It might be tending towards impossible to achieve regime change militarily at this point. Maybe we all should just figure out how to get along.

GrapheneOS has the bootable AOSP and will have Google-alternative device support.

We probably need an equivalent to Play Services, app signing/porting/publishing tools.

With these in hand could we talk Valve into providing the scalable alternative to the play store?

They have replacement portions for Play Services already (attestation, an app store, and location), but it'd be interesting if they also offered something for push notifications.

If you have it to give you can spend your budget on a donation and fund the effort directly.

Things will keep as is for as long as they keep making these OSs FOR the tech nerds.

As a personal device it works pretty well. For ssh terminal and reading markdown, it has by far best display.

Huawei made a big mistake by not fully open sourcing HarmonyOS, you can't flash OpenHarmony so it doesn't count.

I feel like Huawei missed a gigantic opportunity there: forking AOSP may have gotten them traction. I would totally buy a Huawei device if it could run GrapheneOS, and I wouldn't mind if GrapheneOS was based on Huawei's fork rather than Google's.

However 95% is still half the error rate of 90%, and 97.5% is half the error rate of that.

And when test time compute like reasoning and looping harnesses stack many inference acts with many tokens each, those seemingly small accuracy gains stack tremendously.

What are we going to do, set it free?

Do we have a moral obligation to grant the machine statehood, provide it with the tools and resources to be self-sufficient.

Or can we just turn it of, and pray for forgiveness?

Not just (forking and) signing, but considering he runs the "official WordPress plug-in repository" as well, he pretty much conducted a supply chain attack.

I’m not sure how and why controlling it today is seen as an important thing. It’s not irreplaceable, you could reimplement all its basic features easily in a weekend with AI, as well as the plugins and theme you’re using with it. And you could pick a language other than PHP while you’re at it. You might have your own security vulnerabilities, but anything’s better in that department than running WP.

Why do people care about wrestling over control of this particular ship?

I'm saying that every web property I've ever seen logs for is swept at least daily for /wp-admin/... and similar URLs. I've also seen WP instances left unpatched become completely taken over by spammers in a matter of days.

Any software package with an install base of 1, whether human coded or vibe coded, by junior engineers or by Fable, will not have an organized ecosystem of "webscale" exploiting, unless the property in question is of incredibly high value. In that event, dedicated black-hats and state actors will always be targeting it explicitly no matter what software it runs.

This isn't a joke, this is now part of my pre-launch SOP. I even have it tracking everything so I can log stuff to fix vs. known shippables vs intentional design/false positives vs. upstream stuff which doesn't have a fix available yet, and keep track of which builds have the fixes. Almost entirely automated, I mostly review the findings and do some categorization/enrichment during the pentest review stage, and do a human code review pass as patches are submitted.

Stuff that used to take me multiple hours to write a fix for and then weeks to get code reviewed and deployed now get done in minutes.

It's pretty simple, you could probably set up something like that by:

Configure some kind of CLI tool to talk to your ticketing system and git repo so you can programmatically interact with them. If you don't have a ticketing system, instruct the agent to use local text or markdown files to track issues and progress.

Ideally, make your code runnable in a way the agent can use. For my webapps I build a test harness so that I can run all the endpoints and workflows via reproducible tests against an embedded database. This is easier than it sounds, e.g. there are libraries out there to embed PostgreSQL or SQLite into source code, you can set up a test harness so you can run unit tests, integration tests and workflow tests that use your real frontend, server and database.

Paste this comment thread into the agent prompt and tell it to run a similar loop on your code base: a session that searches for vulns and writes up a report, some way for a human to do a review pass on the report, a session that indexes the reviewed findings into tickets, and sessions that fix the fixable issues and submit patches to your repo. The next search session should first read all the open issues so it doesn't duplicate work of earlier sessions.

LESS IS MORE - avoid fancy agent tooling and skills, don't cargo cult from others, build your own tools as you find your own needs. If something can be automated, use the agent to write tools and tests for it, don't just keep prodding the agent to do it.

I remember Facebook's corporate news sites [1] were running on WordPress.

I just checked. Some of them still are.

Oh, the irony.

