MuteDialog

October in a nutshell: - PHP got hacked - Railway got hacked - OpenCode got hacked - Binance got hacked - Polymarket got hacked - GitHub Actions got hacked - SoftBank got hacked - Cursor marketplace got hacked - Coinbase vendor got hacked - Fireworks AI got hacked - LiteLLM got hacked - Capcom got hacked - npm packages got hacked - TiDB Cloud got hacked - Warp's vendor got hacked happy cybersecurity awareness month

This is why LLMs can’t write interesting and novel content, and won’t be able to for the foreseeable future

New Anthropic research: How AI agents shape experts' judgment calls When experts delegate work to an agent, do they still make the key decisions? We tested this in a randomized trial with 50 professional data analysts.

“Woke more correct” type reading here, but professional services (finance, law, consulting, insurance, etc) literally do capture an outsize share of the surplus created by the underlying productive economic activity. They do this in large part by creating & manipulating various socially constructed procedural outcomes that exist on a spectrum from “civilizationally valuable but unintelligible to the population at large” to “outright self-serving grift” Everyone involved in these industries tells themselves they’re in the former category. Many are not. It’s true that a world without lawyers would be much worse and much less productive than a world that can resolve contract disputes peaceably. But that principle has limits. When you mint a surplus of lawyers, they don’t all keep increasing productivity. Some form agencies and NGOs and think tanks whose entire output sums to placing extractive gates in front of production. In the endgame, the production itself can even totally stall while the professional services people keep on extracting and extracting. California might never get highspeed rail, but a whole industry of people already collected a decade of six figure paychecks off of…? That’s just the most egregious example. Public equities markets may be a wonderful innovation, but US ECM teams charging 7% gross spread to 90%+ of companies trying to go public is obviously not the free market in action. Fees vary substantially everywhere else. Google got so offended by this grift they famously did a dutch auction, and the banks in response pilloried them and reduced investor demand to prevent other tech companies getting similar ideas (no marketing, no brokerages promoting them, negative quotes for media, mega friction for retail participants). Whatever you think of the whole affair, it’s obviously more complicated than “finance good” — major players have interests and they protect them by doing much more than just competing fairly. Private Equity gets a bad reputation for ruining corporate america and a lot of the heat it takes is misallocated. They really are being more efficient with capital. But the existence of the debt tax shield as currently written into the US tax code is not a hard fact of the universe. And if you want to maximize your returns under this current socially constructed procedural framework, you will end up shifting the surplus generated away from the employees, managers, and founders of corporate entities and towards centralized firms that use leverage to remove and extract any slack from the system. Insurance too. It’s this thing that obviously makes a whole bunch of systems work. It’s good that it exists. Also: many interactions with insurance systems are transparently cartel-like from the perspective of a customer, with regulatory capture (“socially constructed procedure”) and exploitative and extractive monetization dynamics. And of course that’s how it feels, because that’s what it is. No part of the system is a free market. Merely entering the system as an insurance carrier requires many levels of government approval, with delegated sub-industries (ratings agencies!) to farm out white collar salaries to more people. Again: the optimal level of insurance for a productive economy is obviously greater than 0. But also: the optimal size of the class who collects a salary skimming money off of productive industry through insurance premiums directly & indirectly is almost certainly smaller than ours is today. This is made doubly worse by the way that certain vice industries get subjected to higher and higher premiums to eventually “nudge” them out of existence without the need for legislation. Of course I’d rather live here than there. Don’t confuse reasonable critique with an inferior system. No need to be a revolutionary. But I try not to kid myself about what’s beneath the pretty lies we tell about our society.

are you a flame guy rather than a torch guy, richard? if so, you're a rare bird indeed danfaggella.com/paradigm

🚨 BREAKING: John Healey will announce at the Budget that HMRC will be given powers to seize money directly from the bank accounts of people who fail to pay their tax

So, two big things this morning: 1. A Certificate Authority (CA) was stupid and used a ridiculously-easily-guessable value for its private keys. Which means the entire SSL/TLS chain of trust is broken. This means anyone can impersonate any site, and you won't be able to tell, because the site certificate will be legitimate (in fact, the only way you COULD tell is to know that eMudhra wasn't in the chain of trust for the site before, but is now). Anything that checks/processes certs needs to be updated, to revoke the CA's certs. That means computers, phones, video game consoles, smart appliances, and a ton of phone apps and computer programs. And a lot of them don't have patches ready yet. 2. There's going to be an announcement later today of a vulnerability that's being exploited right now that allows anyone to take over any computer running a website that uses PHP, with a single request. It does not require authentication. If you're running any websites using any version of PHP, research "PHP2Shell" immediately, and take the necessary mitigation steps ASAP. Like I said, this is already being exploited right now, but once the announcement's official, the internet's gonna get slammed with people trying to take control of millions of computers worldwide.