You literally just said a whole bunch of words that are literally gibberish to your average software developers. The devs at openai are good, but very few of them are cyber focused, so it’s not surprising IMO. And you’re also not fully considering the granularity problem, eg there are a lot of sandboxing tools out there but they’re usually quite coarse in the dials and levers they offer, so the only way you can still make the workload do what it needs to do is tune them relatively permissive.
I don’t think we should just accept that the average developer doesn’t know about these very basic hardening methods.
This is your chance to set yourself apart from LLM coding agents. If you want to call yourself a software “engineer” you need to start actually engineering, which includes knowing when and how to apply security principles and these hardening methods.
I reject the notion that “doing cybersecurity” is somehow a different job than software development.
> but very few of them are cyber focused, so it’s not surprising IMO
Yeah but that's a business decision. I work on security at a company that does sandboxing and when the company decided to build an AI harness I was brought in as one of the earliest engineers on the product. We do almost everything on that list and we're a fraction of the size of OpenAI. And it wasn't particularly hard, and we have harder requirements imo (because we solve more general problems vs "run a very specific agent with a very specific task and very specific access").
> And you’re also not fully considering the granularity problem, eg there are a lot of sandboxing tools out there but they’re usually quite coarse in the dials and levers they offer, so the only way you can still make the workload do what it needs to do is tune them relatively permissive.
Very little software is incompatible with running in gvisor, for example. Most people can just overwrite `runc` with `runsc` and things will "just work".
Running an artifact repository in isolation isn't particularly novel or complex either. You can virtually just eliminate SSRF vulnerabilities with a host based firewall or AWS Security Group etc, like the whole problem goes away by just saying "this box can only talk to that box".
Tools like Smokescreen exist, they work great, they're super easy to deploy. I bet OpenAI could do it, I bet they could run 500k tokens just fuzzing and eval'ing it for 0days for like 48 hours before they actually deploy it too.
OpenAI as a business chose to not bring people who know these things in, or didn't empower them, or didn't prioritize it organizationally. I'm not a genius for saying "use gvisor, set up a firewall, isolate resources" - I'm quite sure there are people over there who would get it done in a weekend. But they didn't, and that's notable.
Mate, you’ve fallen into a mind trap. It’s not true!
I know because I was in it once doing your exact same calculations and was out of my mind lonely and stuck. You gotta find a way to believe in “average” and get out of the perfectionist trap. And in retrospect, all my rumination was just pure rumination and self imposed dumb expectations that had no backing in actual reality and what makes a happy marriage and life.
You gotta dare to hope and dare to believe that “settling” is just an idiotic story we tell ourselves after years of psychological programming from movies and pop culture. Every human you will ever meet has infinite worlds within themselves. The only job to be done in dating is finding someone whose inner infinite world you find interesting enough and who finds your inner world interesting enough too.
You don’t really say this in your article but are you pretty sure that you could’ve gotten the exact same results and probably with better convergence if you just use gradient, descent, and optimizers like Adam, etc?
To be clear I think GAs are way cooler though haha. So kudos to you for this awesome write up
Thanks! I do have a section on this in the article "Why genetic algorithms aren't state of the art"
"Physics simulation involves discontinuities (contacts, friction regimes), long rollouts, and chaotic dynamics where small parameter changes lead to large outcome differences. Even with simulator internals, differentiating through thousands of unstable timesteps would yield noisy, high-variance gradients. Evolution is simpler and more robust for this regime."
"The real tradeoff is sample-efficient but complex (RL) vs compute hungry but simple (GA). DQN extracts learning signal from every timestep and assigns credit to individual actions."
Thank you for chiming in. Pricing is still TBD and will be finalized in the coming months before the service goes to GA. At a high level we plan to keep competitive also try to make it inclusive of the integration features too (native CDC + pg_clickhouse). Stay tuned!
Scala supports it with for-comprehensions which are equivalent to Haskell's do-notation but STM is not part of the Scala standard library. Zio and Cats Effect are two popular Scala effects systems with STM.
Verse only supports single-threaded transactional memory. Epic hasn't yet demonstrated that their approach can actually scale to be used from multiple threads in a useful manner, though they claim that it will.
Hey, I did some benchmarks if you're interested - benchmarks results are in the README.md.
https://github.com/nimeshnayaju/zod (Fork of Zod's repo which already included benchmarks comparing Zod 4 against Zod 3, so I simply integrated my validation library)
Yes, the primary focus is memory efficiency; performance improvement is a side effect of that. From my own benchmarks, I have found that to be the case. If you're validating thousands of objects per second or working with memory constraints, the difference becomes quite significant. Happy to share the full benchmark code if you'd like to run them yourself!
I wrote a simple Python script that I run in any directory that gets the context I usually need and copies to the clipboard/paste buffer. A short custom script let's you adjust to your own needs.
Legal issues aside (you are the legal owner of that code or you checked with one), and provided it's small enough, just ask an LLM to write a script to do so . If the code base is too big, you might have luck choosing the right parts. The right balance of inclusions and exclusions can work miracles here.
Cursor can index your codebase efficiently using vector embeddings rather than literally adding all your text files into context. Someone else mentioned machtiani here which seems to work similarly.
