But having water leave the building envelope is a bit scary on very cold days. There are heat traces and freeze valves so it should be fine, but I do worry about power outages during cold snaps
Outside of the initial wave of security vulnerabilities and scrambling, it seems like the logical outcome of this over time is likely vastly more secure vm environments?
I think the main problem with that is the main problem with a lot of security tools. In order to do useful work, you need to provide a lot of tools and permissions.
I.e. in theory the most secure might be a virtual machine with no network access. But then how do you access the LLM provider? Etc.
I'm doing some work in this space[1], it's a really deep and hairy problem. There's a lot that you can do at the OS level sand boxing of course, but you may want some areas of you code to have network access and for some areas that use external dependencies to not have that access. Tracking where systems have side effects ends up being a lot of book keeping and a lot of languages that implement an object-capability model require you to thread caps through all of your calls, which IMO is bad ergonomics and a place where bugs creep in as functions accrue caps. Or sometimes they have rather superficial cap systems like Hack, or are rather awkward like in Deno.
There are a few reasons for this. I really can't seem to wrap my head around Haskell in the wild as written by real people. I also wanted to tie capabilities into the build system tooling so that the build tool could verify caps and launch executables into an OS sandbox. Bolting on capabilities doesn't offer the same ability to enforce them, for example the March package manager ForgePM will reject packages that falsify their cap manifest. Moreover I was reading some papers that inspired the language, and wanted to try it. Cap(X) is also erased b the type checker during compilation in March.
That looks really cool. Can you narrow Bluefin.IO to reads/writes separately? One of the things I've worked on is the ability to allow code to read files, even specific files, but deny writes.
Yes! It started as an implementation of the effect system I always wanted: effects passed on the value level, rather than implicitly on the type level. Once I'd done that I realise that it was actually a capability system (and that was the better way of describing it, because more people already know what a "capability system" is).
Here you go! It's a complete document, but I'll continue to edit it over the next few days before I announce it. I'd love to hear any thoughts you have.
Thank you, I really appreciate that. I'm really trying to make it easy to assert what code can do, then enforce it at compile time and optionally via the build tool at runtime via OS sandboxing integration. Supply chain attacks are also an area I'm exploring by having deps declare caps and then the build can scan and inspect binaries.
It's been a real education. I talked to one of the people behind Caja and learned a lot.
That makes as much sense as saying that better gun technology results in body armor that can stop it. It might incentivize that, but in no way "results" in that; the fundamental technologys underpinning advancements in offense versus defense are fairly different.
Maybe, but I think this misstates how security vulnerabilities work. Vulnerabilities are logic flaws, and we have every reason to believe that there is a maximum number of such flaws in any given system that allow exploitation; and even that we can conceivably develop logic that excludes any flaws. Whereas weapons and armor are devices that deliver and deflect/absorb energy, and any increase in the power of one means we need a corresponding increase in the other.
Now maybe our understanding of logic systems is wrong, and it's just fundamentally impossible to develop programs that lack exploitable vulnerabilities -- that you can always "exploit with more energy". But there's no reason to believe the energy metaphor transfers to logic and intelligence.
Only if you think penetrating holes in a paper vest and then patching those holes constitutes “improving”. If that worked Windows and Linux would be impenetrable fortresses with all the holes that keep getting punched in them.
Cyberdemolitions expertise is about as relevant to cybersecurity as gun making is to bulletproof vest making. Necessary for validation, but not very related to the fundamental engineering and technology.
They are more comparable to a computer worm than anything else. Very strange (and disrespectful imo) to make the jump to slavery. A gun can’t be used at all inside it’s safe so I’m not sure that makes sense. A better metaphor would be making sure gun ranges have backstops capable of stopping contemporary payloads and sufficient range controls to keep people from shooting at cars on the highway. Outside of that you need registration requirements and gun control to make sure you can mitigate and track down perpetrators of gun crimes off the range. If they’re to be used in active conflict you need laws of war to govern the use of lethal force. If you use them to hunt, you need a hunter’s safety card and a current tag.
A gun cannot fire unless someone loads and triggers it, an LLM cannot operate computer unless someone translates what it said to shell scripts. An LLM is super comparable to a gun, not a computer worm which is consistently dangerous.
Sure. I never said guns were a bad metaphor. I meant a worm was more comparable than an “entity” or “digital slave”. Agentic AI is putting the gun on a robot dog, taking the safety off and handing over fire control to an algorithm. If you extend it that far though guns are just any software. Or perhaps computers are guns and software programs are bullets, with LLMs manufacturing bullets from tokens.
This assumes your malefactors don't do malicious engineering, injects, social-agent engineering, etc.
This same assumption is built around the singularity, the TAM of 30Trillion, etc. It's the idea that complexity will some how collapse upon itself in some bizarre borg like collective.
I second the recommendation. I use the Voyager, and it's a delight! I switched when I was suffering from a lot of wrist pain, and it's never come back. I only wish they offered a wireless version for a cleaner desk.
You are essentially describing a proto-tracing system. At the risk of self-promoting twice in one comments section, I have a post walking through going from what you describe above to OTel-compatible tracing: https://jeremymorrell.dev/blog/minimal-js-tracing/
You are right that what you were doing is very similar! However standardization helps a lot here.
I understand the author's perspective in the linked article, but none of that data shows a project in trouble? Some languages have more resources than others, but those all look like healthy open source projects
Every time I share your blog (and I share it a lot) I tell people:
"This guy started a blog in 2024. Wrote three posts and all three of them would still make my top ten list of 'greatest posts on observability' today".
'A practitioner's guide to wide events' especially is still my number 1.
I'd make a wager that things would go better smoother faster if folks tried more stuff, ventures forth more on their own. It's obviously not great that there's no semantic convention that's perfect and just works for everything, and yeah it takes a while. I feel like the real data I'd want is who else, how many people show up to say they've tried something. Is that happening? Whether specs are really good enough advance or not, to me, is often whether enough people have tried it to find out.
The net of this is, otel is a very flexible system you can use and adapt in all kinds of ways and while the spec is important, using the toolkit to FAFO yourself, ahead of any beaten path, should really be encouraged. That's the message I'd want to see being radiated out about otel.
As the author I’d say it’s more of an ad for sandboxes + the idea of OCaps
Unless I’ve missed something obvious in my research, Dynamic Workers are the main product implementing this pattern today, but I expect there will be others for all the reasons I laid out in the article.
We (Cloudflare OS) run an app's client-side code in a null-origin iframe sandbox that is denied access to everything that we can possibly deny access to. Its only communication line to the outside world is via a Cap'n Web RPC session over postMessage() to the parent frame, which in turn forwards the session on to the app's own server, which runs in a Dynamic Worker sandbox on its end. So the app client can only talk to the app server and nothing else.
Or at least, ideally. Unfortunately, content-security-policy today has a few exotic holes. WebRTC, for instance, cannot be blocked; the standard simply doesn't cover it.
So it's not suitable as a sandbox against malicious code trying to leak data by any means possible. Instead it's protection against the AI doing something stupid, perhaps prompted by a user who doesn't know better.
(We would love to get those CSP holes plugged, though...)
Tangent to the thread; I'm coming across your work after researching cloudflare os this evening, and I gotta say, I am super impressed.
I came across sandstorm a few years back too -- so my mind was blown to learn workers and CloudflareOS are a better implementation of that project.
Cloudflare becoming FedRAMP High recently is a big deal in my little world. I'm trying to learn everything I can about it for our little AI consultancy.
CloudflareOS looks like the sandboxing piece I was just starting to put together -- agents and MCPs behind real security boundaries. Sandboxing is so damn important in this space and most of the other providers ignore it completely or just give it lip service. I think the workers concepts are going to supercharge way more than folks are giving you credit for (in the HN thread a few weeks back there were a lot of dubious folks -- I see it more like the Dropbox announcement).
I hope our paths cross at some point soon. I would love to get more understanding of CF and the roadmap for COS.
I've been circling the same exotic holes: I'm trying to sandbox LLM-written code in the browser - running it one layer deeper, in a worker spawned inside the sandboxed iframe.
The WebRTC hole actually goes away down there. RTCPeerConnection is Window-only, so it's just absent in a worker. But you're right not to trust CSP: I'm seeing worse. Under default-src/connect-src 'none' in a worker, Firefox still lets EventSource make the request (fetch/XHR/WebSocket/importScripts all block fine).
What I'm experimenting with right now is SES inside the worker: lockdown() + a Compartment. Still figuring out whether my framework stack survives lockdown().
For UI I'm using Shopify's remote-dom to mirror the UI to the trusted parent page.
Protecting your kids from dopamine-drip algorithms and the effects of social media and short-form video during their most formative years and gradually letting them take over as they mature sounds like… parenting.
I've been there, but going to cybercafés instead of having an internet connection at home until very late. A simlar case with a mobile phone, having to use the one from my dad until I had 18.
I nearly ended up alone, as anynone would expected. Parents understood too late the value of sharing common culture points, up to the point to apologyze and feeling really desperate on the consecuences.
Cracking up wifi and such saved me up a little, but not much. I missed TONS of stuff and experiences. When I could finally got all the media and proper skills, it was really damn late.
Don't do this to your kids, then. Time doesn't roll back. Ever. Don't be a shitty narcisist parent and let your kids develop their OWN tastes.
I’m sorry this happened to you. However nothing in my reply implies cutting your children off from the world. Helping them avoid the harms of algorithmic feeds until they have developed the maturity to navigate them helps them be more connected to the world, not less.
With all due respect I think you are reading more there due to your own experiences, which sound like abuse, not parenting.
Indeed. But in the skills case, ahem, formally, in paper. When I did a finished and advanced trade (pre-University IT, syadmin role), I aced the results as I had plenty of time to even make small patches to BTTV to support my $ELCHEAPO Conceptronic TV card. Having no internet at home made me really 'roguery' on how to achieve stuff, from cracking cable TV to inspect DVB packets, hack cable modems and pirate wifi. No formal education, just by myself, and I could do a trade from age 23 to 27 being lazy as hell because everything was trivial as I could read tons of the bundled books in the Debian Sarge DVD's.
I became really competent on how to 'survive' offline and Unix skills, far more than even the best ones in the grade (and even some math skills from a first year of College, among Lisp), but with really bad social skills but better since I met my SO at age 23 which convinced me to earn a trade. But I'm still a bit depressive for what I suffered.
Parents, listen to your kids, listen to your kids instead of sending them to a therapist, that won't work. Help on their tastes, support them, don't be a hardcore Mc Scrooge Cheapskate.
Spoiled kids are bad, OFC, but the polar opposite can be pretty much as dangerous if not more.
I coudn't even spend the money I had on Christmas on my own preferences since age 14 to 18, and I had to return a Chinese Megadrive console clone I won in a holyday lottery bingo in 1997 because you had to actually buy a separate cartridge.
I coudn't even buy cartridges for a NES I've got from my parents' friends because that was 'wasting money'. So, yes, I played all the games my peers got... about 7 years later, feeling myself more and more disconnected from the world and having to do huge efforst to switch from PC gaming and such back and forth. It was tiring. That would really burn you because you are like having to swtich back and forth from totally opposite cultures, my parents' one and my uncle/aunts' one.
But having water leave the building envelope is a bit scary on very cold days. There are heat traces and freeze valves so it should be fine, but I do worry about power outages during cold snaps
reply