I thought Dropbear was pretty much the defacto SSH server for embedded applications, is OpenSSH+musl actually a common combination for these scenarios?
I wouldn't say the bug is only in musl. Musl is probably the "worst" offender here (at least choose something other than "*"!), but the change in sshd was also a little suspect. i.e. the "let's find a user and take their salt (and hashing algorithm) and use it to compute and compare the hash to avoid timing attacks" change.
I haven't thought it through, but I suspect in an ideal world, sshd shouldn't have accepted the user password regardless of the outcome of crypt() if the user did not exist and it only pretended to go through the motions to avoid a timing attack.
Did look into their patch yesterday(?) which seemed to mitigate this issue which they (rightfully IMHO) consider caused by musl. But it seems their fix is to do a sanity check on the supposed hashed password char length, and thus still theoretically still allowing the possibility of those "!!!INVALID_PASSWORD!!!" suggestions to fall through....
This vulnerability clearly is not one that affects everyone like the PHP vulnerability did. But it's exposure is still significant and very easy to exploit. As easy as it gets.
Maybe because the picture you have in your mind is for the classic maze. There is a very famous AI course from UC Berkeley, CS 188, that uses Pac-Man with variable grid size to introduce Q-learning:
I think that after seeing that layout, plus the fact that the prompt mentions game and neural network training, you would have answered that the most likely game was Pac-Man :)
Valuation doesn't come from what's happening now, it comes from what is expected in the future. The whole point is to put in money to make more money later.
The earning report doesn't need to be bad for investors to see the projected outcomes for future quarters and say "hm... my money is best put somewhere else, whose earnings report showed more potential for growth".
Investors drop stock after report when earning didn't reach predicted level, but confusing part is that sometimes the results are exactly as predicted (and in theory priced in) but some investors are still disappointed and start the sell-off.
Good and bad are relative. If I bought stock with the expectation that Google would make $100B in profit and they "only" made $80B then the earnings were bad from my perspective and I'd be inclined to sell my position.
Previously the stock price was based on expectations, and if those expectations were not met the price could be expected to decline to reflect the actual performance.
Perhaps large investors are moving towards the distribution part of the cycle. (Longer time scales sure look like it on the index charts.) Time will tell
Is that true? I'm actually asking because all the ones that I have seen mentioned from the arena were generated with Claude and I just checked a few random ones and they all have commits by Claude.
I don't know how much was created by LLMs but can you still call these independent implementations?
Yes? Very little about Claude is deterministic. If given the same sufficiently complicated problem, but via slightly different input prompts, it can generate entirely different code. It would be shocking if they all had a single shared bug.
If it's a complicated but narrow problem then regardless of the prompt its possible that Claude will always converge to the same solution type from its training data. So it will generate different version of the same code that have the different implementations of the same procedure that 'works' but is incorrect in some subtle way.
Because of fears of AI, and people watching these indicators as hawks, the exact opposite will happen, they will try delaying this as much as possible to delay the backlash until it's too late.
Elon already stopped talking about job loses and doom, and tries to talk only about the positive.
no, i'd be more convinced if positions drop for tier 4 companies where everything is a mess. Companies like Anthropic have every incentive to build their system around AI accessibility and understanding.
This has nothing to do with capitalism, as these practices antagonise paying customers and quality employees and will lose money to the company in the long run.
This has all to do with people wanting control over other people, which may me classified under authoritarism, totalitarism and the such.
> as these practices antagonise paying customers and quality employees and will lose money to the company in the long run
I've been hearing this for too many years, and so far it hasn't been true.
Maybe next year some of Amazon's customers will somehow become willing to pay more and get less convenience at other retailers, but I wouldn't bet on it.
reply