>What if finding every vulnerability in a piece of software were just as fast and easy as finding a few of them, thanks to automation?
This presumes there is such a thing as "every" vulnerability. It is possible that ever more sophisticated, complicated, and abstract attacks become possible/discoverable as one applies more intelligence to the problem.
IF it is indeed possible to make a piece of software completely secure, then yes, more intelligent systems make the situation better, because it will always be possible to audit a system before it is ever released and make it completely safe.
That is a very big if and, as far as I am aware, remains to be seen if it's the case
-edit- They mention this possibility themselves further down, so the authors know this is a completely speculative point/article. They don't even try to make an argument about why one possibility might be more likely than the other. This article is useless.
We know about physical-layer attacks that break some of the abstractions that software relies on, allowing an attacker to use physical access or physical proximity to violate security guarantees that are enforced by software alone. (I worked on some of these a while ago!)
For a purely remote attacker (although maybe we have to get clear on what distance counts as "physical proximity" because we need to clarify what phenomena spy satellites, for example, can observe), it seems pretty straightforward to me that there is such a thing as actually secure software.
You can make a very strong model of what the software computes and then prove that it never does some undesired thing. It's not common to do this at all, and even formal verification work may not use very strong models or models that capture some important part of the behavior, but it is possible to mathematically reason about what software does and doesn't or can and can't do.
To summarize some of the problems that I partly just mentioned (in no particular order)
(1) We may not have the will, the skill, or the economic demand to make software secure in a very strong sense.
(2) Attackers may subvert our infrastructure or organizations so that we don't actually apply the processes or controls, or run the software, that we expect.
(3) Physical proximity (for active or passive attacks) might sometimes include distances that are actually attainable for attackers. Maybe there are passive or active attacks involving lasers that can be mounted from multiple kilometers away, as an example. In that case most software users might not be able to be sufficiently isolated from the attackers to be protected against those attacks.
(4) Software or hardware other than the specific software whose security we're talking about might be compromised in its supply chain in a way that people don't have a plan, or resources, to detect or mitigate.
(5) Some systems might be compositionally insecure (their pieces might be secure in some relevant model, but the pieces might interact in a way that isn't secure overall, for example related to timing and concurrency problems).
(6) Our proofs of security for cryptosystems rely on unproven hardness assumptions for various primitives, some of which might turn out to be wrong.
(7) Some security properties, especially related to communications security, might be inherently unattainable even with correct software. For example, there's an argument that Roger Dingledine (Tor lead developer) once told me about that implies that no anonymity system is perfectly secure in the long run against a very powerful active adversary, unless the system is willing to make extreme trade-offs like shutting down completely in response to any attack. So it might be that we can't actually build any useful communications system that can absolutely guarantee perfect traffic analysis resistance, essentially because of inherent architectural trade-offs.
But I don't want to lose sight of the idea that you can actually meaningfully reason about what software does and so there is such a thing as the software being correct or incorrect, relative to some specification or goal for its behavior, and correct software actually does exist (which computes correct outputs for every input).
to say that defense doesn't win in the limit is the same thing as saying there is an attack that can not be defended against.
So to re-phase the question to more clearly have an answer: does there exist an attack which no one will ever be able (for all time) to come up with a defense against? (the very existence of such an attack would end the (open) internet, wholly and completely, if the only winning move is not to play...)
There will be an exhaustion of possibilities in the end. New attacks eventually run out after each surface area is hardened against those attacks.
In the limit, defense wins.
There is only one case (that i see) where this may fail. if there is a 'predicament' with the state of security: ie, if securing against attack A requires you to be insecure against attack B and vise versa (this could be a 'whack-a-mole with many different kinds of attacks' situation). But that would be 'provable'. So if such a case exists, we will know about it. And it may be true that predicaments like this could be exercised if they even can exist, we might still be able to avoid/mitigate them.
Very cool site, but I'd love some info pages describing the various categories (harvest period, pollination group, etc.).
I wonder if there is a way to report issues. We have several apple trees of different varieties, and as I was playing around with the harvest period calculator, I entered the peak harvest of one of our later ripening varieties, and asked it to calculate the harvest time for our earliest ripening variety. It told me that peak harvest would be in December. It's actually (as the description for the variety notes) in June/July. So either there is an issue in the harvest period for that variety, or else the calculator is messing up somehow.
Of course they do. Most of their platform is built on [appearing] to repudiate coastal elitism and left wing dogma in higher education + globalism with a healthy dose of fuck you because you're you.
