This is called moral hazard, and people love to worry about it. Usually though (the relevant example here is PrEP, or birth control) it's fine and enables people to live their lives with fewer risks to their, and others, wellbeing
No, I'm not talking about moral hazard at all. I'm just talking about the poor effectiveness. If it were highly effective, like PreP and birth control are, there would be no issue in my mind.
> A war with large geographic scope has been independently modeled as having a high probability of occurring circa 2030 by major governments for a decade or more
Do you have more information about this, or a source?
This has been discussed in strategic geopolitical circles for a long time. When surveying defense analysts and similar if they believe a "great powers conflict" will occur in the near future, the percentage that say yes has been rising rapidly (currently 40-50%). If you search for "probability of global war in $YEAR" you will find a lot of discussion of varying quality.
The major alignment is almost always assumed to be something like Russia/China vs Europe/US/Japan.
You can find circumstantial evidence for this in the change in military posture of many countries and rapid scaling of production capacity. Some random examples:
French General states that they are preparing for open war in "3-4 years" in 2025:
Up until a about a decade back, here in Australia/New Zealand, politicians behind door always talked about the tyranny of distance. Simply due to distance we were largely kept out of or behind larger global flows.
Nowadays it is seen as having the world largest moat.
When things like global conflict starts, it does impact us but it is more the flow on effects rather than direct impacts.
The last few minutes of this 2025 recap by 'Ordinary Things' did the best job or summarizing how the world is getting ready for war.
> Germany's defence minister is frank and plain-spoken, but also deliberate with his words and intention. When he talks about Russia, the future of the West and the possibility of another European war, the message however becomes stark: "Our experts say it can happen in 2029."
> In remarks published Wednesday, Generalleutnant Christian Freuding, the inspector of the German Army, said the 2029 date was not a figure pulled out of thin air by his government's national security establishment, but an actual consensus view among Western allies.
> NATO Chief Mark Rutte urged member countries to do more to prepare for the possibility of large-scale war, warning that Russia may be ready to attack the alliance within five years.
Russia may be ready to attack the alliance within five years.
Russia can't even take the country next door. How exactly are they going to attack NATO? With a bunch of rusty nukes that almost certainly no longer work, and that would get their (relatively few) major population centers vaporized by nukes that almost certainly work just fine?
> With a bunch of rusty nukes that almost certainly no longer work, and that would get their (relatively few) major population centers vaporized by nukes that almost certainly work just fine?
Even 1% of Russia's arsenal being functional would be a problem, and I can imagine someone taking a gamble on "will Germany/France/England want to take a nuke to the face over the Baltics?"
Nukes aren't relevant unless Russia uses nukes or tries to take Paris or London. No one is going to nuke Russia over a Polish-Russian border town, and maybe not even over Warsaw falling. Until Poland and the Baltics get their own nukes, of course.
Have you seen the state of the rest of their armaments? Countries that have to bum artillery and soldiers off of North Korea are not in any position to go up against NATO.
If you're a Russian officer in charge of nuclear stockpile maintenance, why in the world wouldn't you pencil-whip the paperwork and steal the funding? If you're ever caught, it will be under circumstances where nobody will be in a position to do anything about it.
There is a good chance of this. Nukes need ongoing yearly maintenance to be operational, without that they are basically just a flying tin can. The whole movie trope of stealing an old nuke and using it doesn't apply to the real world.
Also corruption is somewhat accepted in some countries as it allows those at the top to have legitimate means of disposing of traitors when needed without that hassle of drumming up fake charges.
I read that in the Cold War, the military expected some incredibly high failure rate (30%+) of the bombs due to technical failures. These are incredibly complicated machines.
> But if someone invents super intelligence, they can dominate new AI research, control global economies, fight much better, and all very quickly.
After reading "If Anyone Builds It, Everyone Dies" I think this is not the correct take. If anyone creates ASI, it just means it's going to wipe everyone out, and it doesn't matter if China or the US do it first
If AI develops enough to successfully out-perform people at highly intellectual tasks, why would being first matter? Why do we need "your" AI output when we can just ask our own for a similar result?
Why do people think about this like the Manhattan Project when it could just as easily be electrification? Sure, some people made a lot of money selling light bulbs. But we didn't all have to cower under the light of the One Original Bulb and hope its nominal owner blessed us with photons.
It just seems like arbitrage to me. You exploit a momentary imbalance in the distributed market. Why do people imagine some winner-take-all scenario? Where does the fantasy of exclusivity come from?
Is there any logical reason to believe AI advances will create a moat? Or is it just a story people tell themselves because it echoes the narrative of past advances? Are these people assuming society will grant them exclusive use just because their AI result came out a little earlier than another? Why would we ever consider giving copyright or patent rights to an AI output?
Arguably, it has all become "obvious" with ordinary skill in the art once you're just prompting AI for permutations like every Hollywood producer stereotype. "Let's make it like X but tweak Y". It's getting silly, almost like people are starting to think they should have exclusive rights to a handful of cards they were dealt at the poker table.
