If a security bug is exploited in the wild, it's an n-day if it's been first exploited n days after the publication of the bug, and a zero-day if it's been exploited before or on the day of the publication.
When a bug is not yet exploited in the wild, it's just a discovery of a bug, not a zero-day.
Originally a zero-day exploit was one that was found by crackers on the first day of release of a software product. Like finding a licence crack for a new Microsoft program on the day it went on sale.
There used to be fierce competition to find such an exploit within those 24 hours, and great kudos for those who did.
Nowadays a zero-day can apparently be found years after release, which makes no sense.
Does "publication" refer to the software or to something documenting the existence of the bug? Because I thought zero-day meant the bug was exploited the same day the software containing the bug was released, but your phrasing sounds like if you exploit a bug before the maintainers know about it then it's a negative day.
CRISPR is foremost a research tool. Calling it "extremely overhyped" without restricting it medical treatment seems disingenuous.
The CRISPR-Cas9 gene-editing tool was developed in 2012, so I don't find it surprising that merely 14 years later, there's only one approved treatment. From discovery to approval, drug development often takes 10-15 years, and often much longer for novel techniques. So I'd say it too early to call it overhyped for treatments.
Finally, I think we'll see a lot of treatments that don't use CRISPR-Cas9, but related gene editing techniques, but it'll take another 10 to 20 years.
Take a look at https://en.wikipedia.org/wiki/MRNA_vaccine#History for how long another novel technique has been in development before it became really widespread with the mrna-based covid-19 vaccines.
One of the reasons is, you don't get really good data on how something works until you start running clinical trials for it. It's all very time-consuming - having to plan how the trial is going to work, getting approval for it, finding subjects who meet the criteria (here, a specific type of cancer at a specific stage probably) and sites near them willing to work with you, manufacturing and shipping the treatments, and only then can you start gathering data. If it didn't work, you gotta start over, And it all costs a boatload of money too.
Let's see... first of all, 14 years ago was the discovery of the base mechanism, not of specific treatments. So specific treatments need to be developed, delivery systems need to be developed, side effects reduced. Then you need safety tests and efficacy tests.
> mRNA vaccines are also quite different. Do they modify the DNA? Of course not. So that's already very different.
And yet it took more than 30 years after the first mRNA experiments to develop a successful vaccine. Why it should be so much faster for CRISPR & Co?
> Much like other CRISPR therapies, delivery is a critical challenge, i.e., getting the large genome-cutting enzyme to all the targeted cells efficiently.
makes me think this is in vitro so far. So, years to decades away from being available for actual treatment in humans. Still good news.
Basically the issue is often that gene therapies end up in the liver since its the livers job to detoxify, but that may cause a dangerous immune response if the immune system notices it in the liver and attacks the organ, since the person could die from the damage.
I’m assuming this has been tried, but why doesn’t nano-encapsulated mRNA (that then makes the CRISPR sequences in cells) or whatever the peptide injectors do solve the problem?
You can target an individual by injecting that very individual with something lethal.
If that's not what you want, you'd need something like a virus to spread it. But then you have to ask yourself: what if that virus mutates? The specialization to certain gene markers is an evolutionary disadvantage, so evolution will tend to make it lose that restriction. Ooops.
Old concern, but it really doesn't work that way. Genetics don't respect human ideas like "nationalities" or "borders" - the targeting you can get by selecting on singular DNA variants is coarse enough to make ICBMs look like precision weapons.
Like many things of this nature, people keep bringing it up because it sounds Very Scary and Very Dystopian - not because it's worth giving an actual fuck about.
If it's year 2126, and you have this kind of tech floating around, and you aren't equipping the entire population with artificial immune systems capable of dealing with known and unknown biological threats? You've done something wrong.
Apple tries to market its product as privacy-focused, yet the privacy of their new AI features is so bad they don't meet EU standards? Is that the message here?
It's the inverse problem. EU wants anyone to be able to install a different AI agent onto their phone with the same access as Siri. Apple says "no- we need time to figure out how that would work, we want other agents to meet the same privacy standards of PCC/on-device that Siri uses". Which EU said no.
I don't think there's a clear good guy/bad guy here.
This conflict applies to many tools that require high privileges:
* If you allow the user to grant those privileges to third-party applications, they can grant it to applications that abuse it, resulting in security and privacy risks. You might even be blamed for allowing them access (e.g. the famous Cambridge Analytica scandal).
* If you don't allow the user to do that, third-party tools won't be able to serve those needs, which can be considered anti-competitive preferential treatment of your own tools.
"Castor" was the name of a storage system used for transporting nuclear waste in Germany. There were quite a few protests against shipping nuclear waste through the country.
Wouldn't have been my choice for a software project :-)
And to keep this thread, I think our three languages should count as one, because at least 20 years ago, it was quite common to have Portuguese, Italian and Spanish mingle in several activities.
As a side note, I wonder when we'll hear the first reports about employees reselling (parts of) their token budget.
Probably not worth it risking your job for a 200$/month good, but at 5K, I'm sure some folks will be tempted. Especially if companies do stupid things like token usage leaderboards.
- Test commences prematurely when people are still around
- Test is aborted partway through but then spontaneously resumes when people have started coming back
- Error in design or failure of hold-down structure turns static fire into dynamic fire, moving fire to where people are
These are unlikely, of course, but they are the things we have to seriously think about and try to design out of the system in order to create safe systems.
No one should ever be that close, but it's a worst case scenario within the realm of possibility (people do get themselves into danger sometimes, for example by wandering onto a railroad track when there's a train approaching). I don't think it's unreasonable to reserve the 10 on the 1-10 scale for 'loss of human life'.
I mean, there was that one static fire recently where the rocket broken loose and started flying. This was not for from a populated area. Ok, maybe that was pretty criminally negligent.
Is it, though? Most Ferraris aren't driven much at all. In fact, most Ferraris are bought by collectors. If somebody has 10-20 Ferraris, do you think they drive them much? In Parallel?
* Chances are that fewer people (maybe even none) will look at the code when it's LLM-generated
* Amount of code being written isn't all that critical anymore
* Keeping patches small isn't that big of a deal anymore (because it's now the LLM's job to maintain it, not the human's)
All of this implies: boilerplate isn't a good reason to avoid a language anymore. (I hate this conclusion, because I hate boilerplate).
Then the question is: what kind of language can you use that buys safety with boilerplate? Probably a statically typed one, possibly with lots of asserts... Eiffel? I don't know if there's enough Eiffel code around the Internet to train LLMs, so maybe a more popular one would be better.
Maybe Java or C#? Haskell? OCaml?
The article suggests golang, and I think there are use cases where golang would be a good candidate.
It would be quite interesting to run an experiment: give separate instances of the same LLM coding agent the task to implement a specific application, and use different languages. Then compare quality, code size, runtime performance and token cost. Ideal would be a multi-stage development that better simulates a real development workflow (bug reports and new feature requests come in over time).
Excessively verbose syntax to express concepts is something I can let an LLM paper over, but a language that does not even function properly without the ceremony is still a non-starter. I want to refactor chains of operations without having to check for errors myself after each step, and I want that with or without an LLM.
If a security bug is exploited in the wild, it's an n-day if it's been first exploited n days after the publication of the bug, and a zero-day if it's been exploited before or on the day of the publication.
When a bug is not yet exploited in the wild, it's just a discovery of a bug, not a zero-day.