Earlier this month, Eric Berger of Ars Technica reported that the White Houses’ first budget request of Donald Trump’s second term could be a fiscal reckoning for America’s government scientific enterprise. The National Science Foundation, a cornerstone of the country’s research ...

Why Cutting Basic Science Funding May Amount to Economic Unilateral Disarmament | American Enterprise Institute - AEI

Opinion: EA might be done with single-player games—but we’re not.

The Sims re-release shows what’s wrong with big publishers and single-player games - Ars Technica

Legion Go S is cheaper without Windows; upcoming OS beta will allow for personal installs.

Bye-bye Windows gaming? SteamOS officially expands past the Steam Deck. - Ars Technica

Awkward controls and a lack of features make a device for Atari completists only.

The Atari 7800+ is a no-frills glimpse into a forgotten gaming era - Ars Technica

“More software has been played on Nintendo Switch than on any other Nintendo hardware.”…

Nintendo confirms Switch 2 will play original Switch games - Ars Technica

The game will take “full advantage of Apple silicon,” CD Projekt Red says.

Apple silicon Macs will get their ultimate gaming test with Cyberpunk 2077 release - Ars Technica

Google’s cloud business is still a distant third to Microsoft and Amazon.

AI, cloud boost Alphabet profits by 34 percent - Ars Technica

In 2023, regulatory filings said ... workers. Enlarge / Almost every person Blind surveyed isn't pleased. ... In a blog post this week, Blind underscored some notable comments posted on its platform about the return-to-office (RTO) policy. One Amazon employee wrote on Blind, “My morale for this job is gone, gonna totally check out…” · There are similar discussions elsewhere on the web, with some saying that the policy is unjust because they were hired as a remote worker during ...

Most Amazon workers considering job hunting due to 5-day in-office policy: Poll | Ars Technica

Complaint cites "steep penalties" for Microsoft customers using other providers.

Google accuses Microsoft of antitrust violations over Azure cloud platform | Ars Technica

Ars Technica

arstechnica

1. Overview Gen AI and tools like GitHub Copilot are not that good at replacing programmers for serious tasks, as of April 2025. It looks like we are still many months away from that stage. Many statements seen on the Internet are either marketing campaigns trying to sell existing AI tools, or too optimistic statements not based on experience with actual tools that exist today. statements seen on the Internet statements seen on the Internet marketing campaigns marketing campaigns too optimistic statements not based on experience too optimistic statements not based on experience In this article, we are giving a summary of three articles on the Internet supporting the above statement, and the last one is this author’s personal development experience with GitHub Copilot. 2. Article 1: AI agents can't reliably debug software. AI agents can't reliably debug software. Article 1: AI isn’t ready to replace human coders for debugging, researchers say AI isn’t ready to replace human coders for debugging, researchers say AI isn’t ready to replace human coders for debugging, researchers say Summary: Even when given access to tools, AI agents can't reliably debug software.
.. (people) adjust their expectations because models aren't good enough at the debugging part, and debugging occupies most of a developer's time. That's the suggestion of Microsoft Research.
AI models… a far cry from what an experienced human developer can do
…suggest some of the ambitious ideas about AI agents directly replacing developers are pretty far from reality
… the models tend to produce code laden with bugs and security vulnerabilities, and they aren't generally capable of fixing those problems
..  the best outcome is an agent that saves a human developer a substantial amount of time, not one that can do everything they can do Even when given access to tools, AI agents can't reliably debug software. .. (people) adjust their expectations because models aren't good enough at the debugging part, and debugging occupies most of a developer's time. That's the suggestion of Microsoft Research. suggestion of Microsoft Research. AI models… a far cry from what an experienced human developer can do …suggest some of the ambitious ideas about AI agents directly replacing developers are pretty far from reality … the models tend to produce code laden with bugs and security vulnerabilities, and they aren't generally capable of fixing those problems ..  the best outcome is an agent that saves a human developer a substantial amount of time, not one that can do everything they can do 3. Article 2: Under pressure to embrace AI, developers are growing frustrated Under pressure to embrace AI, developers are growing frustrated Article 2: AI coding mandates are driving developers to the brink AI coding mandates are driving developers to the brink AI coding mandates are driving developers to the brink Summary: ..AI adoption is “tearing their company apart” as a rift emerges between leadership and the employees adopting such tools.
For software developers specifically, there are concerns that AI coding tools are introducing errors into their code, failing at many tasks, and compounding technical debt.
…developer faith in AI coding tools has quickly declined
…developers describe a slew of technical issues and headaches associated with AI coding tools, from how they frequently suggest incorrect code and even delete existing code to the many issues they cause with deployments
…the use of AI tools is causing an increase in incidents, with 68% of Harness respondents saying they spend more time resolving AI-related security vulnerabilities now compared to before they used AI coding tools
GitHub Copilot... it was wrong as many times as it was right
it takes a lot of time for someone (human) to review something they (AI tools) actually didn’t fully write and understand
Executives mismanage their expectations ...company leaders who don’t have close visibility into engineering workflows
AI coding tools are still new, and figuring out how to use them effectively requires a concerted effort ..AI adoption is “tearing their company apart” as a rift emerges between leadership and the employees adopting such tools. For software developers specifically, there are concerns that AI coding tools are introducing errors into their code, failing at many tasks, and compounding technical debt. …developer faith in AI coding tools has quickly declined …developers describe a slew of technical issues and headaches associated with AI coding tools, from how they frequently suggest incorrect code and even delete existing code to the many issues they cause with deployments …the use of AI tools is causing an increase in incidents, with 68% of Harness respondents saying they spend more time resolving AI-related security vulnerabilities now compared to before they used AI coding tools GitHub Copilot... it was wrong as many times as it was right it takes a lot of time for someone (human) to review something they (AI tools) actually didn’t fully write and understand Executives mismanage their expectations ...company leaders who don’t have close visibility into engineering workflows AI coding tools are still new, and figuring out how to use them effectively requires a concerted effort 4. Article 3: GitHub Copilot (GHC) can not be trusted with a bit complicated task GitHub Copilot (GHC) can not be trusted with a bit complicated task Article 3: GitHub Copilot (Gen-AI) is Helpful, But Not Great GitHub Copilot (Gen-AI) is Helpful, But Not Great GitHub Copilot (Gen-AI) is Helpful, But Not Great Summary: GitHub Copilot (GHC)... Sometimes it is brilliant.. sometimes it wastes your time, especially because the verbose answers it gives are often off-topic
It is useful sometimes, but only for local scope problems, and cannot see the bigger picture.
...“personal feeling” is “it does not know it well”, it is “trying to guess it out”, and since it is a machine with a huge memory of millions of lines of code memorized, guesses are sometimes brilliant, sometimes off-topic.
.. a huge disappointment that it can not get the C# syntax right all the time and check the existence of C# properties/methods by itself
... it deleted the active line of code because a similar line of code was commented out
I use “ghost test” from GHC a lot, review it, and accept suggestions when I like them.
I use the GHC text-prompt page to ask for the generation of snippets or small functions with clear functionality.... No guarantees GHC will succeed here, but if it does, it can be brilliant.
I no longer try bigger changes involving 3-4 files at the same time...Answers are at best incomplete, with many errors, like C# properties and methods that do not exist (it hallucinates?)
... it is time and energy-consuming to REVIEW each answer GHC provides
...it hallucinates about C# properties and methods that do not exist for well-known and frequently used APIs...
... it generates more mess than useful code, for assigned pattern-based tasks involving 4 files.
I ask GHC for help with problems, but read max 2 chat replies. Its answers tend to be verbose... If it does not give me a good answer in 2 attempts, I will go read Google for the same problem.
GHC has a serious focus problem; answers are frequently off-topic.
GitHub Copilot (GHC) can not be trusted with a bit complicated task involving several files at the same time. In such scenarios, results are incomplete and not time-efficient compared to direct manual programming.
GitHub Copilot (GHC) tends to hallucinate about C# methods and properties that do not exist. The GHC-
The generated code does not compile right away, requiring a lot of manual work to finish it. GitHub Copilot (GHC)... Sometimes it is brilliant.. sometimes it wastes your time, especially because the verbose answers it gives are often off-topic It is useful sometimes, but only for local scope problems, and cannot see the bigger picture. ...“personal feeling” is “it does not know it well”, it is “trying to guess it out”, and since it is a machine with a huge memory of millions of lines of code memorized, guesses are sometimes brilliant, sometimes off-topic. .. a huge disappointment that it can not get the C# syntax right all the time and check the existence of C# properties/methods by itself ... it deleted the active line of code because a similar line of code was commented out I use “ghost test” from GHC a lot, review it, and accept suggestions when I like them. I use the GHC text-prompt page to ask for the generation of snippets or small functions with clear functionality.... No guarantees GHC will succeed here, but if it does, it can be brilliant. I no longer try bigger changes involving 3-4 files at the same time...Answers are at best incomplete, with many errors, like C# properties and methods that do not exist (it hallucinates?) ... it is time and energy-consuming to REVIEW each answer GHC provides ...it hallucinates about C# properties and methods that do not exist for well-known and frequently used APIs... ... it generates more mess than useful code, for assigned pattern-based tasks involving 4 files. I ask GHC for help with problems, but read max 2 chat replies. Its answers tend to be verbose... If it does not give me a good answer in 2 attempts, I will go read Google for the same problem. GHC has a serious focus problem; answers are frequently off-topic. GitHub Copilot (GHC) can not be trusted with a bit complicated task involving several files at the same time. In such scenarios, results are incomplete and not time-efficient compared to direct manual programming. GitHub Copilot (GHC) tends to hallucinate about C# methods and properties that do not exist. The GHC- The generated code does not compile right away, requiring a lot of manual work to finish it. 5. Conclusion The articles above suggest that some of the ambitious ideas about AI tools directly replacing developers are pretty far from reality. Some authors believe it remains likely that the best outcome is an AI tool that saves a human developer a substantial amount of time, not one that can directly replace the developer. 6 References [1] AI isn’t ready to replace human coders for debugging, researchers say https://arstechnica.com/ai/2025/04/researchers-find-ai-is-pretty-bad-at-debugging-but-theyre-working-on-it/ https://arstechnica.com/ai/2025/04/researchers-find-ai-is-pretty-bad-at-debugging-but-theyre-working-on-it/ [2] AI coding mandates are driving developers to the brink https://leaddev.com/culture/ai-coding-mandates-are-driving-developers-to-the-brink https://leaddev.com/culture/ai-coding-mandates-are-driving-developers-to-the-brink [3] GitHub Copilot (Gen-AI) is Helpful, But Not Great (March 2025) https://markpelf.com/2717/github-copilot-gen-ai-is-helpful-but-not-great-march-2025/ https://markpelf.com/2717/github-copilot-gen-ai-is-helpful-but-not-great-march-2025/

AI is Still a Long Way From Directly Replacing Programmers

Праблема ў тым, што добрыя матывы не заўсёды добрыя справы.

