Yes, but the point in this case is that we are told the person did not have diplomatic immunity.
Not everybody who works at an embassy has diplomatic immunity.
The Geneva Convention dictates who gets diplomatic immunity, and that is based around your job description and rank.
This is not the first time either that the US has flown somebody out of the UK in questionable circumstances before they were questioned by UK police.
The UK is not a third-world country, there is no reason why somebody should not be questioned by UK police or dealt with in UK courts.
You can also bet your bottom dollar that if the tables were turned and the equivalent happend on US soil, there would be little chance of being flown out covertley. Most sensible people don't like "One rule for US, another rule for everyone else", even more so under the present US administration.
> The Geneva Convention dictates who gets diplomatic immunity, and that is based around your job description and rank.
from what I know, this is not correct.
if the US said he's a diplomat or has diplomatic immunity and/or was given that by the US and notified the UK, then he has immunity and it is up to the US and UK to resolve their grievances through diplomatic channels.
for example, many family members of diplomats and government officials have such status in host countries
From the BBC article "It is understood the individual worked at the US embassy in Vauxhall, south west London, and though not a diplomat, he enjoyed the umbrella of diplomatic protection."
Not necessarily, administrative, service, and consular staff are not diplomats but still receive varying levels of diplomatic immunity, typically just as it relates to their job. A CIA officer would be under the cover of a diplomat, no one would ever say that they actually aren't a diplomat.
My gut feeling is that any serious real-world company with a proprietary codebase worth looking at would not be handing out the crown jewels to a third party. License or not.
I don't doubt somebody licensed their codebase to them, I just have my doubts about who the "who" could be.
Code isn't worth all that much if you don't own the associated IP, mainly copyright. And even if you disagree with that premise, if you trust that they can keep the code secret, it's basically free money.
At any rate, I'm not sure it matters whose codebase it is. I'd even say that a shitty codebase might make for a better test.
The point I'm making is that companies who are serious enough to want to keep their code-base in-house and off the various online repo services are also the kind of companies who are strict about what you can and cannot do with LLMs (if they permit use of LLMs at all).
So it does not make sense that the same companies would then magically sign-off on allowing their entire codebase to be spoon-fed into a whole bunch of LLMs for benchmarking.
You should only ever eat fruit skins if the fruit is organic and the skin is clean.
At this point I think its safe to say there are hundreds of scientific studies out there telling you why. This is one example[1].
I quote from their abstract:
Notably, the distribution of pesticides in the apple peel and pulp layers is visualized through Raman imaging, confirming that the pesticides penetrate the peel layer into the pulp layer (∼30 μm depth). Thus, the risk of pesticide ingestion from fruits cannot be avoided by simple washing other than peeling.
The two fungicides they tested aren’t in common use in US orchards. One is no longer approved at all. Anyway, it would be interesting to test the currently actually used fungicides.
I very much doubt the problem magically disappears with "newer" pesticides.
Afterall, if a pesticide washed off in the rain, it wouldn't be much good as a pesticide .... it would be a very expensive proposition for the farmer to re-apply after each rainfall.
So TL;DR benchmarking in a completely non-reproducible manner ?
"Model X performed great, but we can't possibly tell you anything about the code it was looking at apart from it was a large code base from an unknown company".
> You're giving up transparency for it being harder to game
But then if we take that argument to its natural extreme, surely it means people should take the marketing bullshit published in the 100-page system cards published by Anthropic & co as "valuable" too ?
As long as the ones offering the benchmark aren't trying to sell you something and have no affiliation with one of the companies on the page I'll take it as opposed to having the benchmark rendered useless in 3 months when the next models drop.
I think you know that's basically nothing like this? The model cards have every incentive to be biased, this doesn't necessarily.
But even so, pretty much yes: companies that actually have reliable and accurate info in their releases get trusted more. It takes time because the default is to disbelieve info from biased sources, but it is possible to trust some of them more than others.
In theory, as long as all the models are doing the same thing with the same tools, it's at least useful to see how they stack up against each other right now. It might not be great to track progress over time, as it can get benchmaxxed or the underlying resources may become obsolete.
