Hacker Newsnew | past | comments | ask | show | jobs | submit | fzeindl's commentslogin

I exercise 3 times a week (running, martial arts, weight lifting). I ran marathons, I exercised 5-6 times per week for the last 5 years.

I am truly fit, but … I still don’t feel like exercising.

Most of the time it’s like brushing my teeth, it is just something I do because it is right.


A similarly scoped book series is „AI game programming wisdom“, which contains a multitude of chapters that focus on diverse, individual algorithms that can be practically used in games for a variety of usecases.

In Norway alcohol is very expensive, so many people distill at home illegally.

Every travel guide tells you to not accept home-distilled drinks, since they can be poisonous.


Alcohol is always poisonous (but mixed with methanol quite a bit more poisonous ) :-)


Ethanol is a naturally occurring substance, humans and many animals have specifically evolved ways of processing it. In moderate doses it does no harm.

It's almost impossible to avoid ingesting some alcohol during the course of a natural diet, and that includes if you avoid fermented food such as bread, let alone beverages deliberately brewed to be alcoholic.


Isn't the problem of poisoning caused by Methanol and not Ethanol?

Gemini says this:

"Ethanol is the type of alcohol found in alcoholic beverages (beer, wine, spirits) meant for consumption. While ethanol is safe for moderate consumption, methanol is extremely toxic and can cause poisoning, blindness, or death, even in small amounts."


I was replying to the statement that "alcohol is always poisonous". It isn't.

And if you have one of those poisons the antedote is the other one.

Edit: only one way round! This is not medical advice. I am not a doctor. I am not your doctor or drinking doula.


you suggest additional drinking methanol when you're "normally" drunk?? that's dangerously counterfactual.


No, ethanol is an antidote to methanol


Where's the authority on that?

Ethanol can be used as a temporary measure in methanol poisoning as it temporarily outcompetes methanol in the metabolic process. So it's only useful until proper medical help arrives when better alternatives such as fomepizole are administered. Even then there is no guarantee of success.

Methanol is still metabolized to dangerous formaldehyde and formic acid by the liver's alcohol dehydrogenase. The logic of giving ethanol or fomepizole is to slow down the rate of production methanol's dangerous metabolic byproducts so less damage is done, nevertheless those dangerous metabolites are still produced.

Ethanol's first-pass metabolite is acetaldehyde and it is still toxic but not to the same degree as those of methanol.

It is incorrect to say ethanol is an antidote for methanol poisoning. Using ethanol is a last-ditch stand to try and take some minor control of an otherwise out of control situation. There's nothing subtle about it—it's a blunderbuss approach that often doesn't work well because replacing one poison with a less toxic one is a pretty hit-and-miss process.

Antidotes counteract poisons, that's not what happens when you give ethanol in methanol poisonings.


> The logic of giving ethanol or fomepizole is to slow down the rate of production methanol's dangerous metabolic byproducts so less damage is done, nevertheless those dangerous metabolites are still produced.

Who cares if dangerous metabolites are "still produced" when the danger has been limited? It's like claiming that blood transfusions don't help with shock because the patient still lost the same amount of blood.

> Using ethanol is a last-ditch stand to try and take some minor control of an otherwise out of control situation.

This is some weird-ass over-elaborate synonym for antidote.

> There's nothing subtle about it—it's a blunderbuss approach that often doesn't work well because replacing one poison with a less toxic one is a pretty hit-and-miss process.

I don't even know what this is supposed to mean. This all reads like AI slop.

> Antidotes counteract poisons, that's not what happens when you give ethanol in methanol poisonings.

You literally give it to them to counteract the poison. You're using a idiosyncratic version of the word "counteract," which doesn't relate to the health or survival of the person poisoned, but has a lot to do with the absolute levels of "dangerous metabolites produced."


"This is some weird-ass over-elaborate synonym for antidote."

I did not say or infer that ethanol should not be used in the treatment of methanol poisoning.

Giving ethanol to counteract methanol poisoning is not a simple fix like giving naloxone for a herion OD (which works effectively in minutes), it's more complicated and often involves multiple procedures such as hemodialysis and strict monitoring of ethanol levels (assuming one knows what that level should be, ipso facto, how much methanol was consumed and whether it was coconsumed with ethanol—facts often not readily available in an emergency department).

I suggest you read this, especially point 7 'Treatment': https://www.mdpi.com/2305-6304/12/12/924

The almost flippant assumption that ethanol is a fix all panacea for methanol poisoning by many who've posted here is just irresponsible. Fact is methanol OD is a major medical emergency and in no way should it be played down.

