I'm not exactly clear what the issue is. Corrupting the CRC at the end of the packet if you didn't want to send it was something that was talked about in the 90s. I don't know if anyone was doing it but it was certainly talked about.

Around that time, maybe a bit later, Eurex introduced discard addresses. This meant that you could start writing the packet onto the wire and if you changed your mind before you got to the destination address of the TCP header, you could write in the discard address instead of the exchange address.

There's a paper somewhere (from Eurex) showing that the tick to trade back in 2017 was 39ns. It's completely obvious from that that people are starting writing the IOC onto the wire around the time the first 39 bytes of the market data tick are received.

Obviously there are other ways of sending valid orders that won't cross the book. For example, instead of writing the discard address into the TCP header, you write a price that is way off the market into the IOC. Obviously this means you can decide later - alternatively, you can start sending earlier.

There was absolutely no such suggestion of even thought.

Do you people even hear yourselves sometimes? How do you say shit like this with a straight face?

Outside of the US, nobody is going to get a licence to sell a generic herbicide without showing that it's safe to use. This study was an important part of that regulatory process.

The presumption is that the product needs to be shown to be safe to use to get a licence, while getting a licence revoked requires showing that the product is harmful. It's not at all symmetrical.

There's absolutely no reason for google to require you to have a google account and register your phone with them just so you can install packages from the playstore.

Seriously, that's how America works? Somehow that doesn't surprise me.

In most of the rest of the world it doesn't work that way.

Firstly things are typically not allowed to be sold unless they can be shown to be reasonably safe - which this study was invaluable for.

But when suing you need actual damages to claim for and you have to show direct harm. There isn't such a thing as punitive damages. The model is to try to prevent bad things from being sold up front rather than assume firms won't do it because of the punitive damages that will be awarded once someone is hurt.

Cancer is particularly difficult to attribute to a particular source.
Technically exemplary damages do exist in the UK but they exist in very narrow circumstances.

Mesothelioma, for example, is extremely rare other than due to asbestos exposure. It is not caused by smoking. This makes it easier to sue successfully (outside of the US I guess) for damages.

In most of the world a study like this is not a defence against damages, but would tend to lead to a presumption that glyphospate was safe to use. But that applies anyway because it's regulated. More likely than not the path to damages would be against someone who used it outside the recommended ways.

Withdrawing this study is unlikely to have any impact on the probability of suing for damages due to glyphosphate exposure or have any claim against Monsanto.

Let me guess, competitors can now produce and market it. So now they need to stop it being sold so they can sell the next great thing at huge markup.

I'm old enough to remember being told that we were all going to freeze due to global cooling. Panic, oh the horror and terror!

I'm also old enough to remember and no you weren't. You were told that, absent human interference, we were in a warm period (inter-glacial) in an ice age and would be heading back into a colder period where much of the northern hemisphere developed world would see glaciers return.

Over tens of thousands of years.

Natural climate change is slow. The Earth has enormous thermal inertia and the variability in the sun's output is tiny compared to the long cycle orbital effects.

Obviously once we start talking giga-years then the Earth will be toasty warm (before it's most likely swallowed by the expanding sun).

Using the 1970s stuff on the inter-glacial we are in to assert that anthropogenic climate change is not a problem is like using the red giant end of the world to assert that it will be the end of the world.

Nobody knows what LLMs are fundamentally capable of doing.

We know exactly what LLMs are capable of doing, at least as they exist today. How they might be used to deliberately or inadvertently influence people is a different, and open, question.

There is an area where LLMs might significantly help research - and it might even be applicable to space flight propulsion, and that's bring in knowledge from other fields.

For example, there could be some quirk about the way the squids and octopuses propel themselves in the water which is known to a handful of physicists who have studied the fluid dynamics in detail but isn't generally widely known.

A space propulsion engineer asking an LLM about a problem they're working on will likely "find" this knowledge that wouldn't otherwise be obvious or even obvious who to ask.

And a real world historical example, radar chirping was classified. Bats do it. And the name "chirp" came later, after it was independently discovered and understood in bats.

But it's vanishingly unlikely that LLMs will provide any insight into a research problem to anyone not already well versed in the field and even if they do, it will be because the researchers have sifted that thread of gold from the haystack of straw. The LLM being incapable of telling the difference.

This is true - but it's also not fraud because it's legal. The only way to make it illegal is regulation and some on the NeoCapitalist side of the ledger are convinced that the only solution is less government.

OTOH, the other side of the coin, and why at least one major hedge fund has closed down, returning the capital to investors, is because it's getting hard to impossible to short where you think values are ridiculously high.

The famous case is the GameStock short squeeze. Retail investors set out to deliberately manipulate the price with the goal of forcing a liquidation of the shorts. If institutional investors had tried the same thing they would be in trouble - and possibly even going to prison - because market manipulation is one of the things that is regulated.

However, like so many things, while it was obvious from the social media noise that the goal of many of the retail investors was to manipulate a short squeeze, it's going to be hard to impossible to prove that any individual investor was doing that, especially as individual retail investors do not have the clout to do it, or even start it, on their own so you'd presumably (IANAL) have to prove collusion as well.

