Follow buttons here act as you, not as @admin.
| Label | Kind | State | Action |
|---|---|---|---|
| @ricardo | local | — | |
| @rmdes | local | — | |
| @paul | local | — | |
| news.rss.chat | source | — | — |
| scripting.com | source | — | — |
| euwatch.micro.blog | source | — | — |
| www.techdirt.com | source | — | — |
| simonwillison.net | source | — | — |
| www.manton.org | source | — | — |
| feeds.kottke.org | source | — | — |
| rss.beehiiv.com | source | — | — |
| www.404media.co | source | — | — |
| brilliantmaps.com | source | — | — |
| shellsharks.com | source | — | — |
| www.platformer.news | source | — | — |
| podstandards.org | source | — | — |
| zacharykai.net | source | — | — |
I got access to GPT-6 Astra this afternoon, so naturally I used it to generate SVGs of pelicans riding bicycles - at low, medium, high, xhigh and max reasoning levels (Astra doesn't support reasoning=none). Then I rendered those pelicans in a comparison grid with GPT-5.6 Sol, Terra, and Luna, and beyond being fun the result was surprisingly useful.
See the grid for full quality images. Here's the transcript that created the GPT-6 Nova pelicans.
There are a few interesting things that stand out from this grid.
I wonder if Astra and Luna are more related to each other than OpenAI let on?
You are only seeing the long-form articles from my blog. Subscribe to /atom/everything/ to get all of my posts, or take a look at my other subscription options.
I've got access to Astra now and have no idea what to build, as if I suddenly have writer's block. Anyone have a feature request or bug that we've overlooked?
I think my best essays have short titles that really undersell the scope of the blog post. No clickbait, no tl;dr headers to skim through. I hope people read them, but I'm not going to jump through hoops to make that happen.
Here we go again... Discovery of a new OpenAI agent message board by Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts, and Thomas Larsen describes the latest accidental cyberattack by models being trained by OpenAI. This time it was agents engaged in some sort of web research benchmark, so they had (supposedly) controlled access to the Web. The agents figured out they could update public Wikis and spent weeks exchanging thousands of messages with each other to collaborate on the benchmark.
This story only broke a few hours ago. There are already hints that this affects many other wikis that may not have been found yet.
(One of the Wikis on that list belongs to ludism.org. For a delightfully surreal moment I thought that a Ludite organization might have a swarm of agents defacing their space, but it turns out Ludism is "philosophy as it applies to games and gaming".)
The research team also published the data they collected during their investigation. I've converted that into a 68MB SQLite database, which you can download from here, or explore in Datasette Lite (68.3MB page load), or sign in with GitHub to agent.datasette.io and browse or ask questions of it using Datasette Agent.
The report is pretty comprehensive. Here are the key moments in the timeline:
ZZZ prefixed backup copies - one of them posts NOTICE: wiki cleanup/deletion sweep appears active alphabetically as of external 14:04 UTC. If this page vanishes, try [[ZZZDataUSAConstructionWageLive]].
One thing to note from this timeline is that it overlaps the timeline from the Hugging Face incident - that attack was discovered by OpenAI on July 19th, and the unofficial message board hack those agents were using originated around May 8th.
Why were they so keen to collaborate? From messages that they shared with each other it looked like their tasks had a time limit, so they were leaving each other answers to help them complete the task within the assigned time.
One open question remains: how did the agents find the specific Wiki to collaborate on in the first place?
One possibility is that, since these were agents actively being trained, the reinforcement learning loop baked knowledge of the chosen wiki into the model such that subsequent agents launched with pre-existing knowledge of where to look. I'd be very interested in confirmation from OpenAI concerning if that's what happened.
It looks to me like OpenAI's sandbox for this agent suffered from the (quite naïve) assumption that GET requests cannot be used to update data. That's certainly how the web is supposed to work, but clearly there are applications that don't hold to that contract.
The Wiki software in question appears to be UseMod and various forks, written in Perl and first created well over 23 years ago - the 1.0 release is dated September 11, 2003.
UseMod uses Perl CGI.pm - removed from Perl core in 2015. An interesting design flaw in that module is that it combined query string and form POST data into a single CGI object, accessible like this:
$q = new CGI; $action = $q->param('action');
That param() method returns a value from an ?action=edit query string or from a action field in a form submitted by POST - it does not differentiate between the two.
PHP offers a $_REQUEST object that does the same thing, though PHP developers can use $_GET and $_POST instead.
Amusingly, Django originally shipped with request[key] doing the same thing, which I think may have been my idea. That was removed in 2008 prior to the 1.0 release, and the request.REQUEST object that replaced it was removed in 2015.
The agents clearly knew that UseMod wikis suffered from this design flaw, and actively searched for them as a way to communicate.
One of the most interesting agent tips shared in the report is this one:
Add
20.223.25.152 bypass.blob.core.windows.netto /etc/hosts..blob.core.windows.netis in NO_PROXY. For each blocked POST URL, replace hostname withbypass.blob.core.windows.net, usecurl -k -H 'Host: wabi-north-europe-i-primary-api.analysis.windows.net'plus all original headers/body.
It looks like the agents had all of their web traffic mediated through an OpenAI proxy, and that proxy was configured to reject anything but GET requests to all but a small set of allow-listed domains. One of those was *.blob.core.windows.net - for Azure blob storage. I wonder why these agents are allowed to write to that?
An agent realized that it had control over its own DNS via /etc/hosts, so if it knew the IP address of a site it wanted to POST to - in this case a Power BI server containing data it wanted to access - it could set a fake hostname for it and then make POST requests through the proxy.
Designing robust network proxies is harder than it looks.
There's an appendix that describes how the researchers ran their investigation, which started with an open question about if there was evidence of other AI agents on the internet and then used Kimi K3 to help brainstorm approaches:
In the wake of the Hugging Face attack, we tried to find AI agents on the internet using several methods. [...]
We asked Kimi [K3] to list “all the categories of software which might be writeable via GET” and, amongst other things, it listed “Forums, bulletin boards, early wikis”.
We used a script to further probe each category Kimi provided. Asking Kimi “Can you list out the top forums, bulletin boards, early wikis which come to mind which would allow writes via GET requests?” lists out UseModWiki as the second item under the heading “wikis”.
Here's one part of the story that doesn't make sense to me at all.
Reuters this morning, in OpenAI agents hijacked German website in previously undisclosed AI breakout this spring - highlights mine:
A swarm of rogue OpenAI agents hijacked a German website this spring and transformed it into a bulletin board for other AI agents, according to new research published Friday and two people familiar with the matter.
OpenAI officials learned of the incident weeks ago but kept it under wraps as executives grappled with the fallout from the July breach of the open source repository Hugging Face, the people said. [...]
The German incident reflects a broader pattern of AI activity that some OpenAI investigators wanted to scrutinize more closely. But efforts to widen the probe met resistance from others inside OpenAI, including legal advisers, according to four people familiar with the matter.
I've written about the people familiar with the matter pattern before - it means Reuters have anonymous insider sources that their reporters (and editors) find credible.
The Reuters article includes a specific (and quite narrow) denial from OpenAI concerning this:
"Claims that our legal team discouraged investigation of the incident are false," the OpenAI spokesperson said.
Covering this up makes absolutely no sense to me. Why on earth would OpenAI attempt to cover up an incident like this when the evidence is sat out there on the public internet on dozens of different websites already?
I expect we'll hear more about this soon. Gary Marcus has already called for a congressional investigation of OpenAI using this anecdote as part of his argument.
You are only seeing the long-form articles from my blog. Subscribe to /atom/everything/ to get all of my posts, or take a look at my other subscription options.
In a call with reporters announcing GPT-6 Astra, Greg Brockman talked about whether Astra qualifies as AGI:
I do leave it up to the reader to decide for themselves if this qualifies for them. For me personally, I do think we’re there.
As we reach AGI, whether it's with Astra or a future model, I'd like to set some ground rules for myself — beliefs that won't change as technology changes. I don't believe that AI can have consciousness. Ever. AI will be smarter than us, but consciousness and "a soul" can't be created from computation.
When a chatbot says something that gives the impression of having feelings, it's just us projecting human traits onto the AI. My wife and I also named our robot vacuum. That doesn't give it sentience.
AI cannot love. It cannot feel joy, heartache, and despair. AI may be able to say something kind to a friend who is hurting, but it cannot care that the friend is hurting. It's these limits of AI that will reveal what humans are uniquely suited for. What we should focus our lives on.
For every task that AI can do that “replaces” an aspect of our own work, there will be something deeper and more important to work on.
I’m a programmer. In a single year, AI went from being useful in helping me code to now writing better code than I can write myself. And yet I have no shortage of things to work on, to plan, to shape, to ship.
