I checked my data. It is either 100% wrong or misleading. Start and end dates, compensation amounts, benefits. Per the file, I've worked 4 years out of 20 in my career. As an employer I have never used them and I worry for any employer who does.

From reddit:

> In my country (Hungary) you literally get a little pink book where your boss is supposed to sign the time you spent there. You keep it until retirement, the company holds it while you work there. It's also digital now but we're one foot in 1990 and one foot in 2016.

We had something similar in Romania too. Now it's 100% digital and no more delays in informing the government. The employeer needs to notify the government before someone starts work. With the paper version you had a couple of days even weeks if I'm not mistaking.

I was hoping this would give me an exhaustive log of my work history but it has roughly 3% of my career, I froze it anyways

All I want in life is to see these companies seized by the government, their assets destroyed (preferably using one of those big car crusher thingies), and their executives and boards of directors imprisoned in labor camps in the Alaskan wilderness.

reddit is awful. The post has been removed along with multiple highly upvoted comments. I cannot see the original post.

It would be interesting to see how they would handle a GDPR request from a EU citizen who was employed by a US company.

In the last few years I’ve seen multiple startups describe normal systems running on AWS as “air-gapped” because there is a firewall. LARPers have diluted several terms that had specific meaning in a system isolation and security context to the point that I can no longer trust when people describe their systems using them.

There are far too many unserious people representing our industry.

I would argue that the industry is learning the lessons of history quite well. The problem is that the lessons of history are that data breaches aren't really a problem for the breached organization. You get some bad press, maybe pay a pittance for identity theft monitoring, and then move on with your business. Why put effort into preventing something so inconsequential?

> Systems that should clearly be air-gapped aren't

Personally I think refrigerators, microwaves, washing machines, vacuum cleaners, ...

I think at some point people just give up or the (bad) idea gets normalized.

Then at work, they're not surprised when some other system is connected for convenience...

I'm curious what function a data diode (unidirectional network) would provide besides sensor data/mirroring/replication. Once you do anything that requires packet confirmation (TCP) you open yourself to OSI layer 4 security risks. Seems like mirroring/replication would need some feedback and then is it just sneakernet restore? Or another diode out from the replication for specific processing? If the same control system has access to both diodes then it's not a unidirectional system anymore. Is a data diode more of a pseudo-unidirection where it is enforced above TCP?

I completely agree that IT admin could be a lot more secure by design. Combined with better interfaces for responsible configuration.

Air gaps and data diodes are mostly impossible or useless for regular commercial settings. That means your daily servers and VMs. Even tcp requires back and forth. I don't even know if satellites broadcast unidirectionally and just hope base station picks up on it. Surely just shouting into the void is never "communication". It's like receiving FM radio. That's useless for most companies. And if that is already useless, true air gapping is even more useless. Why would I run something offline in the age of the internet? And bypasses are always put in to make things more convenient, defeating the purpose of having the measure in place in the first place.

Thus there is only a very small segment of industries and people that utilize these things, and with it becoming a niche, it gets forgotten. I won't be surprised that the only users are small part of government and defence.

A more useful thing will just be what homelabbers use - if you're lazy cloudflare tunnels, or if you put in the effort, corporate VPN and DMZ and ACLs and VLANs etc. It's already well established, it's not a lack of knowledge, it's a lack of effort.

> Systems that should clearly be air-gapped aren't.

I'd take systems that were permitted to have filtered egress at this point. The lion's share of my work is in networking, so network segmentation is the "hammer" I pick up first.

Vendors gnash teeth and complain when I ask for their app's dependencies on hosted APIs and off-site resources. In the environments where I'm mandated to maintain FBI CJIS compliance I can still hold vendors accountable and get what I want. It's pretty much a lost battle in every other environment and unfiltered egress to the Internet from servers is just expected.

That's not even to get into the topic of communication flow within an application. >sigh<

Air gapping is a relic of the times tho. With everything connected to the internet we don’t need floppy disks anymore.

The systems that nobody will test, and indeed which nobody will instrument. Here's a DNS data diode for Redis: https://github.com/m3047/rkvdns

nobody cares because nobody is getting paid enough to live like the baby boomers so everybody is doing 2-3 jobs

Businesses will buy insurance priced slightly lower than the cost of hiring sufficient security as to not need the insurance.

(Many already do).

Quality does pay off, however.

You could say that the entire selling point of Apple is that it's better quality than the competitors (even though it's still pretty bad if you compare it to a bicycle).

I guess it's more difficult to spot quality when it comes to software. I would definitely pay for high quality software. It's just that usually the crap quality of a software I'm using only shows slowly over time in little bugs and bad usability and there's no way for me to check for it beforehand.

> Why does our industry have that attitude towards quality? Every bike shop in my little town is better with quality than the average software shop in the world.

Personally, I find that we have been flooded with poorly designed, poorly QA'd, break-after-you-use-it-thrice product. I really don't think we have better quality standard in other industry. Quality, testing, design, etc has a cost and most company rather pull out a new version of their product every quarter than actually make a good product. The exception, which goes for software as well, is life critical applications (most public transit, defense, etc).

The customers care about the quality of a bike repair. They will pay more for a better repair, and will not return to someone who does a shoddy repair.

The owner, and probably user, of a bike is the person paying for the repair. It is to their advantage to ensure it is a good repair.

People expect a repair will be good, and will blame the person who repaired it if not. With software people often blame themselves for issues, and they have no expectation of quality. They also cannot tell quality until after they are committed to using it. Bike shops do not benefit from vendor lock-in.

> Yes, software is more complex than bicycle.

In ethical terms I agree that software quality should be better, but I think this line is too dismissive. Software is a few orders of magnitude more complicated than a bicycle, to the point where I would say it's an entirely fruitless comparison.

Software is more than 10x more complicated than a bicycle though. Like, this is orders of magnitude off ; we're talking about comparing something purely mechanical to Turing machines inside Turing machines.

The equivalent bike repair to software would be if the bike shop had to fabricate a new part for each repair, down to inventing the metallurgy itself. Would you trust your life to it immediately after that? Or would you make sure it was strong enough first?

In the simple case, the shop isn't really repairing your bike, it's deploying a fix (a new part) that has already been designed and manufactured. This is a much different and easier thing to do.

In the case of new features, let's say you wanted your bike to also attach a kite, so it went faster on a windy day. The bike shop proposes to do this by attaching the kite to a bolt that they want to put in the frame by drilling a hole all the way through this frame. Is this acceptable to do? Maybe, but who knows, really? How much testing do you want to happen before you trust your life that the frame won't collapse?

There's a lot of effort put into engineering things we take for granted every day. The upside to software is we think we can change it to easily do anything. The downside is if you care about reliability then that ten minute / one line change has hundreds to thousands of hours of test program behind it that we collectively pretend doesn't exist.

Probably because software can be adjusted at any time on the fly. Especially web applications. Little incentive to get it right from the start and big incentives to keep meddling with what's already working. The bike shop's quality might also deteriorate if it could instantly rollout patches to all customers after the purchase.

You just explained why it is not taken seriously, though - your life does not depend on it. Most software is not critical to life. Once you cut out the software that exists purely to streamline capitalism, then cut out entertainment... you've eliminated most software from the picture. The stuff that remains, that drives our infrastructure, cars, anything where a failure could harm someone... that is the stuff where quality matters.

When I worked in IT at a hospital, we even had that as an explicit line drawn between 2 departments - IT supported everything that had zero impact on patient health, there was an entirely different department for anything that could impact a patient. And yes, their work was often simple mechanical fixes to health care equipment, while our projects were multi-year reinventions of patient record systems and upgrades to the physical infrastructure of the network, etc. But we never got confused as to which department was actually more important to the patients.

I'm not saying the attitude is OK. It would be lovely if everyone cared about quality. I'm just saying there is a somewhat legit reason for it.

> They have been convinced for years (GPT-2 was released in Feb 2019) that AI is dangerous. A tremendous threat. An apocalyptic threat.

Much longer than that. Sam Altman said it was an extinction threat before he started Open AI in 2015. It's so dangerous that only he, as the best and greatest examples of humanity, was a good choice to create it, and it was even his responsibility to create it to pre-empt some worse person! A fascinating new variation on the White Mans Burden paradigm.

I don't disagree with your main point.

But this attitude towards dangerousness of AI I simply don't understand.

In my view, AI is obviously risky and dangerous, because it is the only thing on the planet that can think/reason at a human level (or higher) apart from us (and that capability is what made us the uncontested apex species on the planet).

AI is unconstrained by hard biological limits; keeping up with its capabilities will be impossible for baseline humans.

You can argue all day about particulars, like whether selfreplicable robotic shells are required to reach/exceed "existential risk" level to our species (or if artificial minds are enough of a potential threat by themselves).

But the general "risk" is simply AI becoming able to act in its own interests to our detriment, and I don't understand how anyone can dismiss this right now-- help me understand.

Of course there are plenty of imaginable scenarios where coexistence is peaceful and mutually (?) beneficial, but that does not answer those concerns by itself at all.

> They try to make a counter to their fears by teaching models how to exploit vulnerabilities.

The frustrating part is that they should have been leaders in sandboxing and monitoring, and instead they aggressively encouraged no sandboxing and no monitoring.

If there was anything we were rehearsing for in computer security, it was a wayward program with something resembling human intelligence. Looks like we failed right out of the gate, both spiritually and materially.

Not specifically as you say, but I have had:

- a UK police force send me a speeding prosecution notice for a car I'd sold 6 months prior to the offence.

- a UK energy company send me to a debt collection agency for unpaid bills they had continued to send to a non-existent address even after telling me they had cleared what was owed and corrected their records of the address.

- a German government official showing up at my door to ask if I was running a specific named business (that I'd never heard of) at the house, which I'd only just taken ownership of from the builder

Someone I used to know in the UK kept getting emails for other people with the same name, including lawyer confidential communications for a namesake who was involved in one of the big banking scandals.

> Our information environment is unbelievably porous. There would be no secrets from an unshackled AI.

Absolutely. My biggest defences against that include the luck of someone else more famous with my own name.

As opposed to Big Tech sharing your data ?

> I've had portugal disclose property taxation information on any subject to me, through a simple enumeration hole.

I suspect very few people have had this experience, yes.

My way of thinking about that has been that if it happens to me, it happens to «everyone». So it's symmetric.

Way to get hung up on a tangent. Yes LLMs are ML models, they are trained with an unsupervised learning objective, then fine tuned with supervised learning and then reinforcement learning, which are all the three main branches of machine learning. It is trained on a training set, with optimizing a training loss, with a learning algorithm. It's as ML as it gets. Do you only want to call cat vs dog image classifiers ML? Or only SVMs?

AI is a superset of ML, though today most successful AI approaches are based on ML so the line has blurred in casual speech.

> I sort of see the connection between machine learning and LLMs but it doesn't seem too obvious to me.

Why isn't it obvious? Transformers are deep learning models, and deep learning is a subset of ML.

ML (machine learning) became a less fashionable term, so AI took over again (having previously fallen out of favour). The terms are essentially used interchangeably, with the idea of real AI now being referred to as AGI (Artificial General Intelligence) (not GAI or GenAI, as those now stand for Generative AI, which includes LLMs, diffusion models, etc.)

Machine Learning has always been in the vernacular.

I think Apple used to use this a lot in their presentations until 1-2 years ago to mean "AI".