Quick caveats: this is a post on AI safety, written by a cryptography professor. If that troubles you, you should read something else. I try hard not to work on AI (except when the topic occasional…
Really though? About 15 years ago I was tasked with finding a sandbox just for allowing Python to be run on a website. Admittedly, Python is not the language they should give to you in the first year of Sandboxing School, but the level of thought that had gone into the best package I found was really impressive. The package had one open issue saying, essentially, “This cannot be done”. Given the history of infosec, I think the claim it is “merely hard” would need proving at this point. We have finally invented water, in a computer sense. If you’ve suffered through a flooded basement (or been killed by a tidal wave, I suppose), you already know you cannot argue with water. It will find a way.
So, website let user run arbitrary Python code on the server, right? Yeah, well, depending on the approach this could quickly devolve into a game of whack-a-mole. Can’t really be done indeed. For this I would probably try to write a Python interpreter that does not perform any I/O (yes, that means duplicating decades of work, or at least give up on all libraries that touch the FFI).
I mean, sandboxing a program, that not only isn’t made for this, but also runs arbitrary code, is asking for a heap of trouble. Proper sandboxing likely requires either rewriting anything that’s not meant for it, or put the whole thing in a (possibly formally verified) emulator, and probably not let the emulated program access any type of real time clock.
Thankfully now we can ship the Python interpreter in Web Assembly to run in the browser, so the only thing for users to hack is their own machine. It’s cheating of course, but for all my talk I have to admit I’d rather cheat than bootstrapping the entire computing world.
A company dealing in $billions however has no excuse in my opinion. If they can’t find a way to cheat, I do expect them to bootstrap the world. The regulator could start by holding the brass up top personally, civilly, and penally accountable for any hacking that results from the carelessness of their company. If Mr Altman faced prison time, you can bet there would be much fewer rogue AIs. Or at least they wouldn’t boast about them.
Really though? About 15 years ago I was tasked with finding a sandbox just for allowing Python to be run on a website. Admittedly, Python is not the language they should give to you in the first year of Sandboxing School, but the level of thought that had gone into the best package I found was really impressive. The package had one open issue saying, essentially, “This cannot be done”. Given the history of infosec, I think the claim it is “merely hard” would need proving at this point. We have finally invented water, in a computer sense. If you’ve suffered through a flooded basement (or been killed by a tidal wave, I suppose), you already know you cannot argue with water. It will find a way.
score 1 · canonical
So, website let user run arbitrary Python code on the server, right? Yeah, well, depending on the approach this could quickly devolve into a game of whack-a-mole. Can’t really be done indeed. For this I would probably try to write a Python interpreter that does not perform any I/O (yes, that means duplicating decades of work, or at least give up on all libraries that touch the FFI).
I mean, sandboxing a program, that not only isn’t made for this, but also runs arbitrary code, is asking for a heap of trouble. Proper sandboxing likely requires either rewriting anything that’s not meant for it, or put the whole thing in a (possibly formally verified) emulator, and probably not let the emulated program access any type of real time clock.
Thankfully now we can ship the Python interpreter in Web Assembly to run in the browser, so the only thing for users to hack is their own machine. It’s cheating of course, but for all my talk I have to admit I’d rather cheat than bootstrapping the entire computing world.
A company dealing in $billions however has no excuse in my opinion. If they can’t find a way to cheat, I do expect them to bootstrap the world. The regulator could start by holding the brass up top personally, civilly, and penally accountable for any hacking that results from the carelessness of their company. If Mr Altman faced prison time, you can bet there would be much fewer rogue AIs. Or at least they wouldn’t boast about them.
score 1 · canonical