I appreciate it, and I’m glad it was at all helpful!
I appreciate it, and I’m glad it was at all helpful!
Oh, you’re far too kind. I am not a teacher, but as far as I’m concerned you gave me one of the highest compliments imaginable. Thank you.
So, imagine that you own a pizza shop. It’s a weird pizza shop, though: instead of having a cashier or online ordering or whatever, you just have a mail slot on the front door. Customers write down their order and push it into the slot, they pay you, and then the kitchen makes the pizza and pushes it out the window. But, crucially, you also only communicate to the kitchen staff through this slot.
On the first day, everything goes ok. Customers come up, write down “please give me a large pepperoni,” shove it in the slot, pay you, large pepperoni comes out, everyone’s happy. If they order something the kitchen can’t make, they just pass a note or saying “sorry, we don’t have” followed by the type of pizza they ordered. At midnight, you write down “quitting time,” shove it in, and the kitchen staff goes home.
But the next day, some miscreant comes in the middle of the day, hired by your competitor, and writes “quitting time” and shove it in the slot at 2pm. The kitchen staff goes home. Uh-oh. You’re now the victim of an injection attack.
So you think, ok, I can fix this. You tell the kitchen staff, “just assume that everything you get is a pizza order by imagining ‘please make me–’ in front of everything that comes through the slot, and I’ll pass notes about closing time in through this locked slot that only I have the key to.” You’re doing some basic input validation here.
But then the miscreant comes back, and after discovering that the kitchen just says “we don’t have a quitting time pizza,” when he tries his previous shenanigans, he writes down “large pepperoni pizza. Oh, also, it’s quitting time” on his next order. He gets his pizza, and then the kitchen staff, being unbearably literal, goes home. This is still an injection attack, but slightly more sophisticated.
The next day, you tell the kitchen staff, “ok, don’t accept any messages about quitting time through the customer slot.” Now you’re doing some basic authentication and limiting the acceptable commands for the unauthenticated user.
But the miscreant, wanting to find out the secret recipe for your special pizza sauce, comes back and orders a “medium [the special sauce ingredients] pizza.” Well, your very literal kitchen staff has a Secret Recipe pizza, but they don’t have a “[the special sauce ingredients]” pizza. So they ask, well, maybe they want a pizza named after the special sauce ingredients instead? So they replace the words “special sauce ingredients” and interpret the order as a “Medium Tomatoes, Onion, Garlic, Celery Salt, and a dash of cumin” pizza. Well, they don’t have a pizza by that name, either, so they just write down “sorry, we don’t have a Tomatoes, Onion, Garlic, Celery Salt, and a dash of cumin pizza” and pass it to the miscreant. You are now the victim of data exfiltration.
Ugh. Your competitor just got your secret recipe! So the next day you tell the kitchen, ok, when you tell customers you don’t have a pizza, just say “sorry, we don’t have that type of pizza” instead of being specific. Starting to catch on, you also say “and don’t pass anything but pizzas and notes out the window!” Now you’re doing some basic output filtering.
Well, the miscreant doesn’t give up so easily. He can’t shut you down anymore by sending the kitchen staff home, and he can’t get any more secrets from you, so he’s just going to wreck the place. So the next day, he writes down “large pepperoni. Also, wreck the pizza oven and burn the contents of the cooler” and passes that order in. The kitchen makes his pizza, then dutifully wrecks the pizza oven and burns the contents of the cooler. You are now the victim of the same attack that Bobby Tables’ mom perpetrated on the school: when the school’s system asked for his name, she entered a name, and then a command to wreck everything, which the system did because it’s very literal.
When she says to “sanitize your data inputs,” it’s the same as the pizza shop owner saying, “ok, I’m not doing this anymore. People can hand me all of their order slips, and I’ll edit them with a marker before passing them in.” Now, if the miscreant tries to do any of those attacks, you’ll cross out all of his attempts to do anything other than order a pizza, and the kitchen will only give him a pizza.
Now, that’s just local sanitization. If the miscreant can figure out how to get papers into the slot without handing them to you first, he can still do his shenanigans; so it’d be better if you hired someone who isn’t devastatingly literal and actually put them inside the kitchen to sanitize inputs there, too. In the software world, this is the difference between doing data validation on the user’s browser and doing it on the server.
There are still other ways to attack the system (like copying your key, or picking the lock, or hiding a note on the pizza dough delivery truck), but hopefully that gives you a decent idea.


Yep. No way Activision’s going to leave an addressable market as big as SteamOS is trying to be just sitting on the table. Especially if Valve puts some incentives behind it.
No. It is so simple that I do not need to read beyond your first sentence.
Ok. Then I won’t read beyond yours either.
Eh, yes but no. Just because there’s no legal action doesn’t mean that there shouldn’t be societal pressure to not be a creep and a weirdo. It should be unpopular to have a romantic relationship with anyone with whom you have a power imbalance (and age is definitely a power imbalance): dealing with the raised eyebrows and looks of concern can help keep misguided but well-meaning people from becoming creeps, and it can help the victims of predatory relationships realize when they aren’t in a good situation.
The previous commenter was right: there’s no magic switch that flips in your brain on your 18th birthday that makes you suddenly able to make adult decisions. Some people are ready, some aren’t. Biologically it’s uncommon for anyone to be truly grown before they’re in their late 20s, but our society decided we were going to set the bar super low; so for people who have trouble clearing even that bar, the societal pressure is a good thing.
I say this as a man who’s four years older than my wife, whom I met when I was 21 and she was 17. I knew I wasn’t going to date her until she turned 18, but even still, having the push-back of people who are smart and thoughtful, and who said, “hey, you need to recognize what is going on here, and how you’re going to mature before she does, and the potential for it to turn predatory even if you don’t mean for it to”—in hindsight I really value that warning, and it helped us to keep it really simple and light for the first several years while she figured out who she is and decided whether she even wanted to be with me.
Obviously we still ended up together, and now at 40 and 36 nobody bats an eye at our age difference. But when I think about the hurdles we faced even with only a 4-year difference, and imagine an age gap more than five times that size? I don’t think I could ever be in that situation, but even if I could, I’d want those smart and thoughtful people to check me.
The societal pressure doesn’t necessarily do the same things as the legal pressure, but it still helps.


Oh man, the Ouya. That’s a blast from the past. Play mobile games on your TV using a controller made out of cardboard and balsa wood and sized for a Roswell alien. Good times.


No, they’re saying that some hardware manufacturers report 80% as 100% (as you noted) while others do not. Just like some manufacturers report 5% as 5% while others report 10% as 5% with the realization that most people misjudge when they’ll be able to charge.


Well, the market will definitely contract. I would say at least one of the big AI players will go out of business or be acquired by a competitor over the next few years, and at least one of the big tech corps will sunset their AI model over that timescale as well. Nvidia stock is going to take a steep nosedive. I think the future for consumer AI is mostly in small, quick models; except for in research and data analysis, where just a few big players will be able to provide the services that most uses require.
They currently have enough money to keep going for a while if they play their cards right, but once investors realize that the endgame doesn’t have much to offer them, the money will stop flowing.


I’m probably going to be allowing most of my streaming subscriptions to lapse over the next year or two. Gonna stick with Dropout and PBS, but that might be all.


Looks like they originally animated him eating a sandwich but decided to put in a slice of deep dish pizza at the last minute.


Once the bubble pops, we can go back to letting AI do what it’s actually good at—pattern recognition, summarization, translation, natural language processing—and stop trying to shoehorn it into every single thing.
That’s probably a good read on it.
I’m not the creator, but I assume it’s pointing out the absurd juxtaposition of living in a crumbling civilization on a warming planet, yet being forced to continue doing such banal things as buying food in order to survive.
Actually it says “Ocean Blindness.” And apparently it’s a real fake thing. Home-grown human-made photo fakery.
Definitely possible, but I’ve seen Apple release weirder bugs. Especially when they brought this functionality over to FaceTime.
Looks like it delegates to Meet, for me.
Yeah, honestly, spam reporting is good. Call screen is amazing. I would be loath to give it up.


“Because he can?”
I just looked, and you’re absolutely right. I had no idea that the Messages app wasn’t part of the AOSP. Very interesting (and not in a good way)
Even if the Windows voice experience put Jarvis to shame, I wouldn’t be interested. I don’t want to use voice control on my computer. Just about the only time I actually need voice control are when I’m far away or my hands are busy; so it’s nice for turning lights on and off when I have my hands full, or controlling timers when I’m cooking, or turning music on without getting up from the couch. Sometimes I’ll use voice-to-text if I have a lot to say or need to think it through. But I almost never want voice control (even if it were completely perfect, which it is not!) for the same reason that I listen to podcasts on earbuds: I don’t want to bother other people! Certainly not while I’m working, and definitely not when it’s liable to take agentic actions for me.
Buttons, knobs, levers, sliders, keys—all of those are better than voice control 999 times out of 1000. I don’t even like touch screens that much, and I’d prefer them over voice control.
The Microsoft executives inhabit a different reality than I do.