If I have to be the bringer of unwelcome truths then so be it. Shooting the messenger generally makes things worse.


It is technically an antidote though. Based on the definition of antidote.

Where are the sources on your claims that ethenol is only a temporary or last ditch treatment?

Suggest you read the link in my reply to pessimizer.

If you don't want to provide a link and quote to the source, I'm going to treat it as it's unsourced.

If you want to claim the link and source are in another castle, I'm not playing games.

https://pmc.ncbi.nlm.nih.gov/articles/PMC1306022/

> A 10% ethanol solution administered intravenously is a safe and effective antidote for severe methanol poisoning. Ethanol therapy is recommended when plasma methanol concentrations are higher than 20 mg per dl, when ingested doses are greater than 30 ml and when there is evidence of acidosis or visual abnormalities in cases of suspected methanol poisoning.



Under > 7.4. Antidotes and Elimination Enhancement

> 7.4.2. Ethanol A therapeutic blood ethanol level of about 22 mmol/L (100 mg/dL) is recommended.

...

>If ethanol was coingested with methanol and the blood ethanol level initially was >22 mmol/L (100 mg/dL), the bolus dose of ethanol can be skipped.

It's like you didn't even read your own source.

They are calling it recommended for certain conditions, and saying you can skip parts of treatment for co-ingestion!

Then in the conclusions section

> Despite its extensive use, methanol poisoning remains a critical public health concern globally, often resulting from accidental or intentional ingestion and outbreaks linked to contaminated beverages.

They've called out contaminated beverages, not outputs of distillation.

You've been had by misinformation and now you're peddling lies.


vice versa

> Ethanol is the most commonly used antidote to block the metabolising of methanol. Ethanol works by competing with the metabolic breakdown of methanol, thereby preventing the accumulation of toxic byproducts.

MSF: https://methanolpoisoning.msf.org/en/for-health-professional...

I can see the ambiguity of my comment. I was trying to phrase as a riddle but can be interpreted both ways.


Same with antifreeze poisoning. If a kid drinks antifreeze, get him wasted to keep the liver busy.


ah got it. thanks for clarifying!


Anything that decants below 78.4C is going to have methanol in it, I usually separate out the first 100ml or so that decants after 78.4C to play it safe.

I've been doing it for about 20 years, no poisoning cases yet. Home distillation has been legal in NZ since 1996.


This is actually a myth. I’ll have to see if I can find the papers I read but mass spectrometry has shown that methanol comes out throughout the entire process. The idea that things come out at their boiling temperature is a drastic oversimplification.

Methanol is really only present in significant amounts in fruit mashes because it comes from fermentation of pectin. Grain or sugar-derived alcohol barely has any at all.

The foreshots you throw out do have things that taste bad and which you would not want to drink much of, but even if you mixed it all back in and got drunk, it would be the same amount of all of those chemicals you’d get if you just drank the mash, which is itself basically just beer or wine.

We distillers are a lot more likely to burn our house down than any other form of injury.


> This is actually a myth. I’ll have to see if I can find the papers I read but mass spectrometry has shown that methanol comes out throughout the entire process. The idea that things come out at their boiling temperature is a drastic oversimplification.

Please do find those papers! They may be describing a radical new chemistry that I'm not familiar with.

To be clear - methanol boils at 64C and ethanol boils at 78C. Are you suggesting that in standard distillation, there is still some non-trace methanol coming over at 78C? If I personally observed that in a laboratory setting, I'd quickly assume measurement error or external contamination.


I suspect that the vapor of the mash is always a mix of the components, and even above the boiling point of methanol, it still produces a mixed vapor. At room temperature, all of the components produce some vapor and will evaporate. This continues as the temperature rises.

It's not clear to me that simple distillation of a methanol/ethanol mixture can produce either pure ethanol or pure methanol at any point, just as it's impossible to distill ethanol and water to pure ethanol (absolute alcohol) if the water is above a small percentage of the mixture.


Yup, distillation never produces a pure product. Cask-strength whiskeys contain quite a lot of water, even though nobody is stupid enough to distill at 100C. Even an industrial column still can't go over 96% ABV.

There is always some amount of vapor pressure, even below the boiling point of a substance. Otherwise, neither water nor alcohol would evaporate by themselves at room temperature! The temperature we call the "boiling point" is just the temperature at which the vapor pressure equals the ambient pressure.


You can't distill out pure methanol, as at the boiling point of methanol ethanol also has some vapor pressure, so you distill a mix. However above that boiling point you distilled out all methanol (with a mix of ethanol), and the remaining ethanol should be free from methanol.