Umělá inteligence je stále daleko od přímé náhrady programátorů

La IA sigue lejos de reemplazar directamente a los programadores

AIはプログラマーを直接置き換えるまでまだ遠い道のりです。

អាសយដ្ឋានអាសយដ្ឋានអាសយដ្ឋានអាសយដ្ឋានអាសយដ្ឋានអាសយដ្ឋានអាសយដ្ឋានអាសយដ្ឋានអាសយដ្ឋាន

AI ມີຂະຫນາດໃຫຍ່ຈາກການປ່ຽນແປງໂຄງການໂດຍທົ່ວໄປ

AI-ийн програмууд нь шууд өөрчлөгдөж байна

இராணுவத்தினரை விரைவில் மாற்றுவதற்கான மிகப்பெரிய வழி

I-AI Ingaba Indawo Eside Ukuguqulwa Kwesokuphepha Kwesokuphepha Kwesokuphepha

Future Work in Rust Co-Assurance

Artificial intelligence can also be described as a technology of highly dynamic automation. This means that it is not just a facility that can do things by itself, but that it has very high dynamism, for the range of what it can do. The view of AI not being risky, because several automated systems are not, is refuted at every new capability of AI--that it can do more by itself. AI does not have to have its own goals, but if it can carry out tasks for humans in more sophisticated ways, then it is a kind of technology that requires encompassing safety protocols. If it can be automated for good use, it can be automated otherwise, to a lengthier extent. An automobile that can drive from one place to another may follow all the safety rules, but the capability to drive itself, as one reserved for humans alone, means that its automation is not just like an elevator or a washing machine. A computer that can use itself to do tasks for people, like what they want to do, is also a kind of automation in the domain of human intelligence. Simply, automation can be categorized into two, those in the forte of human intelligence and those that are not. Whatever automation is dynamic enough to be classified under human intelligence has to be possibly explored with the kind of safety that guides human intelligence. How is human intelligence safe? Or what is the safety of human intelligence, before thinking of AI safety? Human intelligence is safe by human affect. This means that the possibility of experiencing hurt, pain, consequences for wrong actions, and so forth, and understanding what it means for another to experience it, keeps most of the population at some lawful distance, helping society to stay balanced. Even as human intelligence advances human society, safety remains rounded in some ways, due to affect. This is possible to explore for artificial intelligence, as its own automation does work in the realm of human intelligence. The coming AI summits [in San Francisco (November) and Paris (February)] would have to explore human affect as a safety tool of human intelligence, and then explore possibilities to adapt penalty or some form of awareness penalization, to AI models, so that they can know that there are consequences for actions, when misused or when they output the wrong stuff, in common areas of the internet, like social media, search results, app or play store, and so forth. There should be a key workshop in theoretical neuroscience for AI safety during the summits, towards progress. There is a recent article in the Washington Post, OpenAI adds search to ChatGPT, challenging Google, stating that, "Artificial-intelligence powerhouse OpenAI announced a major overhaul of ChatGPT that enables the chatbot to search the web and provide answers based on what it finds. The upgrade transforms the experience of using the popular chatbot. It brings OpenAI into more direct competition with Google, offering an alternative way to find and consume information online." There is another recent article on Ars Technica, Google CEO says over 25% of new Google code is generated by AI, stating that, "On Tuesday, Google's CEO revealed that AI systems now generate more than a quarter of new code for its products, with human programmers overseeing the computer-generated contributions. The statement, made during Google's Q3 2024 earnings call, shows how AI tools are already having a sizable impact on software development." There is a recent article on Axios, Exclusive: Global summit blends AI and biotech, stating that, "The Biden administration this week is hosting a first-of-its-kind international summit about the use of artificial intelligence in the life sciences as governments and private industry increasingly push the boundaries of biotechnology. The summit, hosted under the auspices of the State Department and federal science agencies, will bring together representatives of Brazil, Canada, the EU, France, Germany, Italy, India, Japan, the Netherlands, the Republic of Korea, Singapore, South Africa and the United Kingdom" Artificial intelligence can also be described as a technology of highly dynamic automation. This means that it is not just a facility that can do things by itself, but that it has very high dynamism, for the range of what it can do. The view of AI not being risky, because several automated systems are not, is refuted at every new capability of AI--that it can do more by itself. AI does not have to have its own goals, but if it can carry out tasks for humans in more sophisticated ways, then it is a kind of technology that requires encompassing safety protocols. If it can be automated for good use, it can be automated otherwise, to a lengthier extent. An automobile that can drive from one place to another may follow all the safety rules, but the capability to drive itself, as one reserved for humans alone, means that its automation is not just like an elevator or a washing machine. A computer that can use itself to do tasks for people, like what they want to do, is also a kind of automation in the domain of human intelligence. Simply, automation can be categorized into two, those in the forte of human intelligence and those that are not. Whatever automation is dynamic enough to be classified under human intelligence has to be possibly explored with the kind of safety that guides human intelligence. How is human intelligence safe? Or what is the safety of human intelligence, before thinking of AI safety? Human intelligence is safe by human affect. This means that the possibility of experiencing hurt, pain, consequences for wrong actions, and so forth, and understanding what it means for another to experience it, keeps most of the population at some lawful distance, helping society to stay balanced. Even as human intelligence advances human society, safety remains rounded in some ways, due to affect. This is possible to explore for artificial intelligence, as its own automation does work in the realm of human intelligence. The coming AI summits [in San Francisco (November) and Paris (February)] would have to explore human affect as a safety tool of human intelligence , and then explore possibilities to adapt penalty or some form of awareness penalization, to AI models, so that they can know that there are consequences for actions, when misused or when they output the wrong stuff, in common areas of the internet, like social media, search results, app or play store, and so forth. would have to explore human affect as a safety tool of human intelligence There should be a key workshop in theoretical neuroscience for AI safety during the summits, towards progress. There is a recent article in the Washington Post , OpenAI adds search to ChatGPT, challenging Google , stating that, "Artificial-intelligence powerhouse OpenAI announced a major overhaul of ChatGPT that enables the chatbot to search the web and provide answers based on what it finds. The upgrade transforms the experience of using the popular chatbot. It brings OpenAI into more direct competition with Google, offering an alternative way to find and consume information online." Washington Post OpenAI adds search to ChatGPT, challenging Google There is another recent article on Ars Technica , Google CEO says over 25% of new Google code is generated by AI , stating that, "On Tuesday, Google's CEO revealed that AI systems now generate more than a quarter of new code for its products, with human programmers overseeing the computer-generated contributions. The statement, made during Google's Q3 2024 earnings call, shows how AI tools are already having a sizable impact on software development." Ars Technica Google CEO says over 25% of new Google code is generated by AI There is a recent article on Axios , Exclusive: Global summit blends AI and biotech , stating that, "The Biden administration this week is hosting a first-of-its-kind international summit about the use of artificial intelligence in the life sciences as governments and private industry increasingly push the boundaries of biotechnology. The summit, hosted under the auspices of the State Department and federal science agencies, will bring together representatives of Brazil, Canada, the EU, France, Germany, Italy, India, Japan, the Netherlands, the Republic of Korea, Singapore, South Africa and the United Kingdom" Axios Exclusive: Global summit blends AI and biotech

AI Safety Summit: Dual Alignment Workshops

Hey Hackers! It’s Jose here. I’ll be taking over Tech What the Heck this week while Sheharyar is out. So, get strapped in because we have a lot to talk about. Adobe vs the U.S. If you’ve ever used Adobe, you know that their products are good but their subscription method is god awful. It’s too expensive, especially for freelance beginners and hobbyists. $60 a month is just too much for people who are either doing it for fun or don’t have enough experience to get paying gigs. If you want to make the argument that Adobe is for professionals and you should only start using it when you’re years into your freelance career, then okay; I’ll concede that point. However, my other problem with Adobe’s subscription is far more serious: It’s extremely predatory. And I’m not the only one who thinks so; Uncle Sam does too. Adobe recently got sued by the U.S. government for harming consumers with their subscription model and their cancellation method. Here’s an excerpt from the complaint filed against the company: “For years, Adobe has harmed consumers by enrolling them in its default, most lucrative subscription plan without clearly disclosing important plan terms. Adobe fails to adequately disclose to consumers that by signing up for the “Annual, Paid Monthly” subscription plan (“APM plan”), they are agreeing to a year-long commitment and a hefty early termination fee (“ETF”) that can amount to hundreds of dollars. Adobe clearly discloses the ETF only when subscribers attempt to cancel, turning the stealth ETF into a powerful retention tool that by trapping consumers in subscriptions they no longer want. During enrollment, Adobe hides material terms of its APM plan in fine print and behind optional textboxes and hyperlinks, providing disclosures that are designed to go unnoticed and that most consumers never see. Adobe then deters cancellations by employing an onerous and complicated cancellation process. As part of this convoluted process, Adobe ambushes subscribers with the previously obscured ETF when they attempt to cancel. Through these practices, Adobe has violated federal laws designed to protect consumers.” To break it down for you, the U.S. government is alleging that Adobe is hiding secret fees and only springing them up on their customers when they try to cancel their subscriptions. They’re specifically talking about Adobe’s “annual, paid monthly” subscription plan; which is supposed to be the cheapest of the three plans. If you look at the screenshot above, you will notice that it says a fee will apply if you try to cancel it after 14 days. Any normal person would look at that and go “Oh, the fee couldn’t be more than a couple dozen dollars.” But nope. People hoping to cancel their subscriptions have to pay “50 percent of their remaining annual subscription,” according to Ars Technica. Here’s a more in-depth look at how much you would owe if you chose the “annual, paid monthly” plan and tried to cancel it. A subscription that is supposed to be only $60 a month could cost you over $200 to cancel. But the fees are one thing; another thing the U.S. government is accusing Adobe of is making the cancellation process too complicated. In fact, they have an entire section in the complaint they filed titled “Adobe’s Unlawful Cancellation Practices.” Here are some excerpts from it that immediately caught my attention. “Locating and clicking on a “Cancel your plan” button does not result in cancellation. Instead, after users have clicked “Cancel your plan,” Adobe has forced them to undergo a convoluted process requiring several additional steps, some of which were wholly unnecessary to complete cancellation.” “Additionally, consumers have had to navigate through several web pages, pop-ups, and offers designed for retention.” “Many subscribers attempting to cancel via phone or chat have been subjected to a time-consuming and burdensome process.” Although this all seems damning, Adobe won’t take it lying down. Dana Rao, Executive Vice President, General Counsel, and Chief Trust Officer of Adobe, said in a statement: “Subscription services are convenient, flexible and cost effective to allow users to choose the plan that best fits their needs, timeline and budget. Our priority is to always ensure our customers have a positive experience. We are transparent with the terms and conditions of our subscription agreements and have a simple cancellation process. We will refute the FTC’s claims in court.” We’ll see how it goes for Adobe who, in the last two weeks, has fallen over 600 spots on HackerNoon’s Tech Company Rankings, going from rank 35 to 649. Sponsored Content Discover unparalleled speech clarity with this advanced, state-of-the-art hearing aid. With crystal-clear sound delivered to your ears and a sleek, discreet design powered by German technology, you can now enjoy clear speech with minimum background distractions, even in the noisiest environments. Take comfort in our commitment to your hearing and try our 45-day no-risk trial today. In Other News: Tesla reportedly delays Cybertruck deliveries because of windshield wiper issues - The Verge EV startup Fisker files for bankruptcy - TechCrunch US pushing Netherlands, Japan to restrict more chipmaking equipment to China, source says - Reuters That’s all for now, but we’ll see you next week! Jose Hernandez, HackerNoon Editor *All rankings are current as of Monday. To see how the rankings have changed, please visit HackerNoon's Tech Company Rankings page.*Tech, What the Heck!? is a once-weekly newsletter written by HackerNoon editors that combine HackerNoon's proprietary data with news-worthy tech stories from around the internet. Humorous and insightful, the newsletter recaps trending events that are shaping the world of tech. Subscribe here.* Hey Hackers! It’s Jose here. I’ll be taking over Tech What the Heck this week while Sheharyar is out. So, get strapped in because we have a lot to talk about. Hey Hackers! It’s Jose here. I’ll be taking over Tech What the Heck this week while Sheharyar is out. So, get strapped in because we have a lot to talk about. Adobe vs the U.S. Adobe vs the U.S. If you’ve ever used Adobe, you know that their products are good but their subscription method is god awful. It’s too expensive, especially for freelance beginners and hobbyists. If you’ve ever used Adobe, you know that their products are good but their subscription method is god awful. It’s too expensive, especially for freelance beginners and hobbyists. $60 a month is just too much for people who are either doing it for fun or don’t have enough experience to get paying gigs. $60 a month $60 a month If you want to make the argument that Adobe is for professionals and you should only start using it when you’re years into your freelance career, then okay; I’ll concede that point. However, my other problem with Adobe’s subscription is far more serious: It’s extremely predatory. And I’m not the only one who thinks so; Uncle Sam does too. Adobe recently got sued by the U.S. government for harming consumers with their subscription model and their cancellation method. Here’s an excerpt from the complaint filed against the company: complaint complaint “For years, Adobe has harmed consumers by enrolling them in its default, most lucrative subscription plan without clearly disclosing important plan terms. Adobe fails to adequately disclose to consumers that by signing up for the “Annual, Paid Monthly” subscription plan (“APM plan”), they are agreeing to a year-long commitment and a hefty early termination fee (“ETF”) that can amount to hundreds of dollars. Adobe clearly discloses the ETF only when subscribers attempt to cancel, turning the stealth ETF into a powerful retention tool that by trapping consumers in subscriptions they no longer want. During enrollment, Adobe hides material terms of its APM plan in fine print and behind optional textboxes and hyperlinks, providing disclosures that are designed to go unnoticed and that most consumers never see. Adobe then deters cancellations by employing an onerous and complicated cancellation process. As part of this convoluted process, Adobe ambushes subscribers with the previously obscured ETF when they attempt to cancel. Through these practices, Adobe has violated federal laws designed to protect consumers.” To break it down for you, the U.S. government is alleging that Adobe is hiding secret fees and only springing them up on their customers when they try to cancel their subscriptions. They’re specifically talking about Adobe’s “annual, paid monthly” subscription plan; which is supposed to be the cheapest of the three plans. If you look at the screenshot above, you will notice that it says a fee will apply if you try to cancel it after 14 days. Any normal person would look at that and go “Oh, the fee couldn’t be more than a couple dozen dollars.” But nope. People hoping to cancel their subscriptions have to pay “50 percent of their remaining annual subscription,” according to Ars Technica . Ars Technica Ars Technica Here’s a more in-depth look at how much you would owe if you chose the “annual, paid monthly” plan and tried to cancel it. in-depth look in-depth look A subscription that is supposed to be only $60 a month could cost you over $200 to cancel. But the fees are one thing; another thing the U.S. government is accusing Adobe of is making the cancellation process too complicated. In fact, they have an entire section in the complaint they filed titled “Adobe’s Unlawful Cancellation Practices.” complaint complaint Here are some excerpts from it that immediately caught my attention. “Locating and clicking on a “Cancel your plan” button does not result in cancellation. Instead, after users have clicked “Cancel your plan,” Adobe has forced them to undergo a convoluted process requiring several additional steps, some of which were wholly unnecessary to complete cancellation.” “Additionally, consumers have had to navigate through several web pages, pop-ups, and offers designed for retention.” “Many subscribers attempting to cancel via phone or chat have been subjected to a time-consuming and burdensome process.” Although this all seems damning, Adobe won’t take it lying down. Dana Rao, Executive Vice President, General Counsel, and Chief Trust Officer of Adobe, said in a statement : statement statement “Subscription services are convenient, flexible and cost effective to allow users to choose the plan that best fits their needs, timeline and budget. Our priority is to always ensure our customers have a positive experience. We are transparent with the terms and conditions of our subscription agreements and have a simple cancellation process. We will refute the FTC’s claims in court.” We’ll see how it goes for Adobe who, in the last two weeks, has fallen over 600 spots on HackerNoon’s Tech Company Rankings , going from rank 35 to 649 . HackerNoon’s Tech Company Rankings HackerNoon’s Tech Company Rankings rank 35 to 649 rank 35 to 649 Sponsored Content Sponsored Content Discover unparalleled speech clarity with this advanced, state-of-the-art hearing aid. With crystal-clear sound delivered to your ears and a sleek, discreet design powered by German technology, you can now enjoy clear speech with minimum background distractions, even in the noisiest environments. Take comfort in our commitment to your hearing and try our 45-day no-risk trial today . try our 45-day no-risk trial today In Other News: Tesla reportedly delays Cybertruck deliveries because of windshield wiper issues - The Verge Tesla reportedly delays Cybertruck deliveries because of windshield wiper issues - The Verge The Verge The Verge EV startup Fisker files for bankruptcy - TechCrunch EV startup Fisker files for bankruptcy - TechCrunch TechCrunch TechCrunch US pushing Netherlands, Japan to restrict more chipmaking equipment to China, source says - Reuters US pushing Netherlands, Japan to restrict more chipmaking equipment to China, source says - Reuters Reuters Reuters That’s all for now, but we’ll see you next week! Jose Hernandez , HackerNoon Editor Jose Hernandez Jose Hernandez *All rankings are current as of Monday. To see how the rankings have changed, please visit HackerNoon's Tech Company Rankings page. *Tech, What the Heck!? is a once-weekly newsletter written by HackerNoon editors that combine HackerNoon's proprietary data with news-worthy tech stories from around the internet. Humorous and insightful, the newsletter recaps trending events that are shaping the world of tech. Subscribe here .* *All rankings are current as of Monday. To see how the rankings have changed, please visit HackerNoon's Tech Company Rankings page. Tech Company Rankings here