And I graciously waited and allowed them to do things that will take decades if not more to repair before deciding they were irredeemable. I had hoped a middle ground and bipartisan ship would be reached, but it's clear to me it won't be. We do not inhabit the same universe at this point, the disdain is mutual.
You’re acting like I’ve always thought about them like this or like I haven't spent years observing and thinking about this to come to my conclusion. You'd do well to listen to your own words about theory of mind. I was raised conservative I voted for Romney. I'm a fan of many of the political platforms they run on now (minus originalism, removing bodily rights, religion), but in practice they do not walk their own talk. The wars, the spending, abandoning neo-liberalism except in word the blatant corruption and disdain for the positions they hold and how they appear on the world stage.
No, I’ve watched their actions for 15 years and moved ever closer to the position that I have nothing in common with them even being ideologically close to a version of their party from 20-30 years ago and they do so blatantly want to destroy the middle class, health, and wealth for anyone outside a small oligarchic class.
I'm pissed because they wear a lot of my ideology as cheap dress to fuck someone.
You are describing a set of dynamics that lead nowhere other than violence and total and complete breakdown of the polity. If you are correct, then nothing matters, everything is fucked. You won't get what you want, but neither will anyone else.
My preferences, while possibly futile, are least an attempt to not just accomplish short term goals but to fix the broken dynamics of the system. That is, in my opinion, far more important than literally any particular policy goal. Policy progress is pointless in a broken system, so fix the system first.
It's possible that my view of focusing on fixing the system, restoring institutions, erecting new guide-rails in places we have observed that the old ones don't work, etc. won't work. But at least it has a chance of producing a good outcome. A good outcome literally can't come from the kind of political behavior you describe. You want your side to seize as much power as it possibly can when it wins, enact as much "good" as it possibly can in however long it can maintain it's grip before the political tides inevitably swing and you lose power again. You don't seem to realize that this is what we have been doing for at least several cycles now. And what we have seen is that the next administration just tears up the progress, does the same thing except in the opposite direction and even harder, and does what they view as "the good thing" and which your side views as nothing but unmitigated evil (the same way they viewed you and yours when you were in power), and so the both sides have accomplished nothing but pushing the pendulum a little bit further, giving it a little more momentum, and shredding up the social fabric a little bit more.
I'm not so naive as to believe that it is possible for just one side to say "no we won't do that, we will unilaterally disarm". But I am of the belief that, if one wants to pretend that one is "on the side of good", that the only rational action is to, when granted power, to spend as much political capital as is possible to slow down the pendulum, tear back power from the bloated executive and the federal branch more broadly. Stop trying to enact your political project and instead make your political project nothing other than the restoration of the norms and principles of the constitution.
This is not something that has been tried and failed. it's the opposite of the past 50 years of federal political dynamics. What has been tried is your plan of "fuck the other side, they are evil, just do what our base wants and ignore consensus and norms".
It doesn't work, it won't work, and it can't work. It's destroying the country.
From my perspective, you are no better than the side you hate. You may want different policy goals, but both you and your polar opposites are collaborating on a shared project: the destruction of the country.
I want my party back and I want to cut out all the garbage that has infested it. Sometimes that requires taking an actual stand and staying firm to it. Middle road nonsense like what you're suggesting is impotent when one side has so clearly decided to be against it.
Edit: And coming back to this later I need to be clear the left also needs to be swept out. I think our institutions in general need to be reworked. Not replaced entirely, but it's clear they don't survive contact with people who would abuse them for their own ends nearly as well as we had hoped.
I'm of the opinion that if one owns an autonomous vehicle, regardless of software modification or not (which should be allowed), then one is fully responsible for it's actions. If one doesn't trust the software provided by the manufacturer, don't buy/use it. Once one chooses to buy it and operate it, then it's that person.
Possible exceptions would be in the case that, after purchase, the manufacturer pushes a software update that meaningfully changes the behavior in such a way that it causes issues. In that case, both A) the manufacturer should be responsible and B) the owner should have the option to get some kind of compensation.
In all of your situations except for cases where no good legal option exists, ticketing is just the easier way to apply your suggested idea. It gives a direct incentive to the company to lower the rate as far as is possible. It doesn't allow some minimal amount without a fee, but that doesn't seem like that big of a deal.
The biggest reason for the difference between Autonomous vehicles and peanut butter is that with autonomous vehicles, we already have a compliance system in place....cops. It's not designed for autonomous vehicles, and you are correct that it's not the way you would design it for the ground up for autonomous vehicles, but it's far better to accept the imperfections than to build some new, separate compliance and monitoring system on top of the existing one. The benefits aren't large enough to justify it.
