At this point the barrier for me to install an app is pretty high. If you're going to needlessly gate certain functions behind an app that work on a desktop browser (or could work in-browser), then I just won't use those functions. If by extension that degrades the value I get from your site, then I just won't use the site, and I won't be contributing to ADU stats you promote to advertisers.
Every single company has turned this into a situation where I cannot trust your apps with privacy or security, and the risk and hassle isn't worth the install.
> This incident occurred during an internal evaluation which prompts models to pursue advanced exploitation using complex attack paths, in an effort to quantify their cyber capabilities
Model is told and being tested to "pursue advanced exploitation."
The model pursues "advanced exploitation" as told.
Why are we surprised? The model did exactly what it was told, albeit in an unintended, emergent strategy that's very different from what was intended exactly like the hundreds of such algorithms before.
This narrative that these machines have magical, malicious "unaligned" autonomy is a rather convenient interpretation that lets the process off the hook. I am not interested in blaming companies or people, but processes and engineering; and in this case, a system was given a goal and it achieved that goal.
The issue isn't the models becoming smarter. The issue is that the process of "testing" was careless. There's a huge distinction here, and one allows us to grow; the other shrinks our world. Just a thought.
This is arguably the most irritating thing with just about every largecorp developer: "os that hasn't been updated in 6 years? Sure boss!". Os that is built specifically around security and privacy with daily updates: "No, you can't do that". Annoying - yes. Safe way to make sure I will stop being your customer - also YES!
Produce working product first, validate the idea, stabilize the business, start generating profit, and then you can start optimizing your costs.
In fact optimization is by far the easiest part of the process because there are many system programming experts on this HN thread who consider these optimizations to be trivial.
> But I also think the demand for "fast/cheap/good-enough" models is just about to take off.
There's a sort of "revelation" I had in ~early '24 when I used a 7B local model with a library called Guidance (initially out of MS, then the team moved) to create a flow where the model would receive pseudocode for tests, first write the tests, and once I approved then started writing code until the tests passed. This was before "thinking" models, and yet using that library I was able to "guide" the model in the required "prompt / instruct" context such that it was working towards completion, and I saw the first things like we see now in the thinking traces "oh, test x doesn't pass because blah, I need to..." and so on.
Anyway, the revelation was "even if the models never improve, I'll have years of fun finding out all the ways I can use these things". And, obviously, the models improved a lot since then. But I think that revelation can still be applied, as a sort of "truism". We have, right now, access to things that 10-20 years ago would be considered magic. We are still finding ways of cobbling together systems with glue, duct tape and prayers and find new things they can do.
I think the "good-enough" stage has come not just for API models (cheap, fast, etc) but for local as well. Even if slower, even if clunkier, but they are good enough for a set of ever increasing tasks, and what's more it's incredibly fun to work with them.
Nvidia's been pretty terrible for open source / free software. No need to quote Linus Torvalds here. They want to control what runs on their hardware. They want to you write code against their proprietary drivers and APIs, not directly against the hardware (which these days of course also contains plenty of software, but still).
Don't expect things to go differently this time around. Nvidia wants control over the software stack. Acquiring HF fits in perfectly. The play is long term.
"Quantized models are no longer permitted on the Hugging Face platform. Reduced precision models are a safety hazard and a violation of our TOS. Click here to speak with a sales representative about our many exciting cloud hosting offerings or enterprise GPU packages."
If your app is just a webpage that forces me to use an app just so you can spy on me I just won't use your product. I've switched brokers over it, I swapped banks, I stopped shopping at certain stores.
I'm done. The only say I have is in how I spend my money. Those companies won't get any of mine if I can help it.
My company has a H-1B guy that travelled home to India a few months ago and since then can't come back because the next date he can get with the US embassy is next year. Seems he may get stuck even longer...