One possible solution is to only be able to contact someone if you have received an invitation code from them out of band. E.g. "scan this QR code to add me on signal". Such an invitation code should default to single-use but users should be allowed to generate standing invitations so that businesses and the like can print and post one in their store or whatever. Start getting spam from one of your standing invitations? Just revoke it and make a new one. Presumably the Signal folks can come up with more alternative solutions than the half baked one I came up with after thinking about it for a minute, they're clever cookies.
Welcome back to “key signing parties”. PGP never got enough adoption. At least Signal is simple enough that the (ahem) leaders of the US can (mostly) manage to use it.
Unfortunately, in an end to end encrypted messaging system, an identity is denoted by some sort of long number. That is an inescapable fact. Trusting a third party to correctly map, say, a phone number to a cryptographic identity number eventually results in the sort of attacks we have been seeing with phone oriented encrypted messengers recently like WhatsApp and Signal. The PGP people were doing the right thing when they were doing education in the form of key signing parties. That is something the user needs to know.
Anonymous messengers have no real choice and have to use some sort of number for identity. See Briar, Session or Tox for examples.
> attacks we have been seeing with phone oriented encrypted messengers recently like WhatsApp and Signal
Could you give an example of an actual attack of this kind on Signal? The 'Signalgate' event was someone mistakenly inviting the wrong person to a chat.
Allegedly, Signalgate was caused by Apple helpfully mapping the wrong number to a name. Then Signal mapped that number to the wrong cryptographic identity.
Leaders of the US use an Israeli backdoored version of Signal (TM-Signal) TeleMessage by Smarsh was used by DOD, CPB, and others for records retention reasons... also hacked to smithereens.
People seem to get on with Discord invite links just fine. You don't have to do the "confirm that all these emoji are the same on both your devices" dance to stop spam.
> People seem to get on with Discord invite links just fine.
Discord is used by a narrow group of technically literate people. Signal is for everyone. Your grandparents probably don't use Discord, but if they can text then they can use Signal.
Imagine setting up a chat for an organization you're working with - will you be willing to process 20 out-of-band QR codes? 50?
On a smaller scale, it's clear that Signal believes a functioning address book is necessary for end user adoption. For example, by default Signal notifies you of people in your phone contacts who are on or who later join Signal.
> Presumably the Signal folks can come up with more alternative solutions
I have yet to see a solution better than the one they chose, for their requirements. Notice that there are none in this discussion.
Decreases what info Signal needs to collect and retain about a user. When using an SMS verification as a proof, Signal needs to log the phone number, because if they didn't, one spammer could use one phone number to create 10^99 accounts.
When using payment as proof, they can verify that payment occurred, validate the account and then immediately forget about the transaction. One spammer would still have to pay 10^99 times to create that many accounts.
You buy a Mullvad scratch card on Amazon and you redeem the token string.
Mullvad also offer the option to put your card number into the Mullvad website, and I'm sure many privacy conscious people would be very reluctant to do that.
Card payments these days leave far too big a trail. The bank knows, the intermediary (e.g. Stripe) knows, and the merchant (e.g. Mullvad) has to keep records for accounting/tax requirements.
If your concern is "muh phone number", then you can pay and not have to give the phone number to sign up.
It's already the case today (and has been for years) that you don't need to give strangers your phone number to chat on Signal. My username is soatok.45; try to get my phone number if you can.
If you want absolutely no info to be collected, ever, and there to be zero cost on the end user too, be prepared to welcome your new spam overlords. Because the people who will benefit the most from a zero cost signup that only requires a username are spammers.
I'm a bit surprised by this dismissal. Of course some info must be collected, or there must be some cost to enter (probably both I mean phone number is also a cost, but one most people already sunk). But we can still debate the best way, right?
For example:
* Are you absolutely positive signal will never have a bug that let attackers reveal contact phone numbers? I really trust in their secure coding skills, but this class of vulnerabilities (like 2fa leaj) happened to even the biggest players.
