Not just that! The EIP-7702 delegation to make the wallet into a smart contract bypassed all of the controls that they had in place on the signer. It's wild that they didn't have a system in place to stop it from signing that transaction type.
From my rough understanding, this seems like the main exploit. It seems like the machine with access to the wallet key was presented with a crazy EIP-7702 transaction and signed it (which effectively owned its wallet in a single transaction)[1]. Without knowing their security model, it seems like biggest trust boundary should be between that signing machine and everything else.
[1] The fact that the needed to sign 50 of these transactions to solve a race condition seems like an implementation detail
They had to sign 50 of them because they had to compete timing the transaction with the normal transactions. Transactions have to be in nonce order for the wallet, and if two transactions with the same nonce are submitted to a block, it is up to the miner / validator to determine which one to put in. So if you spray 50, you can almost guarantee that the transaction you want will get in.
In Ethereum it would be implemented by linking your account to smart contract code, then throwing away your private key so you can only make transactions through the smart contract. The approval of linking to smart contract code is exactly what they signed here - only it wasn't a multisig smart contract, it was something malicious.
Also Superman III, which predates it and presumably was well known to the writers. But I have an inkling the scheme and it's infamy go back much further. (Precious metal coin clipping/debasement?) It's one of those ethical questions, like a pauper stealing bread, or thought experiments, like "what if reality is just a dream" that many if not most people encounter during their formative years. Per usual, though, the chasm between theory and application (even just identifying real world potential when it matters) is the toughest one to cross.
If they did and didn't account for a simple scenario like this happening and built in roadblocks and friction to prevent it from happening? Then it would stand to reason their entire EIS team should be fired.
The fact nobody thought of this is pretty staggering.
I think you need to go a step further. If AI maximalism turns out to be correct, does Anthropic control AI? Does the AI care that Anthropic as a company is supposed to be returning value to shareholders, or will it have its own agenda?
If you cherry-pick that statement in isolation you're technically correct. But in practice the whole comment you're replying to is actually correct, in this case if you saw the number four, one would be correct in concluding that's unlikely and searching other low digit numbers, the proof of that is that it happened here.
I think they are right and you are wrong. If I understand properly you say:
"Playing roulette, in isolation after RED - RED - RED - RED - RED, there is not a higher chance of getting BLACK than RED in the next run. But in practice, one would be correct in concluding that it will probably be BLACK. The proof is that in our test, the next run gave BLACK".
Said differently, it was not particularly unlikely that the number would be 4. But maybe it got the attention of the person who decided to try assuming that it was a mistake, and they were indeed lucky.
My understanding is more that it's like seeing RED - RED - RED - RED - RED and wondering if the roulette is broken, testing it, and realising it is.
The hypothesis is "I see a small number, I can test if it is broken or not... oh it is". Could totally have been "no it's all good, just happened to be a small number".
Distance does have cost, but that's mostly a brute force solution of strapping more fuel on. The really expensive piece is the tracking and flight control systems that enable interception of fast targets.
If it scans the network and sees a smart dishwasher, smart washer/drier, and smart lights, but no smart fridge, I imagine its worth something to a company like Samsung to start targeting that customer with ads for a smart fridge.
I agree with you and the parent comment, but to be fair to VC, they're also assuming risk. For example, if Wework had IPO'd earlier the public would've been holding the bag instead of private investors.
I agree but not sure WeWork is a good example. That smelled like pump and dump scheme from the beginning. They pretended to be tech company, while actually being landlord middlemen. Plenty of people predicted that downfall.
WeWork collapsed because of their S-1 was on fire. If they had gone public earlier, it would have still been on fire. The reason they lasted that long is because Masayoshi Son didn't do anything that resembled due diligence, but the market would have always done it.
Because if you asked it to fix a bug and every time it responds with paragraphs of how you could re-architect the system, it would be incredibly annoying.
Overall, in the United States, I think that prescriptions are far too broadly required.
For example, I get extreme nausea for about 6-8 hours when I get a viral infection. It's truly miserable, and to the point that I must lay down and can't walk for even a few meters (standing up makes the nausea worse). But, the last few times I had this, I had to go completely without treatment (meaning, for me, ondansetron/zofran) because it takes a massive fraction of that time to see a doctor and it's quite difficult to haul myself to an urgent care when I can't walk, and the telehalth doctor that I saw via my insurance company agreed that ondansetron was indicated but his telehealth company didn't have that drug on the allowed prescriptions whitelist, so he refused to prescribe it. This is despite me knowing the exact needed dosage, the exact needed drug, and being reasonably sure that it wasn't a symptom of something more dangerous. Yet, the law says that this knowledge is irrelevant, and I need someone else's permission, resulting in me being in completely unnecessary misery for a day.
And, in that story, it's just a day, and has no lasting consequences. It gets much worse for other people in some cases.
And, could loosening of prescription paternalism result in people making mistakes? Of course. But, I'm allowed to go and buy power tools, to drive a car (licensing requird, but it's realistic to get this license, while the same isn't true for a medical license and even then self prescription is heavily discouraged), and many other dangerous and complex things.
I'm sorry, it sounds needlessly rough. I wholeheartedly agree that less paternalism would help us all (I'm still bitter at the insane level of paternalism displayed by my country during COVID)
There are a handful of known red supergiant stars around 15 AU in diameter, 20 AU would be pushing past the boundaries of what we believe would be possible.
The star in the video, HR 8799, is about 50% larger than the sun.
reply