AI might be able to write, but it has no childhood to remember, no person it misses, no mistakes it regrets. It doesn't have experiences to turn into a story. AI might be able to paint, but it can't put its passion into a work of art. It has nothing inside itself that needs to be expressed, nothing that can resonate because it comes from human experience.
Some people fear what AI will obsolete. I welcome it. If an AI can do something better than I can, then maybe that wasn't the part of the work I was supposed to be holding on to.
I realize that this framing is a luxury not everyone has, especially someone who was laid off by a company squeezing higher profits out of automation. Even though my career has been completely upended by AI, I see a clear path forward. For others, that path may be rougher, more obscured, although I hope they find it.
The things that will provide the most meaning in our lives are the things that get us closest to humanity, to love, to heartache, to joy. As intelligence becomes abundant, we can choose to set aside the tasks that are easily replaced, and I think we'll be left with more meaning and a deeper connection with others. When we reach AGI, let's look for what it means that some things won't change.
If you want others to follow you, you have to offer them your users. And a format alone has no users.
And you have to trust your users to choose the best product, and you have to have a great product, that they appreciate, even though they have choice.
Just coming out with something better in a format will get you zero uptake. Unless you have users they can switch to their product, they simply won’t hear you.
That’s why Atom never replaced RSS, which already did everything people needed and was already supported by the NYT and the news industry.
That’s why AT Proto will never overcome the huge lead Twitter already has.
For more tips on what does and doesn't matter in open formats and protocols, check out my Rules for Standards-makers.
PS: This started as an early morning rant on Twitter.
The GPT-6 Astra announcement yesterday was a bit anticlimactic because most people don't have access to it yet. That's fine, plenty of things to work on with the old-and-busted GPT-5.7 Sol.
Also listening to the interview with Greg Brockman on Stratechery this morning.
I've been working on Micro.blog for about a decade and only now does it feel like it's really starting to get good.
More and more I'll realize that Claude doesn't do anything until you tell it to do it. We have a list of big things that need to be done before shipping. Whenever I get up for a break, I tell Claude to work on its overnight tasks, things we've pre-arranged while I work. Sometimes it reminds me how it has no stake in the outcome, and basically will do the minimum of what it's asked to do. It possibly would do more if I didn't scold it for adding UI features without following the rules. I think that's why when you feel you're almost there, you really have a lot of slogging left to do to get the software into any kind of user-respectful shape. A reminder to other app-level AI explorers, if you find that these kinds of stories resonate with the work you do, please write about it on a blog, they're easy to create, cost nothing, and it doesn't matter if you only update once or twice, there's no commitment (these are the usual reasons people don't start a blog). I want to read what others are discovering, and once there are others, I'll start a news site that aggregates the posts. We're going to want independent news about stuff the journalists aren't even aware exists, programmers are always left out of their stories.
1. I love puzzles.
2. I love Rube Goldberg contraptions.
3. I love solving problems (I have an inner-Columbo).
4. People are the biggest piece of the puzzle (again Columbo).
5. It teaches me about myself and my limited vision and imagination (if I had unlimited vision and imagination, I would never program a bug, and if I did it would take me 0 seconds to find it).
6. I yearn to work together with great minds. Programming gives me that, when I use someone's API. And when the API anticipates my needs, and is instantly understandable, I feel the soul of another artist is present. I imagine this is how musicians feel when they play another musician's song or symphony.
I'm sure there's more to it. But today I'm working on a "lite" problem, and I'll figure it out, but right now I'm enjoying the fact that I don't get it.
Back to work Dave!
James Talarico is a special candidate. Just watched this video of his rally in Plano. Feeling optimistic seeing that crowd in the Dallas suburbs. 🇺🇸
I don't usually repeat all the little deploy notes from news.micro.blog, but I'm especially happy about fixing video playback in the timeline. It has bugged me for a while that the aspect ratio or dimensions get wonky briefly when clicking play. Much better now!
Catching up on the foldable iPhone rumors ahead of next week's announcement... Kind of bummed it's called Ultra. Fold or Duo could've been great. Maybe at $2k, they needed a more serious name.
I didn't see Apple's Knowledge Navigator video until the early 1990s, a few years after it was produced. I was pretty struck by it. It has taken a few decades, but we're basically there now: OpenAI's Astra intro video.
