freeqaz

Joined 13 years ago

Karma
3,392
Submissions
851
Member since
Oct 15
Head of Security Architecture @ Scale AI - also ex-YC (LunaSec, S19), ex-Figma, ex-Uber, ex-Snap

Email me or go to my domain -- freeqaz.com

Personal email: me at freeqaz

----

[ my public key: https://keybase.io/lunasec; my proof: https://keybase.io/lunasec/sigs/4BoTHAkR8TsFV_1S1Rg-Ed_nFD14ocW-gSgKRhhyNIE ]

YC Badge: 0xcb17dfcabdb996705e2859e224d4cdd94d9ae344

View on Hacker News

Recent submissions

Comment · 5 months ago
I've been working on porting Rock Band 3 and Dance Central 3 to PC via AI assisted decompilation. The repos are on my GitHub (https://github.com/freeqaz/rb3 and https://github.com/freeqaz/dc3-decomp)

Like OP, I've learned at lot in this process. I have versions running in the browser now with a custom WebGPU rendering engine. Still lots of jank and vibes, but it's wild to see what models are capable of with the right tooling. (I've had Claude add extensions into Ghidra for Xbox/Wii specific instruction support)

Wild times we're living in. It's great for software preservation though!

Comment · 5 months ago
I have struggled to get this project working on non-Windows. It just hangs and crashes no matter what I do or try on Linux/Mac. It's a very Windows-oriented project that's slowly losing the shackles right now.
Comment · 5 months ago
This is exactly what happened with Log4Shell.

Day -X + 1: Engineer at Alibaba finds the vuln and tells Apache. Patch is pushed to git while new release is coordinated.

Day -X: A black hat sees commits fixing the bug. Attacks start happening.

Day 0: Memes start circulating in Minecraft communities of people crashing servers. Some logs are shared on Twitter, especially in China, of people getting pwned.

Day 0 + ~4 hours: My friend DMs me a meme on Twitter. I look up to find the CVE. Doesn't exist. My friend and I reproduce the exploit and write up a blog post about it. (We name it Log4Shell to differentiate it from a different, older log4j RCE vuln)

Day ~1: Media starts picking it up. Apache is forced to release patches faster in response. CVE is actually published to properly allow security scanners to identify it.

Today: AI makes this happen faster and more consistently. Patches probably should be kept private until a coordinated disclosure happens post-testing and CVE being published?

Hard to say what the right move is, but this is gonna be happening a lot over the next 1-3 years. Lots of companies are going to be getting cooked until AI helps us patch faster than attackers can exploit these fresh 0-days.

Comment · 6 months ago
I have been wondering if 1 Million token context contributes here also. Compaction is much rarer now. How does that influence model performance? For some tasks I do, I feel like performance is worst now after this. Also Plan mode doesn't seem to wipe context anymore?
Comment · 6 months ago
Also a good fallback if your phone screen cracked 2 hours before. But I can imagine part of the challenge they are facing here are scalpers. TicketMaster app 'rotates' the actual ticket every 30 seconds. Can't rotate paper.

I'd think that having a 2nd factor like presenting ID that matches the ticket would be sufficient there though.

Comment · 7 months ago
128gb is the max RAM that the current Strix Halo supports with ~250GB/s of bandwidth. The Mac Studio is 256GB max and ~900GB/s of memory bandwidth. They are in different categories of performance, even price-per-dollar is worse. (~$2700 for Framework Desktop vs $7500 for Mac Studio M3 Ultra)
Comment · 8 months ago
You can call Cerebras APIs via OpenRouter if you specify them as the provider in your request fyi. It's a bit pricier but it exists!
Comment · 8 months ago
If it maintains the same price (with Anthropic tends to do or undercuts themselves) then this would be 1/3rd of the price of Opus.

Edit: Yep, same price. "Pricing remains the same as Sonnet 4.5, starting at $3/$15 per million tokens."

Comment · 8 months ago
I would honestly guess that this is just a small amount of tweaking on top of the Sonnet 4.x models. It seems like providers are rarely training new 'base' models anymore. We're at a point where the gains are more from modifying the model's architecture and doing a "post" training refinement. That's what we've been seeing for the past 12-18 months, iirc.
Comment · 9 months ago
Does anybody know when Codex is going to roll out subagent support? That has been an absolute game changer in Claude Code. It lets me run with a single session for so much longer and chip away at much more complex tasks. This was my biggest pain point when I used Codex last week.
Comment · 9 months ago
I've been working on decompiling Dance Central 3 with AI and it's been insane. It's an Xbox 360 game that leverages the Kinect to track your body as your dance. It's a great game, but even with an emulator, it's still dependent on the Kinect hardware which is proprietary and has limited supply.

Fortunately, a Debug build of this game was found on a dev unit (somehow), and that build does _not_ have crazy optimizations in place (Link-time Optimization) that make this feat impossible.

I am not somebody that is deep on low level assembly, but I love this game (and Rock Band 3 which uses the same engine), and I was curious to see how far I could get by building AI tools to help with this. A project of this magnitude is ... a gargantuan task. Maybe 50k hours of human effort? Could be 100k? Hard to say.

Anyway, I've been able to make significant progress by building tools for Claude Code to use and just letting Haiku rip. Honestly, it blows me away. Here is an example that is 100% decompiled now (they compile to the exact same code as in the binary the devs shipped).

https://github.com/freeqaz/dc3-decomp/blob/test-objdiff-work...

My branch has added over 1k functions now and worked on them[0]. Some is slop, but I wrote a skill that's been able to get the code quite decent with another pass. I even implemented vmx128 (custom 360-specific CPU instructions) into Ghidra and m2c to allow it to decompile more code. Blows my mind that this is possible with just hours of effort now!

Anybody else played with this?

0: https://github.com/freeqaz/dc3-decomp/tree/test-objdiff-work...

Comment · 10 months ago
I assume that the author here is testing against one of these boxes, right? https://marketplace.nvidia.com/en-us/enterprise/personal-ai-...

Are these considered a good deal at $3-4k? What's the software support like on them? I've got 2x 3090s and I'm curious how this compares.

Comment · 11 months ago
Comment · 11 months ago
Unfortunately not. It's still very broken, and next year it will be worse for a ton of people. I got AI to write a short answer for you:

> Short version: Obamacare never turned into “free primary care for everyone,” it was just a bunch of rules and subsidies bolted onto the same old private-insurance maze. It helped at the margins (more people covered, protections for pre-existing conditions), but premiums/deductibles can still go nuclear if you’re in the wrong income bracket, state, or employer situation. From an EU/Poland perspective it’s not a public health system at all, just a slightly nerfed market where you still get to roll the dice every year.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton