Bio field too short. Ask me about my person/beliefs/etc if you want to know. Or just look at my post history.
Hell, I don’t submit help requests without a confident understanding of what’s wrong.
Hi Amazon. My cart, ID xyz123, failed to check out. Your browser javascript seems to be throwing an error on line 173 of “null is not an object”. I think this is because the variable is overwritten in line 124, but only when the number of items AND the total cart price are prime.
Generally, by the time I have my full support request, I have either solved my problem or solved theirs.
I agree that this is a problem.
“Responsible disclosure” is a thing where an organization is given time to fix their code and deploy before the vulnerability is made public. Failing to fix the issue in a reasonable time, especially a timeline that your org has publicly agreed to, will cause reputational harm and is thus an incentive to write good code that is free of vulns and to remediate ones when they are identified.
This breaks down when the “organization” in question is just a few people with some free time who made something so fundamentally awesome that the world depends on it and have never been compensated for their incredible contributions to everyone.
“Responsible disclosure” in this case needs a bit of a redesign when the org is volunteer work instead of a company making profit. There’s no real reputational harm to ffmpeg, since users don’t necessarily know they use it, but the broader community recognizes the risk, and the maintainers feel obligated to fix issues. Additionally, a publicly disclosed vulnerability puts tons of innocent users at risk.
I don’t dislike AI-based code analysis. It can theoretically prevent zero-days when someone malicious else finds an issue first, but running AI tools against that xkcd-tiny-block and expecting that the maintainers have the ability to fit into a billion-dollar-company’s timeline is unreasonable. Google et al. should keep risks or vulnerabilities private when disclosing them to FOSS maintainers instead of holding them to the same standard as a corporation by posting issues to a git repo.
A RCE or similar critical issue in ffmpeg would be a real issue with widespread impact, given how broadly it is used. That suggests that it should be broadly supported. The social contract with LGPL, GPL, and FOSS in general is that code is released ‘as is, with no warranty’. Want to fix a problem, go for it! Only calling out problem just makes you a dick: Google, Amazon, Microsoft, 100’s of others.
As many have already stated: If a grossly profitable business depends on a “tiny” piece of code they aren’t paying for, they have two options: pay for the code (fund maintenance) or make their own. I’d also support a few headlines like “New Google Chrome vulnerability will let hackers steal you children and house!” or “watching this youtube video will set your computer on fire!”
I’m happy you provided a few examples. This is good for anyone else reading along.
Equifax in 2017: Penalty was, let’s assume the worst case, 700$M. The company in 2017 made 3.3$B, and I’d assume that was after the penalty, but even if it wasn’t, that was a penalty of 27% of revenue. That actually seems like it would hurt.
TSB in 2022: Fined ~48.6£M by two separate agencies. TSB made 183.5£M in revenue in 2022, still unclear if that was pre- or post- penalty, but this probably actually hurt.
Uber in 2018: your link suggests Uber avoided any legal discovery that might have exposed their wrongdoing. There are no numbers in the linked article and a search suggest the numbers are not public. Fuck that. A woman was killed by an AI driven car and the family deserves respect and privacy, but uber DOES NOT. Because it’s not a public record, I can’t tell how much they paid out for the death of the victim, and since uber is one of those modern venture-capital-loss-leader companies, this is hard to respond to.
I’m out of time – and won’t likely be able to finish before the weekend, so trying to wrap up – and Boeing seems complicated and I’m more familiar with Crowdstrike and I know they fucked up. In both cases, I’m not sure how much of a penalty they paid out relative to income.
I’ll cede the point: There are some companies who have paid a price for making mistakes. When you’re talking companies, though, the only metric is money-paid/money-earned. I would really like there to be criminal penalties for leadership who chase profit over safety, so there’s a bit of ‘wishful thinking’ in my worldview. If you kill someone as a human being (or 300 persons, Boeing), you end up with years in prison, but company just pays 25% of it’s profit that year instead.
I still think Cassandra is right, and that more often than not, software companies are not held responsible for their mistakes. And I think your other premise, that ‘if software is better at something’ carries a lot: Software is good at explicit computation, such as math, but is historically incapable of empathy (a significant part of the original topic… I don’t want to be a number in a cost/benefit calculation). I don’t want software replacing a human in the loop.
Back to my example of a flock camera telling the police that a stolen car was identified… the software was just wrong. The police department didn’t admit any wrongdoing and maaaaybe at some point the victim will be compensated for their suffering, but I expect flock will not be on the hook for that. It will be the police department, which is funded by taxpayers.
