Lvxferre

To be a moral agent, your actions towards others need to have consequences for yourself - be those consequences direct, social, emotional, or something else. And intelligence on itself doesn’t provide those consequences.

The nearest that you could do, with AGI alone, would be to hardcode it with ethical principles, but that’s another matter. (I’m saying this because people often conflate ethics and morality, even if they’re two different cans of worms.)

No problem - I’ve seen worse. I’ve done worse.

(I’m fine, thanks! I hope you’re doing well too.)

That seems sensible.

Even a hypothetically true artificial general intelligence would still not be a moral agent, thus it cannot be held responsible for its actions; as such, whoever deploys and maintains it should be held responsible. That’s doubly true with LLMs as they aren’t even intelligent to begin with.

I was focusing mostly on your incorrect claim about account ages. The reliability of the information (speculation vs. solid info) is another can of worms.

The reason why you see mostly speculation is because nobody knows how the algo work, except people inside Reddit itself. The most that people can do is to analyse patterns, and come up with a hypothesis explaining it; and while doing so by subjective means is by no means optimal, it is better than nothing.

Where’s your critical thinking ?

Critical thinking is to neither change the goalposts once people contradict your claim, nor to conflate hypotheses with gullibleness-based argumentation (“I swear it’s true bro”).

In this context it is - it means that the user saw how Reddit used to be, and is likely informed enough to have a good guess on what’s going on.

(Some accounts there are 12, 13, even 15yo.)

It would mean reddit is discarding the biggest thing that makes it different from all the other algo-driven “engagement”-fueled social platforms.

Yup. And it’s a bad trade in its case - because even if it leads to more engagement, it makes it too similar to considerably larger platforms, so there’s no point staying in Reddit instead of, say, Facebook.

I think that Reddit blocked LW from automatically retrieving the info.

Just new Redditors speculating with anecdotes

That’s inaccurate given that 2/3 of the OPs and a lot of the commenters have really old (8yo+) accounts.

You’re right - I copied the title of the post without noticing that they flipped it. (I can’t find the original any more.)

The link from .ml opens fine for me.

Repeated the test now (Friday, 18:30); same lang settings as above. Couldn’t find a single post in Portuguese after rolling across ~30 of them.

x.com and twitter.com are still inaccessible here.

Yup! Frankly it isn’t a really great visual novel, but the soundtrack is fire.

Every time that people talk about Chrono Cross’s soundtrack (it’s great by the way, I agree with you), this reminds me a little SNES game called Radical Dreamers. The soundtrack - largely shared with Chrono Cross - is perhaps its biggest selling point.

This reminds me of that “all mushrooms are edible, at least once” thing.

Well, even if you’re forced to do the right thing, it’s still the right thing. (Thanks for the context!)

The words “update” and “agreement”, when found in the same sentence, usually prompt me to roll my eyes and say “oh look corporation found another way to stab customers”.

This is not the case - what they’re doing is sensible and fair. I don’t even know how forced arbitration is even legal for some countries, it’s basically “we expect you to give up your legal rights”.

What you’re proposing is effectively the same as "they should publish inaccurate guidelines that do not actually represent their informed views on the matter, misleading everybody, to pretend that they can prevent the stupid from being stupid." It defeats the very reason why guidelines exist - to guide you towards the optimal approach in a given situation.

And sometimes the optimal approach is not a bigger min length. Convenience and possible vectors of attack play a huge role; if

• due to some input specificity, typing out the password is cumbersome, and
• there’s no reasonable way to set up a password manager in that device, and
• your blocklist of compromised passwords is fairly solid, and
• you’re reasonably sure that offline attacks won’t work against you, then

min 8 chars is probably better. Even if that shitty manager, too dumb to understand that he shouldn’t contradict the “SHOULD [NOT]” points without a good reason to do so, screws it up. (He’s likely also violating the “SHALL [NOT]” points, since he used the printed copy of the guidelines as toilet paper.)

I don’t think that the entity should be blamed for the shitty manager. Specially given that the document has a full section (appendix A.2) talking about pass length.

They might mean well, but the reason we require a special character and number is to ensure the amount of possible characters are increased.

The problem with this sort of requirement is that most people will solve it the laziest way. In this case, “ah, I can’t use «hospital»? Mkay, «Hospital1» it is! Yay it’s accepted!”. And then there’s zero additional entropy - because the first char still has 26 states, and the additional char has one state.

Someone could of course “solve” this by inserting even further rules, like “you must have at least one number and one capital letter inside the password”, but then you get users annotating the password in a .txt file because it’s too hard to remember where they capitalised it or did their 1337.

Instead just skip all those silly rules. If offline attacks are such a concern, increase the min pass length. Using both lengths provided by the guidelines:

• 8 chars, mixing:minuscules, capitals, digits, and any 20 special chars of your choice, for a total of 82 states per char. 82⁸ = 2*10¹⁵ states per password.
• 15 chars, using only minuscules, for a total of 26 states per char. Number of states: 26¹⁵ = 1.7*10²¹ states per password.

I think so, based on the original: “Verifiers and CSPs [credential service providers] SHALL NOT permit the subscriber to store a hint that is accessible to an unauthenticated claimant.” With “shall not” being used for hard prohibitions.

That stipulation goes rather close to #5, even not being a composition rule. EDIT: see below.

I think that a better approach is to follow the recommended min length (15 chars), unless there are good reasons to lower it and you’re reasonably sure that your delay between failed password attempts works flawlessly.

EDIT: as I was re-reading the original, I found the relevant excerpt:

If the CSP [credential service provider] disallows a chosen password because it is on a blocklist of commonly used, expected, or compromised values (see Sec. 3.1.1.2), the subscriber SHALL be required to choose a different password. Other complexity requirements for passwords SHALL NOT be imposed. A rationale for this is presented in Appendix A, Strength of Passwords.

So they are requiring CSPs to do what you said, and check it against a list of compromised passwords. However they aren’t associating it with password length; on that, the Appendix 2 basically says that min length depends on the threat model being addressed; as in, if it’s just some muppet trying passwords online versus trying it offline.