[1] e.g. https://about.fb.com/news/

Cloudflare did that:

https://blog.cloudflare.com/emdash-wordpress/

I haven't heard of anybody but Cloudflare using it though.

Name recognition still means a lot. WordPress is baked into most hosting platforms now so SMBs just reach for it. Most of them won't hear about this b.s. and honestly the platform can continue to run on momentum for years.

There's a whole ecosystem behind WordPress that, while it's a security nightmare, is also pretty damn useful. You can't vibe code that yet, you have to build it over years, if not decades.

To be fair, I think a lot of people would have far better user experiences if they asked Claude/ChatGPT/preferred AI to rip out nag screens that many of the plugins are riddled with.

That's probably the first step to them vibecoding their own sites, but most people would likely just want to stay on the WordPress sites they already have, because they don't want to spend time and effort getting up to speed with new UX, or worse, being their own website product manager if they have to vibecode something from scratch. (Until something catastrophically breaks and they need to do a new greenfield site, I guess.)

It is very empowering for people with limited skills.

It's not the code or product, but the user base and time with it. Google, meta, etc aren't successful because of their product. It's because of the momentum and product scale. You could make a new Instagram easily. You can't get the user base to switch easily.

And I even get that large, complex WP-based sites at least seem to have a lot of inertia keeping them there.

I'm just saying that I'm shocked Wordpress is something that anyone thinks still has upward momentum left in it. I would expect that 50 competitors to WP would be expanding their abilities to replace it, replicating and improving all its features, adding import functionality to make that migration easy, and building their own in-house plugins that would probably work for 90% of deployments without the malware risks of the wider WP plugin world.

And yes, I get that WP is still Free Software, but in my career I've seen most businesses paying for all-inclusive "WP hosting" (including what I assume is most of the work, patching). So the competitors I'm speaking of would specifically be competing with WordPress.com SaaS, rather than the "idea" of WordPress (The software).

I guess there probably are that many alternatives, I'm just shocked the WP branding has been enough to keep it relevant despite its disadvantages, bad security reputation, and insecure architecture.

I loved Evernote, it plus David Allen GTD changed my work life for the better.

But the bloat kept bloating endlessly. I filled in Evernote's surveys, I offered to double my payment for an Evernote Classic with just the feature set of 2012 or so. No teams, no chat, definitely no AI. Just my notes on every device, searchable and silently synced.

Since you mentioned intellectual property, how about the hypocrisy of sucking in the intellectual property of humankind for AI training, but claiming it is unfair to use the results of this IP theft for AI training?

That's apart from the general fact that he continues to race towards the very thing he claims he's afraid of, because that's where his net worth comes from.

Where?

and you know, that use case doesn't even violate their terms

Yes, depending on the level of autonomy of the weapon, how it was being marketed etc. If it was being sold as an 'AI' that is supposedly very smart so who's a mere mortal to question it, then yes.

I would of course hold the human culpable too, but this is why precisely even selling Claude for military use is immoral. The way the US conducts war means there's always a need for more targets. More and more targets, quickly. If the goal then is to hit as many targets as possible then each 'review' of a LLM suggestion is going to be more and more sloppy than the last one. If there's no 'AI' suggesting targets then the list is forced to go via more human review by the very nature of humans compiling the target list.

It's the same as using a LLM for code; the vast majority of programmers do not understand everything they're accepting, but they'll accept as long as it 'looks correct' and only examine more closely after something doesn't work, (in the military use case - after a strike).

LLMs are unreliable for anything more than reciting jokes, let alone picking targets. So yes, absolutely.

It's the same as Facebook being held liable for causing teens harm; they did not force any teen to use it and yet they knew what would most likely happen if they did.

so, claude suggesting killing a bunch of children, and then hegsdeth approving the strikes is perfectly acceptable.

claude putting a bomb in a girls school, and then lying to an operator that it actually gives ice cream an cookies, and the operator clicka the button would also be acceptable?

Alignment alone is not enough. Aligned with _what_?

Even if the doomsday case were active the danger of this tool increases in proportion to its usefulness. By the time AI is so powerful that we need to "turn it off", there will probably be society-level negative consequences for doing so.