morphillogical 🔍

@niplav_site That bit was originally about dereferences and pointer provenance and it was awful. I asked Claude for other regulation ideas and they just slammed that out off the top of their head. I finally have a banger post and Claude had to go and write the funniest part. ●︿●

@morphillogical "INTERVIEWER: What regulations? COLLINS: Well, gets() is out. INTERVIEWER: And? COLLINS: No strcpy. No strcat. INTERVIEWER: sprintf? COLLINS: Look, sprintf is fine if you're careful." lmao

With apologies to Clarke and Dawe. INTERVIEWER: Thank you for joining us Senator Collins. Now this OpenBSD vulnerability that was revealed earlier today– COLLINS: The one where the kernel panicked? INTERVIEWER: Yes COLLINS: Yeah, it's not very typical, I'd like to make that point. INTERVIEWER: Well how is it untypical? COLLINS: There are a lot of these packets going around the world all the time and very seldom does anything like this happen. I don't want people thinking that C is not safe. INTERVIEWER: Was this C code safe? COLLINS: Well I was thinking more about the other ones. INTERVIEWER: The ones that are safe. COLLINS: Yeah, the ones that don't panic the kernel. INTERVIEWER: Well if this wasn't safe, why was it running at ring zero on millions of machines? COLLINS: Well I'm not saying it wasn't safe, it's just perhaps not quite as safe as some of the other ones. INTERVIEWER: Why? COLLINS: Well some of them are built so that they don't segfault at all. INTERVIEWER: Wasn't this built so it wouldn't segfault? COLLINS: Well obviously not. INTERVIEWER: How do you know? COLLINS: Well because a selective ACK block placed 2^31 bytes away from the receive window, causing an int comparison to overflow, so the kernel concluded the same byte was simultaneously above and below the acknowledged sequence number, deleted the only hole in its SACK list, appended to a null pointer, panicking the kernel and pulling down the entire machine. It's a bit of a giveaway, I just like to make the point that that is not normal. INTERVIEWER: Well what sort of standards is this C code written with? COLLINS: Oh very rigorous software engineering standards. INTERVIEWER: What sort of thing? COLLINS: Well it's not supposed to crash, for a start. INTERVIEWER: What other things? COLLINS: Well, there are regulations governing which functions you're allowed to call. INTERVIEWER: What regulations? COLLINS: Well, gets() is out. INTERVIEWER: And? COLLINS: No strcpy. No strcat. INTERVIEWER: sprintf? COLLINS: Look, sprintf is fine if you're careful. INTERVIEWER: Are people careful? COLLINS: For the most part. INTERVIEWER: What else? COLLINS: Code's gotta be in source control. There's a test suite. INTERVIEWER: What does it test for? COLLINS: That it compiles I suppose. INTERVIEWER: So the allegations that it's a dangerous language that does next to nothing to check whether code is doing what it's supposed to, that's ludicrous? COLLINS: Absolutely ludicrous. C is a serious production language. INTERVIEWER: Well what happened in this case? COLLINS: Well the kernel crashed in this case by all means but it's very unusual. INTERVIEWER: But Senator Collins, why did the kernel crash? COLLINS: Well it got a packet. INTERVIEWER: It got a packet? COLLINS: The kernel received a packet. INTERVIEWER: Is that unusual? COLLINS: Oh yeah. Online? Chance in a million! INTERVIEWER: So what do you do to protect the internet in cases like this? COLLINS: Well we patched the bug upstream. INTERVIEWER: …leaving other vulnerabilities no doubt unfixed. COLLINS: No no no the bug has been patched. You might need to deploy it but– INTERVIEWER: But this class of vulnerability– COLLINS: It's not a class of vulnerability, it's a one-off bug caused by programmer error. INTERVIEWER: Well what else is out there? COLLINS: Nothing's out there. INTERVIEWER: There must be something. COLLINS: There is nothing out there. All there is, is code, and programmers, and fixes. INTERVIEWER: And? COLLINS: And untold numbers of exploitable kernel-level exploits. INTERVIEWER: And what else? COLLINS: And a 27 year old integer overflow. INTERVIEWER: And anything else? COLLINS: And large private models at AI labs discovering more vulnerabilities in secret. But there's nothing else out there. INTERVIEWER: Senator Collins, thank you for joining us. COLLINS: It's a complete void. Nothing worth thinking about. Oh, we're out of time? Could you call me a cab? INTERVIEWER: But didn't you come in a self-driving car? COLLINS: Yeah I did but… INTERVIEWER: What happened? COLLINS: Well the kernel panicked.

@goblinodds the queer and questioning bits make sense in a lot of spaces, like clubs, because coming out is often a process of self discovery for people. and sometimes ppl figure out "oh actually I'm straight" and it's just nice to have space to handle that gracefully

wait i mandela effected this, i thought when i was a kid it was LGB and then we added T but apparently T was always in there even though it has nothing to do with sexuality and apparently people were reclaiming "queer" as far back as the 70s?? so the whole acronym is retarded

ok so everyone knows MMIWG2SLGBTQQIA+ is insane but what is the optimal place to have stopped, where's the sweet spot between "autistically committed to logic" and "so open-minded your brain falls out of your head"

And the vuln: ftp.openbsd.org/pub/OpenBSD/pa…

Based off the classic sketch: youtube.com/watch?v=3m5qxZ…

There-but-for-the-grace-of-stanislav Alexander, go to your room!

@AnniePosting I don't trust him because he lies. As a result, I treat the things he says as strategic noises rather than truth claims or commitments. This is a good reason to diswant him to be leading an ASI company. I've got no opinion about whether he's a sociopath.

why is this so hard for you people he's a sociopath but he might also be good unironically this is ableism making you a bad rationalist

@KelseyTuoc @xwanyex Yeah, though I suspect the inner drive behind this is usually more like a fear of being Eulered than a repressed belief that they aren't on the side of truth.

@xwanyex I think a lot of people on some level do not expect they'd win an honest trust-seeking argument, which is why they regard it as so dangerous if anyone strikes out to participate in one

You assume too much. There are just as many skeptics out there who see bad religious arguments and agree with me that they are unconvincing and so conclude that if this is the only reason to believe, then they shouldn’t. I stick my neck out to point out that nothing hinges on believing that bad arguments are good ones precisely so that skeptics don’t decide that it is the only path to belief. If you tell smart people that religion requires them to believe stupid things, then they simply won’t be religious. Thankfully, Christianity does not require that we endorse bad arguments!

@atlanticesque I've had this for fiction too. me: I'm drawing a total blank for how to describe Sue or her home. AI what do you think? AI: Sue strolled over to the coffee maker. me: you fool. Sue drinks tea at a one-person table by the kitchen, which is cozy but meticulously clean.

I was struggling with a major mental block about writing a certain passage. I tried to get AI to write it for me. When I read what it had produced, I was so angry about all the points it had missed and bad arguments it had made that it motivated me to actually write the thing.

Message I sent to my family about the time-sensitive opportunity to maybe cheaply escape natural death this month: As a heads up: Some of my friends are signing up for a new procedure that can be used to chemically put the brain and body in deep freeze and potentially revive you later. It's something I'd generally recommend for older people (e.g. 70+) and terminally ill people. The tech doesn't exist today to revive people, but it seems as though enough information is preserved in the brain that medical technology will eventually advance to the point of enabling revival. (Assuming humanity doesn't destroy itself first, anyway.) I'd put this in the category of "if it weren't new and it weren't weird / outside-the-box, it would probably be standard-of-care as a last line of resort for people who medical science can't otherwise save". There are plenty of other medical procedures that are similarly risky or experimental, but that buy you far fewer years of healthy lifespan if they succeed. The biggest risks and downsides, from my perspective, are: (a) The company doing this, Nectome, is new and untested, and might turn out to be incompetent or dysfunctional in some not-yet-obvious way. (b) If it takes medical technology a long time to reach the point of being able to revive people, then Nectome might stop existing first, or some natural disaster might occur, etc. to damage or destroy the bodies. (c) Nectome only does preservation with advance notice, so you're out of luck if you pass away in a sudden accident. Some more info: - A write-up on Nectome, plus some high-quality discussion (from people I broadly respect) in the comments: [LW link] - A more general (and fun) write-up on this whole approach to end-of-life care: [@waitbutwhy link] (note that this is a ten-year-old post, and the tech was worse at the time). Per [Nectome link], Nectome's preservation services normally cost $250,000, but until April 30 they're doing a pre-sale where you can buy a $20,000 card that makes the procedure cheaper the longer you wait to use it. E.g., if you pass away in 10+ years the total cost is just the flat $20,000; if it's in 6-7 years, it's $20,000 plus an additional $90,000; etc. The card can be freely transferred at any time to anyone who needs these services, so you could potentially buy several and give them to friends and family as needed. Overall: weird stuff, but weird and neglected innovations like these are sometimes where the biggest surprises turn up. I don't think this is a super safe or ironclad bet, but I'd guess it's worth the cost if you generally care a lot about your lifespan and healthspan.

@sorceressofmath there are certainly better AI architectures than just scaling up LLMs and I expect trillion dollar, exabyte-scale LLMs to find them (apologies to the old joke about genetic engineering)

The funny thing is, I don't think endlessly scaling LLMs is likely the end all of AI. I think there's a legitimate conversation about what other kinds of AI could be added to the mix and how silly it is for AI companies to slash basic research in favor of scaling.

Here are some ways in which the world has gotten better.

@drethelin by modern standards, that's pretty dangerous. most other common activities have a way longer time-to-fatal-accident.

you can drive full-time for 100 years before you would expect to get into a lethal accident. Driving is incredibly safe! It's just something that hundreds of millions of people do for hours every day, so there will be lots of accidents.

I am perpetually annoyed by takes like this because while i'm in favor of waymo and it is safer than humans.... driving is NOT incredibly dangerous

@kahnvex @lrkramer5 @steren varies language by language actually.

@lrkramer5 @steren Not sure when but this was solved with some blaze magic, multiple versions are possible.

When I joined Google, I found it annoying that: 1. Everyone works in the same repo at head 2. All dependencies are explicitly declared 3. External dependencies are copied in a central third_party folder 4. Everything can be re-built from source I had changed my mind for all of these points after a year.

@drethelin er, sorry, the first juggler doesn't lose face. the person saying juggling is easy does sure

@morphillogical They both lose face!

Why do people say "unforced error" it doesn't make you sound smart just say error or hell even "mistake"

@drethelin no difference between someone saying "hey, you've never juggled? it's easier than it looks, try juggling these oranges" vs someone saying "hey everyone, watch me juggle these oranges" second person loses face on failure, the first person doesn't. unforced error captures the diff

@morphillogical Outside of sports there is almost never such a thing as a “forced error” so it’s redundant to say this

@drethelin outside of sports it doesn't require enemy action, just an expectation that the person deliberately got in the situation and should have been able to handle it. compare "you did this to yourself"

@morphillogical Neither error was forced, creating a situation where you look stupid for an error is just another kind of error

@drethelin Alex created the situation requiring a fire, and is the presumed expert. Bailey is out of their comfort zone, and has little experience with trail maps (ok reading a trail map is easy, I didn't pick a hard enough task there)

@morphillogical Both are unforced? One is more embarrassing. This is not a useful concept for 99 percent of situations

@drethelin Alex styles himself as an outdoorsman. Bailey is an indoor cat. Alex invites Bailey to go camping. Alex can't start a fire and they sleep cold and shivering, that's an unforced error. Bailey misreads a trail map and they don't get to see the lake, that's an ordinary error.

@morphillogical In principle maybe but in practice the latter almost never happens