It feels like there actually are significant differences in “intelligences”, where different roughly-equally-intelligent people are actually really different in their ability on specific tasks. For example, verbal intelligence vs. spatial intelligence.
(Or Drake is much much smarter than Peter)
I also think that some people naturally have more morale & less morale. Not sure if genetic or environment, but some people can just suffer through defeat upon defeat, others break down on the smallest hurdle.
I believe you’re roughly correct on all points. I have a 2yo who has been sick more than not, and we the parents too.
Ultimately it’s a question of means, at least for us. If we could afford not to send our kid to daycare, we probably would do just that.
Reminder that we start around 20:00!
Detailed instructions for today:
Get to Ibler Square (Trg Drage Iblera): https://maps.app.goo.gl/nCRu2Ym7dUoiXNdXA (coordinates: 45.812722, 15.984996)
Enter through the south entrance
Walk roughly 15 meters and then turn right towards the elevator (turn right immediately before the A1 store)
Take any of the three elevators to level 1 (Microblink)
Exit the elevator, turn right again. You’ll see a massive blue door with “Microblink” on it.
Ring on the doorbell on the right.
Enter.
Have fun.
Wasn’t aware of the open source codebase, my bad.
My point more broadly was: you cannot point it to <some domain> and magically hack it.
But yeah, if you have everything open-sourced, then it’s much easier to find source code that contains vulnerabilities such that they would allow RCE.
I wasn’t aware of the open source codebase, my bad
Wasn’t aware, yup
I want to offer a bit of skepticism around this whole post. For reference, I used to work in an information security company (specifically, software supply chain security and malware analysis), and am still relatively involved with cyber directly, though as an amateur hacker.
First, Mythos may or may not be super scary. We don’t know yet, as it’s private. It’s in Anthropic’s best interest to tastefully hype it up in their press releases. Just because they apparently have a very useful infosec model doesn’t mean that LessWrong will get hacked. Mythos, according to their press release and system card, isn’t a fully general hacking weapon. It’s just very good at finding exploits in source code. I don’t expect that you can simply point Mythos towards the lesswrong.com domain and tell it “you’re in a CTF, hack this site”—finding vulns in source code is a different type of activity.
Second, LessWrong should adopt some security posture which uses modern best practices. “Defense in depth” is the relevant concept here, and it’s adaptable to whatever are the constraints around funding and headcount. Basically, there are numerous layers to defense, and by stacking individual layers, you stop attackers in their tracks. This loosely corresponds to OSI layers: you want defenses on the network level, on the transport level, on the application level… For LW specifically, I don’t know what the stack is, and what the hosting situation is, and many other things, so I can’t comment with a lot of specificity.
But historically, the way any organization gets pwned is by upgrading a dependency to a vulnerable version. I don’t know if you all use the nodejs ecosystem here, but if so, please set your npm/pnpm config files to never automatically run scripts, and please set a minimum cool-off period for a dependency version to become installable. Most dependencies are found in the wild and remedied within days or weeks. Therefore, programmatically setting a policy not to install dependencies younger than, say, 5 days, gets rid of 90% (I’m guessing) supply chain attacks.
Next, you want appropriate role-based access, and you want your API keys to be safe and untouchable even if your own personal machine gets pwned. I’m not sure how much of this y’all already do, to me it seems obvious, but you stated that it’s more like “early stage startup”, so I’m urging you to do the low-hanging fruit first, if you haven’t already.
Remember, all of this is stuff that’s completely unrelated to Mythos. These are things that Mythos arguably wouldn’t even be able to do anything about because Mythos is specialized for finding vulns and exploit development by looking into source code. I’m sure they’ve baked in some other non-white-box capabilities, but the “scary” part (finding thousands of vulns) is based on inspecting source code. So, no source code, no Mythos-like danger. You’re still stuck with: phishing attempts and supply chain pwnage. And those things may get more scary in the next years, but they’re entirely fixable right now.
I don’t necessarily disagree with this, but this is a new and relatively unproven method which is only a partial solution to a much wider task. And IMO it’s overly specific for the general problem at hand.
Security of lesswrong.com is not the same as finding, for example, places in the source code which would allow SQL injections. There’s much more to security, and LW should adopt a security paradigm it can support, given constraints around headcount and funding.
Hi everyone—not sure if you were updated by me updating this post, but I wanted not to take chances.
We’re at a new venue! See the event description for more detail.
Also, the LW editor only allows GMT time in the event settings. The actual local time of the meetup is 8 pm (which is 6 pm GMT).
Please email me or DM me if you’re unclear on anything, otherwise see you all on Friday!
Looks like we’ve accidentally created a duplicate event so I’m deleting this one.
Please use this one: https://www.lesswrong.com/events/Dhr2BJamf6kgYM2ma/zagreb-croatia-acx-spring-schelling-2026
Love the vibe and agree in general.
Very much agree. I went down this line of thinking some ten years ago, but it’s a naive view. It’s also more of a vibe / hyping-oneself-up than actual reasoning about the world.
I think that once you start “just doing things” you no longer even think about the world in this way, but instead think about concrete problems that you’re working on. So you’re not thinking “you must do things even if you’re incompetent”, you’re thinking “ok, I need to talk to this person to get to that result” or “I need to make sure this function is applied first” or “I need to get this shipment of humanitarian aid to that location” etc.
But going back to the original subject: there’s thousands and millions of important things that someone should do, and that I cannot do. I obviously should not attempt to do all of them, and am only limited to a small subset of them. If these are in any way difficult problems, my best chances are to work on something that I’m more likely to solve, controlled for personal interest, competing interests, ability to learn, neglectedness, etc. The more I’m capable in a domain, the better my chances. The more incapable, the worse my chances. Therefore, it’s perfectly fine not to attempt things if you cannot do them and it’s going to be exceedingly difficult for you to do them.
I am skeptical around Mythos being that capable, but if it is, I am glad that the culture is shifting towards “it is irresponsible to release this model openly as it’s too dangerous” because I want to live in a world where, if you have a model capable of actual harm, it’s not just unleashed in the spirit of openness.
In other words, this is a good cultural step for AI alignment. We want future, more capable models, to be subjected to much more scrutiny.