Yes, thank you. I don't know why we're always so dishonest about this topic (especially the most vocal younger crowd).
Men and women are far too picky compared to the past. That's why they die alone. It's that simple.
There's nothing wrong with this if it means you're happier than being stuck in a relationship you don't want, but you can't have it both ways.
Most people reading this know exactly who they'd be with if they just said yes to their options. Not liking your options is vastly different from having no options at all. Your options can change if you make the change within as well. The fact that this is such a modern and loud problem also points to the lack of competition you'd face compared to the past. We've overcomplicated this beyond belief. That's not nature's doing.
> Most people reading this know exactly who they'd be with if they just said yes to their options.
What does this mean? Just lower your standards and there's a woman out there for you?
It's been a long time since I was single, but I never felt like that. I worked at a job with a bunch of other men and didn't have a lot of social outlets that involved women. My candidate pool was close to zero. I eventually recognized this and found ways to broaden my pool, but it wasn't easy.
I'm not prescribing anything. I'm describing the situation.
I'm only speculating that I think the past used to be (a lot) worse. Competition was higher across the board for significantly worse options across the board.
So much of the modern era is defined by the desire for social change, but nobody seems to pause and think what that must mean regarding the perception of their options (and themselves). It means even your worst option today probably isn't that bad or is already more similar to you than you want to believe. I think this all boils down to mortality. Other people change slower than you have time for, so on some level you do have to either compromise or make your own changes at the pace you prefer. You can't spend life looking at the rear view mirror and a horizon that never comes.
A casual look on social media tends to confirm that the same people not liking their options also think they were "born in the wrong era" or similar.
I think a lot of people who post on HN don't want to admit that, apart from chatbots, AI is completely invisible to the user. A lot of users already hate chatbots to begin with and avoid using them.
So, it has already mostly disappeared, and the lack of practical applications means it will continue to bleed money. Software devs aren't using AI either for the bulk of smaller tasks that require teamwork with non-technical stakeholders.
Yes, it totally can disappear from society. The remaining use cases go with local LLMs and specialized software built around it. From the user's perspective, that's the way things always were and we'll be back to "the way it was" when the bubble is done bursting.
Yes, and the training data behind a lot of models is already stale and rotting fast.
Maintenance is just as important and the cost is often overlooked. The sober reality is that an LLM is just a natural language search index. For now, Google might be the only one with the capability to maintain "training" at the pace most people expect.
I think you misunderstood. I believe the parent comment is talking about an audience who does care enough to message the author, but the author would just shove that message into an LLM to reply.
Beyond all this, there's also tailoring your message to your audience.
In sales, you might call this finding "words that work" or "the pain points". AI will not know how to do this because it's getting a vibe check of the room.
You cannot merely be a sensory part for the AI unless you want to sound as cringe and out-of-touch as the majority of the training data (stale social media). Garbage in, garbage out.
I spent a lot of time thinking about it. AI converges on average which is very bland. The labs are trying to get out of it with RLFH which sadly just produces a different “edgy” average (Calude-speak).
But things get better if you instruct AI to speak in certain style. It’s still average but for the chosen style and thus less tone-deaf for a given use case.
So my thinking is - how much mileage can we get by introducing specific style guides? We can create a library of styles, and to get out of average for a specific guide individual companies and even people will maintain their own private patches from upstream.
Another option is to maintain history of your own writing and thus preserve your own voice. I feel like “averaging” of style is somehow un-ergonomic, in that in numbs the mind, and thus even diversity for the sake of diversity is valuable.
Words are most effective when they buck the trend in just the right way.
I'll use the conference room example for clarity, even though a lot of people still work remote these days.
Reading the room could be as subtle yet significant as reacting to the speaker that was on immediately before you. It could be reacting to the temperature of the room or the catered lunch everyone just had. It can be noticing or participating in or critiquing a peculiarity of the audience (hawaiian shirt fridays, etc.). It can also be a million other things and they'll never let you get away with choosing at random. You have to just "get it" or you're going to be ignored at best.
You're at once trying to both signal in-group status while also asserting your own identity and setting the tone for everything you'll be saying after. Remote work has its own idiosyncrasies, but regardless, you need a pulse for this kind of work. And, all this is just the introduction. What about emphasis choices in the rest of your writing/speaking?
Trying to pin that down is simply not logical and it's not just a matter of "adding" a handful of tricks unless you want to alienate everyone. Sometimes it's also the things you don't say or do that make the difference. You also have to accept that you can't please everyone. You could actually piss off everyone but the most important person in the room and still win. That might actually be the best way or the only way to win sometimes (as was the case for the American sales pitch of AI itself!).
The real world is messy and adding AI, or any particular process, to the mix just makes it worse. You cannot plan an accident, but you can avoid one.
This is extremely accurate, but HN doesn't like it when you burst their bubble.
A good software engineer has always been able to write a ton of code all by themselves in a short period of time without any oversight. There's nothing romantic or intelligent about that. It's just reckless.
Teamwork is more important than ever, and yes of course that slows things down. That's the point. The decision making is the slowest part. 5 hours of meetings today can completely change the trajectory of the next 5 years. This isn't a revelation for anyone but the most naive.
How is the "engineering mindset" different from that of any other role requiring problem solving?
My experience has been that those who are too precious about the only role they've ever had (an "engineer") are difficult to manage precisely because of their inflexibility and lack of curiosity. It's ironic isn't it?
Incurious engineers are typically not good engineers unless the field is completely explored, which is a questionable concept in itself. Stagnant engineers are essentially dead, they may as well just be books at that point. Useful, up to a point.
You're trying to assert authority and make money off of what is super basic cybersecurity. I'm not sure why you think word of mouth would cause anyone to do anything but laugh at you at best, or get the law after you at worst.
> Supply chain - a third-party script file that a site loads is infected with malware, and is then loaded on to the site, exposing all visitors.
I already know many will disagree, but this is far too vague for your answer to make much sense. The list of 15k websites isn't given.
Most websites have at least one analytics script. Some of the biggest vendor names in that space have known XSS issues via nonce reuse that they aren't going to fix because it threatens their entire business model.
You usually get the whole clown car as soon as you allow one 3rd-party script for relatively innocent use cases like wanting a heatmap of user interaction.
You should fully expect that such a blacklist would take out most, if not all, of the websites you use every day. The security model for 3rd party scripts tends to be "trust me bro, we're $bigname"
Yes, exactly! I'm saying the surface area to audit is much bigger than any particular or group of websites. All websites have problems like this that are out of their hands. What if all 3rd-party script vendors are like this (spoiler: they are)?
The blame game isn't going to solve this. Blaming it entirely on the website owners/maintainers is only treating the symptoms instead of the disease.
You have not offered an actionable plan to "fix it". I think its quite reasonable that people hosting malware on their websites should be made aware of it, and then they should stop hosting it. Blocking websites that don't respond to emails sent to their abuse contact - or that can't responsibly host content on the internet is totally reasonable.
I think you're trying to muddy waters here (along with several of the other replies I've responded to). These websites are not necessarily hosting the malware themselves. Even these script vendors don't necessarily know either. That's what makes it a supply chain attack. I've been very clear about implementation to mitigate against this.
Hardly anyone ever thinks about this despite it being a gaping hole. For all the whining I've ever heard about package managers like npm, this one is even uglier and likely being exploited right now. Its dynamic behavior is by design making it very hard to reliably demonstrate when it's being exploited, but it's a hole nonetheless.
It's perfectly actionable to stop using 3rd party scripts the way I outlined in a reply to a sibling comment. I'm not sure what else you need me to say.
It's very simple. Don't open up your web server's content security policy to domains that you "trust" just because a big name company tells you to. The only rub is that it directly contradicts all the instructions every analytics/ad provider gives for their scripts. Is that the real reason why you're saying it's "not actionable"?
That is very simple for anyone that reads the email sent to the WHOIS abuse contact and understands what it means and why they should care. Since virtually none of them will both understand and care, the next step after sending the email to the abuse contact is to blocklist their domain.
When their visitors begin seeing red warning notices they will learn why they should care.
> I'm not sure why you insist on playing whack-a-mole. You'll eventually just end up with a list of every domain the user visits on a regular basis. You're basically "shooting the messenger". Do you not understand that this is the other way around? Do you not understand this is a supply chain attack?
I still do not know what you think the relevance of that statement is. What is the specific action you are advocating the author of TFA take that does not require addressing it at each and every website operator?
If more than one sentence at a time is too much for your context window, you might need to pick another topic to discuss.
You're out of runway with this question and you either fly or you don't.
EDIT (we've hit max reply depth): No. I don't have a link. This is getting weird. If you're only convinced by authority, that explains why you insist on holding someone accountable for an issue that is as systemic as a supply chain attack. There is no "manager" to speak with. :smfh:
Visitors getting a big red warning page is the most effective way to get it fixed though. There's no way for site admins to sweep the issue under the rug
If we're really being serious about getting it fixed and not just waving a magic wand and laying blame, the scripts should not be distributed via a platform that tells web maintainers to blindly paste a script tag and leave their web servers wide open for the whitelisted 3rd party domain(s) to send whatever they want to visitors. We need to end the security theater with nonces that is bypassing what most people expect from a content security policy that is almost never true in practice.
