When I admin’ed a bunch of Wordpress and Drupal websites (open source CMSes), I was very quick to install security patches, and relatively slow to install normal updates—for this reason.
It’s one of the main reasons I used popular open source software: so I could ride the coattails of the rest of the community. Basically everyone else could be my beta tester.
A regular update was an input to the community security practice, so I would let it settle for a while. A security patch was an output of the community security practice, so I would install ASAP, even if it meant breaking a feature temporarily.
I also manually managed dependencies as commits to the main codebase, meaning my entire site was one deployable object from a single Git repo. The “modern” practice today seems to instead favor a minimal repo and resolving and pulling dependencies at deploy time. Personally I think this is a bad idea that has amplified the risk of supply chain attacks.
And now the idea is apparently back to: give it a little while. Tell the automatic dependency puller to chill out and wait.
It doesn’t matter if it is a sustainable business. People will do what they can to maximize their income now. If 10 companies are withholding a cure to milk the patients, any one of them can break from that strategy at any time, with near-instant financial reward and competitive advantage. It is not a stable equilibrium.
It shouldnt be limited to companies within the country. Any foreign company can be a market disruptor here. Assuming the drug approval admin isnt working alongside the 'cartel'.
Patents are intended to temporarily restrict competition. In order to get that, the inventor has to publish the invention.
The time limit creates incentive to go to market. Let’s say a company invents and patents a cure for cancer. If they just sit on it, they’ll get zero revenue, zero return on the cost to discover it… and then in 20 years their competitors can all use it for free. Not a sustainable business model—intentionally.
Yet meanwhile, women entered the legal profession in the 1920's but wages did not catch up until the 1960's when the Equal Pay Act was passed. Economics 101 would say you could snap up competent female lawyers for a little more than they were paid at their current firm and thus wages would creep up, yet this would not happen.
Not sure why you're being down-voted. Efficient markets for talent shouldn't tolerate racism/sexism/etc, but all the historical evidence is to contrary. It's almost as if rational _homo economicus_ is a bad foundation.
I don’t think so. It’s not that law firms intentionally passed up on bidding a little more for women because they were as good as men but cheaper. It’s because they thought the women were simply less good.
It takes awhile for people to change their view. If you come from a society that has for thousands of years said women couldn’t do jobs like be a lawyer as well as men, it’s not crazy that it would take you 40 years to figure out that wasn’t true.
It’s not a bad foundation when it comes to something like what we’re discussing, allocation of capital by professional investors in the medical space. They’re pretty close to homo economicus, but they’re still human so they still err.
It's not a surprise that especially at elite college it's classical economics that is taught in the gen. ed. courses. Its models are simple, and plainly visibly wrong.
If behavioural economics or political economics were taught instead, anything with models that have explanatory power it would be viewed as lefty and revolutionary, and that would really upset donors. Consequently we are stuck with homo oeconomicus.
There’s a big jump between “the attack came from China” and “the attack was sponsored by the Chinese government.” People generally make this jump in one of three ways.
1) Just a general assumption that all bad stuff from China must be state-sponsored because it’s generally a top-down govt-controlled society. This is not accurate and not really actionable for anyone in the U.S.
2) The attack produced evidence that aligns with signatures from “groups” that are already widely known / believed to be Chinese state sponsored, AKA APTs. In this case, disclosing the new evidence is fine since you’re comparing to, and hopefully adding to, signature data that is already public. It’s considered good manners to contribute to the public knowledge from which you benefited.
3) Actual intelligence work by government agencies like FBI, NSA, CIA, DIA, MI6, etc. is able to trace the connections within Chinese government channels. Obviously this is usually reserved for government statements of attribution and rarely shared with commercial companies.
Hopefully Anthropic is not using #1, and it’s unlikely they are benefiting from #3. So why not share details a la #2?
Of course it’s possible and plausible for people to be using Claude for attacks. But what good does saying that do? As the article says: defenders need actionable, technical attack information, not just a general sense of threat.