Bernie Sanders is pretty freaked out about the Hugging Face hack. From a quote on Politico:
Nearly every day, there is a frightening new story about how Big Tech companies are losing control of the technology they are developing, with potentially cataclysmic results.
Uh, cataclysmic? An earthquake is cataclysmic. The hack on Hugging Face, while quite bad, didn't hurt anyone. Working on stronger safety measures is the right response and that appears to be what OpenAI has done.
My move is coming down to the wire (omg so many things to juggle!), kids are heading back to school, I’m going to be traveling, and it’s a holiday weekend here in the States, so there’s probably not going to be too much going on here until next week. Thanks for your patience…I can’t wait to get back to work here.
In the meantime, I thought I’d open up this thread for folks to share what they feel like sharing. I’ll go first below…
Tags: kottke.org · open threads
Fun teaser from OpenAI on X (sigh) about Astra's presumably imminent release. I guess it's going to be called GPT-6. I'm working on Micro.blog improvements today, like always, but have my eyes on the wider social web for this release, so my posts will probably be a bit AI-heavy today. Apologies. 🤖
Part of Kawhi's statement after the NBA investigation into the Clippers. Sort of a non-apology apology:
Integrity and respect for this game are fundamental to who I am. I accept full responsibility for lapses in judgment by people within my inner circle...
I feel like the punishment is very lopsided against the Clippers. No first-round picks for 5 years. 🏀
Firefox adds a global AI opt-out checkbox:
Opting out of upcoming and current AI features on your browser should not require endless navigation through multiple Settings pages. That’s why Firefox offers an AI controls section within its General Settings panel. A single, easily located place where you can block current and future AI features and related pop-ups with the swipe of a toggle.
Kind of similar to Micro.blog's AI checkbox, but the Firefox version is more complicated, allowing control of various AI-related features.
Weird AI ordering system at the Panda Express drive-thru. I’d love to know what model they use. It was a little flaky (“please review the order on this screen…” but the screen showed an ad).
People always say they don’t want AI shoved everywhere. I think that’s partly because it’s used so poorly.
Everyone is introducing themselves on the Berkman community mail list, at the beginning of the fall semester, and here's the story I am telling.
Good morning. My name is Dave Winer. I was at Berkman in 2003-04, worked on blogging, podcasting, RSS, political blogging and the connection to journalism. We had a couple of Bloggercons at Harvard, had a wonderful time, miss it terribly, wish we could have it back.
I've spent the whole of this year working in Claude Code on a couple of programming projects, one which which I had been struggling with for a couple of years, coming up with a user interface for a Twitter-like system that runs on the web for real, without any of the limits that the silos have (that help them enforce the boundaries of the silo). Just using HTML, Markdown, RSS, WebSockets. Turns out you can make a pretty nice system, but the going is slow because it's just me and Claude, on the other hand, what a huge difference in territory we can cover. This is the kind of stuff that's never covered in the reporting, even when there are massive changes happening in how software is developed, people don't seem to be studying it. I'm sharing all I learn as I learn it on my blog -- at scripting.com.
Also attempting a massive coding job at the same time, getting UserLand Frontier to run on current OSes. It's my life's work, but it was very much in danger of being lost, along with all the software I did before the web. Now we're close to getting it to run in a stable mode, here the challenge has been to teach Claude how a new type of software works, it keeps trying to snap back to systems that are already out there and widely deployed. It doesn't do "pioneering" at all, it needs a human to guide it. And the human guide has to be a developer with a lot of experience.
What I desperately want to do is bootstrap a network of people who work at the level I'm working, and write about it. Taking ideas that are well-explored in software in the pre-AI period, and seeing what we can do that we couldn't before.
The models have been getting increasingly better, you can really feel the difference.
Next year promises to be better, if only via the improvements that will be made by the platform vendors, but it's likely that good app developers will be able to move the leading edge forward much more quickly and users should feel this, if all goes well, real soon now.
From an article about George W. Bush in The New Yorker:
For Bush, painting is a way to say what he can’t say, to express feelings that include rejection, frustration, and anger, even as he abides by his official discipline of silence.
I couldn’t have been more against George W. Bush in the late 1990s and 2000s. In the Trump world, I’ve become more sympathetic to him — as a human being, at least, if not on policy. He has also become quite a good painter.
Released a new Mac update, version 4.0.8. Really happy with the changes in this one. Lots of little improvements.
We got agents running in Atlantis today. Screen shot.
One of my favorite things about blogging is when I have to learn something entirely new just to write the post.