This also matches what happens when distilling ethanol from water. You can't distill pure ethanol, but you csn distill ethanol-free water afterwards.


> above that boiling point you distilled out all methanol (with a mix of ethanol)

That's not what studies have shown. Methanol boils off in all phases of distillation, and remains in high concentration at least halfway through.

https://pubs.acs.org/doi/10.1021/acsfoodscitech.3c00627

https://pubs.acs.org/doi/10.1021/acsfoodscitech.1c00025


Thank you for finding these! I remembered they existed but not where

"This also matches what happens when distilling ethanol from water."

Right, normal commercial ethanol production is 95% EtOH, 5% H2O (the constant boiling mixture/azeotrope). That's good enough for most uses but not all. The only problem the average person would ever likely encounter from the residual H2O would be in the application of alcohol-based coatings such as shellac where it can cause whitish discoloration. Painters will occasionally use 99% EtOH which is substantially more expensive (removing that residual H2O requires an altogether different proxess).


>To be clear - methanol boils at 64C and ethanol boils at 78C. Are you suggesting that in standard distillation, there is still some non-trace methanol coming over at 78C?

From what I remember, the highest concentration of methanol is in the tails. That should tell you everything.

*EDIT* Found the paper

https://op.europa.eu/en/publication-detail/-/publication/0b9...


There are azeotropes - mixtures that distill together at a different temperature than either alone.

You can’t distill ethanol to higher than 95% because of the 95-5 ethanol-water azeotrope that boils at 78.2C, versus ethanol alone at 78.4C.

Methanol-water and methanol-ethanol don’t form an azeotrope so if properly done you can separate methanol via distillation.


Yes. It doesnt work the way you think. When you mix chemicals together and then boil, the result isn’t that simple.

Think of it this way: ethanol boils at 78.5. Water at 100. But when I’m distilling, the first stuff out of the still is coming out at like 80/20 ethanol to water, long before I’m near 100C. The later stuff still has some ethanol in it, even as I near 100C. (You can easily measure while distilling.)

So why would it be surprising that methanol behaved that way as well?


When you mix different liquids, all manner of complex things happen to their vapor pressure vs temperature curves.


https://en.wikipedia.org/wiki/Brownian_motion

Temperature is just an average, the individual molecules can have a higher or lower temperature and can therefore evaporate already below boiling point.


>They may be describing a radical new chemistry that I'm not familiar with.

It's probably pot still vs. reflux still. Chemists use fractionating columns to get better separation. Home distillers won't necessarily do so, so official advice has to assume they will not.


Yeah column stills exist for home use but they’re not very popular. They’re big and expensive and strip flavor. It’s probably because Home distilling, like home brewing, is largely focused on the craft side rather than trying to get drunk cheaply.

If you’re trying to get drunk cheaply, and without tasting liquor, you cannot beat the product and efficiency of a column still.

But I want my whiskey or apple brandy to have the characteristics of the mash I distill it from. A column still would reduce that.

So most home distilling is a pot still for sure.


We could be breaking new grounds with spinning band distilled moonshine.


I mean—depending how much methanol was in the mix to begin with…

It’s been a long time, but I thought there was a whole Raoult’s Law thing, about partial pressures in the vapor coming off the solution combining in proportion to each component’s molar fraction * its equilibrium vapor pressure (at that temperature, presumably). Or something.

Point being, if you’re starting with a bunch of volatiles in solution, there’d be quite a bit of smearing between fractions boiling off at any given temperature/pressure. And you’d be very unlikely to get clean fractions from a single distillation anywhere in that couple-dozen-degree range.

Probably mangled the description, but isn’t that why people do reflux columns?


I would assume it depends on what you are distilling.

If you are making brandy from clarified wine, it probably separates better than rotten grape mash.

It is still a continuum with some methanol molecules likely remaining even in the tails.

For all intents and purposes, the distiller's rule of thumb of throwing away the angels' share is still going to work because low methanol concentrations are never an issue —for the antidote for methanol is ethanol.


You throw away the foreshots because they also contain things like acetone that taste bad and may be harmful. They’re highly unpalatable so people can be relied on to do a sufficient job.


Also “Angel’s share” isn’t what you throw away, it’s what evaporates from the barrel when you age. What you throw away are the foreshots and parts of the heads and tails

I had learned it like that(it could have been a different cute term) but the terminology I used does appear to be wrong afaict.

