vinay_ys

Depends on the season. Until a few years ago Bengaluru had a different problem – when it thundered or rained, they would cut power to protect transformers from shorting out due to falling trees on power lines.

There was some priority order to determine which circuits should be load-shed when there is a power shortage. For example while scouting datacenter sites across Delhi, Mumbai and Chennai, I learnt that 220KV lines were not part of load-shedding schedule whereas 66KV lines were. If you took power directly from the power generation company and had contracted power then also you were protected.

Bots are perfectly capable of simulating long user sessions. Many large-volume scrapping traffic for example simulate lots of long persistent user sessions.

Why does this feel like arms race where the only real winner is the arms seller?

Their partner can use the same key. or they also register their own yubikey and keep it safe elsewhere.

Long time ago I used to run qmail for my school (about 2000 users). It was a lot of fun to do as a student sysadmin. Today, I'm tempted to build a minimal mail system for 1-10 users using agentic coding and use it for less critical use-cases like email for shopping/restaurants etc account registration. I wonder if I can get a safe and secure minimal build done completely agnatically without having to directly look at a single line of code.

They should buy a Yubikey (a physical key) and keep their passkeys resident on that. Then they can truly keep that physical key locked up in their safe. And it is truly safer than their physical notebook because they are safe from being tricked into entering their password in the wrong place.

The right question to ask is if it is enabling us to do more interesting things or take on harder or bigger problems that seemed too daunting before. That's what all delegation of tasks (to other humans or machines) have enabled humans to do – scale.

Whatever creativity/thinking/effort bandwidth that's available will now get shifted to a different place in the problem-solving effort bottleneck.

That's the hallmark of any delegation being effective. Do we see that happening with AI tools? Personally, I do see that working for me. Is it as good as the hype makes it to be or I wish it to be? maybe not, yet, for me. But that's the case with most things in life.

All payment rails in India are RBI regulated directly or indirectly. NPCI is a non-profit section 8 company which is basically owned by the major PSU and private banks of India. And NPCI operates not just UPI, it also operates NEFT, IMPS, AEPS (aadhaar based payments), NETC (fastag), NFS (ATM network), Rupay debit/credit card network and BBPS (billpay). Only RTGS is operated by RBI directly.

Money serves its purpose while it's in motion. Increasing the velocity of money is good for economy. All the payment rails above do that 24/7/365 with lowest friction – by making all modes of payment possible and for free.

Digital payment rails is an order of magnitude cheaper (all inclusive) compared to cash rails. Accepting notes, counting, and depositing them, doing book-keeping and reconciling it against sales receipts, paying workers and vendors, avoiding leakage and theft etc – all cost time and money. For small merchants, it costs them time away from their business to handle cash.

UPI person-to-merchant (p2m) payments puts money instantly in their bank account. Their bank statements showing P2M deposits help them borrow for working capital at better interest rates.

Risk of theft with cash is much higher than digital theft from their bank accounts. RBI mandated 2FA, velocity checks, cooling-off periods, and awareness campaigns etc help people avoid scams.

W.r.t taxes, GST surveillance does catch merchants who accept high volume of P2M payments but aren't filing GST returns. Conversely, filing GST returns again helps with credit ratings and borrowing on better terms for working capital.

AFAIK banks don't charge for NEFT transfers when initiated via their mobile app or Internet banking website. Fees apply only when you do it via their physical branch.

The right comparison for Nasdaq's order processing volume or messaging volume would be India's National Stock Exchange (NSE). It does more executed orders per day than nasdaq.

I worked on scaling UPI a few years ago. Real-time Payments is vastly more complex as it is much more distributed - each transaction involves the two banks holding funds, two end-user apps (and their banks), and the network (npci) – for the payment to complete end to end, multiple message exchanges need to happen between these parties while the user at both ends are waiting. So, if you measure the scale in messages/sec it would 10-25x higher.

Real-time payment rails that works 24/7 365 days a year from any bank to any bank (domestic, no exceptions) for free is truly a game-changer. Compare that to US payment rails which is slow and expensive. Apart from UPI, India has 3 more payment rails – NEFT (similar to ACH – batch settlement), IMPS (similar to UPI, instantaneous - but different user experience), RTGS (real-time, intermediated by the central bank RBI, but only for high-value transactions) – all are 24/7/365 and free. Then, there's credit card rails – apart from Visa and Mastercard, India also has RuPay which has much lower interchange rate.

Right now, almost all the incentives are to build very large models that run across many machines in huge datacenters. There is very little incentive to build models that can run well on a small machine under your desk.

So it is less about whether people will be “allowed” to own AI, and more about whether there will be anything useful to own in the first place.

The incentive for local models is mostly to make them good orchestrators or user agents. They may give you some privacy and control, but they will still depend on much larger models running in datacenters for anything difficult.

I remember all the excitement around OpenMoko and other open-source “BlackBerry killer” projects. BlackBerry did get killed, but not by any of those individual-first projects.

For AI regulation, I think we should focus on normal commercial rules: consumer protection, privacy, antitrust, liability, and so on. In other words, focus on where money changes hands and where companies have power over users.

Military and offensive use is different. There, regulation is not much of a defense. The real defense is having enough capability and strength of your own.

Restricting AI because it can give dangerous knowledge to ordinary people is like restricting the printing press because it can be used to spread radical ideas.

I have not used voice mode much with chatgpt. I was surprised to learn that they were already not running the voice model like a UX orchestrator while utilizing other models in background for actual research/response etc. I guess it's good they launched what they could and got here in steps. I suspect in the near future my personal device (mobile/laptop) will be powerful enough to run any UX orchestrator model locally – and route to multiple frontier closed/open model providers in the background as appropriate. The battle is going to be platform owners (Apple/Google/Microsoft) wanting to lock-down the access to that local hardware and local interaction paradigms (ambient always-on full-duplex voice) and intermediate through their platform layers - rationalizing it as consumer security/privacy protection (which is right for most people, but sucks for the open market). Meanwhile I suspect OpenAI/Meta et al will try to build their own hardware and become platform owners themselves, though unsuccessfully. And it's going to take some company like epic games to get them to open that up. and that's probably what the next decade is going to be all about.

You can externalize the things you consider as taste by writing down generalized statements, but those statements need boundary conditions and exceptions to be also specified. Except, exceptions have exceptions and when to apply the rule vs when to use exception is contextual judgement. so, whatever residual that cannot be explicitly and unambiguously and generally spelled out, we call it as taste/judgement.