However, not paying does not mean that you necessarily become "the product".
Offering loss-leading products is a common business strategy and I'm perfectly okay taking advantage of this for hosting needs that fit a vendor's free tier.
Static hosting is very cheap to offer and gathering free tier users will gain developer mind-share, which helps the vendor can sell their truly money-making products. To pick a clear-cut example: AWS Lambda does not collect any additional data on free tier usage compared to paid usage.
Hands-on engineering leader with 14 years building products, infrastructure, and teams, from indie apps with 10M+ users to a production real-time GenAI platform.
Most recently Director of Engineering at Journee, where I scaled the team to 25 and ran a multi-cloud, multi-geo GPU platform (3,000+ concurrent nodes behind a custom cost-aware autoscaler), a low-level WebRTC backend for interactive 1080p/60fps streaming that beat Unreal's PixelStreaming on latency and bandwidth, and the web apps and APIs on top. I also owned cloud FinOps (six-figure annual savings), enterprise security and GRC for automotive and public-sector clients, and represented the tech org in investor relations.
I'm useful when product goals, infrastructure, and team structure are out of sync: getting a real-time or AI system to hold up in production, cutting cloud spend, tightening developer experience, and helping a team ship without piling on process. I trained as a designer (ECAL) before going deep on engineering, so I care as much about the UI/UX as the GPU autoscaler, and I bridge product, design, and infra without overengineering.
Looking for: fractional or full-time CTO / Head of Engineering, or technical advisory work.
Best fit: startups and scale-ups building AI-powered or real-time products that need one senior person to set technical direction and stay hands-on in the code.
It's most likely two or more separate attackers operating. The first malware, Shai Hulud 2, exfiltrates credentials from the infected dev machine to new public GitHub repositories. As the repositories are public and searchable via GitHub's interfaces, any malicious attacker aware of the attack can easily grab the credentials and launch any attack, whether it's a noisy destructive script or some sophisticated ransomware.
That's my bad, apologies. This job post will be published next week and I somehow removed this mention from my comment while editing it. I've put it back now. In the meantime, feel free to apply through the Platform Engineer role while stating your targeted role and I will re-categorize your application later. Thank you!
This is (in part) what "world models" are about. While some companies like Tesla bring together a fleet of small specialised models, others like CommaAI and Wayve train generalist models.
It does, shockingly well in my experience. Check out this blog post outlining such an approach, called Literate Development by the author: https://news.ycombinator.com/item?id=43524673
Whenever an LLM struggles with a particular library version, I use Cursor Rules to auto-include migration information and that generally worked well enough in my cases.
> "[They] placed too much weight on the introspections that they generated at that moment in time, and thus lost sight of their more enduring attitudes.” [1]
The quote refers to this study [2] in which subjects had to chose a poster to take home. The group who was instructed to think about their reasons for their initial choice, and had the option to change it, were less satisfied with it three weeks later. As the abstract says:
> When people think about reasons, they appear to focus on attributes of the stimulus that are easy to verbalize and seem like plausible reasons but may not be important causes of their initial evaluations.
This suggests that satisfaction is more correlated with initial gut feeling than reasoning, at least for aesthetic choices, but I think in many other cases as well.
It is, but only within the same origin, which already enables users to not re-download jquery.js or Google Fonts if they previously visited another website that downloaded the same file from the same (usually cross-) origin.
fal.ai is nice and fast: https://news.ycombinator.com/item?id=39360800
Both in performance and for how quickly they integrate new models apparently: they already support Stable Cascade.
I'm not sure how relevant that threat model is (OS level security would probably be enabled for people susceptible to be targeted in such a way. Support could advise to do it before toggling the flag, etc.), but anyway the hypothetical flag would only be about making sure the automation doesn't happen and the ticket goes to support. Support can then manually handle the rare edge case and place more burden on the person attempting to deactivate the account.
With your suggested approach, the attacker is free to use the account to impersonate the victim until they get a new SIM card, which could easily take days or weeks.
This seems like a degredation compared to the current abuse potential which is mostly limited to logging you out.
This is trivial to mitigate with per-account rate limiting.
On top of that, if a specific account is targeted at the rate-limit, a flag could be put in place to let support disable the automation for that account.
Whoops, my comment isn't very clear, sorry. I meant: "but their account would still be active and in the hands of the thief, if there is no way to quickly deactivate it, e.g. before receiving a new SIM card from their operator that would enable you to prove your identity to WhatsApp."
As YetAnotherNick said, logout might be the better word to describe the impact here (plus, a fairly aggressive inactivity deletion period).
I agree with you in principle, but I still don’t understand how else to mitigate this: WhatsApp must get a lot of cases of stolen unprotected phones. The victim can ask their operator to lock the SIM card, but their WhatsApp account would still be out in the open.
With the continuous improvements in mobile OS security defaults, I’d expect this scenario to become less and less of a problem, but it must still be accounted for.
The process still goes through support ticketing, so I’d expect a spike to be noticed and stopped.
Offering loss-leading products is a common business strategy and I'm perfectly okay taking advantage of this for hosting needs that fit a vendor's free tier.
Static hosting is very cheap to offer and gathering free tier users will gain developer mind-share, which helps the vendor can sell their truly money-making products. To pick a clear-cut example: AWS Lambda does not collect any additional data on free tier usage compared to paid usage.