The way US dominated in some of the industries (including software, for instance) was by being first to extract large value, and then funding the best people with compensation unachievable elsewhere.
This meant that all the talent in the world gravitated towards the US, but that was gradually changing already with compensation catching up.
Still, I believe US only hastened this with their change of immigration policies that were the basis of them keeping a dominant position for decades.
As far as I know, these 100+ dev dependencies are installed by default.
Yes, you can probably avoid it, but it will likely break something during the build process, and most people just stick to the default anyway.
> Reproducible builds, or don’t use those packages.
No. They’re only installed if you git clone react and npm install inside your clone.
They are only installed for the topmost package (the one you are working on), npm does not recurse through all your dependencies and install their devDependencies.
The best tool for your median software-producing organization, who can’t just hire a team of engineers to do this, is update embargoes. You block updating packages until they’ve been on the registry for a month or whatever by default, allowing explicit exceptions if needed. It would protect you from all the major supply-chain attacks that have been caught in the wild.
In security-sensitive code, you take dependencies sparingly, audit them, and lock to the version you audited and then only take updates on a rigid schedule (with time for new audits baked in) or under emergency conditions only.
Not all dependencies are created equal. A dependency with millions of users under active development with a corporate sponsor that has a posted policy with an SLA to respond to security issues is an example of a low-risk dependency. Someone's side project with only a few active users and no way to contact the author is an example of a high-risk dependency. A dependency that forces you to take lots of indirect dependencies would be a high-risk dependency.
Practically, unless you code is super super security sensitive (something like a root of trust), you won't be able to review everything. You end up going for "good" dependencies that are lower risk. You throw automated fuzzing and linting tools, and these days ask AI to audit it as well.
You always have to ask: what are the odds I do something dumb and introduce a security bug vs what are the odds I pull a dependency with a security bug. If there's already "battle hardened" code out there, it's usually lower risk to take the dep than do it yourself.
This whole thing is not a science, you have to look at it case-by-case.
If that is really the case (I don't know numbers about React), in projects with a sane criteria of security, they would either only jump between versions that have passed a complete verification process (think industry certifications); or the other option is that simply by having such an enormous amount of dependencies would render that framework an undesirable tool to use, so they would just avoid it. What's not serious is living the life and incorporating 15-17K dependencies blindly because YOLO.
(so yes, I'm stating that 99% of JS devs who _do_ precisely that, are not being serious, but at the same time I understand they just follow the "best practices" that the ecosystem pushes downstream, so it's understandable that most don't want to swim against the current when the whole ecosystem itself is not being serious either)
> How do you do that practically? Do you read the source of every single package before doing a `brew update` or `npm update`?
There are several ways to do this. What you mentioned is the brute-force method of security audits. That may be impractical as you allude to. Perhaps there are tools designed to catch security bugs in the source code. While they will never be perfect, these tools should significantly reduce the manual effort required.
Another obvious approach is to crowd source the verification. This can be achieved through security advisory databases like Rust's rustsec [1] service. Rust has tools that can use the data from rustsec to do the audit (cargo-audit). There's even a way to embed the dependency tree information in the target binary. Similar tools must exist for other languages too.
> What if these sources include binary packages?
Binaries can be audited if reproducible builds are enforced. Otherwise, it's an obvious supply chain risk. That's why distros and corporations prefer to build their software from source.
More useful than reading the code, in most cases, is looking at who's behind the code. Can you identify the author? Do they have an identity and reputation in the space? Are you looking at the version of the package they manage? People often freak out about the number of packages in such ecosystems but what matters a lot more is how many different people are in your dependency tree, who they are, and how they operate.
(The next most useful step, in the case where someone in your dependency tree is pwned, is to not have automated systems that update to the latest version frequently. Hang back a few days or so at least so that any damage can be contained. Cargo does not update to the latest version of a dependency on a built because of its lockfiles: you need to run an update manually)
> More useful than reading the code, in most cases, is looking at who's behind the code. Can you identify the author? Do they have an identity and reputation in the space?
That doesn't necessarily help you in the case of supply chains attacks. A large proportion of them are spread through compromised credentials. So even if the author of a package is reputable, you may still get malware through that package.
Normally it would omly be the diff from a previous version. But yes, it's not really practical for small companies or individuals atm. Larger companies do exactly this.
We need better tooling to enable crowdsourcing and make it accessible for everyone.
It’s mentioned in the books, kopeng. I think it comes up in some of the repair scenes, but there’s such a jargon dump in many of them that it might slip by. Naomi is caressing some of it at one point, like she’s petting a cat. Which is not far off from how she sees the Roci.
I can think of two in the show, but one is right before Holden needs to tell Nagata something important, and the other is in the middle of a brain dump at Tycho station when the Roci is being diagnosed for repairs.
Look I love giving people the benefit of the doubt, but that's not why this pricing model exits. It's because they want to capture a percentage of the value delivered, and the easiest way to do that it to charge by executions
