Trying to find a way to tip toe around KYC, whilst keeping their customers safe, has also turned out to only use insanely stupid methods, though. So why did they already do that?
FYI it turns out that humans are pretty bad at comparing faces to ID documents. Like, really quite bad.
Automated methods, like the ones Revolut use, are significantly more effective at KYC than a Jane Doe working a 9-5 at a bank. In no way is it “tip-toeing around KYC”, and while really unfortunate leaking a selfie is pretty low down on the list of “bad stuff a bank could leak”.
The implication that the solution to this is to somehow convince your direct competitors to do inferior in-person KYC for you is the most ridiculous thing.
>The implication that the solution to this is to somehow convince your direct competitors to do inferior in-person KYC for you is the most ridiculous thing.
People work with their competitors all the time (see Netfix vs Amazon). Whats ridiculuous is the claim that a scammer would prefer to show up physically at a bank and risk being exposed instead of operating remotely.
>leaking a selfie is pretty low down on the list of “bad stuff a bank could leak”.
don't some of them require a selfie while holding legible official documentation?
> Whats ridiculuous is the claim that a scammer would prefer to show up physically at a bank and risk being exposed instead of operating remotely.
Of course they wouldn’t prefer to show physically. What does that mean though? Are you saying no scammers showed up physically to banks, therefore banking fraud rates are less? Do you have a source for that?
> don't some of them require a selfie while holding legible official documentation?
You can of course do KYC as stupidly as you like (zoom calls anyone?) - Revolut (and their providers) obviously separate document presentation from the liveness check (and fyi this is a short video, not a selfie. The selfie they are talking about is just a capture from the video)
Is your argument supposed to be more convincing because you added the word "patently"?
>What does that mean though?
It means that when you find a way to bypass purely online identity verification checks executing fraud at scale is easier than the physical alternative. As you would say, this is patently obvious.
In the USA they already take passport photos. Being able to receive mail addressed to a name is the closest thing to a national ID the USA has. They're already depended on for identity verification quite a lot.
Some post offices in the US also function as a so called notary public. Basically, they can verify your identity and attest that it's you who sent/did something.
This is used quite often for important things that don't have offices themselves.
Try opening one now. Today it's hard to get a hire purchase contract as an existing custoner (already known and verified) without photos of the ID and selfie.
Likewise, opened a couple in the past few years and never saw this. That said, bank lobbies have tons of ambient cameras anyway, so they don't really need a selfie.
Yep put some deep packet inspection firewall in front of it and stop it completely if it starts acting up persistently before it starts trying to bypass the firewall
If 0. Etc. are also compiled out, at compile time __debug__ is simply False or True and the existing optimization paths take care of it.
Assigning to __debug__ wouldn't do anything to the compiler as it never actually reads the variable, so assignment would just cause weirdness from other use
This really is the simplest path to somewhat decent security, and alongside it you may catch some programs doing requests that are fine for security but you'd rather it not do because of privacy.
The line between privacy and security is very blurry. Consider this: if Microsoft exfiltrates your keystrokes, it's a privacy violation, but if a random person does the same thing then it's a security violation. You might say that the random person is more likely to use it against you, but then the car insurance companies mining your driving data absolutely do use it against some customers, but that's generally considered to be a privacy violation rather than a security violation.
> Consider this: if Microsoft exfiltrates your keystrokes, it's a privacy violation, but if a random person does the same thing then it's a security violation
No, it's a security violation no matter who does it.
No, we really need to stop using weasel words and call it like it is: Windows is malware. Microsoft has illegally hacked billions of computers, and gets away with it by being a big company and by the world having gotten complacent with big companies constantly hacking everyone they can.
Did they have an actual metal container sitting outside their office building in San Diego? I would love to see it on the inside kinda like a walk-in tour you get from real estate listings
he bought an empty container and he's looking for someone to build it out.
i ran 7MW and 20,000 gpus in containers in WA for mining eth for many years. it is a bad idea that he's trying to do. but george is george and the hype is real...
