Recent submissions

Comment · 6 hours ago
I have a more nuanced take on this, which is that many engineers may have decent intuition on security - but that's entirely besides the point here, because without the political capital to have a large organization (and their customers and counterparties!) change their workflows and security stances, they're tilting at windmills. Security is not one of those things that one can throw bodies at - it requires true attention and commitment from leadership, and time to percolate across every facet of a company. If such a mandate is in place, talent is far from the limiting factor.
Comment · 1 day ago
> the older code probably contains a ton of bugs already

The billion-dollar question is: what things might an LLM see as a bug or candidate for simplification, but supported a unique use case? https://xkcd.com/1172/ as always is prescient.

The thing about "rewrite X in two weeks" - or an entire company's worth of code in 24 months - is that it gives scarcely little time to do incremental rollouts to limit splash radius, or to identify and gather stakeholders to whom one can ask "why was this necessary" (or who can be guided to mine their emails and chat logs for conversations about the same).

Which is not to say this shouldn't be done! Let AI-native people guide the momentum with all the fervency of a hungry founder... but find project leaders who are committed to the empathy towards those who depend on the quirks of their workflows - ones who will create "curiosity loops" that try to bring in stakeholders as rapidly as possible on material questions, not just "continue, follow what you think is best" loops when the LLM brings up an open business question.

Comment · 2 days ago
We're in a really interesting world where "anything can run anything." Like, in theory, you could get Doom to run on a Cerebras that's specifically laid out for $specific_model architecture, by swapping the weights it holds in SRAM. Just like we're currently running $specific_model on GPUs that were designed for games in the first place.

To misquote a certain YouTuber: LLMs are just games, unlimited games, but no games.

Comment · 2 days ago
Modern PaaS is tough because there's a general expectation that users (and agents) are able to see and read back environment variables in their management UI or CLI - which means that you can't segregate credential values from the public web environment. See e.g. the visibility icons on https://northflank.com/docs/v1/application/secure/inject-sec...

And sure, you can encrypt at rest, and perhaps even enforce that only re-encrypted versions are ever seen by the management/API web server. But fundamentally this display requirement means that if your management/API web server is compromised, users' secrets can be obtained by a process of impersonation.

Comment · 2 days ago
Only with two fully maxed subscriptions can we achieve this, and this is forbiddeneded
Comment · 3 days ago
Just because OpenAI ran roughshod over the broader software community's notion of "open" which once heavily implied free-as-in-software-not-beer, doesn't mean we need to continue this pattern.

Many industries had "source available" without the word "open" for decades, and that was a broadly understood term. "Weights available" would be a reasonable analogue.

For clarity, the Mistral model license is here: https://huggingface.co/mistralai/Mistral-Large-4-1T-A52B/raw...

> 2. If the Licensee or any of its affiliates operates a Model as a Service business, the Licensee must enter into a separate commercial license with Mistral before using the Model or its derivative works for any commercial purpose. The Licensee may contact Mistral, using this form: https://mistral.ai/contact/, to request a commercial license.

> "Model as a Service" means giving a third party access to the Model or its derivative works for inference or post-training by any means (for instance via API or hosted endpoints), in a manner that allows such third party to exercise meaningful control over the inputs, parameters, or training data. This does not include (a) end-user products with model capabilities solely embedded within specific features or harnesses, or (b) mere relaying of requests to models hosted by others.

"Meaningful control over the inputs" is so ambiguous as to be nearly meaningless. Does a model merely summarizing a user's submitted support tickets, give that user meaningful control over the inputs?

Don't get me wrong - I appreciate that Mistral needs to walk a fine line for its own sustainability, and that sustainability is a good thing! And I may just be an old person ranting at a cloud. But "open" used to mean something, back in my day!

Comment · 5 days ago
From https://discuss.python.org/t/pep-836-jit-go-brrr-the-path-to... :

> We want the PEP to be clear that it’s ultimately the JIT team’s responsibility to find solutions for these packages and tools, and how to deal with situations where a tool can’t be supported or made to work

Is it just me or is this absurdly impossible, to the point of willfully killing the project? Committing a team of brilliant compiler engineers to doing free consulting ad infinitum for every bit of tooling in the world, however hacked-together?

The alternative would be to have the bravery to say: this is the way forward to keep this language relevant into the future, and as a steering committee we collectively own that some tooling may be out of date. Instead, this is a signal that Python is going to rest on its laurels for a very long time.

Comment · 5 days ago
Thank you for fighting for the users!
Comment · 9 days ago
One of my favorite things about UUIDv7: the package https://pypi.org/project/uuid7/ does not implement compliant UUIDv7s, it's from a wholly incompatible draft format. That was not a fun debugging session.

https://pypi.org/project/uuid-utils/ is what you want :)

https://github.com/stevesimmons/uuid7/issues/1

Comment · 11 days ago
One small glimmer of hope is that customizable selects are indeed being worked on: see https://open-ui.org/components/customizable-select.explainer... and the broader work of the Open UI group at W3C.

I'd love to see this level of customization come to date and datetime-local popups, finding a meaningful path that preserves compatibility with the design languages of various platforms. If and when that happens, it will be because of the work of standardization working groups like Open UI and Interop.

Comment · 12 days ago
downloadmoreipads dot com
Comment · 12 days ago
So I could see the other argument here: I’m presenting from a presentation, I want to switch to a live demo environment, and to do so I need to turn off the presentation entirely?

Now, another operating system might see this tension and say: why not have a UI element come up, and ask the user whether they want to share their entire screen or stay on the existing shared window?

Here, I think this hits a fundamental weakness in Apple’s design culture: if you want to make things magical by removing options from users, occasionally you’re going to hit something that’s impossible to do without giving the user control. And if anything, Apple’s culture has been overtuned towards not providing that control, if at all possible.

Nobody wants complexity for complexity’s sake, but this is the type of thing that should have come up in a meeting, and someone didn’t feel empowered to bring it up.

Comment · 12 days ago
One of the most illuminating things here is that now the trigger phrase (for this toy example) is now in an innocuous HN comment. Ask a model perhaps months down the road to look at comments on HN, even ones pre-filtered for known prompt injections, and it will see the trigger phrase. No user generated content is safe.
Comment · 15 days ago
Imagine you’re an employee at OpenAI who has an idea to use your free time to build these monitoring systems. All of a sudden, your existence becomes political. Remember that OpenAI’s raison-d’être is not to detect traffic, it is to be in The Room where AGI happens.

You have built a short-term whistleblowing system that arguably reduces the probability OpenAI is in that Room, via the negative press such detection would generate. You are now a threat in the eyes of your peers.

Now rewind: you know this before you’ve built the sniffer. You personally want to be in The Room because you believe your desires for alignment exceed those of your accelerationist peers. Is now the time to stick your head out? No, it is not. And arguably you’re being optimally protective of society for realizing this. And so the agents do what they do best.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton