That isn’t really true. Let’s say I have a service where I sell dirty filthy smut. You want that dirty filthy smut. I require you to set up an account. So I know what account name you have picked, if it is “WankerWeasel” I can guess that it is the same WankerWeasel as is on SlashDot and maybe other places, but that is a guess. If I look at the IP address you use to connect to my web server I can assume I know roughly where you are, although Private Relay makes that a pretty bad guess (I’m in VT and everyone that looks at my Private Relay IP address is going to think I’m around 400 miles away in MA. Which doesn’t make me “hidden enough” if I don’t want it known I’m in the USA, but hey, Apple didn’t promise me that, plus the farther they drag the traffic the more latency gets introduced). In the future when you use the passkey again I’ll know it is the same identity as was used before, and very likely the same person. I still don’t know if you are the same person as is on SlashDot. I definitely don’t know what state you live in, or if you are in the EU what country. If you are on a smartphone I probably can’t figure out your movements if you use Private Relay unless the passkey continuously leaks the address (i.e. in future verifications not just creation), and even then I’ll only see it on login. If Private Relay also covered that traffic I wouldn’t know any thing about your travel habits.

So sure you making an account gives me some ability to track you, but not really much to correlate you to any other existing data I might want to link yup so I can leverage my vast store of citrus treat preferences to advertise at you at a higher success rate. Folks always looking for ways to blame Apple

Yeah, they are (now) the big guy on the block, so many root for failure, and point and jeer. Plus on slashdot they are frequently seen as the enemy of open source even though they do frequently contribute patches back to various things, or entirely open up works they do internally.

That said this is an Apple screwup. I’m pretty sure it was an accident not an intentional privacy leak so they can “look good” but still gather privacy data. It is at worst a bug someone noticed prior to release and it got filed as a P1 or a P2 and got demoted to a P2 or a P3 so the product could ship, and once shipped rather then being treated as a “fix ASAP” it got treated as “that can’t be a block ship bug by definition, because we shipped with it, so P2 at best, why should we block a future product for a bug we already shipped?”, so it is sitting in someone’s radar backlog and it hasn’t gotten fixed despite being fixable (maybe the private relay folks and the passkey folks have a disagreement on how to fix it, but it doesn’t seem like it is a hard fix, either have passkey ask PR how to route traffic PR can’t recognize as “web traffic to reroute”, or PR has a mechanism to mark non port 80 port 443 traffic as something that PR needs to reroute and passkey isn’t using it, but should -- maybe it is a little deeper, maybe PR doesn’t have a way to encapsulate non http(s) traffic and passkey’s protocol isn’t “enough like” http to work, so a general VPN needs to be used, and Apple’s private relay partners are not up for general VPN, and Apple hasn’t solved the busness side of that yet, not even the minimal “only VPN a few protocols from processes that have the right entitlement so it can be used on a case by case basis for things like passkey but not magically give everyone a free VPN that Apple has to pay for if they use it for bulk data”).

Well as you said FRAND is one reason private companies would fund research and then donate it to a standards body, and a “good” one.

Not the only reason though. A lot of things are driven by adopting standards. If you make your very own technology and other companies need to adopt it they tend to want to deal with standards not a single source product, so you get wider adoption by publishing “your thing” as a standard. It does basically burn most or all of the money you invested R&D, but in exchange you get to enlarge the market. You also get to be the first company that can supply a product that uses the standard. So investing money into a new radio strategy and having that be part of the next WiFi standard you are trading that R&D money for being one of the first companies with the “new” WiFi in your basement station (or sort phone, or whatever).

You also get to shape the future direction of a market. So for example (sticking to radio technologies again) if you contribute a low bandwidth low power long range mode for WiFi you can make WiFi more applicable for things like location tags.

SANDisk I think makes FLASH but not RAM, so from their point of view high bandwidth FLASH displacing some HBRAM demand is a huge win for them, any hardware that decides to use this and less HBRAM makes the market SANDisk participates in larger. SKHynix doesn’t get that same boost because I’m pretty sure they also make RAM. SKHynix however gets a boost because unlike say the other 15 companies that will eventually make high bandwidth FLASH SKHynix (and SANDisk) will be making it from day zero.

Yes, there are long running complex lawsuits about all manner of things you might think are intuitively obvious, however just because the last lawsuit was long running and complex doesn't mean the next one about the same thing will be. In theory if the prior court found that header files are public interfaces and don’t have copyright protection the next lawsuit involving copyright on header files will have the defense lawyer point at the prior judgment and saying “we don’t need to litigate this, it was clear two years ago, and nothing has changed to make this any different, we should do that again” and the judge doens’t have to do the exact same thing, but most will, unless the other lawyer has good counter arguments why it is different in this case (and NOT arguments about the original judgment being incorrect). Sometimes the “good arguments” are merely “that case was decided in Californian and we are in Texas, and the laws are different here!”.

Legal matters can be counter intuitive, but more frequently they actually make sense. Early cases about things are complex and long because the legal process tries very hard to make sure they have a good answer, and that they clearly explain the reasoning behind the answers they give, and the limits of the answer. The results of legal battles that reach a verdict are not just a judgment about how a clash between two parties will be resolved, but about how all similar cases should be resolved. Think of a verdict as something that has cached results (but in a system that can do fuzzy matching on cache lines). A settlement on the other hand produces a result between two parties but no new cache entries.

I’m a lot less sure. I would think a lawsuit could start based on object code, and during discovery get source code and continue if the source code looks similar enough. Doing a whole lawsuit on object code would face significant issues convincing a judge/jury that object code is “expressive enough” to manifest copyright. With the defense arguing that wholly independent implementations of something compile down into the same (or substantially similar) object code.

It should be “easy enough” if you think you have some highly similar object code isolated to convince a judge to allow a civil suit to start and to compel discovery of the source code so you can examine how similar actual code (which has already faced court scrutiny about weather or not it is expressive enough to receive copyright protection) is. Even there you can get some suprising results. Like can a Google Employee who was previously an Apple employee and implements the same function at both companies in basically the same way commit copyright infringement? (In something like a topological sort where the algorithm is a known art, it is entirely possable that writing it from scratch for the Nth time produces a line for line identical copy including variable name choices and the bulk of the comments even if the author doesn’t actually consciously remember prior version of the code!)

Just because code quality improves doesn’t mean the code looks like what a human writes. Currently AI code seems to not favor writing lots of functions, do it’ll basically expand out the same code in multiple places. Which I admit is also what jr programmers tend to do and maybe you can quality that as something that is code quality and will improve. You can frequently use a prompt to make it “don’t write the same code multiple times, define functions for anything repeated (maybe over a specific complexity)” & that reduces that issue.

I’ve noticed AI generated Swift tends to not use default arguments much, almost never uses custom operators, and uses unnamed method arguments way more frequently then most human written code. Sort of. A lot of example code and people showing things in forums and doing toy programs “in public” are similar which makes me guess those end up in training data sets more then signifiant works that do most of that stuff. Or I write atypical Swift, and have worked at places that do the same (in part because I get to set the coding standards at some of those companies!). At any rate I think _some_ AI code has “tells” which is largely independent form bug rate if not actually “code quality”.

As a practical issue commercial software is almost always closed code, so nobody can see the source and simply search for anything that might share code with anything they have copyright on. The open source code isopen. So if you have anything copyrighted you can search the open source to see if anything looks like it is worth filing a lawsuit over. Especially if you have a competing product. So if you are say Intel you can check to see if any of gcc is similar to Intel’s commercial compiler and sue claiming any recent declines in sales are directly related to gcc’s “blatant” infringement. Or if you have a non-compiler you can sue and just complain about common stanzas of code but not establish specific damages so it might be a less valuable lawsuit.

You could even sue if your closed source code got that line from AI as long as the employee that the source code control system claims they wrote that one themselves, and as long as your source code control system says that line was written before the open source project had it’s equivalent code (or if your lawyer doesn’t think to check those things, and the OSS’s lawyer doesn’t think to raise it in defense), so at least chances are rare that the OSS code invents the line and commercial closed source steels the line (via AI) and then claims the reverse happened.

Winner! Winner! Chicken Dinner!

Yep, even when AI generated code is human reviewed to determine that the code does what it looks like it should, and has no subtle issues (or only very very subtle ones!), you still have the huge legal issues (the exact ones you identified).

I will not write it, Sam-I-Am,
I will not offer colored ham!

Depends on how solvent NVIDIA thinks those companies will be. Also I think creditors frequently get paid earlier in a bankruptcy process (before investors at least). Maybe they have it structured like a mechanics lien where they get 100% of the loan back on bankruptcy (I don’t know if that is actually possible), or if they just huger that in a bankruptcy they will get about 80% of the loan back, so they want to make the loan as far ahead of bankruptcy as they can so they get a bunch of payments followed by bankruptcy and then they get a chunk of money awarded by the bankruptcy court (and/or maybe return of the assets?)

Ah! I think that is the one! I bet they are structured as a secured loan, so on bankruptcy the bankrupt company can either surrender the assets (the hardware Nvidia loaded you money for), and Nvidia keeps all prior payments. OR they sign a new agreement both the company and lender agree to which is then omitted from the bankruptcy discharge (i.e. the new agreement can’t be washed away by bankruptcy, so if you still owe say $3m Nvidia can stand firm on that price, or even knock a little off, but whatever is agreed to the bankruptcy court leaves it to stand -- normally, sometimes they will decide there is some sort of bankruptcy fraud going on and you are sheltering money with something like that, normally only if family or close friends are involved though), or the company going into bankruptcy can pay Fair Market Value for the property.

Nvidia might get screwed if companies going bankrupt decide it isn’t worth salvaging the AI hardware either because they pivot to a non-AI busness, or at least a busness where they don’t need Nvidia hardware (like they rent “AI compute” from Google or something, or only needed the Nvidia hardware to refine models and they decide to just run the models they already have and not refine anything).

Nvidia also might get screwed if lots of companies decide AI is BS and the fair market value for AI hardware declines.

Nvidia is also screwed if the whole AI market implodes for a similar reason.

Still it is pretty easy to see how Nvidia is taking a risk, but could “earn” way more money this way. Plus Nvidia gets the interest payments, not a bank (then again Nvidia is taking the risk, not a bank). I don’t know if it is a good idea or not, because it hinges on something I’m awful at predicting: timing. If the house of cards comes down soon Nvidia takes a big bath. If the house of cards stays up for a while Nvidia breaks even, if it stays up long enough Nvidia makes the even bigger bucks.

Actually it is debatable. Anthropic is not making money, they are burning through VC cash. OpenAI is not making money, they are burning through OPM (“Other People’s Money”) as well. NVIDIA _is_ making money selling the AI hardware to the various companies pouring money into finding an AI model+business model that lets them make money. SpaceX’s xAI isn’t usefully broken out into it’s own P&L, but if you want to bet there IK’ll bet they are losing money at the moment as well, if you take the bet and lose you owe me one fancy Starbucks coffee and pastry, if I lose I’ll buy you 5 shares of SpaceX (that is around $1000 vs your $10). Did I forget anyone? Palentier? Also OPM (VC at the moment).

I doubt Apple or Google are making money on AI either, although it is more debatable because they have a bunch of products they can bolster sales with it (people buying a new iPhone because they want something they saw “Apple intelligence” will bring, totally forgetting that Apple hasn’t delivered on their AI promises from 2 years ago yet!), or Google may sell more smart speakers “powered by Gemini” then they sold of their prior assistant powered speakers, or get more Google searches because of Gemini answers. Although I expect the searches will merely manage to better hold onto market share by offering Gemini, which is important, but defending a multibillion dollar a year Business isn’t at all the same a “making money with AI”. Google has definitly said they are cutting headcount by using AI, but I’m not sure if they actually have a productivity increase or merely an increase in code per unit time even if the volume says nothing (or is of lower quality so it produced more bugs per unit code, and more critical outages per unit codebut more volume of code fixes!)

I’m not saying that NVidia are the only ones that can ever make money at this, or that only the hardware makers will ever make money, but that is how it is right now for sure.

As I understand it Mythos’ “big leap” is not in finding specific flaws it is in chaining them together into a “bigger” flaw. So finding a minor issue in curl that lets you put a file where you shouldn’t, plus a flaw in something that assumes some file location is “safe” and it doesn’t have to parse things with an advassery in mind, plus a flaw in something that relies on that thing, and so on.

When doing that kind of security work you don’t need to find a bunch of significant flaws in each tool, just a minor flaw in places that turn out to be useful when combined with say up to 9 other minor flaws. So from the viewpoint of cUrl which doesn’t rely on a lot of other tools to provide its services nothing has changed. The pain is experienced on a wider scale like over a whole OS where there are a lot of tools any of which might contribute a minor flaw so Mythos can find way to gain “the prize” (maybe remote execution, or a privilege escalation, or both).

Maybe a better way to think about Mythos is it doesn’t have to hyper focus on one tool like “can I break into the system using cUrl?” (and is not actually any better at that question then prior AI), but it does a far far better job at answering the question “can I break into the system using up to a dozen or so flaws together out of this pool of 1000+ tools?”. I assume it may be a bit better at finding flaws in single tool if the flaws require putting more bugs together or more steps to reach the state where an existing flaw shows up, but again that isn’t the big deal. The big deal is at a system level it puts multiple sub-critical flaws together to combine into a critical flaw. (queue transformers joke here)

Is Cuda a lock in because there is a critical mass of solutions written in Cuda and people that think about problems in terms of Cuda already so nothing is really going to unseat it that isn’t a close clone of Cuda and making one of this is for some reason impossible, or is the problem that you can make something else that lets you be expressive in the imprint ways Cuda is while giving the backend the same kind of flexibility to schedule operations, but nobody else has made one that isn’t “too buggy” to use on real world problems?

In the distant past very few C/C++ complies existed, they were “too complex” for small companies to make, and now we have very few commercial compilers and a billion open source projects that are all forks of gcc or llvm (or a fork of a fork of the llvm derived clang). We don’t have a billion non-C derived programming environments though (we have a few, JavaScript is popular, and I’ll argue Java is C-derived, although removing pointers form C doesn’t leave a lot, so I’ll also accept it as a distinct environment, but if so, so is Swift, and Rust also counts as distinct...still that is only handful). It doesn’t prove a lot, but I would say even the moat of a programming language and environment only lasts so long.