The default setup is to configure an Internet accessible DB. So yes — the credentials leak has also likely compromised many databases too. They are still obscuring the impact.
> and although we have been up for days on end- I don't blame you if you don't have sympathy for us.
From my timezone, this started last night and is ongoing into today. Has this been going for longer than the status page and email indicated? If so, why was notification delayed so long?
I love your product, have an incredible amount of sympathy for you as humans (having been in similar sleep-consuming nightmares) and was willing to forgive the GCP-triggered outage as an understandable teething pain, but sadly this response has really knocked my confidence.
I understand the hard reality of security issues -- "urgently rotate your keys, they're already compromised" is an important message to share -- but "sorry, that will also require your site going down because we've blocked deploys" (presumably as a response to the incident...) is an incredibly frustrating situation to find ourselves in.
I also want to briefly note that communicating, from the outset, "this is a significant incident, your keys are compromised, the attack is ongoing and you cannot enter new keys as _those too will be compromised_" is a better response than leaving people to figure out the unfortunate combo endpoint of "my keys are compromised, I have rotated them, this has broken my site but I have new keys, and oh surprise, I can't deploy". The full story needed to be communicated more clearly; the email just said "revoke your keys", which I urgently did... and then remembered/found out that changing environment variables requires a deploy.
I would rather have known earlier that I should put a notice on my site, or my own social media, or notify my own customers ASAP and disable some functionality (or make my own choice about porting somewhere else as a mitigation) than get caught out like this after the horse has bolted and it turns out you've been desperately trying to get it back into the paddock for days.
What does this offer over, say, an Innioasis https://www.innioasis.com/products/y2? What Bluetooth codecs does it support; will I be able to use LDAC/LDHC/AAC/AptX HD/etc.? Is "Sudo OS" something I can hack and play with?
These are strong tells for an AI authored article. I know we're all tired of people saying "this is AI" as it's harmful to discussing the content of an article, but articles about AI, (seemingly!) written by AI, extolling the virtues of AI -- don't really seem to drive the discussion forward to me either.
Maybe I should have added this part. As a non-native English speaker, using AI to write RFCs, ADRs, and internal documentation, my own writing style shifted so much to the direction that my writing seems like AI.
I am also a non-native English speaker but that doesn't mean you start speaking Claudian English just because you interact with AI.
If people do not like that particular style of writing and you understand it clearly, why would you double down on it? Especially if your goal is to share your writing with the intention of them reading it?
Furthermore, why not just blog in your native langauge if that is comfortable for you?
That is fair. However, the fact that we have this discussion because I wrote the post in English, I wouldn’t reach out to my fellow engineers to discuss the matter this broadly.
I don't think the existence of this discussion has anything to do with the topic we are discussing. "I wrote this myself but I only know how to write like an AI because that's how I talk in English all the time" is a weird stance to take. Furthermore, your comments are a completely different style of writing so how are you able to write like that here but suddenly switch to Claudian English for the blog?
Regardless, my feedback to you would be to disclose AI writing if you do use it (in the blog itself, not as a reply when called out for it) or if you genuinely write like that, aspire to be better than AI generated content if you care about what you are reaching out with in the first place imo.
The rest of the blog post doesn't strike me as AI generated. Hard to tell, and personally I think "hard to tell" is about as good as it's going to get from here on out, so I give the author the benefit of my doubt.
Agree that using AI for writing is a habit we collectively need to drop immediately.
I always check out the content whenever I see accusations of AI writing because I feel people can be a bit too suspicious these days but yes, this is as close to "AI but i changed how the em dashes look" writing:
> Did Kubernetes kill Ansible? Kind of. I haven’t written an Ansible playbook in years - if you handed me one right now I’d be squinting at the module syntax like I’d never seen it before - not because configuration management stopped mattering, but because Kubernetes...
Your idea that the AI is writing articles saying AI is good is very funny though
It's frustrating to find AI so prevalent in writing. It takes some nugget of a human written idea, dilutes it and increases word count, only to make the actual core idea less obvious (or ultimately summarized by someone using AI).
While it’s impressive work from the LLM and a TS implementation is novel, there’s at least a couple of pre-existing Python REs eg. https://github.com/jya-dev/supernote-tool :)
It seems like most of these "an LLM solved this in only X hours! " could have been "I found an open source solution that did what I needed with X minutes of web search."
Which doesn't mean that the LLM definitely couldn't have accomplished it without the prior art (in either the training set or explicitly in a a web search). But it does seem to be a trend.
For all the agentic loops people seem to have come up with, the research loop or as I call it the “Desperate 10th page on Github’s crappy search results” is still not up to the mark.
Either it might be genuine rate limiting these LLM’s face or just that, they are trained to focus on implementing a solution which would be faster and user acceptable solution. (which seems to be a true looking at people pushing LLM generated code as is).
At least in my personal experience with niche projects and heck even with well documented and famous libraries, along with fancy mcp’s, llms.txt and skills; RTFM has been more relevant than usual for code that I have asked an agent to generate, since it is too eager to reimplement functionality which already exists, only if it RTFM!!
If give an AI the full set of files it needs to RE a file format, and it's running xxd in tool calls in order to document the file format, I don't think it's cheating by copying it off the Internet.
It might be reverse-engineering it, but it also might be kayfabe. (Kayfabe is what professional wrestlers do - the storyline and matches are scripted, but it's presented as real. LLMs excel at doing this.) Similar to how Anthropic showed that their LLMs appear to "think ahead" when writing poetry to come up with a rhyme[1], so too might the knowledge of a file's structure influence how the LLM approaches analysis.
As a simplistic example, suppose one section of the file is known by the model to be bzip2 compressed - the LLM may use xxd to scan for common magic numbers that "just so happens" to include 42 5A (Bz). Every step of analysis is like this - what threads to look for, and which ones to pull on. Somebody or something who mostly-remembers the answer is going to find the answer quicker than if they'd gone in blind.
Haven't used docker sandbox but you can't just `apt install postgres` on firecracker, it needs to get baked into the image first.
That's my experience anyway, there's a lot of restrictions once you need to do some real basic things. For basic prompts maybe but interacting with a full stack ehh.
So bit hesitant to call firecracker a real VM myself.
