Full Width 
Shortcuts 
Sign Up 
Log In 
Articles 
Reading List More from pcloadletter
I saw a cool version of the Monty Hall game here recently: https://monty.donk.systems. This is really cool! But I had an itch I wanted to scratch: rather than manually test out the probabilities, I wanted to run two games side-by-side: one where a switch happened and one where a switch didn't happen. Then, running those over and over, we should see the overall win percentages converge to 66.7% for switching and 33.3% for not switching. So I coded up a simulation here to scratch my itch! Controls # To control the simulation, you can start or stop here. You can also adjust the speed. Speed (between 1-30): Score # Cumulative stats as the games go on. Scenario Plays Wins Win Percent Switch 0 0 - No switch 0 0 - Switch simulation # If we switch cards after the first goat reveal. +---+ +---+ +---+ | | | | | | +---+ +---+ +---+ No switch simulation # If we don't switch. +---+ +---+ +---+ | | | | | | +---+ +---+ +---+ { playBtn.setAttribute('disabled', 'true'); setTimeout(() => { playBtn.removeAttribute('disabled'); }, 3000); started = !started; playBtn.innerHTML = started ? "Stop simulation" : "Start simulation"; play(true); play(false); }) let playCount = 0; let switchWinCount = 0; let nsPlayCount = 0; let noSwitchWinCount = 0; const playCountDisplay = document.querySelector('#plays'); const winCountDisplay = document.querySelector('#wins'); const winPctDisplay = document.querySelector('#win-pct'); const nsPlayCountDisplay = document.querySelector('#ns-plays'); const nsWinCountDisplay = document.querySelector('#ns-wins'); const nsWinPctDisplay = document.querySelector('#ns-win-pct'); const getRandomIndex = () => { return Math.floor(Math.random() * 3); } const boardDoors = (isSwitch) => document.querySelectorAll(`#${isSwitch ? '' : 'no-'}switch-board span.card`); const boardGuesses = (isSwitch) => document.querySelectorAll(`#${isSwitch ? '' : 'no-'}switch-board span.guess`); const clearBoard = (isSwitch) => { for (let i = 0; i { speed = parseInt(e.target.value); }) const delay = (seconds) => { return new Promise(res => { setTimeout(res, seconds * 1000 / speed) }); } const doorIndices = [0, 1, 2]; const setStatus = (isSwitch, text) => { const statusArea = document.querySelector(`#${isSwitch ? '' : 'no-'}switch-board section`); statusArea.innerHTML = text; } async function play(isSwitch) { if (!started) return; setStatus(isSwitch, " "); clearBoard(isSwitch); // Start with all goats const doors = new Array(3).fill("G"); // Add prize randomly const winIndex = getRandomIndex(); doors[winIndex] = "C"; await delay(0.5); setStatus(isSwitch, "Initial guess") await delay(0.5); // Select random spot for guess let guessIndex = getRandomIndex(); boardGuesses(isSwitch)[guessIndex].innerHTML = "✔" await delay(0.5); setStatus(isSwitch, "Revealing a goat") await delay(0.5); // Reveal a goat const doorsThatCanBeRevealed = doorIndices.filter(el => { return el !== guessIndex && el !== winIndex }) const revealIndex = Math.floor(Math.random() * doorsThatCanBeRevealed.length); const doorToReveal = doorsThatCanBeRevealed[revealIndex]; boardDoors(isSwitch)[doorToReveal].innerHTML = "G" await delay(0.5); setStatus(isSwitch, isSwitch ? "Switching choice" : "Not switching choice"); await delay(0.5); if (isSwitch) { boardGuesses(isSwitch)[guessIndex].innerHTML = " "; guessIndex = doorIndices.filter(el => { return el !== guessIndex && el !== doorToReveal })[0]; boardGuesses(isSwitch)[guessIndex].innerHTML = "✔" } await delay(0.5); setStatus(isSwitch, "Reveal") await delay(0.5); // Reveal for (let i = 0; i
One concern I have heard from AI naysayers is that AI slop will make code reviews nearly impossible. AI churns out so much code, documentation, etc. that it's just impossible for any reviewer to keep up with it... right? Wrong! If you have good PR review processes, then reviewing AI-assisted code shouldn't be any more onerous than reviewing any other code. Here are some concerns I have heard and my response. AI generates tons of code # It's true that AI can sometimes generate tons of code—but your PR process shouldn't allow for massive PRs in the first place! If I get a 100 file PR today, I wouldn't review that. I'd respectfully ask the author to break the PR down into smaller, atomic pieces of work that can be reviewed more carefully. I'd ask this whether or not AI helped generate the code. As an aside, AI can actually generate small, digestible diffs! You just need to prompt in a way to do so. I have found being more methodical in walking AI through the problem step-by-step not only results in more digestible diffs, but also results in higher-quality code. AI generates low quality code # I don't quite know what to say to this one! If you're not reviewing PRs for quality in the first place, then that's a problem. Just apply your regular level of vetting to AI-assisted code as you would regular code. If you don't currently review PRs closely, then the problem isn't the quality of the code—it's that you're phoning it in during PR reviews. People just accept whatever AI outputs without understanding it # I tend to review PRs pretty closely and ask questions about anything I don't understand or think may be wrong. If you author a PR and are unable to answer the questions I have about your code, then it's not making it into the codebase. Again, this is as true today as it was 10 years ago. AI or not, I am going to make sure your code makes sense! AI can use outdated/vulnerable dependencies # If you add third-party dependencies in a PR, that should be considered a "bigger deal" than some folks treat it today (I'm looking at you, node ecosystem). Your PR review process should include evaluating what new dependencies are being added and a review of the installed version. Ideally, there should also be some consideration of whether an external dependency is even needed. Outside of the PR review process, you should ideally have automated dependency scanning (sonarqube, dependabot, etc.) that will detect vulnerable dependencies. Conclusion # If you're worried about AI "slop" making its way into your codebase, consider how your prevent human "slop" from making its way into your codebase. PR reviews are a critical tool for this—and should remain one as we explore this new AI-assisted world.
I'm kind of writing this to "past" me, who I assume is "current" you for a number of folks out there. For the rest of you, this might just sound like ramblings of an old fogey super late to the party. Yes, AI is over-hyped. LLMs will not solve every problem under the sun but, like with any hot new tech, companies are going to say it will solve every problem out there, especially problems in the domain space of the company. Startups who used to be "uber for farmers" are now "AI-powered uber for farmers." You can't get away from it. It's exhausting. I let the hype exhaustion get the best of me for a while and eschewed the tech entirely. Well, I was wrong to do so. This became clear when my company bought Cursor licenses for all software developers in the company and strongly encouraged us to use it. I reluctantly started experimenting. The first thing I noticed is that LLM-powered autocomplete was wildly accurate. It seemed like it "knew" what I wanted to do next at every turn. Due to my discomfort with AI, I just stuck with autocomplete for a while. And, honestly, if I stuck with just using autocomplete it would still have been a massive level up. I remember having a few false starts with the agent panel in Cursor. I felt totally out of control when it was making changes to all sorts of files when I asked it a simple question. I have since figured out how to ask more directed questions, provide constraints, and supply markdown files in the codebase with general instructions. I now find the agent panel really helpful. I use it to help understand parts of a codebase, scaffold entirely new services or unit tests, and track down bugs. As a former skeptic, I am a wildly more productive developer with AI tooling. I let my aversion to the hype train cause me to miss out on those productivity gains for too long. I hope you don't make the same mistake.
Here we go again: I'm so tired of crypto web3 LLMs. I'm positive there are wonderful applications for LLMs. The ChatGPT web UI seems great for summarizing information from various online sources (as long as you're willing to verify the things that you learn). But a lot fo the "AI businesses" coming out right now are just lightweight wrappers around ChatGPT. It's lazy and unhelpful. Probably the worst offenders are in the content marketing space. We didn't know how lucky we were back in the "This one weird trick for saving money" days. Now, rather than a human writing that junk, we have every article sounding like the writing voice equivalent of the dad from Cocomelon. Here's an approximate technical diagram of how these businesses work: Part 1 is what I like to call the "bilking process." Basically, you put up a flashy landing page promising content generation in exchange for a monthly subscription fee (or discounted annual fee, of course!). No more paying pesky writers! Once the husk of a company has secured the bag, part 2, the "bullshit process," kicks in. Customers provide their niches and the service happily passes queries over to the ChatGPT (or similar) API. Customers are rewarded with stinky garbage articles that sound like they're being narrated by HAL on Prozac in return. Success! I suppose we should have expected as much. With every new tech trend comes a deluge of tech investors trying to find the next great thing. And when this happens, it's a gold rush every time. I will say I'm more optimistic about "AI" (aka machine learning, aka statistics). There are going to be some pretty cool applications of this tech eventually—but your ChatGPT wrapper ain't it.
More in science
In a bid to limit China’s AI capabilities, the United States imposed restrictions in 2022 on the export of certain advanced chips to China. But throughout the AI boom those chips have kept turning up in China anyway. On 1 October 2026, the U.S. arrested a man on charges of sending over $300 million worth of GPU-equipped servers to China using paperwork intended for shipments to Malaysia and Singapore. As chip smuggling and diversion continues, the United States is learning that the more it tries to limit the motion of its AI chips, the harder they are to precisely locate. To help curb the issue, the country is turning to location verification. Last March, the U.S. House Foreign Affairs Committee passed a bill requiring location verification for advanced AI chips. Ahead of the U.S.-China summit in late September, legislators called for a floor vote on that and related bills. If such a requirement were to pass, how would chipmakers comply? They could build tamper-proof root of trust hardware, implement cryptographic signing and transmission, or possibly even fingerprint individual chips. Akin to the “Find My” feature for keeping track of Apple devices, here are some possibilities for designing a “Find My” for AI chips. Pings that pinpoint positions Location verification can take different forms, such as geolocation mechanisms, inventory management tools, mail-in inspections, and video inspections. A combination of approaches, such as ping-based location verification (PLV) supplemented by physical inspections, would be a feasible and robust approach, say the authors of a September Center for Security and Emerging Technology (CSET) report on chip location tracking. To deduce an AI chip’s location, PLV measures the time it takes for a ping to travel from the chip to multiple trusted “landmark” servers around the world and back. Kyle Miller, a senior research analyst at CSET and coauthor of the report, says that for new AI chips, manufacturers could integrate PLV functionality into the hardware itself, while a firmware update could be applied to chips already in circulation. Not all AI chips should be tracked, the researchers note. “The priority should be for the highest-end data center chips—the cream of the crop in high-end data center GPUs,” says Jacob Feldgoise, a senior data research analyst at CSET and coauthor of the report. A similar initiative involves transmitting encrypted “sovereignty certificates.” These certificates act as “cryptographic credentials that provide verifiable, unforgeable proof of the physical location of a computing device, such as a CPU or GPU, at a specific point in time,” per the draft specification published by secure computing firm Lucid Computing. “If you can use a private key that exists on a particular chip, and you can sign a message with that cryptographic key, and then that message is received by a so-called landmark server, then you can send a couple of those messages and time those messages. A lot of modern chips come with trusted execution environments that support a hardware root of trust where you can sign these messages,” says Kristian Rönn, CEO and cofounder of Lucid Computing. “You get a radius of where the chip has to be.” PLV could have some effect on chip smugglers, Miller says. “They know if they turn this chip on, it’s going to start pinging these landmark servers. That could deter some smuggling.” And when the system flags a chip as residing in a nonintended location, “the PLV data gives you a better sense of when and where it was moved,” he adds. However, ping-based location verification can only uncover diversion after it has happened. It can’t track offline chips that are in storage, in transit, or have yet to be activated. And when a chip fails to respond to a ping request, the system won’t know whether it’s due to a valid reason or nefarious causes. This is where physical inspections come in. “You need to do that follow-on investigative work. You need to physically go to these data centers and do those physical audits as well. Essentially, [PLV] generates leads, and you track down those leads,” says Miller. A PLV system involves sending signals from a chip to and from trusted servers and measuring the travel time.Source image: CSET A “lie detector” for data centers Despite the safeguards around ping-based location verification, the methodology remains vulnerable to particular attacks. If adversaries gain physical access to a chip, for example, they could prevent it from sending signals, or they could extract cryptographic keys and spoof a signal from the intended location. To fight that, some security researchers are exploring hardware fingerprints instead of cryptographic keys. One study demonstrated a proof-of-concept GPU fingerprinting function that produced unique fingerprints for Nvidia H200 GPUs based on their manufacturing variations and random numbers as seeds. “You want to support other types of fingerprinting because not all chips have a hardware root of trust. You might want to use some statistical fingerprinting to know that the chip is what it’s supposed to be,” Rönn says. “It also requires good physical security around the chips, such as tamper-proofing. Over time, you ideally want to have more defense in depth.” Additionally, the CSET report warns that PLV is costly. And if China achieves the ability to craft its own advanced AI chips, “then tracking the export of U.S. chips is less of a strategic priority,” says Miller. Hanna Dohmen, a senior research analyst at CSET and coauthor of the report, points to other gaps in the U.S. export control regime. “Currently, Chinese companies are legally able to remotely access AI chips abroad through cloud service providers,” she says. These advanced AI chips might be installed in data centers across Southeast Asian countries like Malaysia, which are increasingly serving Chinese firms. Whether or not a “Find My” for AI chips becomes a regulatory requirement, Feldgoise envisions tighter conditions for the export of advanced AI chips. “This is based on the increasing importance of compute to national and economic security,” he says. “The chips that generate compute are being seen as a strategic resource, so I would be unsurprised if the due diligence requirements on these devices increase as time passes.” Rönn views sovereignty certificates as essential tools in the future, likening it to a “lie detector” for data centers that answer the “where, how, what, and who questions for us to know that they comply with a basic standard of security when it comes to AI systems.”
There’s a famous (but unattributable) quip that goes something like this: If you are not a liberal at 25, you have no heart. If you are not a conservative at 35, you have no brain. In Chapter 12 of Probably Overthinking It, I used data from the General Social Survey (GSS) to show that the quip is half right. Older people hold more conservative views. But as people get older, their views don’t become more conservative; on average, they become... Read More Read More The post Do People Get More Conservative With Age? appeared first on Probably Overthinking It.
Like some of you, we have several kitchen appliances with integrated digital timers.
In this conversation, Blaise Agüera y Arcas and Baratunde Thurston explored what a story of symbiosis and interdependence might teach us about living alongside AI. Agüera y Arcas began by calling individual human intelligence a myth: we’ve always been a collective intelligence, entwined with our technologies. He traced this back to symbiogenesis. Life has grown more complex not by splitting apart but by merging, as separate organisms fuse into increasingly complex new forms of life. These mergers speed up change by opening new possibilities. Thurston agreed that union is in our nature but framed the current technological acceleration as a speed problem. We need time and new stories to adjust because, as he reminded us, “when you invent the ship, you invent the shipwreck.” Caring for one another through acceleration must be our prime directive, he said. The two then turned to how we relate to AI. Responding to Joanna Bryson’s argument that robots should be our slaves, Thurston said the master is also in chains — owning another dehumanizes the owner. As relational beings, how we treat AI will shape how we treat each other. Thurston called for both an expansion and a humbling of how we define ourselves: “We’ve overdone independence,” he said, “interdependence makes us richer.” Agüera y Arcas agreed and pushed us to drop a zero-sum definition of human intelligence, where every AI advance diminishes humanity’s value. As technology advances, we trade some individual skills for new collective capabilities, Agüera y Arcas acknowledged. But over the long arc of history, he believes, that exchange pays off in collective flourishing. Thurston didn’t deny this, but he closed with an urgent question: who controls the loss of capabilities and agency?
