The forensic report on the failure of the cable sockets is at https://www.thorntontomasetti.com/sites/default/files/2022-0.... Unlike the linked article this includes detailed diagrams and discussion explaining how these sockets worked and how they failed.

My attempt at a quick summary: the Arecibo instruments were held up by heavy steel cables, which are composed of a bundle of 126 to 216 individual wire strands twisted together, where each wire strand is about 1/4 inch diameter. At the cable ends these were anchored in sockets. The socket is conical, widening out towards where the wire ends go. The wire strands of the cable would be separated in a "broom" shape to fill out that conical area, and then the whole thing filled in with molten zinc.

The failure mode of these zinc-filled sockets is for an inner core cylinder, about the same diameter as the cable body, to pull out from the socket while outer strands of the cable which are broomed out of that core either snap or pull free from the zinc plug.

This failure mode hadn't really been seen prior to the Arecibo collapse, partly because it is a long term process where the zinc slowly flows under stress over decades.

It's a well-known "paradox" known as Jevons Paradox. Given enough efficient use of a resource, overall usage could actually far outpace the efficiency gains. E.g. use of coal got efficient enough that travel via trains using it became possible, which led to way more usage of coal.

"Their kernel orgs are pretty lean"

For years, Red Hat employed more kernel developers than anyone and contributed more. These days they're "only" the fourth largest contributor, after Intel, Google, and Meta, but they are still among the largest corporate contributors.

If that's a lean kernel org, I don't know what a fat one would look like.

Human languages are massively redundant specifically to enable this kind of "fill the gaps" learning process.

Observe an unknown word used a few times in different contexts, and you'll get a very good bead on what it means.

It's the "natural" way of learning a language. No one gets every word explained to them in detail - most words you know in your own first language are the ones you picked up on the go.

I think this "structural redundancy" might be a big part of what enables LLMs to learn human languages "from nothing".

I’ve had code review pushback against reorganizing data structures to be more cache-friendly on the grounds that it was “premature optimization” even though I pre-emotively justified the decision with benchmark results indicating that the performance difference was large and business relevant, and addressed a real performance bottleneck that I observed during testing.

This was on a team and at a time where Clean Code was very popular. I somewhat wonder if the problem is that, in the 2010s, many people became convinced that certain aesthetic standards were both objectively, provably correct, and more important than anything else.

They aren't referring to "everyone" they are referring to "the people in the demoscene" and they are correct.

Wow that showed up quickly.

Readers might also consider my 2020 post "On the use of a life" to be an interesting companion piece: https://www.daemonology.net/blog/2020-09-20-On-the-use-of-a-...

> The rocket launch was only achieved through significant ‘manual’ effort on Sol’s part as it papered over its late-game failures to connect certain production systems by repeatedly ferrying supplies between areas of the factory.

Robots: they're just like us!

The article is just restating US copyright law for people who don't know it. The title indicates a recent change in policy, and there hasn't been one.

Now, this is US law. Much of the world does have "sweat of the brow" copyright. But the US does not. See "Feist vs. Rural Telephone". There must be human creativity because the US constitution reads "(Congress shall have the power) To promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries." That limits the power of Congress to change this.

So a lot of things are uncopyrightable in the US. Feist is the big case, and it was about telephone directories. No copyright. Useful objects are not copyrightable, which is why there are third party auto parts. Facts are not copyrightable, nor are databases of facts. Nor are pictures of public domain art. Nor is automotive sheet metal, despite lobbying by automakers.

That's what leads to AI-generated content not being copyrightable. Model weights don't seem to be copyrightable either.

I have seen a significant number of excellent engineers just seemingly turn their brain off entirely and resort to just spitting out "but AI said <blah>" or "AI reported <foo> which I found surprising but I didn't analyze or dig into that result whatsoever". So anecdotally, yes, this absolutely matches my experience.

I like Casio watches but I'd like them more if the watch faces weren't splattered with "Water resist", "Chrono alarm", and such labels. Yes I don't need to be reminded this watch indeed is an chrono alarm, like an advertisement, every time I look at it.

A bounty like this is a polite "thanks asshole, fuck off, don't do it again" rate.

Paying effectively nothing for vulnerabilities just means they don't want to deal with the program.

Wild to think a company supposedly worth a $trillion+ is doing shit like this.

You can thank the npm and the like.

Before, people were responsible for the dependencies they were importing.

With npm and all the javascripters flooding the market, it became normal to be irresponsible "because everybody is doing it".

Fast-forward a couple of years, now everything is web based, even the stand-alone app version. No one knows what is running on own computer, even the Devs themselves don't know what the are asking you to run...

With a pinch of vibe coding on top, and thats the end.

We took 40 years for our industry to be taken seriously, it's all gone now.

In the 1920s, "jay" was a slur similar to "country bumpkin" — an unsophisticated person who didn't understand the city. As cars became more common, the term "jaywalker" emerged, and the auto industry's PR arm seized on it and eventually helped it codify into law. Before jaywalking was a thing, newspapers blamed drivers for accidents, assuming people had the right to walk anywhere (as they always had) and cars needed to yield. It didn't take long for the auto industry — makers of the hottest new technology in the world — to convince their friends in the media to flip the narrative and start shaming pedestrians for getting in the way of cars.

> If you saw creatures behaving like this in the wild, you might attribute some rudimentary intelligence to them.

> But we’ve just shown you how this apparent intelligence arises from the bottom up, with just four neurons and two connections. There’s no magic here. In this view, behavior emerges from neural circuits.

Isn't the conclusion here that very simple behaviors like the sparks are intelligent? I would say even a single neuron has some tiny amount of intelligence, and what the author means by "no magic" and "emergent behavior" is just a different perspective that minimizes it.

I remember when I was ~14 at a private day school with a 1:1 laptop program in the early 00s, we were on AD. There was essentially one mac user in the IT department and the rest was windows, and inadvertently his mac created a hidden folder, I think it was "FindByContent" or something, that allowed full permission to all users in AD. Kids quickly noticed this, made a new AD group that was just us and locked it down a bit more, and for years interesting things started building up in that directory, pirated games (halo 1 for pc), artwork, test answers, even some porn if I remember correctly. Years later I worked for two years in that IT department and it was still there, with a whole decade of built-up content. We decommissioned it but it was super interesting to see how it had been used over the years.

> everyone whose WiFi or data service you use see you connect to "push.myownname.com"

Mozilla has one. Hell, Signal _themselves_ could host a UnifiedPush server. Not an excuse to say 'you use Google or our app uses 10x the battery'.

I laughed out loud at this — my dad is a retired Uni professor, so I know exactly what you are talking about — but I'd point out that the "student list" has around 140 seats in the parliament, so 80 academics hopefully still has another 60 common sense people who are not all about being right all the time, and who bring other perspectives too.

There was a guy in Missouri who pressed F12 (view source) and saw that the state website contained the SSN of all teacher--just right there in plain text in the HTML.

He reported it responsibly and then the governor personally started attacking him and threatening him with a felony.

I checked your link and I see that is a 2022 DoJ policy. How much peace of mind do you think a DoJ policy (not a law) from 2022 gives me?

I read as far as the first sentence: "The policy for the first time directs that good-faith security research should not be charged."

Soooo... the underlying message here is that good-faith security research is technically against the law, but their policy is not to press charges. They clearly consider good-faith security research to be technically against the law, because it wouldn't make sense to say "for the first time, our policy is to NOT charge people who follow the law"--that makes no sense. What they're saying is "we could charge good-faith security researches, but let's not as a matter of policy".

Reading further you see the policy is about NOT prosecuting people who do something like use an alias as their account name. That same paragraph says their focus should be on people who access systems without permission.

And to be clear, I am advocating for red teams that operate without permission. The bad guys are attacking our systems without permission, and I think the good guys should be protected when they do the same for a good purpose.

I guess minimalism is relative. I wouldn’t describe this as minimalism. Minimalism is not using a tool “that combines together X, BlueSky as well as Farcaster and Lens”. To me that is a way to cope with the opposite of minimalism.

You actually can just leave Twitter and read a book instead.

>So was Oracle and Microsoft Windows.

Cisco did provide updates via CCO and anonymous ftp server. They quite openly told that just download new image and test in your lab, and then if feature set did require licensing, please do it before deploying production. Trust was put on customers and they did very little to check and verify if customers did comply. Which is quite contrary to what for example Oracle practise is been.

>If history has taught us anything. It’s that the measure of a successful product is usually more to do with its sales people.

