Hacker Newsnew | past | comments | ask | show | jobs | submit | m4rtink's commentslogin

Is it really available in practice ? Eg. do major distros even compile ffmpeg with these obscure codecs or you need to recompile it yourself to get it ?

Yes. The default ffmpeg build enables everything, and most distros follow suit. Security conscious web services generally disable a lot of them, but there is no official list on which are considered more secure than others, so every site tends to have its own unique mix.

It is a missed opportunity really - they had an exit and and infinite space station.

Imagine the economic possibilities - asteroid mining is for loosers, chair mining and bulkhead disassembly is what it is at!

Not to mention endless free power as long as you can get low resistance (or best super conductive) cables from all the power sockets and light fixtures.

And its already in the form of electricity, no need for steam engines or turbines like when you burn down the Infinite Castle or furniture from Infinite IKEA (SCP-3008)!


Any permanent lunar outpost (with maybe the exception of some of the coastal ones) needs to be fully self sufficient during the winter, that is nothing new.

No one is going to go rescue you tracking or flying thousands of kilometers in total darkness, snow storms and ~-80C temperatures.


With cost of launch to space finally coming down thanks to SpaceX & reusable rockets in general I would imagine this is how things will go much more often in the future.

Not only mass production but possibly cheaper materials, more in-space prototyping & less expensive ground testing and paper studies before launch.


So far it looks like just their previously legit Fedora account got taken over & the other accounts (GitHub) then generated on demand as needed for whatever it was trying to achieve, right ?

BTW, any idea what are the current requirements for creating a new GitHub account ? That could provide some information about if there was actually a person controlling thing thing at that moment to say provide wahtever was necessary to get the new GitHub account.


Yeah, gated communities like that are usually a clear sign that something bad is happening with the given society - or in a minor cases with the community, if it needs to gate itself from a society that is not failing.

Yeah, I am quite surprised this is not discussed more often - for remote cloud based AI not only does the provider see everything you provide to the tool/agent, there is no guarantee they can't manipulate the output at any time for a direct attack or more malicious purpose (fetch keys/secrets, put malware in place).

Even with locally running models this can't be singled out given how blackbox models generated by others are. You would have to generate the model yourself from clean data to be reasonably safe.


So next the attacker puts prompt injection in their PRs & take control of the agent on your end. Perfect, 10 out of 10.

You know the solution to that problem as well and yes, it is to use more technology to filter out prompt injections. It is an arms race just like any other, comparable to the missile vendor who sells missiles to country A, anti-missile missiles to country B, anti-missile resistent missiles to country A, anti anti-missile-resistent-missile missiles to country B, etcetera.

It is a strange game, the only way to win is not to play. That is unfortunate since that'd mean the free software era has largely come to an end.


Not to mention people who are still on the other side nominally in control but send LLM generated patches without declaring them as such.

Then you basically need to review any review from people that might be long term contributors but you don't know personally as new contributor patches, as the code is not from their head & you can't risk them properly reviewing it on their end.

To a degree its will always be a new contributor - an amnesiac LLM prompted to produce the patch with zero memory of any past PRs & lot of entropy in the mix.


In this case the nathan-bot was also still on a plausible side - all the PRs looked kinda trivial & there were not outright rejections that would be a red flag for a maintainer checking the GitHub account activity during PR review.

Mucking with Bugzilla & reassigning bugs especially is what seems to have led to the discovery, rather than spotting an accumulation of nonsensical PRs or other behavior related to code unmasking the bot.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: