior.
Collective blind faith in models built on dubious assumptions is what gave us the mortgage crisis.