Reading your comments outside this thread, I think we would agree on a great many things and have interesting conversations. I didn’t intend to come across as snide, condescending or arrogant. You made the initial point, cassandra challenged you and I agreed with them, so I joined where they seemed not to.
The “bizarre emotion reaction” is probably that I despise AI and want it nowhere near any decision-making capability. I think that as we embed “AI” in software, we will find that real people are put at more risk and that software companies will be able to deflect blame when things go wrong.
The burden of proof is on you. Show me one example of a company being held liable (really liable, not a settlement/fine for a fraction of the money they made) for a software mistake that hurt people.
The reality is that a company can make X dollars with software that makes mistakes, and then pay X/100 dollars when that hurts people and goes to court. That’s not a punishment, that’s a cost of business. And the company pays that fine and the humans who mode those decisions are shielded from further repercussions.
When you said:
the idea that the software vendor could not be held liable is farcical
We need YOU to back that up. The rest of us have seen it never be accurate.
And it gets worse when the software vendor is a step removed: See flock cameras making big mistakes. Software decided that this car was stolen, but it was wrong. The police intimidated an innocent civilian because the software was wrong. Not only were the police not held accountable, Flock was never even in the picture.
Which CEO downvoted this?
Upvoting, but also commenting to say that employees are at a disadvantage in almost all cases: a company can almost certainly absorb your loss but most people cannot absorb the loss of their income.
Asking for a raise could get you fired (sorry, “let go”), especially if you’re in a position where there’s an eager new applicant just waiting for a position to open up, such as any service-industry job.
Even niche skilled jobs are not immune. If your cost approaches the value your employer extracts from your labor, then you will be left jobless and you may find it hard to find a comparable position if your skill-set is tightly focused. If you’re the one COBOL programmer at your company, you are underpaid; the moment you demand your actual worth, they will figure out how to pivot that old code-base to something more modern, even if it costs millions of dollars to license and switch to a new ERP platform or similar bullshit.
I’ve turned this WFH rant into a worker protection rant, so back on topic: Wouldn’t it be nice to just … not have to drive to a place to put your butt in a seat when your butt could be at a seat at home and do the exact same thing? I get that some jobs don’t work that way, but many (probably most) do.
In 2020, we witnessed most jobs at company headquarters around the world being done at home and nothing exploded. Almost everything done from a cubicle can be done from home. Wouldn’t it be nice to knock down those buildings and make them green spaces instead?
I really like the description of AI coding as ‘custom stack overflow generator’ because it really sells the flaws as well, to an experienced dev. We go to stack overflow for help with some weird quirk of a language or find an obscure library that solves our specific need.
I think vibe coding is cobbling together a project from a bunch of stack overflow posts – and they only use the question part of the post.
This look to be amazing. I live by a CLI, but most browsers have some keyboard shortcuts at best. This one seems to have the capability to be fully KB using a VIM-like command line, which is awesome.
Thanks for the recommendation!
I’m no longer at my computer where typing is easy. I thank all of you for responding in good faith, and I’ll be reading the various links. Thanks for engaging with me.
Okay. My method doesn’t work. We can’t reform the system from within.
What does?
What’s your perfect solution? How do we get there?
I’m honestly curious. I’m pissed at the status quo, and don’t know how to make things better with my limited personal power.
I’m now mobile, so my formatting will suffer.
Capitalism = bad. I’m fully behind that, and see it as the root of the problem. What I don’t see is a path forward that doesn’t involve incremental progress, even if not all demographics are served. At least not without violence that will be disrupt even more.
I think this is where we disagree, but I might still be missing something.
You (assorted folks responding to me) want an epoch change where we rise up and take back the power we have. We have it right now, but the price to pay to enforce that is too high for me.
I want a progression where we work towards owning that power. We had it partially when unions were still strong, but it was undermined. In my mind, the solution is education, but I have no power to enact that directly. My ability to influence is limited to my local org and voting.
A green party, socialist party, etc, will never win an election in our current environment. Votes there are literally useless, if not spoiling a candidate that has at least some if your views. The system is rigged, sure, but you can’t flip this table and walk away.
Can we separate this discussion into talking about politics and elections and eliminate Israel/Palestine? I’m a-religious, pro Palestine, pro humanitarian, but having that angle seems to quickly degenerate every conversation into ‘both sides are genocide’ and avoid the’how do we move forward’ question. I think these can be separated, but maybe that is also a place we disagree.
I feel we’re playing different games, or using different terms.
Help me understand.
Firstly. Let’s define words: I’m assuming/using my view of a US-centric Liberal vs Conservative.
Liberal: Democratic party, wants to make life better for the larger segment of the population.
Conservative: Republican party, wants to consolidate power and wealth in the hands of a few.
