Hacker News Reader

Comment by matsemann | Hacker News Reader

What I hate about the current ML space is that half the time is spent trying to get dependencies installed and set up correctly to match whatever project you're trying to run expects. Everything is just so brittle. Following tutorials like these never work out of the box.

View on HN

I recently went through this and conda handled the python deps pretty well, but the nvidia cuda stuff was a massive pain to get the right things installed. I think it’s safe to blame nvidia.

> conda

It seems I may have stepped on a few toes here. For a lot of ML engineers I've talked to, conda is a living nightmare if one tries to go beyond one project (or maybe multienvironment) on one machine.

Sometimes even one is a problem.

I don't think I've talked to a career ML engineer yet that has had a positive work experience with conda, that I can recall. Usually the question has been a good way to trauma bond, which is always good.

It seems like this is more an academic kind of thing?

What I can’t stand is the incessant paternalism that seems to surround AI from big tech,

I got access to DALL-E a few weeks back (after a waitlist… come on) and tried it out. They want all this personal info to even access it, and then they have this oppressive “content policy” that removes anything remotely fun.

For example I tried “Trump riding a velociraptor on mars fighting aliens” because why not? Sounds hilarious. Turns out any query with the word Trump is banned and I got a warning about “repeated violations might remove my access”. It’s not just trump, anything remotely non-corporate-friendly is heavily filtered. Don’t you want to just make images of a cute teddy bear made of pizza instead?! I’m just so tired of it all. It’s like the puritans of the 1990’s won, but they’re corporations now.

Personally I think they can shove that nonsense up their ass.

I think they have a blanket no celebrities or real living people policy for their engine. I think that’s fine since they don’t want to be called out for helping produce defamatory content.

They just want to avoid bad PR. That’s sound safe.

It is to avoid bad PR, but in the name of marketing they've produced the worst content policy I've ever seen:

https://labs.openai.com/policies/content-policy

Highlights include:

-All images must be "G-rated"

>Any prompt referencing politics, violence, sexuality, or even the concept of "health" is banned

>This does occasionally include the very same LGBT themes their "hate" rule ostensibly protects, although not consistently, so there's no way to know whether an LGBT prompt will cause an account strike

>In practice the list of bannable offenses is much longer than this, and includes everything from the concept of death to anything violence or politics-adjacent (e.g. nothing about war, conflict, or any kind of weapon)

>OpenAI refuses to share this list because it's part of a "contextual" filter, even though it demonstrably bans words

They advertise DALL-E 2 as artistic, but it can't make art with restrictions like this. The best it can do is corporate content farming, and even then there's no way I'd make part of my marketing pipeline depend on a service this fickle.

In my opinion, if you haven’t managed to get DALLE to generate fetish art, it just means you don’t have enough fetishes.

My account got deleted because the word katana was in my image

They unban you if you email them. “longsword” is an allowed word though.

Oh wow. You ask nicely and they stop being assholes?

How gracious of them…

Come on man

Don't worry, we'll get much better models at much lower costs (midjourney, stablediffusion) that you can run on your own hardware, and avoid the moral censorship that the paternalising non productive members of these companies want to subject the world to

Pepe is banned. Why? It doesn't matter. Someone will cut around, and they'll get my compute instead. And I'll get my autogenerated pepes, regardless of whether some non productive AI "ethicist" thinks a cartoon frog meme is offensive.

Asking users to avoid creating fakes of actual people “removes anything remotely fun”? Okay…

> It’s not just trump, anything remotely non-corporate-friendly is heavily filtered.

fwiw i found you can misspell words to get around the filters, e.g. try something like Dnoland Tmrump and see if it works

Looking back at the AI Dungeon incident last year, it seems OpenAI isn't great with implementing filters.

What is the solution? Is there a reason why things are not better? Can all of the deps be loaded in a Docker image and be done with it?

> What is the solution?

There are languages ecosystem that solved these issues and never have a problem with it. Look at it, and copy their tooling.

What are some of those ecosystems?

Julia's package manager has basically never failed on me.

Thanks. That’s something to look into then.

Note that the Julia package manager (while very good) is very similar to (and largely inspired by) the rust package manager.

basically never, or never? ;-)

.NET with nuget works flawlessly, compared to bad package managers.

It's pretty good but certainly not flawless. Admittedly I probably don't have high standards. Cocoapods is one of the few I'd consider objectively "bad", though apparently among iOS developers it's considered one of the better ones (!).

That's why I said "compared to bad package managers." NuGet works, have flaws, sometimes doesn't works, but is usually reliable.

On the other hands, I lost a lot of time with npm, and also a lot with pip.

One thing is python's dependency management is just insane in itself. When you then additionally have to have it install basically drivers for the gpu, compile loads of native code etc it becomes a hot mess. And half the ML things you want to try are academic experiments not really made for distribution, so they were made to work and that's it. So if you have some different computer setup, minor version mismatch of a dependency etc it will just break. Datasets or models excist on some url that only works for a month.

It's a shame, I think the field is one where reproduction of results should be really welcome and feasible.

Yeah, a docker image would be nice. Even a Dockerfile, even though that in itself may not guarantee reproducibility if you try to build it later. (And may have issues with gpu drivers etc). But at least it documents all assumptions about the setup.

That's the cool thing about publishing the Dockerfile and an image, one is an example that may or may not break, and the other is a functional snapshot of a working config at that point in time.

No. This would take a very long post to explain why, but in short, it depends heavily on which NVIDIA Cards / CUDA drivers / versions of Linux you're using. Or you're running on AWS GPUs or TPUs and paying a lot more either in the form of straight up dollars or optionality.

Cloud services.

Someone sets it up, leases out instances etc..

Or someone works to ensure that everything gels together and provides support etc..

Or in other words: 'products'

What I hate about the current ML space…

You’re implying it isn’t like that for every language/framework. I’d love to know what you’re working in where the dependencies aren’t always a problem. Even Carmack has complained about this.

Never had an issue running a random java project, for instance. Either because people package all dependencies. Or because maven, while not popular, mostly just works.

Of course, ML is a bit different in that it often needs more drivers/gpu setup. But there are loads of ecosystems that don't assume you have package X installed on your system, like python's does.

Which is why I am using Nix to maintain my development for each machine learning research project.

I'm interested in how this works with hardware specific code? Can Nix detect host hardware and build for that?

Would also like to know. I'm playing around with 32 bit x86 stuff again.

Not sure if this is unique to ML, I had the same experience with C++, Rust, Linux tutorials and and a bunch of other technologies.

I definitely have the same experience trying to get C++ game dev libraries running. Trying to wrangle a bunch of open-source library dependencies into mutually acceptable versions whilst also keeping up with (intentional, or unintentional) operating system breaking changes is a never ending steeple chase.

I'm not so sure about this...I guess maybe there's some project specific stuff, but the good projects are semi stable and oftentimes it's just PyTorch code that you can pull and use elsewhere if needed.

Other people's infrastructure always seems bad to me, as I'm sure mine does to others. The cycle and circle of life! :D

It was exactly the same with voice recognition and synthesis software. Those are complex apps, often born in academia with obscure dependencies.

I feel like this is getting way worse the past 3 years and I also feel that's intentional.

That's the reason why I avoid using Python as much as possible (while I really like the language). Another reason is massive stacktraces everywhere instead of a meaninful user-facing error messages, but that's a smaller cultural thing than dependencies hell.

Node has such an easier ecosystem than python IMO. I really hope the move of ML from python to JS continues.

What's node's GPU acceleration story?

https://www.tensorflow.org/js/guide/nodejs

Tensorflow JS running on GPU/CUDA in Node.

Does npm still create 10000 directories?

npm downloads the dependencies that you install.

No. Only 1000 these days.

Easy? Maybe.

Sane? Absolutely not.

Though I suppose it's not really Node's fault that developers are importing modules like "leftpad".

What's really fucking insane though is that there are modules like "trim-newlines" [0] that exist merely to trim \r and \n from the beginning and end of a string...and that this is such a hard task to get right that it's in version 4.0.2...and that a previous version had a security vulnerability [1].

[0] https://www.npmjs.com/package/trim-newlines

[1] https://www.cve.org/CVERecord?id=CVE-2021-33623

As much as I hate to say it as I hate how these kinds of packages attach themselves to large projects to inflate download numbers for a resume I think most of us here would probably have created the same CVE doing it naively. It was a regex DoS due to exponential runtime not something obtuse like extra bloat being poorly made.

Reply on news.ycombinator.com