tbrockman

Joined 6 years ago

Karma
388
Submissions
75
Member since
Nov 7
of https://theo.lol and https://joinez.co/
View on Hacker News

Recent submissions

Comment · 1 month ago
Amazon, I would like to second this offer.
Comment · 1 month ago
LLVM is bounded by what its IR can express, and what it can express is constrained by what is portable and what it can prove. There is a reason `ffmpeg`, OpenSSL, OpenBLAS, glibc's string routines, LuaJIT's interpreter, etc. all still leverage hand-written assembly.

As for the editor, even if it isn't necessarily optimal assembly (I have no clue), a reduced feature set and relying on OS APIs instead of frameworks will still probably result in something which feels faster than Electron programs like VSCode.

Comment · 1 month ago
I agree! Just to be clear, by "security critical" I mean the tier where you'd also refuse shared VMs. I'm not convinced most people have workloads and threat models that actually need the isolation they say they want, nor a fully considered notion of what their preferred primitive buys them (per your footnote, and any number of other issues I'm completely unaware of). But I like and appreciate Workers, and am grateful to be paying less because Cloudflare bin-packed more.
Comment · 1 month ago
But those same things (and more), in the majority case of completely benign workloads, are significantly better for resource utilization and performance.

I don't think their model is "run everything in V8 isolates as the only isolation primitive", I believe it's closer to "run things with V8 isolates as the floor, dynamically trading efficiency for security in response to runtime (and I'd also assume static) analysis". They also add restrictions to make it more difficult/expensive for code to exploit side-channels (ex. changing the resolution and behavior of `performance.now ` and `Date.now` , no multithreading, no SharedArrayBuffer , etc.). Code attempting to exploit side-channels usually has a fingerprint. If you can classify it well enough, and the cost of a false positive is paying for the process isolation you'd otherwise have paid for everything all the time, you probably end up with healthier margins.

I don't disagree that there are real issues, but I don't think that Cloudflare necessarily misrepresents them (though they do perhaps fall quite a bit short of saying "don't run security critical workloads on our platform"). If you can accept the risk though, you get cheap compute with someone else managing all the infrastructure. If you can't, you probably shouldn't be using Workers (and maybe not even cloud compute in general).

Sources:

* https://gruss.cc/files/scalableisolation.pdf

* https://arxiv.org/html/2110.04751v1

* https://arxiv.org/pdf/2608.17043

* https://blog.cloudflare.com/revisiting-spectre-attacks-on-wo...

Comment · 1 month ago
Comment · 1 month ago
It's not using the File System Access API, on Firefox it uses <input type="file"> for file-picking, and the save just downloads it. It's not synchronizing anything with your filesystem.
Comment · 1 month ago
Comment · 3 months ago
In isolation, yes, that does seem like it would have been the better decision for Claude Code, but it also would have severely diminished the value of their Bun/oven.sh acquisition.

Claude Code isn't the only user of Bun (it's probably not even the only user of it internally at Anthropic), and this way they get to keep the Javascript runtime (and other tooling) that their coding models may one day, if not already, prefer to use when given the opportunity. For those kind of apps, you'll probably also eventually find that--what do you know!--Anthropic also has their own cloud offering (instead of Bun being the one to build one) that specializes in running and managing those applications for you. Even if all they get is a community of developers that choose to use Bun over other options, that gives them power and seats at tables they wouldn't have if they just rewrote Claude Code in Rust.

That'd be my best guess, anyhow.

Comment · 5 months ago
Even accepting your premise your options are still either:

1) Don't participate (and accept the consequences)

2) Participate (and accept potential disappointment/failure, with the benefit of having tried)

If you view 2) as fruitless unless your desired outcome is likely, you miss the potential value in the pursuit itself: working with like-minded people, building community, developing new skills, taking agency in your own life, and whatever else might come up along the way.

I don't begrudge anyone for choosing 1) (as long as they own their decision and don't force it on others), but 2) still seems like the aspirational choice I'd want to make if I could.

Comment · 5 months ago
Even granting your numbers, you're measuring the wrong thing. Wilderness acreage and emissions trends are not ecosystem health.

Citing a wilderness figure for developed countries is misleading. Most of it is ecologically vacant--second-growth and tree plantations sans apex predators, large herbivores, intact soil biota, etc. Tree cover is not a functioning ecosystem. Developed countries have exported their ecological destruction: the beef, soy, palm oil, and minerals driving habitat loss in the tropics get consumed in the same places where the domestic "wilderness" figures look great.

The Living Planet Index (actual wild vertebrate populations) is down 73% on average since 1970. North American bird populations are down ~3 billion over the same period. Terrestrial insect biomass shows steep decline in studied regions. None of that shows up in "how much undeveloped land exists" or "how many solar panels got installed."

China's solar buildout is great news for climate, but climate is one driver among several. Habitat fragmentation, pollution, and overfishing don't get solved by the energy transition. You can decarbonize the entire grid and still preside over a mass extinction.

Comment · 6 months ago
Or generate tiny filler messages every hour until you come back to it.
Comment · 6 months ago
I, too, rely on your web of trust, please don't ever break my heart Jeff!

It makes sense they'd be harder to find, I imagine there are more opportunities to make money by selling your soul than by offering honest review, and people with large investments have large incentives to dilute signal in their favor.

It's sad that so many platforms let it happen, but it makes sense when the users aren't the ones paying the bills. I'm immensely grateful for those that resist though, and if I were a religious person I would nominate them for sainthood or reincarnation or at least a plaque on a nice park bench somewhere.

Comment · 6 months ago
Do you have any legal experience, evidence, or case history to support your perspective? You assert that the statement "Our findings reveal major technology companies simply ignore globally defined opt-out signals, raising the spectre of industrial-scale non-compliance with California requirements" is untrue -- how do you know? Do you think everything found in the discovery process would agree? Do you think a company with a history of privacy violations would actually go through with a lawsuit where they'd have to definitively prove they don't? What about proving malice, that webXray knew their statements were false or acted with reckless disregard for their truth? What about the risk of filing a suit where California's anti-SLAPP statue would probably apply?
Comment · 7 months ago
I wish I'd heard about it when it was first published, it is super cool! Especially the timeline, given that it predates things like ts_zip/LLMZip (which is why I figured someone had already worked on something in the area), while being fundamentally the same mechanism. Makes sense why compression ended up being a more compelling use case though.

Live from the official Hacker News API

A modern reader for Hacker News · SvelteKit + Skeleton