I think the big takeaway here is that if you’re using Tor, or a VPN, or really the internet in general, you always need to think about MITM attacks. There are a lot of standard protections against exactly this kind of attack.

…users who ignored warnings that the SSH host key had changed…

SSH keys are one of those protections. Don’t ignore the warnings. That’s a big red flashing DANGER sign.

…block ports … used to accept various forms of encrypted email—while continuing to allow ports for receiving unencrypted email. If email services downgraded the connections…

TLS connections are another of those protections; don’t use apps or services that allow plaintext communication.

I’d be interested to know which email clients will downgrade connections by default. That is an absolutely insane thing to do. I don’t think my email provider even accepts unencrypted connections anymore.

This is scary but really, nobody’s supposed to trust Tor exit nodes in the first place. This doesn’t drastically change my comfort level with Tor. But it’s a good reminder that you need to be mindful of how your apps are configured.

Sounds interesting, thanks for the link. It’s a little over my head tbh but I’ll definitely take a closer look.

I’m not aware of any realistic way to vet published model weights like that.

It works for some open-source software, because you can download the source and compile it yourself. But most of the “open” models don’t publish their entire training set, or enough details on the training for it to be truly reproducible. DeepSeek doesn’t publish their data sets, and they probably couldn’t, legally, since they “collaborate with third-party data providers to obtain proprietary datasets”. And even if they did, it would be prohibitively expensive to train it on your own, unlike simply compiling open-source code.

The actual code for training LLMs is relatively trivial. The secret sauce is the training data and fine-tuning.

It’s still a risk. You can train an LLM to respond maliciously to a very narrow range of requests that would not be easy to spot in general testing. If you know how the LLM is used, you can target that very specifically. It doesn’t have to be as blatant as “always deny the Tiananmen Square massacre ever happened”.

Given how thoughtlessly people use AI, and how opaque some of the systems are, I think this is a legitimate concern.

And yes, every government outside America should ban the use of ChatGPT and Claude. Obviously.

Yes and yes.

I don’t think TikTok is really comparable though, unless there are somehow people using it for important government work.

Honestly, reasonable.

I mean, I sure don’t trust OpenAI or Anthropic any more than I trust DeepSeek, but that’s because I don’t have legal control over them. The US government does, and it is correct to ban tools that are controlled by adversaries.

You can’t turn it off anymore in Golden Gate. It is a mandatory download (in countries where it is supported) now.

You can still disable some specific AI-related features, but you can’t block the models entirely.

I have mixed feelings about this. On the one hand, that’s a ton of disk space, and Apple is notoriously chintzy when it comes to storage. On the other hand, I do want the default to be local-only models, and giving developers easy access will make that the path of least resistance. Most of my problems with LLMs don’t apply to moderately-sized local models.

It’s like Safari in terms of performance and battery usage, with extension support that isn’t pants-on-head stupid like Safari’s, better customization, and some advanced features. That’s all I really want.

Safari is just too basic for me to use as an everyday browser (especially on iOS).

I think the original impetus was that Safari makes it unreasonably difficult to change its search engines.

Yeah, the business model is not sustainable. They’re playing with funny money for now. There are only a few ways for them to make real money: raise prices a ton, scale back model sizes, and focus on government/military contracts (i.e. steal from taxpayers).

Oh, and enshittify. Enshittify like no one’s ever enshittified before.

They’re already starting, on all fronts.

OpenAI is raising prices like mad this year, and imposing stricter usage limits. They just basically cut the value of their $200/month plan in half while introducing a new $500/month plan. API costs also doubled for some models back in May.

Recently there was an article saying how AI costs are falling by 13x per year: https://archive.is/U0Fju . So as time goes on, they’ll likely be able to offer “similar” levels of performance for drastically lower costs, and just pocket the difference.

Today’s smaller models compare favorably with the biggest models from 2-3 years ago. ChatGPT 3.5 was a “big deal” in 2024, and now you can run a model that performs better on a decent laptop or even a high-end smartphone, basically for free. Small open models keep improving at a steady rate.

They’re indirectly jacking up prices of electronics so much that consumer-level hardware is basically frozen in time, and in some cases even regressing. Look at Microsoft re-introducing 8GB Surface laptops after spending so much marketing money telling people they had to go up to a minimum of 16GB. If I re-built my PC today with the same specs, it would cost about double what I paid a few years ago. So maybe people actually won’t be able to run anything on their own hardware in the near future. Like Uber and AirBNB and Amazon before them, they could start to look comparatively better than the alternatives by destroying the entire fucking market around them. I don’t know how long that will hold though. It can’t stay like this forever…right? Right?!?

I think it’s literally impossible in general, unless there’s some trick I don’t know. It always asks me for a login and won’t show me shit without it.

I just take my business elsewhere. Can’t be arsed with that.

17% surveyed said they paid for their own AI tools.

Extrapolating that to the size of the UK workforce, that’s around 5-6 million people.

That’s ~£166-200 per person per year, which is less than the premium ChatGPT or Claude plans, but more than the entry-level paid plans. That passes the sniff test, though I still find it kind of hard to believe.

What I really want to know is how much person-time are these people indirectly wasting with sloppy work? Because I absolutely do not believe that many people can use AI effectively. I’ve seen too much to believe that. How much of this is just morging?