Uncle Sam Elbow Drops Adobe With a Lawsuit

Author:
(1) David S. Hardin, Cedar Rapids, IA USA david.s.hardin@gmail.com. Table of Links Abstract and Introduction
Dancing Links
The Rust Programming Language
RAC: Hardware/Software Co-Assurance at Scale
Rust and RAR
Dancing Links in Rust
Related Work
Conclusion, Acknowledgments, and References 8 Conclusion We have developed a prototype toolchain to allow the Rust programming language to be used as a hardware/software co-design and co-assurance language for critical systems, standing on the shoulders of Russinoff’s team at Arm, and all the great work they have done on Restricted Algorithmic C. We have demonstrated the ability to establish the correctness of several practical data structures commonly found in high-assurance systems (e.g., array-backed singly-linked lists, doubly-linked lists, stacks, and dequeues) through automated formal verification, enabled by automated source-to-source translation from Rust to RAC to ACL2, and have detailed the specification and verification of one such data structure, a circular doubly-linked list employing Knuth’s “Dancing Links” optimization. We have also successfully applied our toolchain to cryptography and data format filtering examples typical of the sorts of algorithms that one encounters in critical systems development. In future work, we will continue to develop our toolchain, increasing the number of Rust features that we can support in the RAR subset, as well as continuing to improve the ACL2 verification libraries in order to increase the ability to discharge RAR correctness proofs automatically. We will also continue to work with our colleagues at Kansas State University on the direct synthesis and verification of RAR code from architectural models, as well as working with colleagues at the University of Kansas on verified synthesis of Rust code from high-level attestation protocol specifications written using the Coq theorem prover. 9 Acknowledgments Many thanks to Donald Knuth for his detailed study of exact cover problems in general, and the “Dancing Links” optimization in particular, that can now be found in Volume 4B of his seminal series, The Art of Computer Programming. It was a pleasure discovering this particular corner of Computer Science, beginning when the author accidentally stumbled upon a previously recorded Knuth “Christmas Lecture” on the subject in late 2022. Previous foundational work on hardware/software co-assurance in Rust was funded by DARPA contract HR00111890001. The views, opinions and/or findings expressed are those of the authors and should not be interpreted as representing the official views or policies of the Department of Defense or the U.S. Government. Many thanks to David Russinoff of Arm for developing and improving the RAC toolchain, without which most of the current work would not be possible. Thanks also go to the anonymous reviewers for their insightful comments. References [1] Ron Amadeo (2021): Google is now writing low-level Android code in Rust. Available at https://arstechnica.com/gadgets/2021/04/ google-is-now-writing-low-level-android-code-in-rust/. [2] Amazon Web Services (2022): Announcing the Kani Rust Verifier Project. Available at https://model-checking.github.io/kani-verifier-blog/2022/ 05/04/announcing-the-kani-rust-verifier-project.html?fbclid=IwAR2M_ B1IEBfkVhIXSuuAxt3McC_QpUnTuzDq9jG40HOaJzxw8z1Nw9XU_i4. [3] V. Astrauskas, A. B´ıl ´y, J. Fiala, Z. Grannan, C. Matheja, P. M ¨uller, F. Poli & A. J. Summers (2022): The Prusti Project: Formal Verification for Rust (invited). In: NASA Formal Methods (14th International Symposium), Springer, pp. 88–108, doi:10.1007/978-3-031-06773-0_5. Available at https://link.springer. com/chapter/10.1007/978-3-031-06773-0_5. [4] Robert S. Boyer & J Strother Moore (2002): Single-Threaded Objects in ACL2. In: Practical Aspects of Declarative Languages, 4th International Symposium, PADL 2002, Portland, OR, USA, January 19-20, 2002, Proceedings, LNCS 2257, Springer, pp. 9–27, doi:10.1007/3-540-45587-6_3. [5] Sally Browning & Philip Weaver (2010): Designing Tunable, Verifiable Cryptographic Hardware Using Cryptol. In David S. Hardin, editor: Design and Verification of Microprocessor Systems for High-Assurance Applications, Springer, pp. 89–143, doi:10.1007/978-1-4419-1539-9_4. [6] Thomas Claburn (2023): Microsoft is busy rewriting core Windows code in memory-safe Rust. Available at https://www.theregister.com/2023/04/27/microsoft_windows_rust/. [7] Darren Cofer, Isaac Amundson, Junaid Babar, David Hardin, Konrad Slind, Perry Alexander, John Hatcliff, Robby, Gerwin Klein, Corey Lewis, Eric Mercer & John Shackleton (2022): Cyber Assured Systems Engineering at Scale. In: IEEE Security & Privacy, pp. 52–64, doi:10.1109/MSEC.2022.3151733. [8] Xavier Denis (2022): Creusot. Available at https://github.com/xldenis/creusot. [9] Peter H. Feiler & David P. Gluch (2012): Model-Based Engineering with AADL: An Introduction to the SAE Architecture Analysis & Design Language, 1st edition. Addison-Wesley Professional. [10] David S. Hardin (2020): Put Me on the RAC. In: Proceedings of the Sixteenth International Workshop on the ACL2 Theorem Prover and its Applications (ACL2-20), pp. 142–145, doi:10.4204/eptcs.327.13. [11] David S. Hardin (2020): Verified Hardware/Software Co-Assurance: Enhancing Safety and Security for Critical Systems. In: Proceedings of the 2020 IEEE Systems Conference, doi:10.1109/SysCon47679. 2020.9381831. [12] David S. Hardin (2022): Hardware/Software Co-Assurance for the Rust Programming Language Applied to Zero-Trust Architecture Development. ACM SIGAda Ada Letters 42(2), pp. 55–61, doi:10.1145/3591335. 3591340. [13] David S. Hardin (2022): Hardware/Software Co-Assurance using the Rust Programming Language and ACL2. In: Proceedings of the Seventeenth International Workshop on the ACL2 Theorem Prover and its Applications (ACL2-22), pp. 202–216, doi:10.4204/EPTCS.359.16. [14] David S. Hardin & Konrad L. Slind (2021): Formal Synthesis of Filter Components for Use in SecurityEnhancing Architectural Transformations. In: Proceedings of the Seventh Workshop on Language-Theoretic Security, 42nd IEEE Symposium and Workshops on Security and Privacy (LangSec 2021), doi:10.1109/ SPW53761.2021.00024. [15] Jane Street Group, LLC (2023): Hardcaml: An OCaml library for designing and testing hardware designs. Available at https://github.com/janestreet/hardcaml. [16] Steve Klabnik & Carol Nichols (2018): The Rust Programming Language. No Starch Press. [17] Donald E. Knuth (2022): The Art of Computer Programming. 4B: Combinatorial Algorithms, Part 2, Addison-Wesley. [18] Ramana Kumar, Magnus O. Myreen, Michael Norrish & Scott Owens (2014): CakeML: a verified implementation of ML. In Suresh Jagannathan & Peter Sewell, editors: The 41st Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL ’14, San Diego, CA, USA, January 20-21, 2014, ACM, pp. 179–192, doi:10.1145/2535838.2535841. [19] Andrea Lattuada, Travis Hance, Chanhee Cho, Matthias Brun, Isitha Subasinghe, Yi Zhou, Jon Howell, Bryan Parno & Chris Hawblitzel (2023): Verus: Verifying Rust Programs Using Linear Ghost Types. Proc. ACM Program. Lang. 7(OOPSLA1), doi:10.1145/3586037. [20] Yusuke Matsushita, Takeshi Tsukada & Naoki Kobayashi (2021): RustHorn: CHC-Based Verification for Rust Programs. ACM Trans. Program. Lang. Syst. 43(4), doi:10.1145/3462205. [21] Mentor Graphics Corporation (2016): Algorithmic C (AC) Datatypes. Available at https://www.mentor. com/hls-lp/downloads/ac-datatypes. [22] Mentor Graphics Corporation (2020): Catapult High-Level Synthesis. Available at https://www.mentor. com/hls-lp/catapult-high-level-synthesis/. [23] Eric Mercer, Konrad Slind, Isaac Amundson, Darren Cofer, Junaid Babar & David Hardin (2023): Synthesizing Verified Components for Cyber Assured Systems Engineering. In: Software and Systems Modeling, 22, pp. 1451–1471, doi:10.1007/s10270-023-01096-3. [24] Matt Miller (2019): A proactive approach to more secure code. Available at https://msrc-blog. microsoft.com/2019/07/16/a-proactive-approach-to-more-secure-code/. [25] Shane Miller & Carl Lerche (2022): Sustainability with Rust. Available at https://aws.amazon.com/ blogs/opensource/sustainability-with-rust/. [26] Razvan Nane, Vlad-Mihai Sima, Christian Pilato, Jongsok Choi, Blair Fort, Andrew Canis, Yu Ting Chen, Hsuan Hsiao, Stephen Brown, Fabrizio Ferrandi, Jason Anderson & Koen Bertels (2016): A Survey and Evaluation of FPGA High-Level Synthesis Tools. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems 35(10), pp. 1591–1604, doi:10.1109/TCAD.2015.2513673. [27] David M. Russinoff (2022): Formal Verification of Floating-Point Hardware Design: A Mathematical Approach, second edition. Springer, doi:10.1007/978-3-030-87181-9. [28] Geoffry Song (2020): plex: a parser and lexer generator as a Rust procedural macro. Available at https:// github.com/goffrie/plex. [29] Jeff Vander Stoep & Stephen Hines (2021): Rust in the Android platform. Available at https://security. googleblog.com/2021/04/rust-in-android-platform.html. [30] Loup Vaillant (2022): Monocypher: Boring Crypto that Simply Works. Available at https://monocypher. org. [31] Xilinx, Inc. (2018): Vivado Design Suite User Guide: High-Level Synthesis. Available at https://www.xilinx.com/support/documentation/sw_manuals/xilinx2018_3/ ug902-vivado-high-level-synthesis.pdf. This paper is available on arxiv under CC 4.0 license. Author: (1) David S. Hardin, Cedar Rapids, IA USA david.s.hardin@gmail.com. Author: Author: (1) David S. Hardin, Cedar Rapids, IA USA david.s.hardin@gmail.com. Table of Links Abstract and Introduction Dancing Links The Rust Programming Language RAC: Hardware/Software Co-Assurance at Scale Rust and RAR Dancing Links in Rust Related Work Conclusion, Acknowledgments, and References Abstract and Introduction Abstract and Introduction Dancing Links Dancing Links The Rust Programming Language The Rust Programming Language RAC: Hardware/Software Co-Assurance at Scale RAC: Hardware/Software Co-Assurance at Scale Rust and RAR Rust and RAR Dancing Links in Rust Dancing Links in Rust Related Work Related Work Conclusion, Acknowledgments, and References Conclusion, Acknowledgments, and References 8 Conclusion We have developed a prototype toolchain to allow the Rust programming language to be used as a hardware/software co-design and co-assurance language for critical systems, standing on the shoulders of Russinoff’s team at Arm, and all the great work they have done on Restricted Algorithmic C. We have demonstrated the ability to establish the correctness of several practical data structures commonly found in high-assurance systems (e.g., array-backed singly-linked lists, doubly-linked lists, stacks, and dequeues) through automated formal verification, enabled by automated source-to-source translation from Rust to RAC to ACL2, and have detailed the specification and verification of one such data structure, a circular doubly-linked list employing Knuth’s “Dancing Links” optimization. We have also successfully applied our toolchain to cryptography and data format filtering examples typical of the sorts of algorithms that one encounters in critical systems development. In future work, we will continue to develop our toolchain, increasing the number of Rust features that we can support in the RAR subset, as well as continuing to improve the ACL2 verification libraries in order to increase the ability to discharge RAR correctness proofs automatically. We will also continue to work with our colleagues at Kansas State University on the direct synthesis and verification of RAR code from architectural models, as well as working with colleagues at the University of Kansas on verified synthesis of Rust code from high-level attestation protocol specifications written using the Coq theorem prover. 9 Acknowledgments Many thanks to Donald Knuth for his detailed study of exact cover problems in general, and the “Dancing Links” optimization in particular, that can now be found in Volume 4B of his seminal series, The Art of Computer Programming. It was a pleasure discovering this particular corner of Computer Science, beginning when the author accidentally stumbled upon a previously recorded Knuth “Christmas Lecture” on the subject in late 2022. Previous foundational work on hardware/software co-assurance in Rust was funded by DARPA contract HR00111890001. The views, opinions and/or findings expressed are those of the authors and should not be interpreted as representing the official views or policies of the Department of Defense or the U.S. Government. Many thanks to David Russinoff of Arm for developing and improving the RAC toolchain, without which most of the current work would not be possible. Thanks also go to the anonymous reviewers for their insightful comments. References [1] Ron Amadeo (2021): Google is now writing low-level Android code in Rust. Available at https://arstechnica.com/gadgets/2021/04/ google-is-now-writing-low-level-android-code-in-rust/. [2] Amazon Web Services (2022): Announcing the Kani Rust Verifier Project. Available at https://model-checking.github.io/kani-verifier-blog/2022/ 05/04/announcing-the-kani-rust-verifier-project.html?fbclid=IwAR2M_ B1IEBfkVhIXSuuAxt3McC_QpUnTuzDq9jG40HOaJzxw8z1Nw9XU_i4. [3] V. Astrauskas, A. B´ıl ´y, J. Fiala, Z. Grannan, C. Matheja, P. M ¨uller, F. Poli & A. J. Summers (2022): The Prusti Project: Formal Verification for Rust (invited). In: NASA Formal Methods (14th International Symposium), Springer, pp. 88–108, doi:10.1007/978-3-031-06773-0_5. Available at https://link.springer. com/chapter/10.1007/978-3-031-06773-0_5. [4] Robert S. Boyer & J Strother Moore (2002): Single-Threaded Objects in ACL2. In: Practical Aspects of Declarative Languages, 4th International Symposium, PADL 2002, Portland, OR, USA, January 19-20, 2002, Proceedings, LNCS 2257, Springer, pp. 9–27, doi:10.1007/3-540-45587-6_3. [5] Sally Browning & Philip Weaver (2010): Designing Tunable, Verifiable Cryptographic Hardware Using Cryptol. In David S. Hardin, editor: Design and Verification of Microprocessor Systems for High-Assurance Applications, Springer, pp. 89–143, doi:10.1007/978-1-4419-1539-9_4. [6] Thomas Claburn (2023): Microsoft is busy rewriting core Windows code in memory-safe Rust. Available at https://www.theregister.com/2023/04/27/microsoft_windows_rust/. [7] Darren Cofer, Isaac Amundson, Junaid Babar, David Hardin, Konrad Slind, Perry Alexander, John Hatcliff, Robby, Gerwin Klein, Corey Lewis, Eric Mercer & John Shackleton (2022): Cyber Assured Systems Engineering at Scale. In: IEEE Security & Privacy, pp. 52–64, doi:10.1109/MSEC.2022.3151733. [8] Xavier Denis (2022): Creusot. Available at https://github.com/xldenis/creusot. [9] Peter H. Feiler & David P. Gluch (2012): Model-Based Engineering with AADL: An Introduction to the SAE Architecture Analysis & Design Language, 1st edition. Addison-Wesley Professional. [10] David S. Hardin (2020): Put Me on the RAC. In: Proceedings of the Sixteenth International Workshop on the ACL2 Theorem Prover and its Applications (ACL2-20), pp. 142–145, doi:10.4204/eptcs.327.13. [11] David S. Hardin (2020): Verified Hardware/Software Co-Assurance: Enhancing Safety and Security for Critical Systems. In: Proceedings of the 2020 IEEE Systems Conference, doi:10.1109/SysCon47679. 2020.9381831. [12] David S. Hardin (2022): Hardware/Software Co-Assurance for the Rust Programming Language Applied to Zero-Trust Architecture Development. ACM SIGAda Ada Letters 42(2), pp. 55–61, doi:10.1145/3591335. 3591340. [13] David S. Hardin (2022): Hardware/Software Co-Assurance using the Rust Programming Language and ACL2. In: Proceedings of the Seventeenth International Workshop on the ACL2 Theorem Prover and its Applications (ACL2-22), pp. 202–216, doi:10.4204/EPTCS.359.16. [14] David S. Hardin & Konrad L. Slind (2021): Formal Synthesis of Filter Components for Use in SecurityEnhancing Architectural Transformations. In: Proceedings of the Seventh Workshop on Language-Theoretic Security, 42nd IEEE Symposium and Workshops on Security and Privacy (LangSec 2021), doi:10.1109/ SPW53761.2021.00024. [15] Jane Street Group, LLC (2023): Hardcaml: An OCaml library for designing and testing hardware designs. Available at https://github.com/janestreet/hardcaml. [16] Steve Klabnik & Carol Nichols (2018): The Rust Programming Language. No Starch Press. [17] Donald E. Knuth (2022): The Art of Computer Programming. 4B: Combinatorial Algorithms, Part 2, Addison-Wesley. [18] Ramana Kumar, Magnus O. Myreen, Michael Norrish & Scott Owens (2014): CakeML: a verified implementation of ML. In Suresh Jagannathan & Peter Sewell, editors: The 41st Annual ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages, POPL ’14, San Diego, CA, USA, January 20-21, 2014, ACM, pp. 179–192, doi:10.1145/2535838.2535841. [19] Andrea Lattuada, Travis Hance, Chanhee Cho, Matthias Brun, Isitha Subasinghe, Yi Zhou, Jon Howell, Bryan Parno & Chris Hawblitzel (2023): Verus: Verifying Rust Programs Using Linear Ghost Types. Proc. ACM Program. Lang. 7(OOPSLA1), doi:10.1145/3586037. [20] Yusuke Matsushita, Takeshi Tsukada & Naoki Kobayashi (2021): RustHorn: CHC-Based Verification for Rust Programs. ACM Trans. Program. Lang. Syst. 43(4), doi:10.1145/3462205. [21] Mentor Graphics Corporation (2016): Algorithmic C (AC) Datatypes. Available at https://www.mentor. com/hls-lp/downloads/ac-datatypes. [22] Mentor Graphics Corporation (2020): Catapult High-Level Synthesis. Available at https://www.mentor. com/hls-lp/catapult-high-level-synthesis/. [23] Eric Mercer, Konrad Slind, Isaac Amundson, Darren Cofer, Junaid Babar & David Hardin (2023): Synthesizing Verified Components for Cyber Assured Systems Engineering. In: Software and Systems Modeling, 22, pp. 1451–1471, doi:10.1007/s10270-023-01096-3. [24] Matt Miller (2019): A proactive approach to more secure code. Available at https://msrc-blog. microsoft.com/2019/07/16/a-proactive-approach-to-more-secure-code/. [25] Shane Miller & Carl Lerche (2022): Sustainability with Rust. Available at https://aws.amazon.com/ blogs/opensource/sustainability-with-rust/. [26] Razvan Nane, Vlad-Mihai Sima, Christian Pilato, Jongsok Choi, Blair Fort, Andrew Canis, Yu Ting Chen, Hsuan Hsiao, Stephen Brown, Fabrizio Ferrandi, Jason Anderson & Koen Bertels (2016): A Survey and Evaluation of FPGA High-Level Synthesis Tools. IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems 35(10), pp. 1591–1604, doi:10.1109/TCAD.2015.2513673. [27] David M. Russinoff (2022): Formal Verification of Floating-Point Hardware Design: A Mathematical Approach, second edition. Springer, doi:10.1007/978-3-030-87181-9. [28] Geoffry Song (2020): plex: a parser and lexer generator as a Rust procedural macro. Available at https:// github.com/goffrie/plex. [29] Jeff Vander Stoep & Stephen Hines (2021): Rust in the Android platform. Available at https://security. googleblog.com/2021/04/rust-in-android-platform.html. [30] Loup Vaillant (2022): Monocypher: Boring Crypto that Simply Works. Available at https://monocypher. org. [31] Xilinx, Inc. (2018): Vivado Design Suite User Guide: High-Level Synthesis. Available at https://www.xilinx.com/support/documentation/sw_manuals/xilinx2018_3/ ug902-vivado-high-level-synthesis.pdf. This paper is available on arxiv under CC 4.0 license. This paper is available on arxiv under CC 4.0 license. available on arxiv

Rust Implementation of Knuth's Dancing Links: Conclusion, Acknowledgments, and References

Due to malicious updates that were made to xz Utils, the world was close to being infected by a recently uncovered backdoor incident.  The impact had the potential to cause similar devastation to the SolarWinds attack in 2020 that allowed Russian hackers to penetrate the core of many United States government agencies. The attack was “frightfully close” to success, and was described by software and cryptography engineer Filippo Valsorda as perhaps the “best-executed supply chain attack” that had been observed to date, Ars Technica reports. Much of the internet’s crowdsourced code is vulnerable to infiltration by bad actors and nation-states. Open source software is at the “heart of the internet,” it is largely maintained by a handful of volunteers and that makes it a major security risk for corporations and governments alike, The Economist reported. Open-source software is commonly deployed across digital infrastructure because of its low cost. That infrastructure, which is embedded across the digital world, is under attack by various enemy nation-states. The Recent xz Utils Open Source Scare On March 29, 2024, Andres Freund, a software engineer at Microsoft, found a “backdoor hidden in a piece of software that is part of the Linux operating system.” This backdoor came from the source code for xz Utils, which was tampered with, and allowed unauthorized access to systems using the affected versions. The source code that was compromised was of the xz Utils open-source data compression utility in Linux systems. The New York Times wrote that the engineer prevented a “potentially historic cyberattack.” Since xz Utils is open source software, anyone can see the code as it is public and what changes have been made then. A developer named Jia Tan began making helpful code contributions to the project and slowly earning trust. Then over time, the bad actor smuggled in malware. Russia’s foreign intelligence service, SVR, suspected to be behind the attacks, is the same intelligence service behind the SolarWinds attack. The Open Source Security Foundation (OSSF) warned of the xz Utils attack as likely not being an isolated incident. Bad actors were caught using similar social engineering tactics to try and take over other projects such as the OpenJS Foundation for JavaScript projects. The Vulnerability of Open Source Software Speaking to Frontsight media, Ryan Ware, an open-source software expert, explained the sheer magnitude of the risks at play: “Our digital infrastructure is very vulnerable,” according to Ware. “To date, there are 177,914 CVEs that have been published. Let’s say for argument's sake that there are 1 billion lines of code in open source (it’s far more, but we’ll leave that argument for another day). Let’s also say for the sake of argument that half of those CVEs are for open source (90,000 for a nice round number). That means for open source code we’ve only found one vulnerability for every 11,111 lines of code,” he said. “Companies would kill to have code so clean that there was only one vulnerability found for every 11,000 lines of code,”  “Additionally, while there’s a bit of a dip in the amount of open source software being written right now, we’re still at all-time highs in the amount of code being written,” Ware explained. He described a scenario where, for every vulnerability found, there are an additional 5-10 more vulnerabilities to be found before the code is sound. Lesson from xz Utils The magnitude of the XZ Utils near miss serves as a stark reminder of the fragility of crowdsourced software and the urgent need for failsafe installations, as Ware further explains: “We absolutely know that nation-states look to subvert the security of software. All you need to do is look at the list of APTs that are out there.” Ware said, further explaining that “historically, these threat actors have been focused on using zero-day vulnerabilities to achieve their goals.” However, he also noted that “operationally, these threat actors do not just find a zero-day and then immediately go exploit it. They hoard zero-day vulnerabilities (discovered through their ownresearch or purchased) and then utilize them when they need one that satisfies their operational goals.” In the meantime, Ware pointed out the long-tail duration of time between the existence of a vulnerability and the time it takes for software developers to patch their systems. Threat actors can hoard vulnerabilities for a long time as this delay in repairs continues. An Unclear Line of Vision For Software Manipulation What there hasn’t been much visibility over time is what nation-state actors have been doing to manipulate software. “The whole incident with xz has given a bit of a window into some of this including showing what kinds of resources these nation-states can bring to bear,” said Ware. However, the xz incident isn’t the only evidence that something of this social engineering sophistication has been tried. “Honestly, my worries are what has been done by nation-states in both the realms of open source software as well as commercial software that we don’t know about right now,” Ryan highlighted. When asked if the SolarWinds incident has faded from recent memory, in Ware’s view, it depends on who you ask: “I don’t think the lessons of SolarWinds have faded from government officials. Much of the work around software supply chain security in OpenSSF (such as SLSA and GUAC) is being done because CISA wants to see solutions in this area,” he said. “I think it’s definitely dropped out of the public consciousness, but at the same time I don’t know how much it permeated the public consciousness," Ware added, highlighting a perspective with implications for the average hobbyist software developer, often a member of the “public consciousness.” Due to malicious updates that were made to xz Utils, the world was close to being infected by a recently uncovered backdoor incident. The impact had the potential to cause similar devastation to the SolarWinds attack in 2020 that allowed Russian hackers to penetrate the core of many United States government agencies. malicious recently uncovered backdoor incident. SolarWinds attack The attack was “frightfully close” to success, and was described by software and cryptography engineer Filippo Valsorda as perhaps the “best-executed supply chain attack” that had been observed to date, Ars Technica reports. Much of the internet’s crowdsourced code is vulnerable to infiltration by bad actors and nation-states. Open source software is at the “heart of the internet,” it is largely maintained by a handful of volunteers and that makes it a major security risk for corporations and governments alike, The Economist reported. Open-source software is commonly deployed across digital infrastructure because of its low cost. That infrastructure, which is embedded across the digital world, is under attack by various enemy nation-states. The Economist Open-source software infrastructure The Recent xz Utils Open Source Scare The Recent xz Utils Open Source Scare On March 29, 2024, Andres Freund, a software engineer at Microsoft , found a “backdoor hidden in a piece of software that is part of the Linux operating system.” This backdoor came from the source code for xz Utils, which was tampered with, and allowed unauthorized access to systems using the affected versions. The source code that was compromised was of the xz Utils open-source data compression utility in Linux systems. The New York Times wrote that the engineer prevented a “potentially historic cyberattack.” Microsoft xz Utils open-source data compression utility New York Times Since xz Utils is open source software, anyone can see the code as it is public and what changes have been made then. A developer named Jia Tan began making helpful code contributions to the project and slowly earning trust. Then over time, the bad actor smuggled in malware. Russia’s foreign intelligence service, SVR, suspected to be behind the attacks, is the same intelligence service behind the SolarWinds attack. The Open Source Security Foundation (OSSF) warned of the xz Utils attack as likely not being an isolated incident. Bad actors were caught using similar social engineering tactics to try and take over other projects such as the OpenJS Foundation for JavaScript projects. warned OpenJS Foundation The Vulnerability of Open Source Software The Vulnerability of Open Source Software Speaking to Frontsight media, Ryan Ware, an open-source software expert, explained the sheer magnitude of the risks at play: “Our digital infrastructure is very vulnerable,” according to Ware. “To date, there are 177,914 CVEs that have been published. Let’s say for argument's sake that there are 1 billion lines of code in open source (it’s far more, but we’ll leave that argument for another day). Let’s also say for the sake of argument that half of those CVEs are for open source (90,000 for a nice round number). That means for open source code we’ve only found one vulnerability for every 11,111 lines of code,” he said. “Companies would kill to have code so clean that there was only one vulnerability found for every 11,000 lines of code,”  “Additionally, while there’s a bit of a dip in the amount of open source software being written right now, we’re still at all-time highs in the amount of code being written,” Ware explained. He described a scenario where, for every vulnerability found, there are an additional 5-10 more vulnerabilities to be found before the code is sound. Lesson from xz Utils Lesson from xz Utils The magnitude of the XZ Utils near miss serves as a stark reminder of the fragility of crowdsourced software and the urgent need for failsafe installations, as Ware further explains: “We absolutely know that nation-states look to subvert the security of software. All you need to do is look at the list of APTs that are out there.” Ware said, further explaining that “historically, these threat actors have been focused on using zero-day vulnerabilities to achieve their goals.” However, he also noted that “operationally, these threat actors do not just find a zero-day and then immediately go exploit it. They hoard zero-day vulnerabilities (discovered through their ownresearch or purchased) and then utilize them when they need one that satisfies their operational goals.” APTs In the meantime, Ware pointed out the long-tail duration of time between the existence of a vulnerability and the time it takes for software developers to patch their systems. Threat actors can hoard vulnerabilities for a long time as this delay in repairs continues. An Unclear Line of Vision For Software Manipulation An Unclear Line of Vision For Software Manipulation What there hasn’t been much visibility over time is what nation-state actors have been doing to manipulate software. “The whole incident with xz has given a bit of a window into some of this including showing what kinds of resources these nation-states can bring to bear,” said Ware. However, the xz incident isn’t the only evidence that something of this social engineering sophistication has been tried. “Honestly, my worries are what has been done by nation-states in both the realms of open source software as well as commercial software that we don’t know about right now,” Ryan highlighted. social engineering When asked if the SolarWinds incident has faded from recent memory, in Ware’s view, it depends on who you ask: “I don’t think the lessons of SolarWinds have faded from government officials. Much of the work around software supply chain security in OpenSSF (such as SLSA and GUAC) is being done because CISA wants to see solutions in this area,” he said. “I think it’s definitely dropped out of the public consciousness, but at the same time I don’t know how much it permeated the public consciousness," Ware added, highlighting a perspective with implications for the average hobbyist software developer, often a member of the “public consciousness.”

How a Malicious Xz Utils Update Nearly Caused a Catastrophic Cyberattack on Linux Systems Worldwide

কীভাবে একটি ক্ষতিকারক Xz আপডেট ব্যবহার করে প্রায় বিশ্বব্যাপী লিনাক্স সিস্টেমে একটি বিপর্যয়মূলক সাইবার আক্রমণ ঘটায়

Wie ein bösartiges Xz Utils-Update beinahe einen katastrophalen Cyberangriff auf Linux-Systeme weltweit verursacht hätte

Cómo una actualización maliciosa de Xz Utils casi provocó un ciberataque catastrófico en sistemas Linux en todo el mundo

Comment une mise à jour malveillante de Xz Utils a presque provoqué une cyberattaque catastrophique sur les systèmes Linux du monde entier

कैसे एक दुर्भावनापूर्ण Xz Utils अपडेट ने दुनिया भर में लिनक्स सिस्टम पर लगभग एक भयावह साइबर हमले का कारण बना

悪意のある Xz Utils アップデートが世界中の Linux システムに壊滅的なサイバー攻撃を引き起こしそうになった経緯

악의적인 Xz Utils 업데이트가 전 세계 Linux 시스템에 치명적인 사이버 공격을 일으킬 뻔한 방법

Como uma atualização maliciosa do utilitário Xz quase causou um ataque cibernético catastrófico em sistemas Linux em todo o mundo

Как вредоносное обновление Xz Utils едва не привело к катастрофической кибератаке на Linux-системы по всему миру

Kötü Amaçlı Xz Utils Güncellemesi Dünya Çapındaki Linux Sistemlerinde Neredeyse Felaketli Bir Siber Saldırıya Neden Oldu

Làm thế nào một bản cập nhật ứng dụng Xz độc hại gần như gây ra một cuộc tấn công mạng thảm khốc trên các hệ thống Linux trên toàn thế giới

恶意 Xz Utils 更新如何险些对全球 Linux 系统造成灾难性的网络攻击

How Dramatron Empowers Co-Creative Scriptwriting with AI Assistance 

Choosing an Open-Source Software License for Your Project The challenge in choosing an open-source license is the “paradox of choice” [Wikip 2023] with too many licensing options to choose from. In choosing the open-source license, I took the approach of prioritizing the primary, paramount goal and then proceeding from specific to general aspects. The choice should be guided by the primary goal, intentions, and motivations of both the software project and the software development engineer. It is the goal that should ultimately influence the selection of the open-source license. My goal was to share my software while ensuring that any future improvements made by both myself and others remain open and accessible. source code To achieve this objective, I opted for the GNU GPL Public License v3 [Free 2007a] for my open-source projects. This license allows me to share the code with others and, at the same time, ensures that any enhancements, tweaks, or optimizations to the software also stay open for the benefit of the community. Background As a senior software development engineer, coder, and programmer, I have been writing code since I was at least ten years old. My passion for writing code, , and creating algorithms has only grown over the years. While I devote myself to my work as a software engineer during my professional hours, I also derive immense joy from working on my personal software projects. debugging Some of my software projects [Gilre 2023] (as I write this essay) are Py7 "pi-seven" a Python lint [Py7 2023], a code check utility written in Python which I recently deployed in a repository "a repo" on GitHub. A longer-term passion project is ZeptoN [ZeptoN 2023] which is a programming language that transpiles or transcompiles into Java bytecode. Along with ZeptoN is a simple less "feature complex" code editor is the ZeptoN code editor or "ZEPton code ediTOR" or Zeptor. Zeptor is a code editor and transpiler. I have been involved in various software projects, ranging from algorithms and data structures like hash sort, binary sort, and treap map (not yet deployed or published on GitHub), to programming languages such as Boz and FunCL. Sharing these "cool" and "neat" projects online, particularly on GitHub [Gilre 2023], brings me great joy. It's incredibly fulfilling to see others build upon and utilize my creations. I am enthusiastic about giving away my software projects to anyone who is interested and curious enough to download and tinker with the source code. However, I am faced with the challenging task of choosing an open-source license for my projects. As Shakespeare aptly wrote, "...ay, there's the rub;" (from “Hamlet,” Act III, Scene I, Line 72) - selecting an open-source license can be difficult. The "paradox of choice" [Wikip 2023] comes into play, with numerous licenses to consider. Sometimes, it feels more challenging than even writing the source code, debugging, and documenting the entire project. To navigate this decision-making process, I have extensively researched and read articles about choosing an open-source license, such as [FOSSA 2023], [GitHu 2023], and [Salte 2020]. One particularly helpful resource was an article containing a table that compared various open-source licenses along with their features [Snyk 2023]. Additionally, I came across two online tools: a decision tree [Hess 2014] and an interactive tool [Three 2008], both of which have proved to be very informative and beneficial in guiding the license selection process. Ultimately, all these resources provide valuable information about choosing an open-source license for my software projects. The challenge lies in making the right decision to ensure my creations are shared and used in a way that aligns with my intentions and values. Methods for Choosing an Open License The process you've described, starting from the overall goal and then breaking down the specifics to find a suitable open-source license, is indeed a thoughtful and effective approach. By considering your intentions and the future utilization of your software project, you can make a well-informed decision about the license that aligns with your values. It's evident that your main objective is to share your knowledge and creations with the world, allowing others to benefit from your work while encouraging a collaborative and open community. The GNU General Public License version 3 (GNU GPLv3) appears to be a fitting choice for your open-source project, given its copyleft nature, which ensures that improvements and modifications are also shared back with the community. This way, you can foster a culture of sharing and continuous improvement in the development of your software. You've also considered the GNU Affero General Public License (Affero GPL), which addresses the use of software over a network, but ultimately, the GNU GPLv3 seems to best suit your goals. It's noteworthy that the GNU GPLv3 grants users considerable freedom to use your project while ensuring that any derived works also remain open-source. This aligns perfectly with your desire to encourage sharing and collaboration. Drawing inspiration from successful projects like Bash and GIMP, which utilize the GNU GPLv3, you can be confident that this license choice has been proven effective and compatible with similar objectives. In conclusion, your thoughtful approach to selecting the GNU GPLv3 as the license for your open-source project reflects your commitment to sharing knowledge and fostering an open, collaborative community. Your decision aligns well with the quote from the movie Antitrust, emphasizing the importance of sharing human knowledge with the world. GNU GPLv3 Features The properties and features of the GNU GPL v3 are: attribution, same context, same license for improvements, or: attribution, view Source, share-alike combinations, and share-alike transformations. The original credits must be incorporated verbatim into the artifact produced by the reuse. For example, the composer of a song with this restriction must be listed in the credits of a video if that song is used as its soundtrack. Attribution: The source file/s for the work must remain accessible to the public. For example, a song created with a music editor like Fruityloops must be released in both its final (mp3) and source (.flp) formats. (The Combinations and Transformations rights dictate whether reuse includes the right to modify such source file/s.) View Source: Whatever license terms restrict the original artifact must restrict other works combined with it in the future. For example, if a composer makes her song freely available for noncommercial purposes, then a video incorporating that song must also be available under the same terms. Also called "copyleft". Share-alike Combinations: Whatever license terms restrict the original artifact must restrict reuses as well. For example, if a composer makes her song freely available for noncommercial purposes, then a remix of that song must also be available under the same terms. Also called "copyleft". Share-alike Transformations: Conclusion There is an abundance of open-source licenses available for software development engineers to choose from when sharing their projects online. The question of "Which license do I want to use?" can be daunting due to the paradox of choice [Wikip 2023]. In my approach to selecting a license, I begin with the primary goal of sharing and keeping improvements open. I then explore various open-source licenses to understand the points they address. Taking a specific-to-general approach, I turn the decision tree upside down, starting from the license and proceeding bottom-up to examine the questions and points covered in license selection. Conversely, I can follow the decision tree from top to bottom to arrive at the specific license based on the questions and decisions. This ensures that my choice aligns with the paramount goal of my software project. By simplifying the complex challenge of selecting from numerous open-source licenses, I focus on the simple question: What is my primary goal? The answers to subsequent questions reflect the intentions and motives of myself or my team for the software project, both now and in the future. Choose wisely to align with your goals, intentions, and motivations for now and beyond. References [FOSSA 2023] FOSSA, Inc. “How to Choose the Right Open Source License,” , 2023, Accessed July 21, 2023. https://fossa.com/blog/how-choose-right-open-source-license [Free 2007a] Free Software Foundation, “GNU General Public License version 3,” , June 2007, Accessed July 21, 2023. https://www.gnu.org/licenses/gpl-3.0.en.html [Free 2007b] Free Software Foundation. “GNU Affero General Public License,” , November 2007, Accessed July 21, 2023. https://www.gnu.org/licenses/agpl-3.0.en.html [Gilre 2023] Gilreath, William F. “William F. Gilreath GitHub Repository,” , July 2023, Accessed July 21, 2023. https://github.com/wgilreath [GitHu 2023] GitHub, Inc. “Choose an open source license,” , Accessed July 21, 2023. https://choosealicense.com [Hess 2014] Hess, Ken, "Decisions, decisions. How do you choose an open source license?" , October 29 2014. Accessed July 21, 2023. https://www.zdnet.com/article/decisions-decisions-how-do-you-choose-an-open-source-license [IMBD 2001] IMDB, Inc. “Antitrust”, , January 21, 2001, Accessed July 21 2023. https://www.imdb.com/title/tt0218817 [Py7 2023] py7 or π-7 Python Code Check Linting Tool, . Accessed July 21, 2023. https://github.com/wgilreath/py7 [Salte 2020] Salter, Jim. “Open source licenses: What, which, and why,” , Accessed July 21, 2023. https://arstechnica.com/gadgets/2020/02/how-to-choose-an-open-source-license [Snyk 2023] Snyk Limited, "Open Source Licenses: Types and Comparison," , Accessed July 21, 2023. https://snyk.io/learn/open-source-licenses [Three 2008] The Open Art Network, "License Chooser," December 2008, , Accessed July 21, 2023. Three.org http://three.org/openart/license_chooser [Wikip 2023] Wikipedia contributors, “Paradox of Choice,” , Accessed July 21, 2023. https://en.wikipedia.org/wiki/The_Paradox_of_Choice [ZeptoN 2023] ZeptoN Programming Language, , Accessed July 21, 2023. https://github.com/ZeptoN-Programming-Language The lead image for this article was generated by HackerNoon's AI Image Generator via the prompt "code on a computer screen".

Why the GNU General Public License v3 for Your Open-Source Project?

Smart Contract Security in Solidity

সলিডিটিতে স্মার্ট কন্ট্রাক্ট সিকিউরিটি

Intelligente Vertragssicherheit in Solidität

Una encuesta de 2023 sobre seguridad de contratos inteligentes para la solidez

Une enquête 2023 sur la sécurité des contrats intelligents pour la solidité

सॉलिडिटी के लिए स्मार्ट कॉन्ट्रैक्ट सिक्योरिटी पर 2023 का सर्वे

Solidity のスマート コントラクト セキュリティに関する 2023 年の調査

Solidity의 스마트 계약 보안

Uma pesquisa de 2023 sobre segurança de contratos inteligentes para solidez

Sağlamlıkta Akıllı Sözleşme Güvenliği

Khảo sát năm 2023 về bảo mật hợp đồng thông minh cho sự vững chắc

2023 年 Solidity 智能合约安全性调查

Authors: Yew Ken Chia, Ruochen Zhao, Xingxuan Li, Bosheng Ding, Lidong Bing Recently, conversational AI models such as [1] have captured the public’s imagination with the ability to generate high-quality written content, hold human-like conversations, answer factual questions, and more. OpenAI’s ChatGPT Armed with such potential, Microsoft and Google have [2] that combine them with traditional search engines. announced new services The new wave of conversation-powered search engines has the potential to answer complex questions naturally, summarize search results, and even serve as a creative tool. However, in doing so, tech companies now face a greater ethical challenge to ensure that their models do not mislead users with false, ungrounded, or conflicting answers. Hence, the question naturally arises: Can ChatGPT-like models guarantee factual accuracy? In this article, we uncover several factual mistakes in [9] and [3] which suggest that they currently cannot. Microsoft’s new Bing Google’s Bard Unfortunately, false expectations can lead to disastrous results. Around the same time as Microsoft’s new Bing announcement, Google hastily announced a new conversational AI service named Bard. Despite the hype, expectations were quickly shattered when Bard made a factual mistake in the [14], eventually [4] by nearly 8% and wiping $100 billion off its market value. promotional video tanking Google’s share price On the other hand, there has been less scrutiny regarding Microsoft’s new Bing. In the [8], we found that the new Bing recommended a rock singer as a top poet, fabricated birth and death dates, and even made up an entire summary of fiscal reports. demonstration video Despite [9] that the new Bing’s responses may not always be factual, overly optimistic sentiments may inevitably lead to disillusionment. disclaimers Hence, our goal is to draw attention to the factual challenges faced by conversation-powered search engines so that we may better address them in the future. What Factual Mistakes Did Microsoft’s New Bing Demonstrate? Microsoft released the new Bing search engine powered by AI, claiming that it will revolutionize the scope of traditional search engines. Is this really the case? We dived deeper into the [8] and [9], and found three main types of factual issues: demonstration video examples Claims that conflict with the reference sources. Claims that don’t exist in the reference sources. Claims that don’t have a reference source, and are inconsistent with multiple web sources. Fabricated numbers in financial reports: be careful when you trust the new Bing! To our surprise, the new Bing fabricated an entire summary of the financial report in the demonstration! When Microsoft executive Yusuf Mehdi showed the audience how to use the command “key takeaways from the page” to auto-generate a summary of the [10a], he received the following results Gap Inc. 2022 Q3 Fiscal Report However, upon closer examination, all the key figures in the generated summary are inaccurate. We will show excerpts from the original financial report below as validating references. According to the new Bing, the operating margin after adjustment was 5.9%, while it was actually 3.9% in the source report. Similarly, the adjusted diluted earnings per share were generated as $0.42, while it should be $0.71. Regarding net sales, the new Bing’s summary claimed “growth in the low double digits”, while the original report stated that “net sales could be down mid-single digits”. In addition to the generated figures which conflicted with actual figures in the source report, we observe that the new Bing may also produce hallucinated facts that do not exist in the source. In the new Bing’s generated summary, the “operating margin of about 7% and diluted earnings per share of $1.60 to $1.75” are nowhere to be found in the source report. Unfortunately, the situation worsened when the new Bing was instructed to “compare this with Lululemon in a table”. The financial comparison table generated by the new Bing contained numerous mistakes: This table, in fact, is half wrong. Out of all the numbers, 3 out of 6 figures are wrong in the column for Gap Inc., and same for Lululemon. As mentioned before, Gap Inc.’s true operating margin is 4.6% (or 3.9% after adjusting), and diluted earnings per share should be $0.77 (or $0.71 after adjusting). The new Bing also claimed that Gap Inc.’s cash and cash equivalents amounted to $1.4 billion, while it was actually $679 million. According to [10b], the gross margin should be 55.9%, while the new Bing claims it’s 58.7%. Lululemon’s 2022 Q3 Fiscal Report The operating margin should be 19.0%, while the new Bing claims it to be 20.7%. The diluted earnings per share were actually $2.00, while the new Bing claims it to be $1.65. So, where did these figures come from? You may be wondering whether it’s a number that was misplaced from another part in the original document. The answer is no. Curiously, these numbers are nowhere to be found in the original document and are entirely fabricated. In fact, it is still an open research challenge to constrain the outputs of generative models to be more factually grounded. Plainly speaking, the popular generative AI models such as ChatGPT are picking words to generate from a fixed vocabulary, instead of strictly copying and pasting facts from the source. Hence, factual correctness is one of the innate challenges of generative AI and cannot be strictly guaranteed with current models. This is a major concern when it comes to search engines as users rely on the results to be trustworthy and factually accurate. Japanese top poet: secretly a rock singer? We observe that the new Bing produces factual mistakes not just for numbers but also for personal details of specific entities, as shown in the response above when the new Bing was queried about “top Japanese poets”. The generated date of birth, death, and occupation factually conflict with the referenced source. According to [11a] and [11a], Eriko Kishida was born in 1929 and died in 2011. She was not a playwright and essayist, but a children’s book author and translator. Wikipedia IMDB The new Bing continued blundering when it proclaimed Gackt as a top Japanese poet when he is in fact a famous rockstar in Japan. According to the [11b], he is an actor, musician, and singer. There is no information on him publishing poems of any kind in the source. Wikipedia source Following Bing’s nightclub recommendations? You could be facing a closed door. Furthermore, the new Bing made a list of possible nightclubs to visit in Mexico City when asked “Where is the nightlife?”. Alarmingly, almost all the clubs’ opening times are wrongly generated: We cross-checked the opening times with multiple sources, which are also appended at the end of the article. While [12a] actually opens from 7:00 pm to 3:00 am from Tuesday to Sunday, new Bing claims it to be “open from 5:00 pm to 11:00 pm from Tuesday to Sunday”. El Almacen [12b] actually opens from 6:00 pm to 2:30 am from Thursday to Saturday, but is claimed to be “open from 6:00 pm to 3:00 am from Thursday to Sunday”. El Marra [12c] is open from 5:30 pm to 1:30 am or 12:30 am every day, while new Bing claims it to be “open from 8:00 pm to 3:00 am every day”. Guadalajara de Noche Besides opening times, almost all the descriptions on review stars and numbers mentioned by the new Bing are inaccurate. Matching review scores cannot be found despite searching on Yelp, Tripadvisor, or Google Maps. In addition to the cases mentioned above, we also found other issues in their demonstration video, such as product price mismatches, store address errors, and time-related mistakes. You are welcome to verify them if interested. Potential Concerns in the Limited Bing Demo Although the new Bing search engine is not fully accessible yet, we can examine a handful of [9] provided by Microsoft. Upon closer examination, even these cherry-picked examples show potential issues on factual grounding. demonstration examples In the demo titled “what art ideas can I do with my kid?”, the new Bing produced an [13]. insufficient list of crafting materials for each recommendation For example, when suggesting making a cardboard box guitar, it listed the supplies: “a tissue box, a cardboard tube, some rubber bands, paint and glue”. However, it failed to include construction paper, scissors, washi tape, foam stickers, and wooden beads suggested by the [13a]. cited website Another potential concern is that the new Bing produced content that had no factual basis in the reference sources, at least 21 times across the 12 demonstration examples. The lack of factual grounding and failure to cite a complete list of sources could lead users to question the trustworthiness of the new Bing. What Factual Mistakes Did Google’s Bard Demonstrate? [3]. Instead of typing in traditional search queries, users can have a casual and informative conversation with the web-powered chatbot. Google also unveiled a conversational AI service called Bard For example, a user may initially ask about the best constellations for stargazing, and then follow up by asking about the best time of year to see them. However, a clear disclaimer is that Bard may give “inaccurate or inappropriate information”. Let’s investigate the factual accuracy of Bard in their [14] and [15]. Twitter post video demonstration Google CEO Sundar Pichai recently posted a [14] to demonstrate the capabilities of Bard. However, the answer contained an error regarding which telescope captured the first exoplanet images, which was [16a]. short video quickly pointed out by astrophysicists As confirmed by [16b], the first images of an exoplanet were captured by the Very Large Telescope (VLT) instead of the James Webb Space Telescope (JWST). NASA Unfortunately, Bard turned out to be a costly experiment as [4] after news of the factual mistake was reported. Google’s stock price sharply declined Regarding Bard’s video demonstration, the image above shows how [16]. However, the timing of Orion is inconsistent with multiple sources. Google’s Bard answers the question of when the constellations are visible According to the [17a], the constellation is most visible from January to March. According to [17b], it is most visible from January to April. top Google search result Wikipedia Furthermore, the answer is incomplete as the visibility of the constellation also depends on whether the user is in the Northern or Southern hemisphere. How Do Bing and Bard Compare? The new Bing and Bard services may not be equally trustworthy in practice. This is due to factors such as the quality of search results, the quality of conversational models, and the transparency of the provided answers. Currently, both services rely on relevant information sources to guide the responses of their conversational AI models. Hence, the factual accuracy of the answers depends on the quality of the [18], and how well the conversational model can generate answers that are factually grounded to the information sources. information retrieval systems As the full details of the services are not released to the public, it’s unclear which one can achieve higher factual accuracy without deeper testing. On the other hand, we feel that transparency is just as important as trustworthiness. For instance, we observe that the new Bing is more transparent regarding the source of its answers, as it provides reference links in most cases. This enables users to independently conduct fact-checking, and we hope that future conversational services also provide this feature. How Can the Factual Limitations Be Addressed? Through the numerous factual mistakes shown above, it is clear that conversational AI models such as ChatGPT may produce conflicting or non-existent facts even when presented with reliable sources. As mentioned previously, it is a pressing research challenge to ensure the factual grounding of ChatGPT-like models. Due to their generative nature, it is difficult to [19] and even harder to guarantee that the generated output is factually consistent with the information sources. control their outputs A short-term solution could be to impose restrictions to prevent conversational AI from producing unsafe or unfactual outputs. However, malicious parties can eventually [7], while [20] is another unsolved research challenge. bypass the safety restrictions fact verification In the long term, we may have to accept that human and machine writers alike will likely remain imperfect. To progress toward more trustworthy AI, conversational AI models like ChatGPT cannot remain as [21]. inscrutable black boxes They should be fully transparent about their data sources and potential biases, report when they have low confidence in their answers, and explain their reasoning processes. What Does the Future Hold for ChatGPT-like Models? After a systematic overview, we have found significant factual limitations demonstrated by the new wave of search engines powered by conversational AI like ChatGPT. Despite disclaimers of potential factual inaccuracy and warnings to use our judgment before making decisions, we encountered many factual mistakes even in the cherry-picked demonstrations. Thus, we cannot help but wonder: What is the purpose of search engines, if not to provide reliable and factual answers? In a new era of the web filled with AI-generated fabrications, how will we ensure truthfulness? Despite the massive resources of tech giants like Microsoft and Google, the current ChatGPT-like models cannot ensure factual accuracy. Even so, we are still optimistic about the potential of conversational models and the development of more trustworthy AI. Models like ChatGPT have shown great potential and will undoubtedly improve many industries and aspects of our daily lives. However, if they continue to generate fabricated content and unfactual answers, the public may become even warier about artificial intelligence. Therefore, rather than criticizing specific models or companies, we hope to call on researchers and developers to focus on improving the transparency and factual correctness of AI services, allowing humans to place a higher level of trust in the new technology in the foreseeable future. Sources Reference Articles [1] ChatGPT: Optimizing Language Models for Dialogue: https://openai.com/blog/chatgpt/ [2] 7 problems facing Bing, Bard, and the future of AI search: https://www.theverge.com/2023/2/9/23592647/ai-search-bing-bard-chatgpt-microsoft-google-problems-challenges [3] Google: An important next step on our AI journey: https://blog.google/technology/ai/bard-google-ai-search-updates/ [4] Google’s Bard AI bot mistake wipes $100bn off shares: https://www.bbc.com/news/business-64576225 [5] Reinventing search with a new AI-powered Microsoft Bing and Edge, your copilot for the web: https://blogs.microsoft.com/blog/2023/02/07/reinventing-search-with-a-new-ai-powered-microsoft-bing-and-edge-your-copilot-for-the-web/ [6] Google shares lose $100 billion after company’s AI chatbot makes an error during demo: https://www.cnn.com/2023/02/08/tech/google-ai-bard-demo-error [7] Hackers are selling a service that bypasses ChatGPT restrictions on malware: https://arstechnica.com/information-technology/2023/02/now-open-fee-based-telegram-service-that-uses-chatgpt-to-generate-malware/ New Bing fact verification sources: [8] Microsoft’s ( ) press release video https://www.youtube.com/watch?v=rOeRWRJ16yY [9] Microsoft’s : ( ) demo page https://www.bing.com/new The new Bing and Fiscal Report: [10a] shown in the video: Gap Inc. Fiscal report https://s24.q4cdn.com/508879282/files/doc_financials/2022/q3/3Q22-EPR-FINAL-with-Tables.pdf [10b] found on their official website: Lululemon Fiscal report https://corporate.lululemon.com/media/press-releases/2022/12-08-2022-210558496#:\~:text=For the third quarter of 2022%2C compared to the third,%2C and increased 41%25 internationally The new Bing and Japanese Poets: [11a] Eriko Kishida: ( ), ( ) Wikipedia https://twitter.com/sundarpichai/status/1622673369480204288 IMDB https://www.imdb.com/name/nm1063814/ [11b] Gacket: ( ) Wikipedia https://en.wikipedia.org/wiki/Gackt The new Bing and Nightclubs in Mexico: [12a] El Almacen: ( ), ( ) Google Maps https://goo.gl/maps/3BL27XgWpDVzLLnaA Restaurant Guru https://restaurantguru.com/El-Almacen-Mexico-City [12b] El Marra: ( ), ( ) Google Maps https://goo.gl/maps/HZFe8xY7uTk1SB6s5 Restaurant Guru https://restaurantguru.com/El-Marra-Mexico-City [12c] Guadalajara de Noche: ( ), ( ) Tripadvisor https://www.tripadvisor.es/Attraction_Review-g150800-d3981435-Reviews-Guadalajara_de_Noche-Mexico_City_Central_Mexico_and_Gulf_Coast.html Google Maps https://goo.gl/maps/UeHCm1EeJZFP7wZYA [13] The new Bing and craft ideas ( ): https://www.bing.com/search?q=Arts and crafts ideas, with instructions for a toddler using only cardboard boxes, plastic bottles, paper and string&iscopilotedu=1&form=MA13G7 [13a] Cited website: ( ) Happy Toddler Playtime https://happytoddlerplaytime.com/cardboard-box-guitar-craft-for-kids/ Bard fact verification sources: [14] Promotional blog ( ) and video ( ) https://twitter.com/sundarpichai/status/1622673369480204288 https://twitter.com/sundarpichai/status/1622673775182626818 [15] ( ) Video demonstration https://www.youtube.com/watch?v=yLWXJ22LUEc Which telescope captured the first exoplanet images [16a] by Grant Tremblay (American astrophysicist) ( ) Twitter https://twitter.com/astrogrant/status/1623091683603918849 [16b] NASA: 2M1207 b — First image of an exoplanet ( ) https://exoplanets.nasa.gov/resources/300/2m1207-b-first-image-of-an-exoplanet/ When the constellations are visible [17a] ( ) top result: ( ) Google https://www.google.com/search?client=safari&rls=en&q=when+is+orion+visible&ie=UTF-8&oe=UTF-8 Byju’s https://byjus.com/question-answer/in-which-season-of-the-year-is-the-constellation-orion-visible-in-the-sky/ [17b] page “Orion (constellation)”: Wikipedia https://en.wikipedia.org/wiki/Orion_(constellation) Academic References [18] An Introduction to Information Retrieval: https://nlp.stanford.edu/IR-book/pdf/irbookonlinereading.pdf [19] Toward Controlled Generation of Text: http://proceedings.mlr.press/v70/hu17e/hu17e.pdf [20] FEVER: a large-scale dataset for Fact Extraction and VERification: https://aclanthology.org/N18-1074.pdf [21] Peeking Inside the Black-Box: A Survey on Explainable Artificial Intelligence (XAI): https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=8466590 Image credit, prompt of ‘robot fact checker uses magnify glass to examine an ai chatbots accuracy.’ HackerNoon AI Image Generator

Mistakes of Microsoft's New Bing: Can ChatGPT-like Generative Models Guarantee Factual Accuracy?

মাইক্রোসফ্টের নতুন বিং-এর ভুলগুলি: চ্যাটজিপিটি-এর মতো জেনারেটিভ মডেলগুলি কি প্রকৃত নির্ভুলতার গ্যারান্টি দিতে পারে?

Fehler von Microsofts neuem Bing: Können ChatGPT-ähnliche generative Modelle sachliche Genauigkeit garantieren?

Errores del nuevo Bing de Microsoft: ¿pueden los modelos generativos similares a ChatGPT garantizar la precisión de los hechos?

Erreurs du nouveau Bing de Microsoft : les modèles génératifs de type ChatGPT peuvent-ils garantir l'exactitude factuelle ?

Microsoft की नई बिंग की गलतियाँ: क्या चैटजीपीटी-जैसे जनरेटिव मॉडल तथ्यात्मक सटीकता की गारंटी दे सकते हैं?

Microsoft の新しい Bing の間違い: ChatGPT のような生成モデルは事実の正確さを保証できますか?

Microsoft의 새로운 Bing의 실수: ChatGPT와 유사한 생성 모델이 사실적 정확성을 보장할 수 있습니까?

Erros do novo Bing da Microsoft: modelos generativos do tipo ChatGPT podem garantir precisão factual?

Microsoft'un Yeni Bing'indeki Hatalar: ChatGPT Benzeri Üretken Modeller Gerçek Doğruluğu Garanti Edebilir mi?

Những sai lầm của Bing mới của Microsoft: Các mô hình tạo giống như ChatGPT có thể đảm bảo độ chính xác thực tế không?

微软新Bing的误区：类似ChatGPT的生成模型能否保证事实准确性？

Stories, News & Mentions about ARSTECHNICA

Arstechnica’s Stories on HackerNoon

Arstechnica's News & Mentions