rushter

A recent post on Hacking OpenAI and a bug bounty of $6,500 reminded me of an old problem. A security company was able to hack into private OpenAI repositories, but only got a small bounty. A company with a valuation of $852 billion paid a few pennies to researchers. In comparison, such data could be sold for hundreds of thousands on the black market. For those who don't know, a bug bounty program is a way for companies to pay white-hat hackers (security researchers) to find vulnerabilities in their services and software. Bug bounties allow researchers to perform security research in a legal way and get paid for it. The hack was initiated through a hosted Discourse forum, but that forum was out of the scope of OpenAI's bug bounty program. In bug bounty programs, there is usually a list of services the company wants to be tested and the rest of the services do not receive any bounty. In the case of the OpenAI hack, accessing the private data (from repositories) was in scope,[......]

A recent post on Hacking OpenAI and a bug bounty of $6,500 reminded me of an old problem. A security company was able to hack into private OpenAI repositories, but only got a small bounty. A company with a valuation of $852 billion paid a few pennies to researchers. In comparison, such data could be sold for hundreds of thousands on the black market. For those who don't know, a bug bounty program is a way for companies to pay white-hat hackers (security researchers) to find vulnerabilities in their services and software. Bug bounties allow researchers to perform security research in a legal way and get paid for it. The hack was initiated through a hosted Discourse forum, but that forum was out of the scope of OpenAI's bug bounty program. In bug bounty programs, there is usually a list of services the company wants to be tested and the rest of the services do not receive any bounty. In the case of the OpenAI hack, accessing the private data (from repositories) was in scope,[......]

My thoughts on the current state of searching for things on the internet.

Reddit used to be a good source to find real recommendations. Well, not anymore. Years ago, I used to append "reddit" to my search queries to find real discussions about products. If you search for managed Postgres on Reddit, you may stumble on posts like this: If you look at the profile of the person who created it, their posting history is usually private: > u/xxx likes to keep their posts hidden, but check out their stats to learn more about them. But when you do some research and look at their other posts from Reddit dumps to find their real identity, you see this: By diving deeper, you notice that there are around 10 accounts that constantly ask about managed Postgres or recommend a specific provider. They are all connected to the same company.[......]

Custom memory allocations and arenas are notoriously hard to deal with in Rust due to the ownership model. In a lot of projects, they can significantly improve performance. For example, let's take databases. Sending a query to a database produces a lot of temporary objects, and if the default allocator is used, you will need to allocate and deallocate thousands of small objects for each query, which is wasteful. Almost every database engine uses custom memory pools to improve performance. Some go so far as to statically allocate all the memory before the program starts. Another good example is scripting languages. I have an article on how Python uses arenas to reduce the number of allocations for Python types. A simple web app in Python can allocate more than a million of objects after 100 HTTP requests.[......]