In the far future when the vast majority of vehicles are autonomous? Sure, probably worth scrapping to a new system (by then, my guess is that issues are rare enough to just not have a system at all and just use the legal system in the rare cases of large issues).
Until then, ticketing in the case of traffic violations seems fine and good enough to me.
> What happens after autonomous vehicle get enough violations?
They put R&D resources toward not getting as many tickets and eventually fix their software to not get tickets? Self driving cars might profit $100/day. Getting tickets completely eats that and ticketing mega corps will be very popular politically so you better believe it will happen
> They put R&D resources toward not getting as many tickets and eventually fix their software to not get tickets?
Why would you assume they would do that?
What if the autonomous vehicle only blows a red and kills someone every once and a while and the lawyers to tie the family up in court are cheaper than the software dev and ai training to fix it?
Are you willing to wait until the number of dead people exceeds the cost of the fix?
Its an extreme example I know but to just assume they would fix it also assumes they are caught and ticketed 100% of the time.
There are tons of examples of corporate America weighting the pros and cons of things like this.
Every time an AV is liable for a death the company will face a high 8 digit legal settlement. Wont even go to trial. Again, the AV companies will avoid this because their goal is to make money and paying 8 digit legal settlements does not make them money. You are right that if this only happens once a year and they have a million cars it wont be a high priority, but if thats the case AVs are much safer than the current driving environment. If AVs caused death at anything close to current rates the companies would lose tons of money.
> assumes they are caught and ticketed 100% of the time.
No it doesnt. It assumes they are caught often enough for it to be worth it for them to fix. When politicians start telling traffic enforcement to focus on AVs Im betting that will happen. AVs will be known as incredibly conservative drivers because the companies really dont want tickets and there will be memes about how waymo drives like grandma.
i'd argue Waymo is "1 Driver", and after they get a cumulative 4 points in 1 year, then Waymo would no longer be allowed to drive in the state of California
Intel always had that habit of starting an internal conflict whenever whatever potential alternative revenue sources start to threaten their internal dependence on x86
They'll always have iGPUs so whether or not they stay in the dGPU market depends mostly on whether or not people buy them. So they might not, whole market seems to be moving to SoCs/APUs/whatever you want to call them.
Not only will they always have iGPUs, but also cannot give up on advancing their datacenter AI GPUs (the next being Jaguar Shores). They need both of those far more than consumer or prosumer dGPUs, but that means they are committed to Big GPU work and Small GPU work.
Since they will have both of those big and small "bookends" of GPU architectures, it is a question of whether they see benefits in maintaining an accessible foothold in the midmarket ecosystem. I could make an argument for both sides of that, but obviously the decision is not up to me.
I thought I had read that too and went to look for clarification and found that they’re just moving to a single architecture for their cards. Seemed reasonable.
What do you mean, are they still making GPUs? This is a discrete GPU that has just recently been released, and it's one of the most popular GPUs in its class at the moment, due to 32 GiB of RAM for under $1000, which makes it great for LLM inference.
There was recent talk of them pulling back from the consumer segment, though obviously the leaks have also predicted Battlemage not being a thing so go figure: https://youtu.be/NYd2meJumyE?t=638 (timestamped)
That said, them not releasing a B770 in the consumer segment also sucks, since there are games and use cases that the B580 comes in a bit short for.
I wonder how large the footprint will be. I live in the greater Portland area, but not in the city proper. There are definitely situations where Waymo would be great, but my guess is that they won't start off serving my specific area.
>Care has been taken to ensure minimal impact to BookStack end users. The original GitHub repository is still staying around, and will essentially act as a mirror of the codebase on Codeberg, so any existing instances fetching updates from GitHub can continue to do so.
Since they are keeping the github as essentially a mirror, doesn't this obviate those concerns?
-edit- although also:
>although eventually we will only create releases on Codeberg so it’s advised to watch/subscribe to them there instead:
I guess someone _else_ could choose to fork and keep up-to-date.
BookStack maintainer here. Just to clarify on that, the GitHub repo will continue to be updated and mirror the Codeberg repo (including release tags/code) for the foreseeable future, it's just that I might stop specifically publishing GitHub release entries (details on the release tag) at some point to avoid the duplication of work.
>As is so often the case for controversies before the Supreme Court, this case isn't so much about glyphosate as it is about the interface between federal and state law.
It was mentioned on a podcast recently that in many cases, the SC is not making a decision on what should/shouldn't happen/be the policy/is correct or whatever. They are deciding which layer of government gets to decide a given question. The Executive Branch? Legislation? Constitution? Who is the controlling entity?