* One of the reasons signal collects phone numbers (and asks for a contacts permission) is to check which contracts are already on signal. For some people or in some governments even having a signal account is an opsec problem (to be fair, they have a secure privacy-preserving protocol for this - as you know - and it's possible to avoid this footgun if necessary)
> We found deSEC to be the only affordable DNS supplier in the EU that complies with state of the art secure DNSSEC.
I mean, if your definition of "affordable" is free, then sure.
But for the record there are other affordable EU suppliers who do DNSSEC:
- Bunny DNS[0] is "free" – i.e. only subject to their minimum $1/month account spend fee.
- RcodeZero is very affordable[1] plus added bonus it is run by the `.at` registry so the infrastructure is solid – business customers only, no private individuals
- Netnod (only via resellers[2] unless you are a big company or government) – Netnod host the I Root Servers and their public hosting DNSSEC service will soon feature HSM-bound DNSSEC keys
I happen to run an affordable EU supplier who does DNSSEC, and also AXFR (incoming and outgoing). I offer a free plan from time to time, but not at the moment to preserve resources for paying customer.
We have a support ticket at Bunny that has been open for months precisely because they don’t provide state-of-the-art DNSSEC. We had to move to another provider, as we have a deadline to comply with at the end of this month. I don’t know what the issue is off the top of my head.
Netnod.se uses a DNSKEY that is too small on their main domain.
Sure: zonemaster[1] is the tool we use [2]. It checks for keylengths and other things and allows policies to be defined on them. It comes with a fairly well defined / modern policy but in our Dutch .foundation article you can read that one should be a bit stricter. However, the default policy of zonemaster warns about the keylength of netnod.se [3]
Internet.nl does not look at DNSSEC that extensively, allowing poorer quality configurations to pass. You can see what they check in the explanations of both DNSSEC metrics [4]. See [5] for discussions about keylength.
Verisign does check for key validity but not for key strength / length as seen in your link.
Mullvad Browser[1] is an example of just that, ready to go for people in the real world who don't have the time or inclination to mess around with random extensions and `about:config` hacking.
Also surprised the blog author made zero mention of the importance of keeping your OS up to date. Its all very well having a patched and hardened browser but not if you're running it on a vulnerable OS.
Yes, but you have to admit that the existence of these SLDs (like co.uk) is always going to be a point of confusion for anyone with a basic knowledge of how the domain hierarchy _usually_ works.
Needing to be familiar with all the special cases (like the VERY special case of x.y.name which I previously knew nothing about) kind of ruins everything and introduces yet more security risk.
> but you have to admit that the existence of these SLDs (like co.uk)
I'm sorry, what ? Admit ? Confusion ?
In the case of .co.uk it has been around since 1996. HN is a technical forum, most people here should be well aware it is a serious SLD. I honestly can't believe it even needs clarifying.
Hell, if you use AWS Route 53 you'll see they use co.uk as one of their nameserver suffixes[1].
I'm not referring to the HN audience; I mean the larger evergreen cohort of people in the world who are still building their mental model of how the web works. They will each eventually be doomed to the same misconceptions because it's a system full of inconsistencies and special cases.
Nominet and therefore .co.uk has been around since 1996.
.co.uk is not going anywhere, and neither is Nominet.
The only "problem" is the original poster did not do their homework. I suspect they were inferring `uk.co` which is a completely different kettle of fish. The original poster should urgently correct their post.
Yes, but the point in this case is that we are told the person did not have diplomatic immunity.
Not everybody who works at an embassy has diplomatic immunity.
The Geneva Convention dictates who gets diplomatic immunity, and that is based around your job description and rank.
This is not the first time either that the US has flown somebody out of the UK in questionable circumstances before they were questioned by UK police.
The UK is not a third-world country, there is no reason why somebody should not be questioned by UK police or dealt with in UK courts.
You can also bet your bottom dollar that if the tables were turned and the equivalent happend on US soil, there would be little chance of being flown out covertley. Most sensible people don't like "One rule for US, another rule for everyone else", even more so under the present US administration.
reply