Do you have a write-up of this? I enjoy seeing these Playstation/ASIC/GPU mining installations which are usually some combination of incredibly clever engineering and duct tape.
And if you go for actual GPUs it'll run much faster, I'd say 24gb may be pushing it for context, but my 5090 with 32GB VRAM is usually somewhere between 60 to 100 tok/s with mtp and 2-3k tok/s for prompt processing. I'm not sure what they cost now but it's definitely still quite far from the macbook, and there's also some other 32GB GPUs that are considerably more affordable
AC is sorely lacking in the EU, e.g. right now I have one in my office but not in my bedroom and nights are horrible, but I do read a lot about people overdoing it quite a bit with AC, aiming at 18-20°C during 30s outside which is a huge energy expenditure when a healthy human should be perfectly fine at higher temperatures
More niche hardware has been impossible for me to find in the EU marketplaces I got to with searches, with only availability from US ebay, and then Chinese marketplaces. Or if it does exist here it's the same used part but it costs 500€ instead of 40
Undervolting would definitely help, and is the actual fix. The current Intel fixes were mostly just for the symptoms, as the main issue is high voltage+power when pushing high clocks, but they can't actually fix that as it'd downgrade the advertised clocks the cpus were sold with
Sorry, but that understanding is dangerously incomplete. You're describing the first set of issues they uncovered, but there's also:
"Microcode and BIOS code requesting elevated core voltages which can cause Vmin shift especially during periods of idle and/or light activity" (emphasis mine)
Recall also that "Vmin shift" means "the minimum voltage the processor needs to run correctly goes up" so if the issue isn't addressed, that level of undervolt may stop working
Not sure what's supposed to be wrong with that? The clock tree degrades at high voltage. Some theories I've seen were on the CPU requesting significantly higher voltages during alternating clocks when there's a short lull in load from e.g. a pipeline stall. Then there doesn't seem to be a good enough of a sensor net in the correct places for the CPU to react to this, so it just "burns" itself down gradually. Assuming these are true, actual fixes from intel would be relaxing boost clocks to ones that are universally safe and open themselves to a lawsuit from everyone that bought the high end SKUs, or do a new stepping which is extremely expensive for a done design.
When you degrade the CPU naturally needs higher voltages to be stable, until the point where it just breaks completely and no amount of voltage it help it. But if your CPU doesn't degrade because it hasn't been overdoing it on voltages then there'll be no issues for Vmin to shift.
As an anecdotal experience from someone I know that runs these in prod for game servers, limiting the CPU to 80°C and 1.4V-1.45V, 400A has been keeping them alive for years doing 24/7 loads. Maybe a bit lower on the voltage if one wants to be sure longer term, as they are fine with just mass RMAing these. There's also large amount of differences in the silicon quality between samples that can make one run cool and completely fine even at the old stock settings, and an another sample that'll have to pull say 1.5x the power for the same load and clocks having it degrade.
You're implying that if you don't run the CPU at high power and high heat it won't have problems, and that undervolting or underclocking will prevent damage. This is not correct: while that is helpful, Vmin degradation occurs during idle or light activity as well
Vmin will creep up, and the headroom for undervolting will degrade. It will affect the high clocks first (they demand the highest voltage), which is why dropping the max boost multiplier a step or two can also work around it (at the cost of basically downgrading it to a cheaper processor)
Idle and light load is bad for degradation only because that's the most common scenario where the boosting algorith will actually go to the highest clocks. More loaded cores will have the CPU target lower clocks on all cores so that it actually can get the power for it and have the CPU be coolable, but if you're idle and then some task loads just a single core for a bit the CPU will boost it the highest it can. The voltage spikes from those boosts will cause local hotspots even if the CPU is cool overall
"Even under idle conditions at relatively cool temperatures, sporadic elevated voltages are observed when the processor is resumed from low power states in order to service background operations before entering a low power state again."
They now support passkeys with things other than their shitty app. I use 1Password, and it works fine.
I've also had a yubikey for a long time and can't be bothered to type in codes, so I didn't know their shitty app did OTP or even that OTP was actually a possibility for MS accounts.
reply