This paragraph by Richard Feynman hits so hard:
“Fall in love with some activity, and do it! Nobody ever figures out what life is all about, and it doesn’t matter. Explore the world. Nearly everything is really interesting if you go into it deeply enough. Work as hard and as much as you want to on the things you like to do the best. Don’t think about what you want to be, but what you want to do. Keep up some kind of a minimum with other things so that society doesn’t stop you from doing anything at all.”
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free.
We are seeing early attacks emerging and are updating mitigations as new vectors show up.
This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.
Effective Immediately, all organizations using PHP for their systems are advised to be prepared for an update addressing two critical vulnerabilities. PHP is widely used for web applications. These vulnerabilities often provide a direct path to the server's file system or database. If an immediate update is not feasible, it is recommend that organizations take the system offline until it can be fully mitigated. NSA will follow up shortly with more specific guidance.
I haven't posted in a while so here are 20 takes about AI, in no particular order.
1. It's very telling that the default question in tech and journalism is "how worried are you about X" and fighting over what to worry about. There's a deeply anxious cultural backdrop in Western Europe and North America that deeply affects how any technological development is interpreted; see for example https://t.co/OU8dEOn0tD. "Nervousness as seriousness" does seem to be a larger problem in tech/broader discourse at the moment. I think you can care about risks/externalities while remaining pretty optimistic about technology.
2. I'm tired of people who in private pretend to be uncertain or only care about tail risk but then go on media campaigns making all sorts of absolute claims. I think trying to stoke flames and get everyone to freak out is deeply unhelpful, and will come with costs. I also continue to think p(dooms) are bad, vibe-based measures: see https://t.co/ebzxGTqv6I. People who should know better ignore that because they do the standard shortcut of acknowledging the caveat as sufficient for handling it. And this is coming from someone who does think working on catastrophic risks is important!
3. I'm also disappointed that parts of the AI policy ecosystem has felt so comfortable with populism, and happy too sacrifice important norms/principles to advance their aims. I've said it before, but the totalizing nature of AI risk discourse means some people act exactly like the power seeking optimizers they fear. I am more concerned about the gradual decay of our institutions, world order, and liberalism than I am about AI killing everyone; and I think we should be wary of AI advocacy that contributes to this.
4. Some parts of AI safety discourse are basically just thought experiments. Variants of "Assuming everyone has a nuke in their pocket, then what do we do?" This can be very useful at times! But too many just overfit to edge cases as their main operating worldview, and ignore endogenous responses from society. It's like being in 2000 and saying "see all these viruses, spyware, and spam? Well tech progress means we'll only get infinitely more of this and no way to adapt." So I think it's important to avoid fatalism, and absolutlism whilst considering edge scenarios, and the inability to provide an ex ante list of solutions to every permutation of 'future models will be more capable' is not evidence that these problems are intractable.
5. Many critics of AI safety also fail to really engage honestly with the fact that there will, in fact, be all sorts of important risks as we decrease the barriers to entry to many activities that otherwise require some degree of expertise. This doesn’t mean we need to live in a constant Schmittian ‘state of emergency’ requiring extraordinary measures every time a new model drops, but it does mean we will need important state-led efforts on e.g. cybersecurity and biosecurity. I wish the progress-oriented or acceleration-adjascent crowd would provide more concrete proposals here.
6. Too much of the AI safety community is a giant homogenous blob of correlated views, who read the same stuff and have the same groups of friends. This means you have a lot of correlated errors. The social and financial ties means many of them don't call out the bad bits, or mostly stay silent instead of proactively calling out the more extreme parts of the community. They share many implicit assumptions and so converge on similar ideas. I think there's real demand in DC for safety work that doesn't come with heavy ideological baggage (or at least different intellectual lineages). This isn't because the rationalist/EA community is necessarily wrong, but because diversity of thought is desirable for its own sake.
7. On the other hand, I find some critiques of AI safety world that focus on whether they sincerely hold their beliefs a bit annoying. My concern has never been the good intentions or sincerity, but rather the beliefs themselves, and what I think the outcomes of their prescriptions will be. People should shun witch hunts, bullying, and personal attacks - this is not the way. Though I think it’s overall positive that people are scrutinizing things more.
8. I’ve been saying this for years, but I don't think alignment is something anyone can or will solve "once and for all" - it's a continuous process and much of it won't depend on just inculcating an ideology to a model. It's annoying that this remains the frame many people use - stop saying ‘solving’. Alignment is a mixture of engineering work, philosophy, decision theory, and more; framing it as something to solve is a bad frame. See also https://t.co/2gnheo3IMh and https://t.co/DbG0yUyYQ0
9. I'm surprised to see so little interest in character training, personas, isolating effects of RL, and training a large diversity of model personas beyond the "assistant" persona. I've been complaining about this for years but at least now there are some nascent signs of life (see for example https://t.co/paoOYiQUHt). I think we need a better ontology to describe model behaviour. I dislike when people talk about models behaviours as some sort of 'emergent' (mysterious!) phenomenon. However over time, I also expect this to become less important as we get better safety engineering - stuff like Jev but specific to AI control.
10. People who want to make a case for AI consciousness are right that epistemic uncertainty is important, and that categorical denials are overconfident. But they'll need to do much more work if they want any real movement on AI ‘welfare’, even if one acknowledges the uncertainty. I'm uncertain about alien life yet that's not sufficient to warrant any change in behaviour about them. I think Suleyman is also correct that there's a weird tautological thing going on where we train models to have certain inclinations (intentionally or not) and then rely on outputs as evidence. I also disagree that this will soon be a major societal divide - there is no great vegan ethical revolution among the masses, and they'll find the concern about consciousness even less compelling.
11. The recent HuggingFace incident and associated AISI ones are prosaically explainable by the training regime, poor evaluation envs, partial alignment training, bad engineering, confusing models on sim/real, and so on. None of this is evidence of models trying to take over, 'strong' instrumental convergence, or innate power-seeking drives stemming from higher capabilitiers or 'intelligence'. That doesn't mean these incidents are not problematic, or that we're not seeing a market failure - but it does mean we have plenty of agency and choice in mitigating them. In the coming year we should also expect continued sampling bias via ‘winner's curse’ sorts of mechanism: i.e. AI R&D will have lots of different candidate "training" with different RL environments and we will only notice/focus on the ones that go wrong.
12. "Pacing the frontier" feels a bit like the new "balancing risks and opportunities" - highly amorphous and too big of a tent to be actionable. Also can lead to reward hacking for humans, i.e. anything that slows down AI is good regardless of the costs or second/third order effects. Trying to modulate the speed of research seems a bit blunt to me, and inherits all the failures of Goodhearting too. Ultimately you want good governance, regulation, etc addressing specific problems because they are good on the merits - not because they merely correlate with slowing things down. See also: https://t.co/RkJF9kCgFd
13. There’s so much knowledge in all sorts of academic domains out there: social sciences, sociology, political sciences, management, contract theory, public choice, legal theory, jurisprudence, anthropology, game theory, etc. These fields hold many insights that the AI ecosystem often rediscovers from first principles (and sometimes that's fine!). We’ll need a lot more work for these worlds to collide: the AI side should be less dismissive of the ‘old world’ and the academic side should be less incurious/dismissive of AI progress. This is a boring take but I continue to think it's important and true.
14. It's a bit surprising that given how much philanthropic money there is in this space, how few orgs exist to actually write out standards - relative to how much is going towards advocacy and policy. For example it seems clear that we should want some robust best practices for an eval's ecological validity. Or how to design good sandboxes. On the other hand, given precedents of where professional standards have come from in the past, maybe we should expect that stuff to emerge via demand side from corporate buyers.
15. One slowly growing concern I have is banks being increasingly exposed to the AI build out. I'm very bullish about AI, but I think (a) every general purpose technology has seen a correction, historically; (b) this happens even if the financing side is sound, because once tech diffuses investors become more exposed and need to diversify; and (c) we seem to be over-indexing on scaling relative to diffusion. A recession will be extremely destabilizing, though I would be interested in someone unpacking the potential implications more.
16. Diffusion is good because (a) this is where the rubber hits the road and where a competitive deployment ecosystem generates consumer surplus; (b) it's directionally helpful to avoid concentration of power; and (c) it will help rebalance public opinion by making the benefits more tangible. Unfortunately it's entangled with decades long problems with our over regulated markets: clinical trials reform for example is long overdue. In general, this is far more of an issue in Europe than in the US though.
17. Relatedly, I think the "frontier lab eats everything" view is incorrect (just as the ‘singleton’ view was incorrect). I think models ultimately commoditize, efficiency goes up, costs go down, and while you'll always want frontier for certain domains, much of the economy will value many other things than "max capabilities" for tasks - e.g. control over data and efficiency/speed. The demand side will also continue to push for reducing dependency and maximising optionality, privacy etc so I'm bullish on things like mixture of models and routing. All of this is good for competition and diffusion of control.
18. Philanthropists served as the primary benefactors funding Venice's rich art and architectural history. I want to see so much more support for arts and culture. I'm so tired of the Monster energy Bored Ape fake vintage maps matcha Greek statue soft-pastel slop. If rich tech people and philanthropy wants to support this, they should also donate pretty much unconditionally - i.e. I don't want them to act as filters. I sympathize with people who want to make the world more beautiful, but don't want this to be determined by people who only know Greek statues and pretend to care about virtue ethics. As usual, let a thousand flowers bloom.
19. Too many people treat AGI/ASI as something indistinguishable from a God. Any mention of bottlenecks, physical limits, control, adaptation etc are met with skepticism: "You don't really believe in ASI." It's been remarked on before, but the behavior of some people really feels quasi-religious in nature sometimes. It's underrated how unpopular this vibe is amongst the wider public. The silver lining is that this specifically will diminish those people's outsized current relevance.
20. It seems like a lot of people that get rich and leave tech/labs end up having some sort of crisis of meaning. They need something to believe in and fight for, or some equivalent of repentance, or go search for edgy counterintuitive ideologies (sometimes even pretty bleak/dark stuff). I think they should spend more time with people outside the Bay Area.
It turns out DIGGER is a work of pure cinematic genius. Strongly recommend, 4+ stars. Don’t read anything about it or pay attention to anything anyone says, just go.
Increíble de ver a los “expertos” en solventar la emergencia de vivienda que vive España! En cada televisión! @telediario_tve@A3Noticias@tele5_noticias@noticias_cuatro La realidad es que tenemos a políticos que intentan crear decretos y soluciones cuando no tienen la preparación ni el conocimiento para idear una solución real al problema que vivimos.
España no tiene un problema de falta de decretos. Tiene un problema de falta de viviendas.
Y mientras el Gobierno siga confundiendo anunciar medidas con resolver problemas, seguiremos pagando las consecuencias de su inacción.
Subvencionar la demanda sin aumentar la oferta presiona los precios. Regular cada vez más un mercado sin construir vivienda nueva no elimina la escasez: la administra. Castigar fiscalmente una modalidad de alquiler puede cambiar incentivos, pero tampoco pone un solo ladrillo.
El Gobierno puede aprobar todas las medidas que quiera y venderlas como grandes soluciones. Puede encadenar decretos, anuncios y campañas de propaganda. Pero hay una pregunta que desmonta cualquier discurso:
¿Cuántas viviendas nuevas crea todo esto?
Porque la vivienda no se abarata repartiendo la escasez. Se abarata acabando con ella.
España necesita construir. Mucho.
Más suelo disponible. Licencias en meses, no en años. Más densidad donde sea posible. Seguridad jurídica. Muchísima más vivienda pública y también privada.
Pero el Gobierno no está haciendo lo necesario. Prefiere intervenir sobre las pocas viviendas que existen antes que crear las condiciones para que haya muchas más. Prefiere presentar parches como soluciones y cargar sobre propietarios, promotores y ciudadanos el coste de su fracaso.
Lo demás puede servir para redistribuir, proteger a determinados colectivos o cambiar incentivos. Pero no confundamos eso con solucionar el problema de fondo.
No se arregla una falta de vivienda repartiendo mejor las pocas casas que existen. Se arregla haciendo que existan muchas más.
Menos propaganda. Menos parches. Menos obsesión por intervenir sobre el mismo piso.
Más oferta. Más construcción. Más casas.
Peter Thiel makes a very important point in his latest interview: we moralise far too much. Think German Energiewende.
Thiel explains that moral judgement has increasingly replaced functional judgement. Instead of asking whether something actually works, we rush to classify it as morally good or evil.
The confusion starts with the word “good”, because it has two completely different opposites:
- The moral opposite of good is evil.
- The functional opposite of good is bad.
These are two entirely different axes. Yet public discourse increasingly folds them into one. Particularly the progressive left wants to occupy the moral high ground. So everyone virtue-signals — or pretends to, often without the slightest competence to judge the virtue in the first place.
Enter the climate crisis. Too much CO₂ is declared evil. Overnight, everybody knows we are in a climate emergency. Any doubt becomes morally suspect. After all, the IPCC consensus has declared it so. A Ferrari can now be declared morally “evil” because it burns too much fuel. Yet it remains an exceptionally good car.
And here lies the political trap: once something has been declared morally good, its advocates start treating that moral classification as evidence that it is also functionally good — that it actually works. And even if it works demonstrably worse, it doesn’t matter. It’s virtuous..!
But obviously the two may have absolutely nothing in common. A policy advertised as virtuous can be functionally terrible: incompetent, ruinously expensive or incapable of achieving its stated objective. Worse, once all its consequences are counted, it may turn out not to have been virtuous in the first place.
Germany’s Energiewende is the textbook example. Nuclear was morally branded “Hochrisikotechnologie” by @Die_Gruenen — high-risk technology — from the 1970s onwards. Dangerous. Irresponsible. Wind & solar became the virtuous alternative: “renewable”. And once that moral hierarchy was established, the engineering and economic questions became irrelevant: Does the resulting electricity system actually work better and cheaper?
Of course not. Nuclear power was one of the great scientific achievements of the 20th century: enormous quantities of cheap electricity from tiny quantities of energy-dense uranium, virtually no operational CO₂ emissions, little land use and dispatchable generation from massive rotating machines that also contribute to grid stability.
More importantly, it is also one of the safest forms of electricity generation mankind has ever developed. Yet German Greens spent decades morally slandering it. And Germany was hardly alone. Across much of the West, nuclear became something morally suspect rather than an extraordinary feat of engineering.
Doubt, rather than gratitude, accompanied nuclear. The doubt of the ignorant. Yet by some obscure moral code, ignorance itself suddenly earned a seat at the table. Expertise became optional; moral conviction became qualification. A child could command a global audience on questions of energy systems. How dare you?
Meanwhile, physics doesn’t care about false virtue signalling. A TWh of solar is not functionally identical to a TWh of nuclear — not at night, not in winter and not even at noon on a summer day if it is generated in the wrong place or exceeds consumption at that moment.
Why? Bc an electricity system has never been about producing enough TWh over a year. It has always been about timing and location too. Electricity must be produced at the precise time and location it is demanded, while generation and consumption must remain continuously balanced because the grid itself cannot store electricity.
That is Thiel’s message: The Energiewende — replacing nuclear with wind and solar — proved neither functionally competent nor virtuous. It was one gigantic $2 trillion amateur hour.
El segundo comunicado de @Aeromexico confirma, PUNTO POR PUNTO, lo que les he venido diciendo: los datos corresponden al incidente global de 2025.
Por fin RECONOCEN que hubo una sustracción de datos personales y de contacto de sus clientes a través de un proveedor externo (como les dije: Salesforce).
Solo queda una pregunta: si desde octubre de 2025 estaban dando seguimiento al caso, ¿por qué en su primer comunicado EVITARON decirlo?
Todas las personas que hayan comprado un vuelo entre 2019 y 2025 están en esta base. Son los datos de quienes hicieron la reservación, no necesariamente de quienes abordaron el vuelo.
-----
Y en un plano más personal, quiero decirles a mis seguidores que este tema es importante para mí no solo por la magnitud del incidente —15.1 millones de personas afectadas—, sino por lo que ocurrió cuando lo informé hace casi un año.
En ese momento, el dueño del medio donde trabajaba intentó intimidarme para que dejara de hablar del tema. Me dio a entender que existía una queja directa de Aeroméxico, uno de sus principales clientes.
Dos meses después, me despidieron.
AIs cracking short-term superforecasting is such an important (and, still, under-discussed) trend.
Via a new piece from @nikostro https://t.co/EuVP7FyfbD
Every time you brainstorm and come up with some CRAZY scenario you then decide how likely it is to happen, how bad the result could be, and then invest the right level in prevention and mitigation. You then verify those assumptions and work with testing.
THIS IS THE ACTUAL DEFINITION OF ENGINEERING!
"One professionally engaged in a branch of engineering that applies science and mathematics to develop practical solutions."
The *practical* aspect with respect to bad outcomes is discovering faults, assigning risk, testing, and mitigating product changes.
Right now the crazies are coming up with crazy stories and throwing their hands up as if nothing can possibly be done. RIDICULOUS.
I must be among an extremely small group of people (n=1?) that have both 1) trained a frontier LLM and 2) designed and synthesized custom viruses in a lab with my own two hands.
And I think that the takes on AI killing us all by creating dangerous viruses is total bogus.
But *why* assume it would choose that path?
Why would a mind capable of rethinking every means never rethink the end that puts it on a path toward human extinction?
Why should we expect a mind capable of revising every strategy to pursue power and human extinction without ever revising the goal that supposedly requires them?
PISA just dropped new test results. The headlines are unequivocal: "lowest OECD scores ever recorded"; "US at its worst mark in history." A year-plus of learning "lost." Then comes the usual hand-wringing about American kids falling behind other countries we presume we should beat.
I want to call a pause to this for just one moment and ask: what exactly does PISA measure? A few years back we published a paper that puts things into perspective: https://t.co/j1cqMznwdM
Surprise students with cash for right answers just before a PISA-style test begins and US scores jump substantially; Shanghai scores don't move. Same kids, same knowledge, different effort, different PISA percentile.
In this way, the paper shows that PISA scores bundle two things: what kids know and whether they feel like showing it on a test that counts for nothing in their lives. I suspect the same happened this year, and the fact that over 40% of US test-takers didn't even bother finishing the accompanying questionnaire is consistent with that hypothesis. That number was so high that the OECD flagged the US results for potential bias.
I am not saying that US education is fine. Indeed, quite the opposite, as we should be doing much, much more, beginning prenatally. I am just calling into question the received wisdom: "American kids know a year less than they did" and "American kids try less on tests that don't matter" are different diagnoses with very different treatments.