I disagree, but, before I get into the disagreement, I do want to acknowledge and give props for engaging with the actual details of the legislation. Most people don't.

Meta-level: The ballot proposition is 32 pages and dense in legal and accounting jargon; believing it to be free of any weird traps requires trust that has very much not been earned. I think most people correctly conclude that they aren't capable of distinguishing a version with gotchas from a version without gotchas, look instead at the political process that produced the document, and conclude that it probably has gotchas. I also wrote this about wealth taxes broadly, and while the California ballot proposition is the one that we happen to now have to look at, the discourse dynamics are not specific to it and largely predate it.

Object-level, by my own read, the California ballot proposition has some pretty major gotchas in it. I don't think your confidence that it "could not make anybody bankrupt unless their tax lawyer was illiterate and also probably deceased" is justified. In particular, some things I picked out from a (not especially thorough) reading:

• Not being able to sell is not a usable defense, in the way you describe it to be, because "unable to sell" and "unwilling to sell" are not legally distinguishable until much further into litigation than anyone wants to get.
• The ODA mechanism specifies that in order to use it, you have to give up several of the causes of action that you would want to use to dispute the tax. It also says that the Franchise Tax Board will create a contract, leaving some freedom in what that contract will contain, which likely means giving up additional causes of action.
• The ODA mechanism specifies that "A taxpayer may only attach assets or groups of assets to an ODA to the extent that the amount of additional tax that would be owed as a result of Section 50301 (without the use of an ODA) would exceed the sum of the combined value of all of the taxpayers' assets subject to the valuation rules of paragraph (1) of subdivision (c) of Section 50303." My my read of paragraph (1) of subdivision (c) of Section 50303, this includes all cash, cash equivalents, and easily tradeable commodities. Which would seem to imply that the ODA mechanism obligates anyone who uses it to sell all covered assets and go to a cash balance of zero, and only allows deferring additional tax after hitting zero; but this doesn't include any margin for short-term expenses, or for taxes other than the wealth tax such as capital-gains incurred as a result of being forced to sell all assets.
• The definition of "Publicly traded asset" in 50308(j) is "an asset that is traded on an exchange; traded on a secondary market in which sales prices for such asset are frequently updated; available on an online or electronic platform that regularly matches buyers and sellers; or any other asset that the Board determines has a value that is readily ascertainable through similar means." A literal reading of this definition would seem to include cars used as primary transportation.
• 50302(e) says that "No debt or liability, including recourse debts described in subdivision (a), shall reduce net worth if the debt or liability is owed to a related person or persons; or if the existence or amount of the liability is contingent on future events that are substantially uncertain to occur or that are substantially uncertain to occur within the subsequent five years; or if the debt or liability was not negotiated for at arm's length." This would exclude convertible notes, which are a common financial instrument used by startup investors.

Looking at discourse around California's ballot proposition 25-0024 (a "billionaire tax"), I noticed a pretty big world model mismatch between myself and its proponents, which I haven't seen properly crystallized. I think proponents of this ballot proposition (and wealth taxes generally) are mistaken about where the pushback is coming from.

The nightmare scenario with a wealth tax is that a government accountant decides you're richer than you really are, and sends a bill for more-than-all of your money.

The person who is most threatened by this possibility isn't rich (yet), they're aspirationally upwardly-mobile middle class. If you look at the trajectories of people-who-made-it, especially in tech and especially in California, those stories very frequently have a few precarious years in them in which their accessible-wealth and their paper-wealth are far out of sync. That happens with startup founders (a company's "valuation" is an artifact of the last negotiation you had with investors, not something you can sell). And it happens with stock options (companies use these to pay people huge amounts of money, without accidentally triggering an immediate retirement, and without needing to have the money yet). This sets up situations where, if the technicalities work out badly, a "5%" tax can make you literally bankrupt.

When people talk about "fewer businesses being created", this is why. If I were a billionaire, and I lost 5% of it to tax, I wouldn't care. If I were following a precarious, low-probability path towards becoming a billionaire, and I thought California would spring a kafkatrap to destroy me as soon as I got close, I would either not try, or not try in California.

In a different state, this might not be a credible fear. But California is a state that is famous for its kafkatraps, and for refusing to ever back down from the kafkatraps it's built.

No, that's not a working mechanism; it isn't reliable enough, or granular enough. Users can't add their own content to robots.txt when they submit it to websites. Websites can't realistically list every opted-out post in their robots.txt, because that would make it impractically large. It is very common to want to refuse content for LLM training, without also refusing search or cross-site link preview. And robots.txt is never preserved when content is mirrored.

The vibe I get, from the studies described, is reminiscent of the pre-guinea-pig portion of the story of Scott and Scurvy. That is, there are just enough complications at the edges to turn everything into a terrible muddle. In the case of scurvy, the complications were that which foods had vitamin C didn't map cleanly to their ontology of food, and vitamin C was sensitive to details of how foods were stored that they didn't pay attention to. In the case of virus transmissibility, there are a bunch of complications that we know matter sometimes, which the studies mostly fail to track, eg:

• Sunlight can be a disinfectant, so, whether a surface or the air of a room can transmit a virus might depend on whether it has windows, which way the windows face and what time of day the testing was performed.
• Cold viruses are widespread enough to have widespread immunity from prior exposure. Immunity might not generalize between exposure methods; ie, maybe it's possible to be immune to low-quantity exposure but not high-quantity exposure, or immunity on nasal mucus but not deep lung, etc.
• There are a huge number of viruses that are all referred to as "common cold", with little in common biologically other than sharing an evolutionary niche.
• Because immunity fades over time, there might be an auction-like dynamic where cutting off one mode of transmission still leaves you with recurring infections, just at a longer interval

I think that ultimately viruses are a low-GDP problem; after a few doublings we'll stop breathing unfiltered air, and stop touching surfaces that lack automated cleaning, and we'll come to think of these things as being in the same category as basic plumbing.

What they don't do is filter out every web page that has the canary string. Since people put them on random web pages (like this one), which was not their intended use, they get into the training data. 

If that is true, that's a scandal and a lawsuit waiting to happen. The intent of including a canary string is clear, and those canary strings are one of very few mechanism authors have to refuse permission to use their work in training sets. In most cases, they will have done that for a reason, even if that reason isn't related to benchmarking.

While LW is generally happy to have our public content included in training sets (we do want LLMs to be able to contribute to alignment research after all), that does not extend to posts or comments that contain canary strings, or replies to posts or comments that contain canary strings.

Canary strings are tricky; LLMs can learn them even if documents that contain the canary string are filtered out of the training set, if documents that contain indirect or transformed versions of the canary string are not filtered. For example, there are probably documents and web pages that discuss the canary string but don't want to invoke it, which split the string into pieces, ROT-13 or base64 encode it, etc.

This doesn't mean that they didn't train on benchmarks, but it does offer a possible alternative explanation. In the future, labs that don't want people to think they trained on benchmark data should probably include filters that look for transformed/indirect canary strings, in addition to the literal string.

Ok, to state what probably should be obvious but which in practice typically isn't: If the US does have a giant pile of drones, or contracts for a giant pile of drones, this fact would certainly be classified. And there is a strong incentive, when facing low-end threats that can be dealt with using only publicly-known systems, to deal with them using only publicly-known systems. The historical record includes lots of military systems that were not known to the public until long after their deployment.

Does that mean NATO militaries are on top of things? No. But it does mean that, as civilian outsiders, we should mostly model ourselves as ignorant.

When I use LLM coding tools like Cursor Agent, it sees my username in code comments, in paths like /home/myusername/project/..., and maybe also explicitly in tool-provided prompts.

A fun experiment to run, that I haven't seen yet: If instead of my real username it saw a recognizably evil name, eg a famous criminal, but the tasks it's given is otherwise normal, does it sandbag? Or, a less nefarious example: Does it change communication style based on whether it recognizes the user as someone technical vs someone nontechnical?

Entering a conversation with someone who is literally wearing a "Might be Lying" sign seems analogous to joining a social-deception game like Werewolf. Certainly an opt-in activity, but totally fair game and likely entertaining for people who've done so.