That’s my personal and biased broad-strokes view of the political landscape.
Conservatives have managed to gather enough popular support that people will vote against their best interest for either perceived economic gain or for ‘hurt the other people more.’
Stepping back even further, what is your end-goal? How do you respect the desires of millions of people without some sort of representation, and if you have such, how do you ensure that the representative aligns with the goals of their constituents?
Sadly, I’m offline for the day, but I’d be happy to continue this conversation.
In this post: not realizing that the ideal solution is not a single step away, but rather multiple steps – and they will not be simple to sell to a general populace.
I’ll admit I’m not familiar with the term. ‘Electorialism’ seems to be, according to Wikipedia, a ‘half-way step’ between Authoritarianism and Democracy.
As far as I know, we are still not quite in an Authoritarian state here in the US. We are more likely to be headed in the opposite way from Electorialism; where we are transitioning from what is a democratic process to one where oligarchs have consolidated enough power and influence that they can just say, ‘fuck it, we win.’ In that case, yes, I do want to make a case against Electorialism.
In Electorialism, the dominant party, presumably the authoritarian one, conducts elections that allow their opponents a stage and promises to be free and fair while still controlling the levers of power. What we have seen in the last 8 years is a party, republicans, that are throwing every possible strategy at the wall in the effort to undermine and discredit elections with the end result that if they win, the election will be seen as fair and, if they lose, the election will be seen as unfair.
All concepts of what are optimal democratic processes are going to be just that: concepts. We live in the real world. There are millions of people you have to convince to move to your desired method of representation. I think we agree on the end-goal, I just disagree on how to get there and think we can’t jump from a Trump presidency directly to a worker-owned utopia.
Help me out. What’s our next step?
Mine is to help elect people to local, state and federal offices that want to make life for everyone better.
My comment was removed by the mods… probably because I let my rage show. Though the mod log shows rule 2 instead of rule 1 :P
Here’s a longer and nicer version:
I’m a (US) liberal, and I don’t approve of any of the views described by kittenzrulz123. Lumping half the country into a single bucket is not going to give you a good overview of the myriad ideals we might have individually.
You have a choice. You can look at the political landscape at the moment of the election and choose one of four options:
At this time, our election system really only works for two parties. Any third-party vote is useless, if not counterproductive. If you can’t understand how that math works, let me know and I’ll break it down for you. I’d love to change that, but the process is by using our ability during primaries to put forward more liberal candidates that support election reforms, not by putting our heads in the sand and voting 3rd party hoping that we will make people notice… hint: they will not.
If you don’t like your choices when you go to the voting booth in November, the solution is to get involved in late November and make things better next time. Join a local democratic organization and become part of the solution. Complaining online about how your choices suck is something we can fix if we all jump in. If you’re not doing that, then you are abdicating your responsibility and allowing others to make the choice of who represents us instead. If you choose not to be part of the selection process, the very least you can do is vote for the ‘lesser evil’ and not make things worse.
Side note: the Primary election is the end of that selection process, not the start. Putting your values on the primary ballot is where you should spend your energy if you’re mad at the status quo.
I will admit that I’m angry that we didn’t get a Democratic primary and that Harris was ordained as Biden’s successor without any popular input. The DNC is to blame for that fuck-up. It’s irrefutable, though, that Harris would have been better for Palestine, the US economy, US healthcare, foreign relations, and dozens of other topics than trump is.
Would Claudia de la Cruz have been better? Sure. Her platform looks awesome. Did she have even a chance of winning? no.
I tripped over this awesome analogy that I feel compelled to share. “[AI/LLMs are] a blurry JPEG of the web”.
This video pointed me to this article (paywalled)
The headline gets the major point across. LLMs are like taking the whole web as an analog image and lossily digitizing it: you can make out the general shape, but there might be missed details or compression artifacts. Asking an LLM is, in effect, googling your question using a more natural language… but instead of getting source material or memes back as a result, you get a lossy version of those sources and it’s random by design, so ‘how do I fix this bug?’ could result in ‘rm -rf’ one time, and something that looks like an actual fix the next.
Gamers’ Nexus just did a piece about how youtube’s ai summaries could be manipulative. While I think that is a possibility and the risk is real, go look at how many times elmo has said he’ll fix grok for real this time; but another big takeaway was how bad LLMs still are at numbers or tokens that have data encoded in them: There was a segment where Steve called out the inconsistent model names, and how the ai would mistake a 9070 for a 970, etc, or make up it’s own models.
Just like googling a question might give you a troll answer, querying an ai might give you a regurgitated, low-res troll answer. ew.