Hacker Newsnew | past | comments | ask | show | jobs | submit | acdha's commentslogin

What makes it “doomerism” other than being inconvenient for your political beliefs? Reading the article, it’s a pretty anodyne statement of facts with researchers methodically showing a combination of factors making a culturally-significant phenomena less common than in the past.

What’s more likely to have a major security problem – Django’s authentication system or something custom an LLM rolled?

I don't even particularly care for Django, but darned if I'd want to reimplement on my own any of the great many problems they've thoroughly solved. It's so widely used that any weird little corner case you can think of has already been addressed. No way I'd start over on that.

At some point that’s true, but don’t they run the n-1 or 2 generation production lines for years after the next generation launches? There’s a significant capital investment there and my understanding is that the cost goes down significantly over the lifetime as they dial in the process so even though the price is lower it’s still profitable.

Unless plans have changed, the foundries making DDR4 are winding down, with the last shipments going out as we speak.

The specialty DRAM vendors (Nanya notably) will keep making DDR4 and earlier

Isn’t that mostly because Chinese manufacturers are flooding the market with cheaper products?

This is only true as long as there's enough of a market left. You tend to end up with oversupply and excessive inventory during the transition, and that pushes profit margins negative and removes all the supply pretty quickly.

It's not entirely JavaScript but it is partially due to some of the language's history and culture: prototype pollution wouldn't be possible in every other language and not everyone has culture around things like decoding payloads in an exploitable manner (e.g. in the Python world some people used to decode pickled objects but it was always frowned upon; the Java world has had debates over the years about this). The big one which is unique to JavaScript is the culture around client-side execution and mixing code running between the two environments, which means you have a lot of machinery setup to execute code on the server and/or clients, making it both easy to have confusion around the execution context in ways which have been exploited and encouraging people to do things like ship complex objects between the two which programmers using other backend languages wouldn't consider because they never had the possibility of running directly in the browser.

Has anyone noticed this not blocking the PoC?

https://github.com/assetnote/react2shell-scanner


Reuters isn’t a bank. Wiz is a security company so they have a greater responsibility to distinguish between their own original work and discoveries made by other researchers.

They do that by saying "we discovered this" when they discover it.

It’s far more extreme: old servers are still okay on I/O, and memory latency, etc. won’t change that dramatically so you can still find productive uses for them. AI workloads are hyper-focused on a single type of work and, unlike most regular servers, a limiting factor in direct competition with other companies.

I mean you could use training GPUs for inference right? That would be use case number 1 for a 8 * a100 box in a couple of years. It can also be used for non IO limited things like folding proteins or other 'scientific' use cases. Push comes to shove im sure an old A100 will run crysis.

All those use cases would probably use up 1% of the current AI infrastructure, let alone ahat they're planning to build.

Yeah, just like gas, possible uses will expand if AI crashes out, but:

* will these uses cover, say, 60% of all this infra?

* will these uses scale up to use that 60% within the next 5-7 years, while that hardware is still relevant and fully functional?

Also, we still have railroad tracks from the 1800s rail mania that were never truly used to capacity and dot com boom dark fiber that's also never been used fully, even with the internet growing 100x since. And tracks and fiber don't degrade as quickly as server hardware and especially GPUs.


> Push comes to shove im sure an old A100 will run crysis.

They don’t have video out ports!


Just like laptop dGPUs.

Market competition with a high barrier to entry doesn’t tend to result in a wide range of options for consumers. Everyone spending huge sums on infrastructure will have very similar pressure to find advertising revenue since ordinary people aren’t tripping over themselves to take on substantial new subscriptions.

It also naturally tends toward oligopoly with incumbents colluding not only to set prices but also to suppress competition that might defect from the collusion.

Yes, real artists need time, supplies, space to work, etc. If you don’t pay them, they’ll have less of everything they need to make the art you like.

> Pip does not support this; with uv, use `--exclude-newer`. This appears to require a timestamp; so if you always want things up to X days old you'll have to recalculate.

I do this by having my shell init do this:

    export UV_EXCLUDE_NEWER=$(date -Iu -d "14 days ago")
That’s easy to override if you need to but otherwise seamless.

FWIW, I'd like if these tools had an option to prefer the oldest version satisfying the given constraints (rather than the newest, as it is now — probably still a better default).

> prefer the oldest version satisfying the given constraints

The problem is there's no metadata for which versions fix security bugs, and therefore which previous versions are now insecure.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: