There is now an iron clad defense against all memory safety bugs leading to RCE that is actually practical to use in production in many cases, and people should start taking it seriously. Any PHP install that has ~2x CPU headroom should be switched to a memory safe Fil-C build immediately. More generally, anyone running network-exposed C/C++ code that is not routinely pegging the CPU should recompile with Fil-C ASAP.
"The entire world should use 2x more compute" is not a real answer. You can do that on your own personal computer which has compute to spare. For servers, you're already paying for the relevant amount of compute to serve your thousands or millions of users, and every % of overhead matters at that scale. You are suggesting everyone allocates a 2x budget for server-compute, or I suppose you're only talking about hobby servers where people are running tiny workloads and had so little traffic it doesn't matter?
Large, well-optimized services are running at high CPU utilization all the time. But there's a long, long tail of services that are running well below 100% utilization almost all or all of the time, and it's not just hobby stuff. Vulnerabilities in those services are still real and can be very important, and trading some otherwise idle CPU time for an absolute shield against memory safety issues is a good idea. Even for some services that do have high CPU utilization it may be a good trade to pay for more CPU to get that shield in this new world.
In addition to what my sibling comments have said, there is also the advantage of pushing the ecosystem to safe and fast approaches as a whole. Imagine if the default was to run C/C++ software under Fil-C, if no other measures where taken by the developers, e.g. if the consensus interpretation for one of the current security regulations (NIS2 etc.) mandated it. There would then be an enormous incentive for software to provide faster alternatives to Fil-C, as there where 2x-4x speedups for the taking!
Come to think of it, I believe it would actually be a good idea to lobby for exactly that. Memory safety issues have been a plague in IT for far too long.
I think the very success of PHP, JS, and all the other slower server-side languages is evidence to the contrary. Making the world use more compute for convenience was a real answer, and we know it was real because it happened. So why not do it again but for security?
Running a parallel PHP-filc deployment at such times at even 2x costs would 100% be worth it. Especially that you'd only be focusing on web-facing deployments (and not background processors).
People keep defending PHP (as they have been for ages) saying things like "oh, it could happen to any platform, this one's just so popular so the odds are higher" but then you take a peek at the diff for this fix and realize that nothing has changed since Fractal of Bad Design was published a decade ago. PHP is a scourge and unfortunately a still too popular one. The best time to realize the only safe option is to stop using it was in 2010, the 2nd best time is now ..
It will take time if the PHP sites have a database with a business model built on PHP. But with agentic coding, at least it is easier. I already transferred all wordpress static sites to pure html.
yeah anyone wise migrated away from PHP ages ago. The fact it got lipstick on back with PHP7 doesn't make it a well designed programming language. At least in my experience the vast majority of PHP websites nowadays are old abandoned PHP5 projects, which aren't much worse than just slopping a rewrite in something else
For now this is just one person posting about it. Can be real, can be a mistake, can be a hoax. But if it's real, then OpenAI once again fudged up really bad.
There's a longer land path that starts in or near Senegal and ends in China. But they miss it because it goes near the Dead Sea, and they treat anything below sea level as water.
The one they give also crosses numerous rivers and lakes. For the strict version of the challenge where you literally can't cross water it's likely that the best solution is across Antarctica. Guaranteed by temperature to contain no water whatsoever.
In passing, https://en.wikipedia.org/wiki/Paul_Salopek is walking from Ethiopia to Tierra del Fuego, tracing the path of human migration out of Africa. Walking the coast, not a straight line.
You could maybe determine this using a SAT solver. You would have to encode the entire QR code specification. I was thinking of doing this to find a minimalist QR code that just had as few black cells as possible.
This is where harness, and the fact that a machine can be endlessly prompted to try again comes in.
Even if an LLM starts by pursuing things that follow human bias, continuous failures and re-prompting to try something different will eventually force it to consider things outside of what ever biases it has.
You can do the same thing to a human. But most people would consider it unethical to lock someone in a box and force them to keep trying to solve the same problem over and over again until they figure it out.
Your comment stopped me in my tracks a little bit.
Is a 'bias' in a piece of writing generally a property of word to word choice and sentence to sentence construction or is it something more nebulous? Especially in terms of the appreciation of mathematics and someone's hesitance about publishing a mathematical argument they think is ugly or brute forced in some way.
> Is a 'bias' in a piece of writing generally a property of word to word choice and sentence to sentence construction or is it something more nebulous?
I wouldn't have expected that there was post training specifically on the issue of looking for proofs vs counter examples. But it might be that other post training has a side effect of making AIs better at looking for counter examples. I wonder if these agents are overall less biased and more rational than humans. Can you expand on what you mean by goal based training?
One argument would be that Ozempic doesn't give your body any additional resources. It just triggers your body to behave in a different way. But if the changes it causes are universally good, why didn't evolution already make your body work that way?
I suppose the counterargument would be that modern life is different from the evolutionary environment, and so it's possible for a change to be beneficial now that wasn't beneficial then. But it would still be good to understand better the mechanism of the effect of Ozempic on things like addiction.
There are people with more or less sensitive GLP-1 receptors today, who have lesser or greater impulsivity. If some event occurs where only those with lower impulsivity survive, then the future population will have more sensitive GLP-1 receptors.
This is the only way that happen - noticeable evolution is always driven by population bottlenecks or strong selective pressure. In the absence of those, mutation just keeps expanding the gene pool so more different candidates are available for the next bottleneck.
In case an event happens where only red-haired people survive, good thing some are available, otherwise there's no reason to think everyone will have red hair in the future.
> But if the changes it causes are universally good, why didn't evolution already make your body work that way?
We evolved in an environment where every bit of food took hours of effort and food preservation was impossible, so the only logical thing to do with extra food was feast and store up as much fat as possible for lean times. We're still many generations away from evolving to compensate for the discovery of fire, let alone everything that came after that.
reply