If it was the Australian Medicare Statistics Reporting Service on June 18th it may have been part of this incident: https://collusion.wiki/ - the bulk of that coordinated activity was between 16th and 21st of June, and we know they were hitting UK government data sites.
I had a dig around in the data that they published on that site and found references to www.aihw.gov.au and viz.aihw.gov.au and vizprod.aihw.gov.au
ABC have picked up this story now at [1], but ABC are treating it as two separate events, possibly directly connected though:
1. Probing of AIHW's website to try and obtain PBS statistics, as collusion.wiki findings show. The collusion.wiki findings don't indicate anything other than intentionally public data was obtained. Bots appear to be trying to get around Cloudflare geo-blocking implemented on AIHW's public website. I can't think of a reason why geo-blocking may be deemed necessary on that website though?
2. Probing of an outdated Medicare statistics reporting website. (I guess at [2] this could be the recently shut down https://medicarestatistics.humanservices.gov.au or related website that matches timeframes of this story).
I suspect though anything to do with PBS data is more important than Medicare data because of heightened tensions from international pharmaceutical companies that lobby extensively against Australia's public healthcare system and collective purchasing of medication by the federal government.[3] Regardless of whether a course of medication costs AUD$50 or AUD$50k, it's purchased in bulk by the Australian government after negotiating with pharmaceutical companies, and then subsidised down to a maximum of AUD$25 at the time it is sold to a patient at a pharmacy. Perhaps if international pharmaceutical companies had obtained more detailed data on use of each brand of prescription medicines in Australia, they could be advantaged in their price negotiations with the Australian government, or advantaged against their competitors?
Less alarmingly though, perhaps some researcher studying the side effects of a particular medication was just asking an LLM to answer a benign question such as "How often is ACME Inc's FixMeUp medication prescribed in Australia?"
The classic problem here is if you do that thing where user agents that send "accept: text/html" get HTML, while user agents that don't get JSON or some other format.
This used to be impossible to deploy behind Cloudflare caching, because they ignored the Vary header on anything other than images - so you risked caching the JSON version and then serving it up to someone who was expecting HTML.
(Independent of the Cloudflare feature I ended up deciding never to use that pattern, because I prefer having URL that predictably returns HTML or JSON - I add a .json suffix to my apps to serve JSON instead.)
Frankly, the supposed variability of the Accept header never really sat all that well with me; in practice I much prefer working with explicitly versioned endpoints — one of the most infuriating things is having to hardcode "Accept: text/x-myorgname-custom-json-blob-v4" because omitting it would produce "406 Not Acceptable". Bonus points if that's the only Accept header the service would ever accept in all of three years of it working before being decommissioned. Double bonus points if v5 would be introduced behind a separate URI anyway (and it, too, would require precisely "Accept: text/x-myorgname-custom-json-blob-v5" and nothing else).
I always thought Accept (and Accept-Language) headers are quite neat. Surely I can try article.es.md first, get a 404, try article.en.md, get a 404, try article.es.txt, article.en.html and so on, until I find the thing I'm looking for. But Accept let's me say "I'll take any one of these, preferably in this order". This is especially useful now when agents are reading the web and they don't really need all of our HTML code - just the text.
If you're versioning the whole API though, I agree it's best behind a a /v2/ prefix.
REST is all about MIME types and Accept/Content-Type. So there goes REST.
TFA makes me think that your argument is stronger than I would have thought yesterday, though I still prefer to have Accept/Content-Type negotiation. Sibling's comment about negotiation is on-point.
And I think there is Content-Location header as well?.. My point is, it's possible to divorce caching of the server's response that choses the best available representation from caching of the actual content, and if you can't send Vary with the first response, then "Cache-Control: private, max-age=0" will still probably won't kill your redirection-making server. Or there is the Negotiate/Alternates + 300 response code mechanism as well!
It feels like an LLM variant to me. It's a large model, trained in large amounts of text, that you prompt using human languages. The only difference is that the output is a set of scores as opposed to more text.
I visited https://claude.ai/ over a mobile tethered connection from my laptop the other day and was pleasantly surprised at how quickly it loaded.
(That said, I just had a look in Firefox and it loads 20.78 MB of JavaScript (6.84 MB compressed) so I expect they could make it a bunch lighter if they kept trying.)
I doubt that they could iterate from where they are to an optimal solution though. What would have gotten them there more reliably is a development culture that would have found it disgusting to even consider shipping that much JS in the first place. And I don't buy the "then they never would have shipped at all" argument in this case, because, unlike the case of shipping cross-platform desktop apps before Electron, we did ship plenty of web apps, including interactive chat-shaped apps, before it became easy to unthinkingly ship a JS bundle that big.
> so I expect they could make it a bunch lighter if they kept trying.
What is preventing a 1T dollars company from "keep trying"? What did they "kept trying" that got them to ship a webapp with 21mb of JavaScript?
This is a failure of their software engineering culture. Keep trying the same thing will keep doubling their JS, not halving it. That's the effect of incompetence + LLM reliance.
I wouldn't expect any better from a company that uses nextjs and React for their cli/TUI.
Yeah, culture. I expect most of the web developers at Anthropic are of the generation that considers 21MB of JavaScript a perfectly reasonable way to build a web app.
I vibe coded a playground UI for trying this out. The conversation mode is neat, and it's very expensive - most of my experiments have cost less than a cent.
Bit of both. I define "vibe coding" as building without looking at the code at all. For this one I was reading the code to understand how it works, and I then followed up several times to adjust how it was working.
Nice but in general I wouldn't put my API key into some third party website, no matter if it claims to not store it. It's not something personal, you are a bit of a celeb here so I wouldn't think you'd save the keys, it's just good general data hygiene. Especially not if a leaked API key can rack up thousands of dollars in fees quickly.
> Voice replication: Recreate consistent vocal profiles from just a 30-second audio sample of your voice or a voice you have the rights to use, backed by built-in consent verification, SynthID watermarking, and C2PA credentials to protect both developers and their vocal talent.
I guess voice cloning is widely enough available now from other providers that Google are no longer hesitant to ship it.
Yesterday night I was doing a project with QwenTTS 1.7B.
After some debugging, making a clean dataset with clean recordings, and experimenting with a good fine tune recipe (much props to the new GPT models yesterday being cheaper).
I was able to make a robo-me that sounds absurdly good, family was shocked, all in a matter of a few hours.
so one of my interests is reducing the payload size for video games
the vast majority of the image sizes have been audio recordings, and its been that way in different qualities for the last two decades. this is still the case as more varied and comprehensive audio is pursued by studios at unfathomable expense and still failing to cross a bar of realism
good voice models are just a few gigabytes in comparison and can supplant all of that, and be run locally at this point. Future ubiquitous hardware configurations in consumer devices will make inference dedicated and computationally cheaper and faster
although AAA studios are hamstrung and will be deeply unpopular if they stopped booking voice actors
everyone else who would have never had the capital for voice actors will just use this and have richer experiences until they themselves are AAA studios from the market buying their rich experiences
this will vastly supplant the assumed and uninspired “tricking humans” use case from that video. once it crosses a threshold of ease, the applications will expand
They probably do something similar to GPT-Live where they expect a given voice profile to send them a sample saying 'This is the owner of this voice and I consent for synthetic samples to be made of it'
and/or local voice cloning is good enough as is so Google doesn't grant a uniquely liable ability?
>and/or local voice cloning is good enough as is so Google doesn't grant a uniquely liable ability?
Probably the latter. Cat's already out of the bag to the extent that you can synthesize with a specific voice in one go and it sounds decent. Even if you need commercial models for better intonation or whatever, you can probably get the commercial models to first generate with a generic voice, then use a local model to transfer that to voice you're cloning. That'll probably get rid of any C2PA watermarks too.
This has been possible for quite a long time (probably 1-2 years). There are multiple open models that can do this quite well. Recent example from my YT feed:
usually people bring up anyone who is losing physical control of their voice faculties, so they can have a synthetic voice that matches their natural voice
The iPhone has a built in voice cloner hidden in the accessibility settings for exactly this use-case: creating a backup of your voice in case you need it in the future.
I mean yeah? If google offers a cloud nmap tool, should everyone get in a tizzy about how google is "evil", even though it saves baddies maybe 5 minutes of work?
I don't know why this argument is brought up all the time anyway, it literally means nothing. They can name themselves "Don't Be Evil Inc" and continue to do evil stuff cause evil isn't an objective measure. If squeezing juice out of puppies made money, any business can just say it's "not evil."
And if you think they're evil why would you trust them to follow their own guideline of not doing evil? An evil corp would be more likely to just hide behind that phrase, not quietly remove it as some subtle hint that they want to be openly and proudly evil all of a sudden.
Fine tuning LLMs has turned out to be mostly not worth the effort, but I wonder if fine tuning Jev-style models will turn out to be a whole lot more useful.
But why? Jev-style models seem useful for "I have no clue what my incoming distribution looks like but I need to give some sort of answer". If I know what my incoming distribution looks like I'll just upload a CSV of that into ChatGPT and ask it to fit a basic ML model on my data.
Both authors. Stochastic Parrots was Emily M. Bender, Timnit Gebru, Angelina McMillan-Major, and Margaret Mitchell - the linked article is by Emily M. Bender and Timnit Gebru.
This made my day! I love it when people on Hacker News mention Stochastic Parrots, and they're actually referring to the paper and its authors, instead of just mindlessly performing a reflexive drive-by anti-ai shibboleth by parroting a phrase they heard on the internet without any understanding of what it means, or what paper it refers to, or who wrote it, or what the conclusion and responses to the paper were. Thank you!
But we have to have a talk about stochastic pelicans riding bicycles...
And apparently they sometimes get lost or processed incorrectly, leaving people disenfranchised.
reply