As someone who worked Cisco gear over thirty years I still remember why us networking did want cisco instead of many other brand devices and it hadn't anything to do with marketing and sales people did.

The Cisco IOS text based configuration was in early days of internet which made it so popular.

Many other manufacturers like HP, 3Com, Cabletron, Madge (IBM), Bridge, etc. did not get why we wanted and complained “give us textual configuration format like IOS has”.

With a plain text based configuration it was easy to adapt configuration from one model to have ready made templates for each model, upgrades and migration to new models were easier, you could use version controls (rcs,cvs, svn,... long before git) and then when RANCiD came it was easy to automate config backups, revert and rollback changes, pass audit with human readable configs and what was in production even long time after etc. In short text based configs made it possible to build large network scale configurations management tools.

IOS has compact, but quite easy to read config snippets made it much easier emailing others, posting examples newsgroups, opening TAC at Cisco CCO, books with examples, learning and teaching etc.

It took quite long before for example HP understood and switched text formats right after turn of century. Juniper seemed to understood right from beginning. But some like Fore, Nortel, Alcatel (ATM-switch makers) and many others did not understand before going out of business. Most of these others had either menus (3Com, HP) or a lousy CLI with obscure unique for just that device model and quite often not even option to print config or if they had not just with changes from default config but printing everything and providing no means to drop showing default. This made it manually while online very hard without external version control to even know what is current status and what had been changes.

BTW, this is still an issue with some manufacturers haven't understood and makes their devices much worse than they understand. Fortigate firewalls CLI is still like this. You can select a subsection of config to print, but it will no indication what differs from default configs. And the whole firewall config is hundreds of kilobytes. Good luck finding what's been changed unless you had saved default config when you started using that device!

When you have thousands to even tens of thousands of network devices in use as many were working you need to be rely that even when you encounter device failure and you don’t have same model any more available, you are able to adapt and find working fix configuring something else doing what is needed.

Binary and any non textual configurations may fit the purpose SOHO category devices, but when network grows even bit larger and configurations more complex there isn’t anything better than text base configs as far as us humans will need to configure and maintain those devices.

Cisco have had issues with software quality for sure, but it was Cisco IOS that was the reason it became so popular and we wanted to use it.

And we did put more weigh on manageability which that IOS text based configuration provided than for example speed some manufacturers got with their devices (Madge, etc.) and even when some Cisco switches dropped some Network World tests more packets we still wanted that manageability more and relied Cisco will fix those issues with software upgrades which it often did.

Juniper when it came end of 90's did understand this and made even better configuration system for Junos than IOS was and still is. Cisco have improved things with IOS-XR, but it's still not up to what Junos is currently.

e: fixed few typos and added that manageability chapter near end. Places where I did work none were always everything Cisco places. No, but either so called ABC (Anything But Cisco) places either. Cisco was and is still popular for those reasons mentioned above.

6000 years ago was about the time of the last interglacial period so likely it was ice free at that time.

As was stated "normal" is not really a useful framing. It has at various times been both "normal" for the glaciers to extend much further south, and it has also been "normal" for the earth to have no glaciers at all. When thinking about climate change the issue is not that the climate IS changing, but rather how quickly. There is no evidence that global climate has ever changed as quickly as it is today, with the fastest rates we have evidence for being on the order of 1 degree every thousand years, as compared to the current rate of about 1 degree per 50 years.

"The walls have ears."

Personally I would be careful about poking this bear so publicly. All it does is accelerate escalation and cause those of us who have been subjected to user-agent discrimination and found our own workarounds even more difficulty.

With the rise of AI, this point may be moot, but this is still a war and anything you make public can and will be used against you.

The striking detail here is that the patient's post-shift numbers wouldn't have tripped the static alarms we currently use; a resting heart rate moving from 44 to 49 bpm is still "athletic" by population standards. What mattered was the synchronized shift in several metrics relative to his personal baseline.

Perhaps because statistics education attunes us to average over individual differences, any mention of "data" unfortunately makes people instinctively jump to this 'cross-sectional' corner... textbooks explain how the typical human body behaves, and standard education and medical practice respectively emphasize averaging and population-level guidelines.

I think this approach is limited in some fundamental ways, and forces a dilemma: either accept wide and unactionable bands for what counts as normal, or use narrow bands that over-pathologize most individuals as diseased. The natural consequence of this is to start "fixing" deviations, and this is the territory of dangerous over-steering. This is why the medical community is afraid of "incidentalomas" and over-intervention. Tests which are point-in-time and compare one human to others are problematic in this respect. This is especially acute when the body is measured along many axes: like a full body scan. Much like the US Air Force Study of pilots discovered that there is no single pilot compatible with the "average" pilot measurements, comparing metrics from an individual's full body scan to a cohort average is likely to drastically overestimate problems.

In some ways, learned systems (like our physiology which is constantly adapting to our individual environment and experiences) follow the opposite of the Anna Karenina principle: every healthy individual is healthy in their own way. So the real diagnostic leverage isn't comparing an individual to an aggregate human template, but measuring change against their own homeostasis, and this requires high temporal resolution, not wider population comparisons.

I'm currently exploring how to bring this kind of longitudinal tracking to higher-fidelity modalities like wearable imaging. If any clinicians or researchers here are thinking about how to operationalize personal baselines in practice, I'd love to chat (email in profile).

> saying it will cover all losses from the hack and is working with law enforcement officials to identify who is responsible.

Isn't Binance the one that needs to be prosecuted for negligent security? How does "a compromised laptop" lead to a $6bn wipe in a matter of minutes?

This is why banks are regulated, though I have no idea if/whether these platforms are regulated in any similar way.

I appreciate this. The full text search is fairly crucial, as while I've seen the entire series more than once I cannot for the life of me remember "the name of the episode where the aliens pretending to be dumb kidnap Geordi", but the search is good enough to get there without being too obvious.

It was all going great until I read

> The design also avoids problems like function coloring and plays well with Rust's ownership rules.

Async is not I/O. It can be used for I/O, but it's just a way of writing pure, deterministic state machines that keeps a logical flow together instead of scattered over a bunch of transitions.

Even if you choose to manually compile your async flows into explicit state machines, you still have to deal with ‘function colouring’ (a.k.a. typing): a flow that crosses several state transitions (and may have other disjoint parts of the state updated in the meantime, via other transitions) now has to be rewritten as a (series of) state transitions, and can't be called from a blocking function. If anything, rewriting all your state machines without `async` makes the function colouring ‘problem’ worse, because multi-transition flows are even more different from normal functions.

This reminds me of a billboard I saw about 15 years ago when the state of Delaware was considering changing its laws to permit new casinos in addition to the three that had been grandfathered in when the restrictions went into place.

Delaware Park, one of those three casinos, put up a billboard opposing the bill, and it said, "No more casinos! THREE IS ENOUGH!"

It just goes to show that corporations will take any position -- even a casino taking an anti-casino position -- as long as it's self-serving.

That's me. But I don't understand your comment. Could you expand on it, either in a reply or preferably by email or via an MSRC case? You can reply with the vuln number so I can fast route it.

> The callback you're redirecting the user to at the end of that flow is forgeable

The redirect_uri is checked against the app registration. There's a general OAuth problem called "open registration redirects" that applies here, about which we've [blogged](https://www.microsoft.com/en-us/security/blog/2026/03/02/oau...) - but frankly, none of the industry solves this well.

In general, "I can create a link that goes to malware via X endpoint" isn't very interesting - you can also just create a direct link to the malware. Web browsers won't reliably show you the real destination of a link anyhow and even if they did, it's mostly just us hackers who understand URLs at all.

> as long as a way to authenticate users exists.

I'm lost. Entra supports [OpenID Connect](https://learn.microsoft.com/en-us/entra/identity-platform/v2...) for authentication. Most portals that surface admin consent authenticate the user with an OpenID Connect request either immediately before or after the admin consent request.

I was working on the clearly mistaken impression that "Made by Anthropic" in the cursor store meant that the artifact had been signed by Anthropic. If that is not the case, then two party's need to get their act together:

  - Cursor needs to add signing if they want to claim something was "made" by another party.

  - Anthropic needs to stamp out any provider from using said, "Made by Anthropic" until they start adding signing to their process.   Trademark law is useful here.

Until that happens - it's almost like you have to delete any extension from the Cursor Store off of your Cursor instance - kind of a crapshoot what you are actually downloading, no?

For example - what guarantee do I have with something like: " This publisher has verified ownership of cursor.com" - when I'm looking at the WSL extension. Are there any guarantees it's not been replaced with some other extension?