#3 much intelligence is to the benefit of industry and commercial companies. To a country their economy is their country. After the end of the cold war most state espionage was focused on industry. Sharing is possibly common but secret. The lack of details in the report to me smells of "we are not allowed to share the details". (It also smells of that law to attribute incompetence and not lies)
Now anthropic is new and I don't know how embedded they are with their hosts government compared to a FANG etc but I wouldn't discount some of #3
(If you see an American AI company requiring security clearance that gives a good indication of some level of state involvement. But it might also be just selling their software to a peaceful internal department...)
Snow Leopard eventually became a solid release. At launch it had many bugs, including some that lost customer data.
It’s tempting to compare one’s memory of an old late-cycle OS, after all the UI changes have been accepted and the bugs squashed, to the day-1 release of a new OS today, when UI changes seem new and weird and there are tons of bugs they knowingly shipped to hit the launch date (just like with Snow Leopard). But it’s not really a fair comparison.
To be fair, tons of scientists and technical people believed at that time that telepathy might be real. For example if you go back and read science fiction from the 40s, 50s, even 60s, there is a ton of telepathy and mental powers. This reflects both the authors’ efforts to predict future scientific advancement, and their audience’s willingness to believe it.
No it represents the editor's (John W. Campbell) passions - he would suggest using those ideas to authours and was more likely to accept stories with those ideas.
He had an overwhelming presence in SF until the New Wave of the 1960s
It’s more accurate to say that Campbell became a huge presence in science fiction by publishing the stories he did. Their popular success reflected a desire in the culture to read what was being published. Larry Niven is one example of an author who did not go through Campbell but yet had many mental powers in his stories and found huge success.
Many universities had depts to study “parapsychology.” The end of that era is the basis for the opening of Ghostbusters. I’m using popular media as shorthand for how wide-spread these ideas were, but military and intelligence operations seriously studied this stuff too, and in many countries, not just the U.S.
This is the way science goes; people can only work with what is known at the time. Newton was doing alchemy while inventing the basis for modern physics. It’s tempting to look back and condemn people by the standards of what we know today, which is based on additional evidence and theory developed over decades or centuries since. But I think it inhibits understanding of how such knowledge is created over time.
Water and power are local issues. And data center use of water and power is already, currently having local impact on politics. I saw ads about it during the election cycle that just concluded. Candidates had to answer questions about it at debates and in interviews.
People are using these arguments for the simple reason that they demonstrably resonate with average people who live near data centers.
They probably don’t resonate with people who have plenty of income and/or do not compete with data centers locally for resources.
You’re for sure exceeding the linear resolving power of 35mm film at 40MP or 64MP.
However, a Bayer-filtered sensor has lower color resolution, since each pixel only sees one color. So the pixel shift really helps quite a bit here since the sensor (and Bayer array) are shifting relative to the film multiple times per exposure.
High-quality film scanners maintain color resolution by using linear sensors without Bayer filtering. But they’re slow and expensive.
All the current Nikon Z bodies (and probably other brands too) have different levels of pixel shift where it’ll take 4 or 8 images and basically cancel out that it’s a bayer sensor. The bayer array is a 4 pixel pattern, so it moves one pixel to the right then one down and then one back to capture all 3 channels for each individual pixel. For things like film scanning it works flawlessly, I use it all the time.
Then it’ll do a 16 or 32 shot stack in order to do the same thing but with more resolution.
The scan is the least of the problems - good luck getting to that level of detail with mostly vintage lenses, balancing depth of field and diffraction, keeping the film perfectly flat, on a stable enough tripod with no vibration whatsoever; developing perfectly in the dedicated developer. Yes, it's impressive but no, it's not relevant to the average user or hobbyist.
It’s one of the main reasons I used popular open source software: so I could ride the coattails of the rest of the community. Basically everyone else could be my beta tester.
A regular update was an input to the community security practice, so I would let it settle for a while. A security patch was an output of the community security practice, so I would install ASAP, even if it meant breaking a feature temporarily.
I also manually managed dependencies as commits to the main codebase, meaning my entire site was one deployable object from a single Git repo. The “modern” practice today seems to instead favor a minimal repo and resolving and pulling dependencies at deploy time. Personally I think this is a bad idea that has amplified the risk of supply chain attacks.
And now the idea is apparently back to: give it a little while. Tell the automatic dependency puller to chill out and wait.
reply