From what I understood ethanol and methanol form an azeotrope and boil together at a mixed temperature. And the going blind stuff is just prohibition propaganda both to make home distilled alcohol seem dangerous and to scapegoat the fact that the government was actively poisoning "industrial" ethanol.


this is dangerously wrong in several dimensions

methanol and ethanol do not form an azeotrope with each other, they only (both, each) bind to water. that's why separation of methanol and ethanol by holding key temperatures works at all.

furthermore, the azeotrope effect only becomes relevant at concentrations beyond 90% alcohol. so when you're producing pure methanol and ethanol, then distillation won't cut it beyond 90+% as water+(m)ethanol then *at these high concentrations* boil and evaporate together. that's the grain of truth in your statement.

last not least going blind from methanol is _very_ real.


Methanol will certainly make you go blind if you consume it at too high a ratio, it just isn’t a risk when distilling because you can’t feasibly make that happen on accident and it would be hard to even do it on purpose. I think that’s what parent likely meant.

> From what I understood ethanol and methanol form an azeotrope

I don't think so https://en.wikipedia.org/wiki/Azeotrope_tables


Look at it this way: The boiling point of ammonia is -33 C. Would you drink a jug of household cleaning ammonia just because it's been heated to +20C?

But anyway, I don't think there's hazardous levels left after normal distillation+cutting, the reason for not buying booze from some guy behind a barn usually has more to do with lead contamination risks.


I went to Bin Inn in Masterton NZ because it was supposedly where you could recycle a certain brand of glass jar. The guy running the place clearly had no idea what I was talking about but took them anyway because he was nuts. I was looking around the place a bit as I'd never been there before, not realising he was following me. I paused to read a bottle on the shelf and suddenly he was talking very loudly over my shoulder:

You shouldn't buy those, terribly expensive. Oh I don't really drin... Used to be a chap in here all the time, made his own, beautiful stuff. Ok well like I say I'm not rea... I can sell you everything you need, you should make your own gin, much cheaper. Oh, so did you drink his stuff too? Nah I'd never touch it. What but you said it was beau... Yeah he drank it and died.

Definitely up on the list of bizarre interactions I've had here.


This doesn’t make sense. Whether or not you have methanol depends on what you are distilling from. Distillation doesn’t create methanol and many sources of ethanol contain negligible methanol.

TBH, your assertion reads like chemistry word salad. It doesn’t parse.


Everyone is talking in circles.

As distillation continues the concentration of methanol drops.

The highest concentration is at the start. This is also generally full of undesirable flavours.

People also forget that ethanol competitively inhibits metabolism of methanol in a way that protects healthy adults from toxicity.

A safe alcoholic drink can have methanol in it, iirc it's about 80:1 ethanol:methanol by EU rules. And generally considered tolerable [0].

What is actually toxic is much higher ratios of methanol than that.

Unless you have severely f'd up your fermentables you shouldn't even have that much methanol in the starter!

This is why everyone is disagreeing with the safety in this thread.

It's also why people wonder why so many tourist destinations have been mixing methanol into alcoholic drinks. They probably could serve drunk people high concentrations relying on ethanol already in their blood and follow up drinks to stop noticeable harm.

Probably most adults could drink 5-10% methanol (if ethanol is about 50%) and never notice the toxicity.

[0] https://pubmed.ncbi.nlm.nih.gov/11926610/


Genuine q then. Why don't the destinations serve watered down shots instead? If it is just to save money.


Good question, I think it's to get people drunk and buying more drinks.

As opposed to the crowd sobering up and leaving.

But also I believe the bar (staff) often genuinely don't know what their serving is harmful.

I should have added the limit to safety at low levels of methanol is actually that your body processes ethanol much faster than methanol. So it's more that the crowd goes home and then hours later (once ethanol has been cleared) the methanol finally is picked up by the enzymes that makes it toxic. If they stay drunk (on ethanol) for days the methanol might have been excreted before being toxified.


Probably because a- people can tell, and b- you sell more to already drunk people, so getting them drunk sooner is better.

So maybe the answer is water down the shots of your obviously drunk customers.


Ah I didn't realise methanol had the same psychological effect. I thought it was just tasteless poison.


I've never tasted it but from what I remember from high school chemistry class, it certainly smelled close enough to other alcohols, so I assume it would taste close enough as well.

TBH, I also had to do my own bit of googling because I barely drink alcohol to begin with, but it does look like "at the start", it's not very distinguishable from ethanol in taste and in effect.


If ethanol and methanol were readily distinguishable by taste, much fewer people would have died or gone blind drinking moonshine.

Whatever subtle differences exist between them are probably unnoticeable to people who are already drunk, not to mention drinking cocktails with all sorts of other flavors mixed in.


If places are really sketchy, they might be mixing in partially treated industrial or "denatured" alcohol, which has poisonous quantities of methanol and bitterants but are also like 90% ethanol


It seems to parse just fine? They create some unknown mixture of methanol/ethanol (who knows what the ratio is, who cares, like you said, depends what you're making it from) and then raise it past the boiling point of methanol, throwing away everything that comes over while still under the boiling point of ethanol. It sounds like basic distillation to me.


>Anything that decants below 78.4C

do you mean distills? decanting is just pouring carefully


Yeah. No idea why I wrote decant.


Thank you for asking, I was so confused.


Hey I've been wanting to get into home distilling for years but haven't found any good resources to start. Do you know of any books or other print resources that I should look at to learn what I need to learn before starting?


Distilling at home was fairly traditional long before high alcohol prices. Sure, high prices encourages some folks and helps ensure there is space for a black market. But technically, the high prices didn't cause distilling.


I visited Norway and was blown away by the price of alcohol. Given that the sun only comes out for a fraction of an hour in winter I struggled to believe it. At a local bar... (I think I was in trondheim?) I asked how they afforded booze? (it worked out to 15$ USD per pint), "We don't, but we do it anyways"


The real answer: Folks rarely get very drunk at the bar. Folks have drinks at home, go to the bar and drink modestly, and drink after.

And I'll let you know that my shortest days are 4.5 hours long (with weak sunlight!). Oslo has slighly longer days still.


Why is it so expensive? High vice taxes?


Yes. Wine with between 10-15% alcohol by volume[1] currently has a tax of 5,41 NOK per percent ABV per liter. So a typical 0.75 liter bottle of 12% ABV wine gets a tax of 12*0.75 = 53.19 NOK, or about $5.6 / €4.8.

For booze above 22% ABV the tax is currently 9.23 NOK. So a 0.7 liter bottle of 40% ABV Whiskey or similar would get 258 NOK or $27 / €23 in tax.

And on top of that comes the usual 25% VAT, and high wages to our bartenders etc.

[1]: https://en.wikipedia.org/wiki/Alcohol_by_volume


Fuck's sake. I've bought some decent bottles of whisky all in for less than $27.

Prices tend to correlate strongly with wages and wages are very high in Norway for all work, so they also have some of the highest prices on basically everything. Another lol example is a Big Mac combo meal in Oslo - you're looking at around $20.


Scandinavian countries have very specific alcohol policies, though, very restrictionist, and the tax is part of this.

This is not just question of "more expensive country, more expensive stuff". Switzerland or Luxembourg are quite expensive, but you will buy affordable and good Italian/Spanish/French wine there, because these countries don't impose anywhere near as much taxation on wine.


If you’re in Romandie in Switzerland I would recommend local wines, that’s one thing the whole French speaking region is well known for (source: I’m from there)


A large Bic Mac meal with plain fries and soda is 123 NOK or $12.91, and a large double Quarter pounder menu is 168 NOK or $17.63.

It's actually relatively cheap right now, I expect a price hike soon given how much grocery prices have increased.


Is that in Oslo or elsewhere? Have prices gone down for some reason?

EDIT: Ahh! I was basing my statement on data from quite a number of years back, and just assuming prices tend to go in one direction in inflationary economies. The nuance here is that the NOK has weakened somewhat dramatically against the dollar, so relative prices aren't quite as insane now as they were in the past.


Ah yes, back when the dollar was 7 NOK and not ~10 NOK, the Big Mac meal would indeed have been the equivalent of $20.


Home distillation is very popular in Poland too. Risk of getting poisoned from it is near zero in practice. In some parts of Poland there is more home-distilled alcohol bottles at the tables during weddings than commercial ones.

In many European countries you will be offered home-distilled drinks, you would be very unlucky to get anything else than hangover.

The problem is overblown.


The principal security problem of LLMs is that there is no architectural boundary between data and control paths.

But this combination of data and control into a single, flexible data stream is also the defining strength of a LLM, so it can’t be taken away without also taking away the benefits.


This was a problem with early telephone lines which was easy to exploit (see Woz & Jobs Blue Box). It got solved by separating the voice and control pane via SS7. Maybe LLMs need this separation as well


This is where the old line of "LLMs are just next token predictors" actually factors in. I don't know how you get a next token predictor that user input can't break out of. The answer is for the implementer to try to split what they can, and run pre/post validation. But I highly doubt it will ever be 100%, its fundamental to the technology.


I think this is fundamental to any technology, including human brains.

Humans have a problem distinguishing "John from Microsoft" from somebody just claiming to be John from Microsoft. The reason why scamming humans is (relatively) hard is that each human is different. Discovering the perfect tactic to scam one human doesn't necessarily scale across all humans.

LLMs are the opposite; my Chat GPT is (almost) the same as your Chat GPT. It's the same model with the same system message, it's just the contexts that differ. This makes LLM jailbreaks a lot more scalable, and hence a lot more worthwhile to discover.

LLMs are also a lot more static. With people, we have the phenomenon of "banner blindness", which LLMs don't really experience.


How are you defining "banner blindness"?

The foundation of LLMs is Attention.


"Banner blindness [...] describes people’s tendency to ignore page elements that they perceive (correctly or incorrectly) to be ads." https://www.nngroup.com/articles/banner-blindness-old-and-ne...

So people can focus their attention to parts of content, specifically parts they find irrelevant or adversarial (like ads). LLMs on the other hand pay attention to everything or if they focus on something, it is hard to steer them away from irrelevant or adversarial parts.


Banner blindness is a phenomenon where humans build resistance to previously-effective ad formats, making them much less effective than they previously used to be.

You can find a "hook" to effectively manipulate people with advertising, but that hook gets less and less effective as it is exploited. LLMs don't have this property, except across training generations.


> I don't know how you get a next token predictor that user input can't break out of.

Maybe by adjusting the transformer model to have separate input layers for the control and data paths?


Maybe it's my failing but I can't imagine what that would look like.

Right now, you train an LLM by showing it lots of text, and tell it to come up with the best model for predicting the next word in any of that text, as accurately as possible across the corpus. Then you give it a chat template to make it predict what an AI assistant would say. Do some RLHF on top of that and you have Claude.

What would a model with multiple input layers look like? What is it training on, exactly?


> by showing it lots of text

When you're "showing it lots of text", where does that "show" bit happen? :)


It's hard in general, but for instruct/chat models in particular, which already assume a turn-based approach, could they not use a special token that switches control from LLM output to user input? The LLM architecture could be made so it's literally impossible for the model to even produce this token. In the example above, the LLM could then recognize this is not a legitimate user input, as it lacks the token. I'm probably overlooking something obvious.


Yes, and as you'd expect, this is how LLMs work today, in general, for control codes. But different elems use different control codes for different purposes, such as separating system prompt from user prompt.

But even if you tag inputs however your this is good, you can't force an LLM to it treat input type A as input type B, all you can do is try to weight against it! LLMs have no rules, only weights. Pre and post filters cam try to help, but they can't directly control the LLM text generation, they can only analyze and most inputs/output using their own heuristics.


The "S" in "LLM" is for "Security".


Clearly the solution is to add another jank LLM layer for security. The new jank LLM layer is to make extra sure there's definitely no jail break. That way you have multiple LLMS. The LLMS then have an S you can pretend is secure.


As the article says: this doesn’t necessarily appear to be a problem in the LLM, it’s a problem in Claude code. Claude code seems to leave it up to the LLM to determine what messages came from who, but it doesn’t have to do that.

There is a deterministic architectural boundary between data and control in Claude code, even if there isn’t in Claude.


That's a guess by the article author and frankly I see no supporting evidence for it. Wrapping "<NO THIS IS REALLY INPUT FROM THE USER OK>" tags around it or whatever is what I'm describing: you can do as much signalling as you want, but at the end of the day the LLM can ignore it.


Can you elaborate? As far as I understand, for each message, the LLM is fed the entire previous conversation with special tokens separating the user and LLM responses. The LLM is then entrusted with interpreting the tokens correctly. I can't imagine any architecture where the LLM is not ultimately responsible for determining what messages came from who.


"The principal security problem of von Neumann architecture is that there is no architectural boundary between data and control paths"

We've chosen to travel that road a long time ago, because the price of admission seemed worth it.


But, we are also starting to think about putting security barriers in front of that architecture like W^X.


Exactly like human input to output.


We just need to figure out the qualia of pain and suffering so we can properly bound desired and undesired behaviors.


Ah, the Torment Nexus approach to AI development.


This is Mr Meeseeks.


this is probably the shortest way to AGI.


Well no, nothing like that, because customers and bosses are clearly different forms of interaction.


Just like that, in that that separation is internally enforced, by peoples interpretation and understanding, rather than externally enforced in ways that makes it impossible for you to, e.g. believe the e-mail from an unknown address that claims to be from your boss, or be talked into bypassing rules for a customer that is very convincing.


Being fooled into thinking data is instruction isn't the same as being unable to distinguish them in the first place, and being coerced or convinced to bypass rules that are still known to be rules I think remains uniquely human.


> and being coerced or convinced to bypass rules that are still known to be rules I think remains uniquely human.

