> If LLMs can really find a ton of vulnerabilities in my software, why would I not run them and just patch all the vulnerabilities, leading to perfectly secure software?
Probably because it will be a felony to do so. Or, the threat of a felony at least.
And this is because it is very embarrassing for companies to have society openly discussing how bad their software security is.
We sacrifice national security for the convenience of companies.
We are not allowed to test the security of systems, because that is the responsibility of companies, since they own the system. Also, companies who own the system and are responsible for its security are not liable when it is found to be insecure and they leak half the nations personal data, again.
Are you seeing how this works yet? Let's not have anything like verifiable and testable security interrupt the gravy train to the top. Nor can we expect systems to be secure all the time, be reasonable.
One might think that since we're all in this together and all our data is getting leaked twice a month, we could work together and all be on the lookout for security vulnerabilities and report them responsibly.
But no, the systems belong to companies, and they are solely responsible. But also (and very importantly) they are not responsible and especially they are not financially liable.
>> If LLMs can really find a ton of vulnerabilities in my software, why would I not run them and just patch all the vulnerabilities, leading to perfectly secure software?
>Probably because it will be a felony to do so. Or, the threat of a felony at least.
"my software" implies you own it (ie. your SaaS), so CFAA isn't an issue. I don't think he's implying that vigilante hackers should be hacking gmail just because they have a gmail account.
We need paper ballots because people can understand them. Election conspiracy theories are becoming a problem. Having a counting process that people can understand and trust is a feature.
Paper ballots that we almost never bother manually checking against the insecure digital tallies unless there’s a very close race or explicit challenge to the count.
Nearly every state routinely does statistical audits of voting machines compared with paper records.
People hate to hear this but: statistics work. You can randomly sample a portion (say, 2% to 5%) of ballots and have effective certainty about how much fraud or error there is in your voting system.
Conspiratorial thinking can't be fixed with additional facts. There is no set of facts that conclusively establish any claim to someone who is already committed not to believing the claim.
A common property of conspiracies is that any evidence is evidence of the conspiracy. Not enough data produces "what are they hiding" stuff. More data produces deliberate misunderstandings of the data to justify the conspiracy. We saw this very clearly with covid. When public health agencies were less transparant it was evidence of an evil coverup. When public agencies were more transparant about limitations or things they didn't fully understand it was evidence that public health efforts didn't work.
Why, Imperial Command Enforcement of course. They're a a bit like Hitler's SA (in fact one of them even dressed the part), the Great Leader sends them wherever he wants something stamped on.
I don't know if I'd phrase it like that. It does show they see ICE as a fix all police they can deploy for a wide variety of purposes though. ICE is better funded than some branches of the military, and they are demonstrating they are willing to use ICE for whatever they think needs to be done.
Somehow they will eliminate anonymity for real people, but bots will still be pushing Russian or... some other country's interests with massive bot farms.
I haven't read the article, but my understanding is that a normal curve results from summing several samples from most common probability distributions, and also a normal curve results from summing many normal curves.
All summation roads lead to normal curves. (There might be an exception for weird probability distributions that do not have a mean; I was surprised when I learned these exist.)
Life is full of sums. Height? That's a sum of genetics and nutrition, and both of those can be broken down into other sums. How long the treads last on a tire? That's a sum of all the times the tire has been driven, and all of those times driving are just sums of every turn and acceleration.
I'm not a data scientist. I'm just a programmer that works with piles of poorly designed business logic.
How did I do in my interview? (I am looking for a job.)
Say I have N independent and identically distributed random variables with finite mean. Assuming the sum converges to a distribution, what is the distribution they converge to?
If I had made the extra condition that the random variables had finite variance, you'd be correct. Without the finite variance condition, the distribution is Levy stable.
Levy stable distributions can have finite mean but infinite variance. They can also have infinite mean and infinite variance. Only in the finite mean and finite variance case does it imply a Gaussian.
Levy stable distributions are also called "fat-tailed", "heavy-tailed" or "power law" distributions. In some sense, Levy stable distributions are more normal than the normal distribution. It might be tempting to dismiss the infinite variance condition but, practically, this just means you get larger and larger numbers as you draw from the distribution.
This was one of Mandelbrot's main positions, that power laws were much more common than previously thought and should be adopted much more readily.
As an aside, if you do ever get asked this in an interview, don't expect to get the job if you answer correctly.
But if you haven't had exposure to this either through work experience or through course work it would be unfair to ask this question and use your answer to judge competence.
For a potential coworker role I would certainly be curious about your curiosity but a sharp ended question is not a way to explore that.
The free market solution to this seems to be making it easy / easier for competitors to arise. Then, when private equity does this, the customers, and workers, just hop ship to a competitor that's better managed and the original clinic goes under.
I don't expect this happens in reality though. In general the things that happen in a healthy free market are NOT happening in our society.
This completely discounts the work involved to find service providers you trust. I spent a long time finding a Doctor I trust, finding a Vet I trust, etc. I don't want a "free market" solution where I need to switch providers every 6 months because some rich dude is being a dick.
This is the problem with so many market focused solutions. They discount the burden put on the consumer.
Participating in a market is work, the only way a market (or life in general) works is if you hold your counterparties accountable.
> I don't want a "free market" solution where I need to switch providers every 6 months because some rich dude is being a dick.
Nature does not have a mandate that good quality services and products be available at low prices at all times. The rich dude being a “dick” was a tired vet owner who wanted to sell their equity, just like anyone else who sells their SP500 shares or their house.
The only thing that can be done is encourage government policies to ensure more sellers exist.
If the market is healthy, there will already be two or three providers in town instead of one that has any sort of monopoly, and the LBO won't be lucrative to begin with.
In a perfect world we'd have antitrust enforcement all the way from the top of government down to the municipality, so that this kind of behavior could be curbed. But I bet few cities bother to try at all.
You’re confused because you are treating free-market and capitalism as the same thing.
Capitalism is about who owns the assets, free markets are about how they are transferred. They don’t require each other. State owned enterprises can participate in the free market, an example are municipal utility companies. Private enterprises can operate without a free market, an example would be Lockheed Martin, whose defense business is mostly cost plus contracts.
The US hobbled the free market with deregulation since the 1980s. We encourage monopolies with strange reactionary legal precedent, use tax and other policy to establish price floors on residential units and health procedures.
The behavior that these firms are able to carry on with in veterinary, dental, dermatology, hvac and plumbing is anti-competitive and predatory.
Fewer businesses. But that aside when people say regulations are costly without providing specifics typically they are upset they can't rip off the public, pollute the environment or perform other acts to the disadvantage of the population.
Probably because it will be a felony to do so. Or, the threat of a felony at least.
And this is because it is very embarrassing for companies to have society openly discussing how bad their software security is.
We sacrifice national security for the convenience of companies.
We are not allowed to test the security of systems, because that is the responsibility of companies, since they own the system. Also, companies who own the system and are responsible for its security are not liable when it is found to be insecure and they leak half the nations personal data, again.
Are you seeing how this works yet? Let's not have anything like verifiable and testable security interrupt the gravy train to the top. Nor can we expect systems to be secure all the time, be reasonable.
One might think that since we're all in this together and all our data is getting leaked twice a month, we could work together and all be on the lookout for security vulnerabilities and report them responsibly.
But no, the systems belong to companies, and they are solely responsible. But also (and very importantly) they are not responsible and especially they are not financially liable.
reply