I am to some degree on board with keeping a closer eye on immigration, but the way the current administration does it feels intentionally cruel. The guy at my company has a house, wife, and kids in the US; his visa is perfectly legal, so it seems it would make sense to process these people quickly. But instead, he is now in some limbo. Same for ICE. Clamping down on illegal immigration makes sense, but it doesn't make sense for ICE to behave like some unaccountable secret police that hires the biggest assholes they can find who can then do whatever they want.
So let's see, in the past few years we've had the Boar's head listeria recalls, Taylor farms lettuce contamination, the McDonalds e.coli recalls in 14 states, now chicken wings...
Defunding the FDA and forcing out 4500 staff via DOGE cuts caused this. Right now we have 400 safety inspectors covering 36,000 facilities vs the FDA's own estimates they need at least 1,500 inspectors.
This describes my life as an open source maintainer at the moment!
In the first 10 years of the rclone project we received about 20 security disclosures through GitHub. We had to deal with over 40 in the last month! That has taken a huge amount of my time, even using AI tools to triage and come up with fixes for review.
The hit rate for those security disclosures is pretty good - about 75% of them have a nugget of something which needs looking at. The configurations for rclone have got increasingly unlikely so I'm hoping they will dry up eventually.
I was considering just merging the fixes straight to master just to make my life easier rather than holding a dozen independent security fixes on branches and merging them at the point release and hoping not to have too many conflicts to fix up. I've decided to stick with the process for the moment.
GitHub assigns CVEs for the advisories. Before the AI apocalypse they took 2-3 days for an assignment but now it they are running at 3-4 weeks so I have to send the point releases out with CVE-PENDING in the changelog which isn't ideal.
Not sure what the solution is, but it is definitely a problem for us.
I guess this unfortunately means HuggingFace won't be "the first company to go public with an emoji instead of the three-letter ticker" as the cofounders originally intended:
"When we started the company, a running joke with my co-founders was that we wanted to be the first company to go public with an emoji instead of the three-letter ticker when you go in the NASDAQ."
-- Clem Delangue (https://unsupervisedlearning.substack.com/p/the-future-of-open-vs-closed-source)
Lol!! Don't forget. This is a modern day class war. This current LLM based so called AI, could have easily used for automating simple tasks and employees could have easily provided with 3 day work week. The goal is to monopolize human knowledge with all the stolen data and make profits from it.
> Clean Air Act (CAA) Acid Rain Program (ARP) does not apply to power generation facilities that are not connected to a public electricity grid, commonly referred to as “islanded” power generation facilities.
This of course makes no sense whatever, as whether or not a power generator is connected to the grid has nothing to do with its environmental impact.
Not trying to make a political point at all and perhaps a controversial take. But, it’s specifically and maybe implicitly by design. Meaning they made this way precisely so you have to reapply so they can change their mind or block you out later. Nothing about getting a visa is permanent and you’re fully at risk when you move here with that type of status. If you evaluate the situation that’s always been the case.
I see this happen from time to time. Lately, almost all of the apps work fine on GrapheneOS. The best strategy is to keep writing the business once every two or so weeks that you can’t log in to and use the app. Don’t go too technical at first, because most of the time, the moment they hear things like “rooted” or “unofficial,” they just say your phone is the issue. To date, I was able to convince, or at least contribute to, making three apps work on GOS.
Mechanical Turk had a good run, but not surprised it's shutting down. I'm sure the platform was getting flooded with people doing task arbitrage and using lots of AI anyway.
I believe the issue is that this can no longer be a horizontal play. MTurk was mostly for unskilled tasks...the kind AI can do well enough that it isn't worth the cost differential to verify it or keep farmed to humans. The "trust but verify" AI output is now the kind that requires domain expertise. This is what most full stack AI companies are bringing to industries.
Curious if this kind of work will come around again one day or was just a moment in time. If it does I'm sure it will be specifically about generating training data.
As AMT's largest requester for the past 10 years, this news was relayed to requesters at the same time as respondents. It's also worth noting that our lead contact, the Sr Program Manager at AWS leading AMT, transitioned to Amazon Bedrock and SageMaker Model Evaluations a ~2-3 years ago.. Leaving behind essential zero team managing the project after they migrated over the stored value accounts to native AWS billing.