Yes, similar to an etf.

Perhaps a non-crypto example would be an ETF property fund.

Except the fund was formed by the investors putting in property they held rather than money.

Then they offload the ETF shares to the unsuspecting investor who trusts the value the fund has put on its assets.

I don't think it's quite that.

Normally, if I'm going to create a fund what I do is raise money from investors, go out and buy the underlying assets for my fund and then give the investors shares.

The investors get two things, access to my skill at investing, and the ability to spread their risk across the market without having to have hundreds of separate holdings.

What's happening here is, instead, the fund is being funded by assets the fund manager already holds but aren't really liquid and so are hard to price.

But once they've sold the shares in the fund, they've sold their hard to value asset for cash without having to actually find a buyer for a multi-hundred million holding or even having to properly value it.

The UK also had a veto over most of the rules that the EU introduced. I don't think it ever used it. In fact, in almost every case, the UK voted for the proposed rules. It was something like under 2% that it didn't want, mostly because the EU tends to make sure everyone is happy before even having the vote - you know, how adults agree stuff.

Pretty much. Although for many things the UK didn't have a veto but did very well out of the fact that if there was a disagreement at the "big country level" then it was France vs Germany with Britain being the casting vote.

Your 2% rings a bell - although that doesn't mean that the UK voted for the other 98%. The UK did abstain in a substantial proportion. - something like 60% of the time its vote went with the winning side, 38% abstain, 2% lose due to enough numbers on the other side.

The UK government also specialized in gold plating EU legislation. It would get the law it wanted passed in the EU and would then go over and above what the EU required while simultaneously saying to the voters "It's not us, the EU made us do it".

I know they have because I've done tests, down to confirming which hop is blackholing the data.

Genuine DNS was broken for me when a (TCP) DNS packet exceeds one MTU. I wrote a short program to send a (genuine) DNS request out and a short program to send a (genuine) response back that required multiple TCP packets and I could control the TTL on the packets being sent.

Every single hop until my router returns a TTL exceeded, so it's definitely seeing the packet. When the response packet fits in a single TCP packet, the router also sends a TTL exceeded. But as soon as the DNS packet required multiple TCP packets the router blackholes them.

I don't recall the exact details any more, it was nearly three years ago which I investigated this, but I think it might only have been the second TCP packet that got blackholed.

So the only way to get reliable DNS with DNSSEC is to make DNS queries on a port other than port 53 and have something "elsewhere" that forwards them on on the correct port.

I guess you didn't read this bit.

If you use DNSoTLS or DNSoHTTPS you're handing your data to whoever runs those so it's just the same problem with the same solution of different port. I don't actually care if my ISP wants to monitor my DNS queries but I do care that they don't work at all.

Ultimately, in my case, it doesn't matter what port you use or what protocol you use so long as it's not port 53 as the only traffic allowed to cross the modem on port 53 is (a subset of) valid DNS traffic.

I'm on CGNAT. While I understand there are ways to get this turned off, if you do you lose ipv6 connectivity.

My ISP is not the most competent[1] but it's my only option unless I go with something like 5G.

Sometimes IPv4 fails but not IPv6 and sometimes the other way around.

I notice far more quickly when ipv6 goes down. Far more websites stop working that do when I've only got IPv6 connectivity.
(Note that because of the way it fails, it's not that I lose the route, it's that the modem loses the traffic until it's rebooted so the failures are related to which protocol the connection tries to use)

[1] For example, they do deep packet inspection on port 53 (I have no idea why) but can't handle TCP packets that span more than one MTU. A query of debian.org that includes the DNSSEC information gets a response of more than 1500 bytes. So the only way to get reliable DNS with DNSSEC is to make DNS queries on a port other than port 53 and have something "elsewhere" that forwards them on on the correct port.

(And by using a resolver that sets the TTL on the response, I can confirm that it's the modem in my home that is dropping the packet, nothing else as I get the expected TTL expired messages all they way to my home.)

The other option would be to use the modem as the dns resolver. I *assume* this would work but I don't trust it :-)

If this actually does verify that there's an exploitable vulnerability and also verifies that the fix resolves it then perhaps it won't be so bad.

I don't have much experience of this but I was once working on a patch where I knew I'd got a security vulnerability (command injection via quotes in strings I needed to pass to a script) but before I worked on that (where it wasn't obvious how to do it securely) I wanted to test if the idea worked at all.

I tried chatgpt for ideas on how to resolve the vulnerability but it was "utterly incompetent", it never once suggested anything that would actually solve the issue, just different ways of writing the same issue, and, in fact, told me that the idea I had to solve it (base64 encoding the strings) wasn't supported in an asterisk dialplan. Fortunately, I read the docs and didn't rely on chatgpt!
(It's more common, IMO, for it to halucinate function that don't exist but sound just like what you want than to assert that what you want doesn't exist but it gets it wrong both ways)

It's equally (or more) incompetent when it comes to writing python macros in libreoffice. This is where you realise just how bad it is at programming, There are thousands of pages of documentation but it just ignores them completely and comes up with something "completely random and totally non-working". You'd hope that "AI" would help save time and be able to quickly send you to the right pages but it doesn't save any time at all.