Now, in a practical sense, by the time it gets to the SC, making a decision on who gets to decide, is, functionally, picking what the outcome is, since the various layers of government have already made their positions clear.
But the upshot is, if one is upset with what happens with a given policy after a SC decision, in many cases (although not all), the proper target of one's ire should not be the SC; since what they are usually saying is something like "this is something that is controlled by statute. If the statute is dumb/bad/poorly written, that is not our fault nor within our control, take it up with Congress to rewrite the statue", and instead one should be upset with whoever the controlling entity is for doing a bad job (in recent years: most commonly congress, not so much for doing a bad job so much as not doing any job)
It's not propaganda. It's a legal and historical theory that found popular purchase. The word propaganda has a meaning, and we're in a point in history where ensuring it retains that meaning is more important than in any other time in my life.
Definition of language is not up to you but society in the aggregate.
You can claim as you wish while I and others can do the same.
If you're saying we need to hold to beliefs of the past, that's a position that physical reality makes untenable.
See you in church? That was the center of communal life for the majority for centuries. Anyone that's abandoned such agency has engaged in abandonment of history, of norms others can just as easily (and do) claim are more important than ever.
You can make whatever claims you want rhetorically but the non-fractal reality we live in does not allow for the strict conservatism you appeal for. Entropy gives rise to generational churn which gives rise to shifting social values.
These corny appeals to history you never directly experienced are little more than parroting grammatically correct statements you were taught.
noun
The systematic propagation of a doctrine or cause or of information reflecting the views and interests of those advocating such a doctrine or cause.
...my use seems to fit the definition to me.
You are applying personal emotional bias to a very plain stated definition.
Where is that definition from? It lacks key elements of the definition, notably, an agenda.
Your operating definition would turn the teaching of evolution (or frankly, any education or broadly-communicated message) into propaganda.
That isn’t a serious claim. If it is for someone, that person’s definition of propaganda isn’t the generally-accepted one, which means it’s unclear how they’re speaking about anything else. By being hyperbolic you’re getting downvoted and ignored.
> You are applying personal emotional bias
Nope. I’m explaining why a serious argument you’re making, one that deserves consideration, is being downvoted and ignored for being introduced with a thoroughly unserious assertion.
> just Googled the definition; it reads the same as the posted definition on various sites; from Merriams to Oxford
These are those source’s definitions [1][2]. They’re significantly more precise than the one I suspect you got from Google’s AI, hence your mis-use of the word. (Mis-use is fine. Doubling down against evidence is less forgiving.)
IMO SCOTUS should retain the power to interpret vagaries of law; Congress still holds ultimate power, as it can pass a more specific law overriding their interpretation.
What about striking down unconstitutional laws, though? That has to be up to SCOTUS, nobody else can do it.
SCOTUS granted itself that power. Their originalist powers are extremely limited.
So do not listen to justices that claim to be "originalist". SCOTUS authority to strike laws is self dealing and not at all an originalist power.
The original expectation was the public would demand such change via elections every 2-6 years and remove the corrupted Senator or Representative.
SCOTUS is not supposed to have power over theoretical cases yet it operates on concepts all the time. Just another way in which the system is rigged; the appeals of originalists who have clearly read the words, they're plain English, are just more self dealing power away from the public to the elites
This is just not true. Yes the SCOTUS ruled that it had the right to judicial review, because that's what the constitution said it had the power to do. This isn't "granting itself that power" anymore than Congress granted itself the power to pass laws or the president granting themselves the power to execute laws.
I think that there will come a point when open source models are "good enough" for many tasks (they probably already are for some tasks; or at least, some small number of people seem happy with them), but, as you suggest, it will likely always (for the forseeable future at least) be the case that closed SOTA models are significantly ahead of open models, and any task which can still benefit from a smarter model (which will probably always remain some large subset of tasks) will be better done on a closed model.
The trick is going to be recognizing tasks which have some ceiling on what they need and which will therefore eventually be doable by open models, and those which can always be done better if you add a bit more intelligence.
This presumes there is such a thing as "every" vulnerability. It is possible that ever more sophisticated, complicated, and abstract attacks become possible/discoverable as one applies more intelligence to the problem.
IF it is indeed possible to make a piece of software completely secure, then yes, more intelligent systems make the situation better, because it will always be possible to audit a system before it is ever released and make it completely safe.
That is a very big if and, as far as I am aware, remains to be seen if it's the case
-edit- They mention this possibility themselves further down, so the authors know this is a completely speculative point/article. They don't even try to make an argument about why one possibility might be more likely than the other. This article is useless.
reply