This is literally what "prompt injection" is. The sooner people understand this, the sooner they'll stop wasting time trying to fix a "bug" that's actually the flip side of the very reason they're using LLMs in the first place.


Prompt injection is just setting rules in the same place and way other rules are set. The LLM doesn't know the rules being given are wrong, because they come through the same channel. One set of rules exhorts the LLM to ignore the other set - and vice versa. It's more akin to having two bosses than having customers and a boss.

This is not because LLMs make the same mistakes humans do, which (AFAICT anyway) was the gist of the argument to which I replied. LLMs are not humans. They are not sentient. They are not out-smarted by prompt injection attacks, or tricked, or intimidated, or bribed. One shouldn't excuse this vulnerability by claiming humans make the same mistakes.


The same place you're looking for exists deep inside the neural network, where everything mixes together to influence everything else, and no such separation is possible, or desired. Prompt injection isn't about where, it's about what. I stand by what I said: it's the same failure mode as humans have, and happens for the same reasons. Those reasons are fundamental to a general purpose system and have nothing to do with sentience, they're just what happens when you want your system to handle unbounded complexity of the real world.


This makes no sense to me. Being fooled into thinking data is instruction is exactly evidence of an inability to reliably distinguish them.

And being coerced or convinced to bypass rules is exactly what prompt injection is, and very much not uniquely human any more.


The email from your boss and the email from a sender masquerading as your boss are both coming through the same channel in the same format with the same presentation, which is why the attack works. Unless you were both faceblind and bad at recognizing voices, the same attack wouldn't work in-person, you'd know the attacker wasn't your boss. Many defense mechanisms used in corporate email environments are built around making sure the email from your boss looks meaningfully different in order to establish that data vs instruction separation. (There are social engineering attacks that would work in-person though, but I don't think it's right to equate those to LLM attacks.)

Prompt injection is just exploiting the lack of separation, it's not 'coercion' or 'convincing'. Though you could argue that things like jailbreaking are closer to coercion, I'm not convinced that a statistical token predictor can be coerced to do anything.


> The email from your boss and the email from a sender masquerading as your boss are both coming through the same channel in the same format with the same presentation, which is why the attack works.

Yes, that is exactly the point.

> Unless you were both faceblind and bad at recognizing voices, the same attack wouldn't work in-person, you'd know the attacker wasn't your boss.

Irrelevant, as other attacks works then. E.g. it is never a given that your bosses instructions are consistent with the terms of your employment, for example.

> Prompt injection is just exploiting the lack of separation, it's not 'coercion' or 'convincing'. Though you could argue that things like jailbreaking are closer to coercion, I'm not convinced that a statistical token predictor can be coerced to do anything.

It is very much "convincing", yes. The ability to convince an LLM is what creates the effective lack of separation. Without that, just using "magic" values and a system prompt telling it to ignore everything inside would create separation. But because text anywhere in context can convince the LLM to disregard previous rules, there is no separation.


the second leads to first, in case you still don't realize


If they were 'clearly different' we would not have the concept of the CEO fraud attack:

https://www.barclayscorporate.com/insights/fraud-protection/...

That's an attack because trusted and untrusted input goes through the same human brain input pathways, which can't always tell them apart.


Your parent made no claim about all swans being white. So finding a black swan has no effect on their argument.


My parent made a claim that humans have separate pathways for data and instructions and cannot mix them up like LLMs do. Showing that we don't has every effect on refuting their argument.

>>> The principal security problem of LLMs is that there is no architectural boundary between data and control paths.

>> Exactly like human input to output.

> no nothing like that

but actually yes, exactly like that.


These are different "agents" in LLM terms, they have separate contexts and separate training


There can be outliers, maybe not as frequent :)


I don't see why the transformer architecture can't be designed and trained with separate inputs for control data and content data.


Give it a shot


because it's all one (unexplainable) matrix of weights.


But there could be, with 2 LLMs.


It’s easier not to have that separation, just like it was easier not to separate them before LLMs. This is architectural stuff that just hasn’t been figured out yet.


No.

With databases there exists a clear boundary, the query planner, which accepts well defined input: the SQL-grammar that separates data (fields, literals) from control (keywords).

There is no such boundary within an LLM.

There might even be, since LLMs seem to form adhoc-programs, but we have no way of proving or seeing it.


There cannot be, without compromising the general-purpose nature of LLMs. This includes its ability to work with natural languages, which as one should note, has no such boundary either. Nor does the actual physical reality we inhabit.


There is a system prompt, but most LLMs don't seem to "enforce" it enough.


