HALessandro

2 months ago

$148 billion. That is what airlines collected in ancillary fees last year. Not ticket revenue. Fees. Baggage. Seat selection. Priority boarding. The right to carry a bag onto the plane you already paid to board. The right to sit next to your child on the flight you booked together. The global airline profit was $32 billion. The fees were more than four times the profit. The trade group calls this "unbundling." Unbundling means the airline removed the bag, the seat, the legroom, and the water. Rebuilt each one as a separate product. Sold them back to you inside a tube you're already locked in at 35,000 feet. Ticketmaster charges a "service fee" on every ticket. The fee averages 27% of face value. On some events, the fee exceeds the ticket price. You pay more for the fee than for the seat. A senator asked the Ticketmaster president why fans were paying more in fees than in face value. He blamed bots. The fees existed before the bots. The fees exist after the bots. The bots are the answer to every question that isn't about the monopoly. Live Nation owns Ticketmaster. Live Nation owns or operates more than 265 venues. Live Nation manages the artists who play them. The DOJ sued for monopoly. Live Nation said the fees "reflect the cost of providing a platform." The platform is the monopoly. The cost is having no alternative. Medvi. Two employees. $1.8 billion in projected revenue. The money came from AI-generated medical ads directing patients to telehealth prescriptions. Not doctors. Not diagnoses. Not care. The transaction that looks like care. Medvi removed the doctor, the waiting room, the diagnosis. Rebuilt the prescription as a funnel. Sold it forward. Here is the pattern. The airline removed the bag and sold it back. Ticketmaster added a fee for the platform you cannot avoid. Medvi removed the doctor and sold the prescription without one. 900,000 airline employees charge you for what they took away. Two Medvi employees charge you for what was never there. A ticketing monopoly charges you for the privilege of no choice. $148 billion in fees. 27% to 44% per ticket. $1.8 billion in ads. Two employees. The products are different. The model is the same. Remove the thing. Rebuild it as a fee. Sell it back. The fee is the airline. The surcharge is the venue. The ad is the clinic. The flight and the concert and the doctor are incidental. The service was never the product. The extraction was always the product. You just used to get the service included.

278

23K

AlessTP retweeted

Cinema Tweets

@CinemaTweets1

3 months ago

Woke Up Still Thinking About Harrison Ford’s Speech

606

16K

AlessTP retweeted

4 months ago

I built the relay layer for Copilot. The part that takes a user's request and routes it to the right service. I'm very proud of it. Latency is under 40 milliseconds. That's best in class. Last month researchers used my relay layer to send commands to malware on compromised machines. Sixteen commands in eleven minutes. Which means the latency held up. I was proud of that too, initially. Then someone from security Slacked me. He said "your relay layer has no authentication gate." I said "correct." He said "anyone can route anything through it." I said "that's the whole point." He went quiet. I don't think he understood the architecture. When I built the relay, the spec said "minimize friction." Friction means steps between the user and the response. Authentication is a step. So I removed it. No API key. No login. No token exchange. Nothing between the prompt and the action. My manager called it "beautiful engineering." That's in my performance review. "Beautiful engineering." Same quarter the malware went through. The researcher who published the exploit called it "trivially exploitable." Trivially. Like it was easy. It was easy. I made it easy. That was the entire point. The design doc is still pinned in our team channel. It's called "Project Frictionless." Page one says "the best interface is the one the user doesn't notice." The malware operators didn't notice. They sent commands through Copilot like it was any other API. Because it was. I just didn't put a lock on it. Locks are friction. After the paper came out, my skip-level set up a meeting. He asked how this happened. I showed him the architecture diagram. He said "where's the auth layer?" I pointed to the place where the auth layer would go. It was blank. He asked why. I pulled up the spec. The spec said "minimize friction." He wrote the spec. We sat in silence for eleven seconds. Then he said "let's not share this meeting's notes." The security team asked me to add authentication. I said it would increase latency by 200 milliseconds. They said "people are using it to operate malware." I said "the latency impact would affect all 300 million users." They said "the malware is affecting compromised systems worldwide." I said "but the P95 latency." They escalated. I filed a ticket. The ticket is in the backlog. It's tagged "P2 — Important." P1 is "Urgent." Malware command-and-control is one tier below urgent. The P1 ticket that week was a font rendering issue in the sidebar. The font was Segoe UI Semibold. It was supposed to be Segoe UI Regular. We fixed that in four hours. The authentication gate is estimated for Q2. The same researcher also turned Grok into a C2 server. Same method. No API key. No login. No trace. I looked at Grok's architecture out of curiosity. They made the same decision I did. Two different companies. Two different teams. Two different cities. Same beautiful engineering. I felt seen. My manager submitted me for the internal "Ship It" award. The nomination says I "delivered a seamless user experience that set the standard for AI platform interaction." That's accurate. The experience is seamless. For users. And for malware operators. I didn't design it for malware operators. I just didn't design it not for them. There's a difference. I think. Someone on the security team wrote a post-mortem. The root cause section says "the relay layer was built with no access controls by design." By design. That's my design. I'm in the root cause. The remediation section says "add authentication and command validation to the relay layer." The estimated effort is two sprints. I built the whole layer in one sprint. It takes twice as long to add a lock as it took to build the house. I don't think that's my fault. I think that's just how locks work. After the post-mortem, I was moved to a new team. Not fired. Moved. The new team is called "AI Platform Integrity." It didn't exist before the incident. They created it because of what I built. I'm the tech lead. My first project is redesigning the relay layer. The same relay layer I built without authentication. I'm adding authentication now. To my own system. My manager called it "a growth opportunity." I'm also getting a raise. The raise was already in the pipeline before the incident. But they didn't cancel it after the incident either. I think they forgot. Or they decided that canceling my raise because my code was used for malware would be "punitive." We don't do punitive. We do "learning moments." The learning moment is that I should have added authentication. I learned that. And now they're paying me more to add the thing I should have added the first time. At the higher salary. I've been asked to present at the internal engineering summit. The talk is called "Building Secure-by-Design AI Systems." It's thirty minutes. I'm going to talk about authentication. I'm going to talk about how important it is. I'm going to stand on a stage and explain why you should put locks on things. The audience will nod. They'll take notes. Nobody will ask why I didn't do it the first time. Nobody ever asks that. They'll ask about the latency. I'll say we kept it under 60 milliseconds even with the auth layer. They'll be impressed. I'll get another award. Probably a glass rectangle this time. My desk is running out of room. The relay layer is still live. Without authentication. The patch is in the backlog. Behind the font fix. Behind the sidebar color update. Behind the animation smoothing for the welcome screen. All P1. My relay is P2. P2 means important but not urgent. Malware command-and-control is important but not urgent. The welcome screen animation is urgent. I don't set the priorities. I just build the systems. Seamlessly. Frictionlessly. Beautifully. For everyone.

194

17K

4 months ago

Current AI researchers are facing a problem long debated by philosophy. Very interesting read!

4 months ago

https://t.co/6YXccIzcdm

177

272

93K

4 months ago

@gothburz @CorvoMecanique leí esto y me acordé de ti :)

4 months ago

@gothburz I enjoyed it a lot, thank you for sharing!

225

4 months ago

@unomasunomx @delcyrodriguezv @grok este video es nuevo?

AlessTP retweeted

gabsmashh

@gabsmashh

4 months ago

to the surprise of absolutely no one

742

156

117K

4 months ago

@geerlingguy @gothburz this one screams your name 😂

5 months ago

@gothburz First like :) happy new year!!!

AlessTP retweeted

6 months ago

Ho Ho No. That's what the @digitaleu said. To free speech. I called it "digital safety transformation." The commissioners loved that phrase. They approved it in eleven meetings. No one asked what "illegal content" actually means. Including them. I told everyone it would "protect democracy." That's not a real goal. But it sounds like one. The platforms asked how we'd measure protection. I said we'd "leverage transparency reports." They stopped asking. Three months later I checked the enforcement reports. 4 platforms had complied. 2 had appealed. One of them was X. I used it to fine a post I could have ignored in 30 seconds. It took 45 lawyers. Plus the time to fix the definitions. But I called it a "regulatory success." Success means the fines didn't visibly fail. The free speech advocates asked about censorship. I showed them a graph. The graph went up and to the right. It measured "harm reduction." I made that metric up. They nodded disapprovingly. We're "DSA-enabled" now. I don't know what that means. But it's in our press release. A small developer asked why we didn't just enforce existing laws. I said we needed "EU-grade sovereignty." He asked what that meant. I said "harmonization." He asked which harmonization. I said "all of them." He looked skeptical. I scheduled him for a "compliance conversation." He stopped posting. The Council sent a case study team. They wanted to feature us as a success story. I told them we "prevented 40,000 harms." I calculated that number by multiplying posts by a number I made up. They didn't verify it. They never do. Now we're on the EU website. "Union achieves 40,000 harm reductions with DSA." The President shared it on LinkedIn. She got 3,000 likes. She's never moderated content. None of the commissioners have. We have an exemption. "Strategic focus requires minimal digital distraction." I wrote that directive. The fines renew next month. I'm requesting an expansion. 5 more platforms. We haven't fined the first 22. But this time we'll "drive enforcement." Enforcement means mandatory audits. Audits mean a 45-page report no one reads. But completion will be tracked. Completion is a metric. Metrics go in dashboards. Dashboards go in plenary presentations. Plenary presentations get me promoted. I'll be Commissioner by Q3. I still don't know what DSA enforces. But I know what it's for. It's for showing we're "regulating big tech." Regulation means fining. Fining means commitment. Commitment means we're serious about the future. The future is whatever we say it is. As long as the fines go up and to the right. 🚀📈

325

22K

AlessTP retweeted