The scripts should be 100% static files hosted by the same origin and not be obfuscated. These scripts should not make additional requests to inject even more scripts that cannot be known until run time and are specific to that targeted visitor. These scripts should be released in the usual semver tradition with matching hashes that never change without the explicit action by the same domain that the user actually visited (making the nonce obsolete).
Like I said, this is a very old debate with a very simple solution whose only problem is that it breaks the business model of a multi-billion dollar idea. Not only would this tighten up security, but your favorite websites wouldn't lag so hard anymore either. The vast majority of complaints about the web being slow are from the dozens of HTTP requests constantly being made behind your back. This is exactly why so many users feel forced to use an adblocker even though that doesn't always work.
You're totally not getting what I'm saying and that's fine, but why do you post these replies then?
I'm not sure why you insist on playing whack-a-mole. You'll eventually just end up with a list of every domain the user visits on a regular basis. You're basically "shooting the messenger". Do you not understand that this is the other way around? Do you not understand this is a supply chain attack?
If you insist on warning users, then that could only possibly work against the URLs of the requests behind the scenes, not the domain of the site they intended to visit. That is basically what an adblocker already does in the first place!
But, an adblocker is not a solution to this problem and is just a band-aid. Re-read the rest of my earlier comments.
Are you replying to something else? I don't see the connection to a problem affecting a small number of websites or the suggestion of reporting them all to a browser maker to indirectly inform them.
What makes you so sure that kind of malware isn't being distributed by otherwise trusted 3rd-party scripts?
That's the standard definition of a supply chain attack. If the website maintainer was acting maliciously or incompetently, it wouldn't be a supply chain attack anymore.
If I’m about to enter my credit card information on a site that’s compromised, I don’t care if it’s because of infected first party code or infected third party code. I want my browser to say “bro this site is fishy, maybe don’t”.
How about "Using third party analytics scripts is a bad idea in general, because they can and frequently do have vulnerabilities and your trust in $BigCompany is misplaced"?
Exactly. This is what website operators need to learn. People generally don't learn lessons like this without experiencing some pain first, so in my mind skipping straight to the blocklist is the most efficient.
You need to look up what a supply chain attack actually is.
This is not necessarily malicious behavior nor incompetence, unless you consider putting ads on a website incompetence. This problem has been festering for well over a decade.
AI doesn't really count as a "tech" topic like we've ever seen before.
Transformers are not a particularly significant academic breakthrough in computer science or engineering, but they are an application of what we used to broadly call "big data". The research had a much smaller impact on the result than the sheer scale at which we started to throw hardware at it and the very permissive situation we found ourselves in regarding the data that feeds it.
None of this really works without the massive amounts of data and hardware. It's enough to make you wonder how many times similar thoughts had been floated before we accepted some variant of the "transformer" idea.
As a consequence, AI is more like 50% political, 30% sales pitch, and 20% "tech".
> It's enough to make you wonder how many times similar thoughts had been floated before we accepted some variant of the "transformer" idea.
It's hugely annoying when people downplay ideas that required years of human intuition to iteratively divine.
Regardless of your position on whether the current scaling trajectories are sustainable or ethical, we didn't have a good mechanism to generally apply ML to arbitrary, heterogeneously, and un-schematized data.
I don't really care about the ethics or sustainability. I think you're so engaged otherwise that you're looking for anti-AI sentiment that isn't there.
I don't think "AI" is going anywhere. It's here to stay, but it's also massively overhyped and still somehow misunderstood by those who never got a CS education. There are a lot of charlatans still making absurd claims long after it should have ended.
Transformers + an obscene amount of data and hardware.
Do you have a POC of this era of "AI" working out as expected without the part I added after the '+'?
I'm only saying that this is not like the rest of computer science. It's borderline brute force. That's the bottom tier for algorithms and often considered trivial.
Men and women are far too picky compared to the past. That's why they die alone. It's that simple.
There's nothing wrong with this if it means you're happier than being stuck in a relationship you don't want, but you can't have it both ways.
Most people reading this know exactly who they'd be with if they just said yes to their options. Not liking your options is vastly different from having no options at all. Your options can change if you make the change within as well. The fact that this is such a modern and loud problem also points to the lack of competition you'd face compared to the past. We've overcomplicated this beyond belief. That's not nature's doing.
reply