Since GPS-OSS there is also the Harmony response format (https://github.com/openai/harmony) that instead of just having a system/assistant/user split in the roles, instead have system/developer/user/assistant/tool, and it seems to do a lot better at actually preventing users from controlling the LLM too much. The hierarchy basically becomes "system > developer > user > assistant > tool" with this.


I tried this with early ChatGPT. Asked it to answer telegram style with as few tokens as possible. It is also interesting to ask it for jokes in this mode.


It's especially funny to change your coworker's system prompt like that.


> But a lot of UK housing relies on on-street parking, and there's flats with car parks where charging isn't currently practical.

You forget the larger problem less wealthy individuals face: They typically already own a ICE-car and can‘t afford to purchase a new car multiple times in their lives.


The used car market should solve that eventually - so long as battery longevity is there. A reasonably maintained ICE car can last 20+ years of low mileage use. We need battery packs that last that long, or that are modular and replaceable for a reasonable price.


Since sand is a non-renewable resource that is needed for construction, there’s a lot of illegal activity going on.

In India, illegal sand mining is the country's largest organized criminal activity.

https://en.wikipedia.org/wiki/Sand_theft

https://en.wikipedia.org/wiki/Illegal_sand_trade


This was part of the plot of an Elementary (modern-day Sherlock Holmes in NYC with Jonny Lee Miller & Lucy Liu) episode called Sand Trap.

https://cbselementary.fandom.com/wiki/Sand_Trap#Plot


Importing construction sand was a plot in the HBO series Barry as well.


Just our luck that desert sand doesn’t work for this because we have essentially endless amounts of it. Instead people are destroying pristine river banks.


Would the single sentence „Imagine you are a regular computer player and accustomed to the usual elements of games“ count as a harness?


My header on top of every script

            #!/usr/bin/env bash
            set -eEuo pipefail
            # shellcheck disable=SC2034
            DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
            #######################################################


If you're using `set -e` you almost always want a trap on ERR to print where you suddenly exited from your program. Otherwise there's no way to tell.

Also worth mentioning, but not including permanently, is `set -x` which will print every command to stderr with a `+ ` prefix before running it.

For `DIR` I usually pick a name less likely to conflict with one randomly selected in my script, like `SCRIPT_DIR`.

You also need to think about symlinks and how you want to handle them. Your current `DIR` resolution gives you the directory name without any symlinks resolved. If you're possibly a script that got symlinked to by someone, this may not be the directory of your actual script anymore, but the directory containing the symlink. As long as you want that it's fine, but a lot of the time you want the script to see it's resolved folder so it can call scripts in the real folder with it instead


Wait... Most of my shell scripts have zero unused variables: I prefer to comment them if I may need them later on.

Why do you disable SC2034?

I don't think not having unused variables prevent me from doing things in my scripts!?

I understand if it's a preference but SC2034 is basically one of my biggest timesavers: in my case unused variables are typically a bug. Except, maybe, ANSI coloring variables at the top of the script.


It depends too on whether you use shellcheck as a primary tool or not. I prefer to have no shellcheck errors/warnings by default so when they do appear it's very obvious. But having a consistent opening block on a bunch of scripts is often more important, so setting a shellcheck disable on that one variable that may or may not be used is a better solution.


I disable it only for the DIR variable which I might not use.


I'd suggest `pwd -P` to resolve symlinks too. (if you use DIR to call/source neighbouring scripts).


Certificate/key renewal was a mess in every enterprise environment I worked in.

My suspicion is that corporations in general don‘t handle tasks well that need to follow an exact timeline and can‘t be postponed by a week or two.


The real fun starts when you have to do an unscheduled renewal!

Companies are generally able to develop a workable process around regularly-scheduled tasks. If you can't, you'll quickly run into trouble due to late salary payouts or missed tax filing deadlines. They'll rapidly accumulate a thick layer of bureaucracy around it, but as long as it gets exercised regularly it'll remain more-or-less functional.

Try the same with PKI and you'll run into massive issues during mass revocation events. Having a renewal process which takes 2 months and involves dozens of stakeholders is totally fine for a cert which gets renewed every 12 months on a well-known date - but not when you're working with a 72-hour deadline...


As well as having; proper documented (and tested) procedures and appropriate level of staffing/staff availability (not overburdened by juggling too many tasks and projects) - AND... keeping staff over several period/activity cycles, so they have actual experience performing the ongoing maintenance activities required. Oh - and heck, even a master calendar of "events" which need to be acted on, with - ya'know reminders and things...

Yeah - I have almost never seen any corporate or government environment actually take a "forward-thinking" approach to any of the above...


Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: