Today Boston Dynamics announced the retirement of their Atlas robot. Boston Dynamics shared this video on Youtube!
For almost a decade, Atlas has sparked our imagination, inspired the next generations of roboticists, and leapt over technical barriers in the field. Now it’s time for our hydraulic Atlas robot to kick back and relax. Take a look back at everything we’ve accomplished with the Atlas platform to date.
I’ve been hearing and reading a lot about AI agents lately.
Ezra Klein has been discussing them all month on his podcast, in a pretty excellent interview series. WIRED’s Will Knight wrote a newsletter last month with the headline “The Age of AI Agents Is Fast Approaching.” The general consensus seems to be that this is where we’re headed.
I have my doubts.
As background, an AI agent is a piece of software that can complete tasks on your behalf. Ezra provides a clarifying example in his most recent interview:
“The example I always use in my head is, when can I tell an A.I., my son is turning five. He loves dragons. We live in Brooklyn. Give me some options for planning his birthday party. And then, when I choose between them, can you just do it all for me? Order the cake, reserve the room, send out the invitations, whatever it might be.”
That’s a tight and evocative description. You can immediately see the appeal, right? It is, broadly speaking, rich-people-shit. One of the (many) advantages that the wealthy have over the rest of us is that they can afford a personal staff that takes care of everyday-life time sinks. Planning a kid’s birthday, figuring out travel logistics, submitting paperwork, etc. Our normal daily lives include an inordinate number of tasks that consume time and mental energy. Rich people can hire someone to handle all that stuff. The rest of us just grin and bear it.
The promise of software agents is that sometime, in the not-too-distant future, the trappings of rich-people-shit could become available to the rest of us.
I’d love to believe in that promise. I am, amongst other things, a perpetually-overwhelmed parent. If technology could reliably help me manage the day-to-day life churn, I would be thrilled.
And Klein’s reasoning is facially quite strong: A whole lot of very well-funded businesses are working quite hard to build software agents right now. The technical hurdles are comparatively small. They have (much of) the necessary technology. They have the funding. They (likely) have (some) market demand. This is not an absurd belief for Ezra to have arrived at.
But I keep being troubled by the ghosts of digital futures’ past. These promises are not new. Nicholas Negroponte and the MIT Media Lab folks were insisting that the age of software agents was imminent in the early ‘90s. Douglas Adams wrote and performed Hyperland, a “documentary of the future,” for the BBC in 1990. it featured Tom Baker as the personified software agent, dressed up as a literal butler.
Instead of software agents acting as personalized digital butlers, we ended up with algorithmic feeds and the infinite scroll.
Facebook’s algorithm is personalized, sure, but it is designed to maximize value for Facebook by keeping you within the company’s walled garden. Amazon’s algorithm is optimized to sell you the most products.
These are not digital butlers. They are digital sales associates.
And, with the benefit of hindsight, we can generalize this phenomenon: the trajectory of any new technology bends toward money.
We could have developed software agents 10, 20, 30 years ago. Software engineers were working quite hard on it. They started companies and obtained funding. The technical hurdles were comparatively small. But there was little money in it. And, in a VC-dominated marketplace, we do not get products that would be useful to the end-user unless they hold the promise of phenomenal financial returns to the investors.
We didn’t get free (or cheap) digital-butlers-for-everyone, because there was no money it.
That’s why the current wave of enthusiasm seems like a hype bubble to me. I am seeing a lot of very smart, normally insightful people being taken in by the idea of “AI personal assistants for the masses,” without asking what the revenue model is meant to resemble.
And let’s be clear: Dario Amodei is casually dropping numbers like “$5 or $10 billion” to train the next-generation models that are supposed to make these AI agents possible. That’s the financial hole these AI agents are somehow meant to fill. And that’s just for starters.
The promise of personalization in internet-futures-past went unfufilled, because the money wasn’t in personalizing to your interests. The money was in keeping you on-site, seeing targeted ads. And, again, the trajectory of the future bends toward money.
Sam Altman says we’ll have agents. Sam Altman says a lot of things. Most of what he says is tuned to what he senses people want to hear at any given juncture. But what is the revenue model for personalized agents? In particular, what is the revenue model that might convince investors over the longer term that it could go to infinity.
(Side note: a number of tech critics have been arguing that AI hype is nearly over, because it’s becoming obvious that the tech companies are spending billions to make millions. I want to gently suggest that these critics are not yet jaundiced enough. The companies are spending billions on a loss-leading product that juices their stock price and makes them worth paper-trillions. The OpenAI investment doesn’t need to generate more sales than MSFT spends on it. It just needs to keep the share price absurdly high. It’s ridiculous, and further evidence that our entire economy is just derivative financial products at this point. But that’s the absurd state of things right now.)
Agents, if they are developed at all, are going to be a bespoke, luxury good. They’ll be for discerning customers with money to spend on personalization. The business class lounge set. The rest of us will get info-sludge and degraded public services. That’s the status quo ante, at least. It’s what will happen if we don’t resist, and collectively demand a better future.
I’d like it to be otherwise. And I plan to keep a close eye on this, since it sort of represents a hard test of my broader thesis about how technologies develop.
A lot of companies are trying to build AI agents right now. They are well funded. There is supply.
The appeal of AI agents, if a smooth and trustworthy product can be brought to market, is undeniable. …Holy hell would it be nice if AI could make the trappings of rich-people-shit available to the rest of us, just this once.
But we are still living in the free trial period of these technologies. The trajectory of the future bends toward money.
So, either a market is going to develop for subsidizing these tools (packaging and reselling all of our behavioral and personal data, for instance), or the products will be rendered unaffordable to the mass public.
If you want to know where social technologies are headed, don’t focus on what the technology might be used for under ideal conditions.
Focus on the direction that currently-existing market forces will channel it.
And if that direction looks bad, exert pressure on public officials accordingly.
Maybe I’ll be wrong. Maybe I’ll revisit this post in 2029 and, with the benefit of all the time made available by my digital personal assistant, compose a thoughtful mea culpa.
But, for the time being, I would urge you to be skeptical of the promise of AI agents.
Until someone can explain how we’re going to pay these digital butlers, I’m going to assume they aren’t ever going to be available to the masses. That’s not their purpose in this story. Their purpose is to get us excited about the promise of AI, to place our faith in these tech firms (old and new) under the assumption that the benefits will be broadly distributed sometime later.
Norway’s northernmost region has asked the European Commission to grant it permission to establish a time zone with 26-hour days.
Excuse me? Say that again.
Traditional (boring) 24-hour days: out. Modern (revolutionary) 26-hour days: in.
The bizarre plan, promoted by a local town mayor in the Arctic Circle near the Russian border, aims to boost local values, increase family time and attract new residents to the region. All nice ideas, but in practice, the details remain at best fuzzy.
In its letter to the European Commission — which confirmed that it has received the request — the region is asking the EU body to instruct Norwegian authorities to approve the creation of a time zone with 26-hour days instead of 24-hour days.
How would the new time zones work in practice? Wenche Pedersen, the mayor of Vadsø who authored the letter, is unsure.
“We haven’t thought a lot about that” she said. “The clock will go from 12 to 13… and we have to see how this will go. I don’t think they’re going to say yes so we haven’t thought about all the details.”
Right.
According to Pedersen, the region has been struggling to attract new residents. But the mayor is hoping this will change by showcasing the area’s unique values.
“Through our ‘MOREtime’ project, we aim to celebrate and promote this unique way of life, offering individuals the opportunity to enjoy more quality time engaging in activities such as fishing, hunting, learning new languages, or simply being with loved ones,” Vadsø said in a letter.
“What is the good thing about living here? It’s the time,” she told POLITICO.
“We don’t run after the buses or after the trains or have to take a long time to travel to work and so on,” she added. “We are very satisfied with living in a part of Norway where we have more time to be with our friends, with our family and together.”
By extending the length of the days, Pedersen hopes that more people will be inspired to move to the remote region. Ensuring that the area is populated is “more important than ever” in light of Russia’s war against Ukraine, Pedersen added.
“We like our lifestyle and we think that could be very exciting, especially for families with small children,” the mayor said. “I think it’s a more calm and better everyday life than for example in a big city.”
Could it actually happen?
Norway is not an EU member, but the country is part of the European Economic Area (EEA). While a EU directive regulates summer time arrangements, whether it has authority over creating separate time zones is another question.
According to a Commission official, time zones are a matter for countries themselves, so it’s unlikely that the EU will be able to grant the region’s request.
Nevertheless, Pedersen is hoping to at least spread the word about the uniqueness of northern Norway.
“In this respect we are one of the richest regions in Europe because […] we have more time,” Pedersen said.
In breaking news that dropped just after our weekly security column went live, a backdoor has been discovered in the xz package, that could potentially compromise SSH logins on Linux systems. The most detailed analysis so far seems to be by [Andres Freund] on the oss-security list.
The xz release tarballs from 5.6.0 in late February and 5.6.1 on March 9th both contain malicious code. A pair of compressed files in the repository contain the majority of the malicious patch, disguised as test files. In practice, this means that looking at the repository doesn’t reveal anything amiss, but downloading the release tarballs gives you the compromised code.
This was discovered because SSH logins on a Debian sid were taking longer, with more CPU cycles than expected. And interestingly, Valgrind was throwing unexpected errors when running on the liblzma library. That last bit was first discovered on February 24th, immediately after the 5.6.0 release. The xz-utils package failed its tests on Gentoo builds.
One of the xz maintainers, [Jia Tan], weighed in on that Gentoo bug, suggesting that it was a GCC bug causing the Valgrind errors. This is the same developer that pushed the malicious archive files and minted the tainted releases. And as if to clear up any remaining doubts, the developer doubled down in a GitHub commit, working around the Valgrind errors, and linking to a completely unrelated GCC bug report claiming it to be this issue.
At this point, the only reasonable conclusion is that the person in control of the [JiaT75] GitHub account is a malicious actor and is completely untrustworthy. What’s unclear is if this is still the same developer that has been co-maintaining the project since August 2022. It’s possible that [Jia Tan] has always been a bad actor, or that account may be completely compromised.
What may not be clear is the connection to SSH. And it’s a trip. Many Linux distros patch sshd to add systemd features, and libsystemd pulls the liblzma library. That means the liblzma initialization code gets run when sshd starts. In the malicious code, the library checks argv[0], which is the name of the program being executed, for /usr/bin/sshd. Additionally it seems to check for debugging tools like rr and gdb. If the checks are green, liblzma replaces a few function calls with its own code. It’s a complicated dance, but the exploit is specifically looking to replace RSA_public_decrypt.
That’s a very interesting function to clobber, as it is one of the functions used to validate SSH keys. It’s not hard to imagine how malicious code here could check for a magic signature, and bypass the normal login process. The full analysis is still being done, and expect more information in the coming days.
But the bottom line is that a machine with a patched sshd binary, that also has xz packages version 5.6.0 or 5.6.1, is vulnerable to unauthenticated SSH logins. The good news is that only a few distributions have shipped the 5.6.x series of xz packages. Fedora Rawhide/41 them, and Debian Testing and Unstable shipped these versions as well. If you’re on an affected system, look for an update right away.
It’s unclear what the path forwards is for the xz project. This is obviously an important system utility for Linux systems, and its current maintainers seem to be asleep at the wheel — or intentionally steering towards disaster. Expect one or more hard forks, and then a lot of cleanup work.
This is a developing story. For more, see the Redhat security alert, the Debian alert, and the oss-security thread on the subject.
Log in
