You might want to rethink scraping marinetraffic before you get a call from their lawyers?

https://www.marinetraffic.com/en/p/terms

Fair enough, I'm actually not scraping it on any automated cycle currently, I just manually copied the JSON from their site to get some ships on the map.

There's a few live ship tracking APIs I considered but they are expensive or their free offering just straight up didn't work. I sent a few an email if they would consider sponsoring the project, no replies yet.

    - AISStream.io — https://aisstream.io — Down/not working
    - DataDocked — https://datadocked.com — Ran out of credits on a single failed request
    - VesselFinder — https://www.vesselfinder.com/realtime-ais-data — Enterprise contact form, asked if they wanted to sponsor in exchange for a link
    - MarineTraffic — https://www.marinetraffic.com, their API is like an enterprise contact form, same as above, waiting for response.

It doesn't matter how good the models become. They can only deal in bullshit, in the academic use of the term.

I added a comment above about the use of https://leafletjs.com/ if you are interested.

The real winners are those psychic commodities/future traders and the arms industry. Again.

Is there any actual independent data though, or verification of any of these claims?

As it stands this is just a marketing programme for all involved.

Ffmpeg confirmed on Twitter that they sent the patches.

Although, they also said, "Because the patches appear to be written by humans".

"Mythos writes code like a human" incoming

The patches could have been written by humans, it doesn't matter that much. Or written by a clanker and polished by engineers. The difficult part is usually not in writing the patches that fix such vulnerabilities, but in finding the vulnerabilities. And these days it's even harder to exploit them, since you need to bypass modern hardening features.

What would be the product they're marketing by this campaign?

You don't market products, you market lifestyles/interests. Sell the sizzle, not the steak etc.

For Anthropic it's "we own the big scary models, the AI security space, but it's ok we're responsible"

For the partners it's "we're the Big Boys here and will look after your enterprise needs"

None of it needs any more than anecdata and some nice, pre-approved, quotes.

Every organisation does it.

The product they launched?

just because _we_ don't have access does not mean anthropic's not getting paid

That's pretty disingenuous, bordering on ridiculous.

Do they have a record of lying to you? No.

Go read the system card. It's a lot more tame than you think, peoples are taking pieces out of this and hyping it. Doesn't mean it's not valid.

You're absolutely right! Let me go ahead and fix that now...(the sound of credits disappearing...) /s

Is the onus really on people who write code here? It really should be on those who choose to use this unsigned code, surely?

Perhaps, but if it's gotten to the point where millions of people download the unsigned code, signing should probably become required. Even reproducible builds.

Required by who though? If your business etc depends upon some code, it's up to you to ensure its quality, surely? You copy some code onto your machine then it's your codebase, right?

While I think anyone unwilling to sign their code is negligent, I also feel anyone unwilling to ensure credible review of code has been done before pushing it to production is equally negligent.

Anyone that maintains code for others to consume has a basic obligation to do the bare minimum to make sure their reputations are not hijacked by bad actors.

Just sign commits and reviews. It is so easy to stop these attacks that not doing so is like a doctor that refuses to wash their hands between patients.

If you are not going to wash your hands do not be a doctor.

If you are not going to sign your code do not be a FOSS maintainer.

No they don't! They have literally no obligations to you - and you've got the MIT/APL/GPL license to prove it. You're getting the benefit of their labour for free!

Even if they did sign the code, What's stopping them slipping some crypto link in. And do they also need to check all the transitive depdencies in their code?

They have basic obligations as highly trusted FOSS software maintainers, a role they allowed themselves to be elected into, to make sure their hard earned goodwill and trust is not stolen by a bad actor. They also have a basic obligation to make sure they have accountability and review of all code before it gets to their users.

Sitting back and expecting Microsoft to keep the community safe is going to continue to end badly. The community has an obligation to each other.

Like, no one is making someone go bring a bunch of food to feed the homeless, but if you do, you have some basic social obligation to make sure it is sanitary and not poison.

People who give things away for free widely absolutely have obligations, and if they do not like those, they should hand off the project to a quorum of responsible maintainers and demote themselves to just a contributor.

They literally owe you nothing. They can walk away tomorrow, sell their github account, introduce breaking changes, add bugs, die, add crypto links, whatever.

>if they do not like those, they should hand off the project to a quoarum of >responsible maintainers and demote themselves to just a contributor.

The most responsible thing to do is to release it under an OSS license and let whoever, yes - including you, fork and maintain their own copy if it's that important.

If you're paid then sure. Otherwise... It depends.

Is a doctor doing volunteer work still obligated to wash their hands between patients?

Is a food pantry giving away free food obligated to check expiration dates and make sure the food is properly sealed?

Volunteer work absolutely has obligations, and I do not know why software volunteers are exempt from any responsibility unless they are being paid.

If you do not want to do the volunteer work in a safe way, please hand off the job to a volunteer willing to do so.

Literally untrue as we don't have proportional representation.

Sounds like a non-sequitur?

Proportional representation is nice, but it's neither sufficient nor necessary.

I think your disgrace-level calibration needs adjusting given everything else that's going on rn buddy.

Or perhaps it's in the context of the current US administration having spent the past year telling Europe to get screwed on trade, military etc?