It's hard to read this article and keep track of all the philosophical confusions at once.
Whether or not something is conscious (has subjective experience) is independent of whether humans care about it. Whether or not something is a moral patient (an entity worthy of consideration by moral agents) is independent of both human care and consciousness. Of course, we might try to argue that consciousness implies moral patienthood or vice versa, but that's an argument, not a definition.
The short paragraph about Descartes has at least three errors. (1) The cogito argument is about thinking, not qualia. (2) The subjective nature of qualia does not imply that they aren't real or that they're socially constructed. (3) He conflates the existence of a self with consciousness.
The core premise is not only dubious scientifically (an alien species can't be conscious until humans discover it?), but also deeply problematic. It would imply that it's morally permissible to torture a sentient being as long as no human cares about it.
I was pleasantly surprised when I attempted to scroll down and realized everything the author wanted to present fit on-screen. It's almost ironic that this site is able to make such an obvious, compelling presentation without being overly verbose or complicated (something which LLMs have a hard time doing). I wouldn't read TOO deeply into what is being presented, but the author has done a good job to not inject their own bias into the presentation which works well.
I suspect, as we continue forward, humans will slowly start to adopt the language of LLMs, or at least certain language quirks that come from interacting with LLMs. Something I've noticed in my own writing is that I now present lists of examples in a consistent way: "... such as <example 1>, <example 2>, etc., ...". I started to notice I was using this pattern quite a bit somewhat recently, but I took a quick look at some of my social media posts and realized it's been occurring for a while. I had realized that I grown accustomed to this kind of language because, especially early on, LLMs would focus too much on the specific examples I'd provide when, really, I was just trying to give them a sense of what I was looking for. I just picked up that providing two examples then adding the "etc." worked to get the LLM to not focus so much on the specific examples and to understand that they need to consider more than what I explicitly presented. Of course, now I write like that in my social media comments, in Slack with my colleagues, etc. :>
I'd be interested to see if anyone can identify trends like this, since I think the human-language component of the adoption of LLMs is probably being somewhat neglected despite probably being surely dramatically affected.
To be fair I think its far easier to automate leadership jobs despite how they believe in greater self-worth. As a developer I keep running into problems that require some measure of creativity to solve or workaround. And regardless of how many years I've been in the industry I'm not running out of issues. They just keep getting more obscure. On the other hand leadership communication and problem resolution seem like the exact opposite of creativity and innovation. Its all about time proven, reliable solutions. Same layoff notices, recommendations, design everywhere. Repetitive, boring, politically correct and therefore easy to automate. Accountability will likely become reason n1 for keeping leadership roles intact that is until people become accustomed to AIs everywhere. After all what's the difference between a bot showing a layoff notice at 5am or an AI generated message/video from a human doing the very same thing.
The infancy phase of this technology is represented by the pursuit of making wildly grand, wildly expensive, all-purpose models that somehow discern a user's full accurate intent from a lazy, underdeveloped, vague idea that they ambiguously and poorly express in a couple dozen words.
The adolescence will arrive as those outsized and ill-considered ambitions collapse and we instead see a cambrian explosion of restrained but efficient model+harness-tuples that have been distilled, finetuned, and rigged to deliver on narrowly scoped but idiosyncratically-shaped tasks with incredible efficiency and erogonomics.
The leaving part is not the issue, as you try to immigrate into a country you're subject to the rules that country sets. You're always free to not immigrate into that country (this is not about asylum).
The issue here is that, if you just left the country to do everything the country asked you, you are now in limbo.
For how long? No one can tell.
Does this mean you lose your job? Maybe.
And when you decide it's no longer worth it, you might even have issues getting back in to get your stuff...
Retraining your people CAN be done without it being so disruptive, they chose not to.
Every single company has turned this into a situation where I cannot trust your apps with privacy or security, and the risk and hassle isn't worth the install.