Hacker Newsnew | past | comments | ask | show | jobs | submit | codethief's commentslogin

Average Joe likely can't host the model to begin with but the average company won't be able to do so either, at least not for others[0]:

> If the Licensee or any of its affiliates operates a Model as a Service business, and the aggregate revenue of the Licensee and its affiliates exceeds 20 million US dollars (or the equivalent in other currencies) in total over any consecutive 12 months, the Licensee must enter into a separate agreement with Moonshot AI before using the Software or its derivative works for any commercial purpose.

[0]: https://huggingface.co/moonshotai/Kimi-K3.1-Pro/blob/main/LI...


It's not impossible that the separate agreement in question imposes light limitations.

I think one of the initial reasons why otherwise open source models started with the limitations on model-as-a-service use cases was because of quantised or entirely different models being served as the model in question on open router, and they needed a legal method to limit that. It might just be that, thought it might also be the direct opposite, hard to know.


This doesn’t stop any company spinning it up for their internal use. It only bites if you try to resell it.

Cool project! I take it "LawVM" as a name and "frontend" as a term are plays on LLVM and its different frontends?

Two suggestions: 1) Handwrite the website (mainly the copy but also the design) instead of letting Claude do that. Right now it is really hard to read and comprehend. 2) Drop the "frontend" terminology. Even if it makes sense from a technical perspective, people working in the legal field (who I suppose you want to reach) will likely find it confusing.


Yeah, like LLVM. Compiler for legal text-state -> structural analogy to other compilers (just need to reverse-engineer the exact specifications at the same time).

I think I'll call it "frontend" still internally but I'll look for better terminology.

Agreed re the website. Initially had a simpler website and well, I guess I was trying to achieve something re getting actual jurisdictions interested on adopting it and gauging how much energy to spend on this in general.

Hopefully one day soon my other projects are a lesser priority so I "get to" do the websites again, and maybe figure out what I'm even trying to communicate, exactly or achieve with the website. Hopefully global adoption eventually.


I doubt this would work.

Git commits get rebased, squashed, cherry-picked and edited retroactively, written during pair or mob programming sessions or rewritten during code review. And we also know that commit messages often suck. As a result, commits almost never tell you the full story about who exactly contributed, in what order or why.

The process is even messier when writing new bills. They get passed around between different departments, discussed & edited in various committees, etc.

Sure, you could force all participating parties to use git, prevent them from force-pushing or rewriting history even on their "feature branches", get them to sign their every commit, etc. But what you'd then likely just end up with is most negotiation & editing happening out-of-band.

Besides: At the end of the day it's the (majority of the) parliament that enacts a given law, so in my book they are all responsible, even if in practice laws get written by a small subset of people.


I'm blown away by the hand wringing of this. Someone would be forced to answer for the way they voted and inserted language. It makes it harder to do what you complain about because someone is going to take a hit. If its a little guy he might lose the next election. If its a big guy, eventually these things add up. Not sure what unintended consequences might appear. It sounds like you are resigned to the worst fate right now.

In Germany Sparda-Banken and, I think, Volks- und Raiffeisenbanken support tap-to-pay through their apps. (And maybe other banks providing apps developed by the same contractor, Atruvia AG.)

PayPal also offers tap-to-pay, though I recently had to disable Graphene's "secure app spawning" feature for the PayPal app to get it to open.


If we want our bank to add suppprt for GrapheneOS and specifically for “tap to pay” on GrapheneOS, without Google pay, what technically and specifically should we be asking for?

I wish I had a good answer for you! I don't think there's anything specific they need to do for GrapheneOS. They "just" need to use Android's NFC API[0] and then do the necessary magic incantations to implement the relevant payment scheme, i.e. exchange data with the credit card terminal and talk to the bank's backend servers. How exactly that works… no idea. But if there's anyone who knows it's them!

There was a time when I thought about figuring this out in detail and building an open-source alternative to Google Pay. But from what I've heard, integrating with credit cards is not something that can be done in an agnostic manner but actually requires support and buy-in by the issuing banks. Not a great perspective for such an app.

[0]: https://developer.android.com/develop/connectivity/nfc/nfc


As someone with a degree in physics and math, I find the line you're trying to draw rather blurry.

> Quantum physics is a theory, as in "as far as we can tell, this is an exact mathematical description of the world".

Is it?

If by "mathematical exactness" you merely mean we have somehow been able to produce some numbers that later on we measured in experiments, then yes. (Though we haven't been able to produce such numbers in all cases, see e.g. [0].)

I my book, though, mathematical exactness means your model is mathematically consistent and is applied with the necessary mathematical rigor.

Quantum mechanics and quantum field theory, as they are commonly taught in universities, are everything but. They are a bunch of concepts and recipes that, albeit successful, are held together loosely with duct tape and lots of hand waving to make you ignore the logical gaps & jumps and the fact that many of the "mathematical" objects physicists refer to don't even exist[1]!

[0]: https://www.scientificamerican.com/article/this-simple-exper...

[1]: Haag's Theorem, Aizenman–Fröhlich Triviality Theorem, etc.


Really, all previous PHP versions are affected?


Are there security patches for servers running old versions?

There are so many keeping old php versions alive for compatibility with whatever software


The CVE wasn't clear about the impact and suggested every version after 5. That is going back over a fucking decade, almost two.

There's a lot of zombie software on the net that is ripe for the picking. More food for the botnet.

Wordpress in particular is a stupidly simple vector.


At this point, it would be fastest/most effective for the PHP foundation to deploy their own white-hat mass hacking attack to exploit the vulnerability and forcefully shutdown vulnerable servers.

I can't think of a faster way to clear out the vulnerable surface area.


Fastest, most effective and also illegal. Unless you use AI to do it I guess, then it is fine to hack people.


Yeah they should poorly set up a sandbox and ask it to fix all the vulnerable servers with the remote RCE and prepare to be surprised when it escapes the sandbox.


for debian there's https://deb.sury.org/


Ubuntu pro is free for up to 5 machines


PHP 8.1 on Ubuntu 22.04 had the fix backported and released via security.ubuntu.com


> There are so many keeping old php versions alive for compatibility with whatever software

If only there was a way to trivially rewrite just about any software


Looks like news-web.php.net is offline now?


It has been offline for the latest 3 hours for me.


Hopefully it didn’t get hacked…


Kind of seems like they just shut down their PHP service like everyone else... If this is the case, hopefully they can set up a temporary static site to inform about relevant updates.


I would be worried if even they don't have access to the patch.



I think we can safely overload the term since the domains are separated enough. No one will think you're referring to quantum states when complaining that the system has been decohering too much lately. I can see why the author choose the term: "decohere" is a verb, which is fitting since it denotes a process, something that happens to systems gradually as change accumulates. There's no such connotation and associated verb to "incoherence".


> This site is an index. The complete original emails — full headers, bodies and attachments, with DKIM signatures intact — are in the torrent.

Weird, if the original messages have been published, why do both OP and the EuroNews article linked by the GP say that "Hackers have published 281 GB of AfD emails as AI summaries" and "A website published what it said were summaries of some of the emails but not the original messages"?


> It weighs upwards of 5,000 short tons (4,500,000 kg).

TIL there's something called a short ton.


If you're in the USofA it's the same 2,000 (US) pound ton you've always known.

For those of us elsewhere on the globe it's that non metric weight we call either a short ton or a US ton.

The OG ton, also known as the imperial ton or British ton is some 2,240 avoirdupois pounds that's been "standardised" (plus minus some obscure fuzzing) for some 700 years or so.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: