HNHacker News
TopNewBestAskShowJobs

CaptainOfCoit

2,067 karma · joined December 19, 2023

Modder at night, plain hacker during the day.
submissionscomments
CaptainOfCoit··on Microsoft 365 Copilot – Arbitrary Data Exfiltration via Mermaid Diagrams
The very same company that for at least two decades and two CEOs have been saying "Security is now our top security".
CaptainOfCoit··on YouTube Just Ate TV. It's Only Getting Started
I lived in three different countries in my life, and neither of them have been the US, but all of them have apparently had free South Park episodes available to them :)

I don't know if that website works/shows full episodes in the US, currently I'm in a EU country and everything except the last two seasons seems available.

CaptainOfCoit··on We saved $500k per year by rolling our own "S3"
> I'm curious how many engineers per year this costs to maintain

The end of the article has this:

> Consider custom infrastructure when you have both: sufficient scale for meaningful cost savings, and specific constraints that enable a simple solution. The engineering effort to build and maintain your system must be less than the infrastructure costs it eliminates. In our case, specific requirements (ephemeral storage, loss tolerance, S3 fallback) let us build something simple enough that maintenance costs stay low. Without both factors, stick with managed services.

Seems they were well aware of the tradeoffs.

CaptainOfCoit··on Nvidia DGX Spark: When benchmark numbers meet production reality
> There you’ll see the 10 Cortex-X925 (“performance”) cores listed with a peak clock rate of 4 GHz, along with the 10 Cortex-A725 (“efficiency”) cores listed with a peak clock rate of 2.8 GHz

> If you start Python and ask it how many CPU cores you have, it will count both kinds of cores and report 20

> Note that because of the speed difference between the cores, you will want to ensure there is some form of dynamic scheduling in your application that can load balance between the different core types.

Sounds like a new type of hell where I now not only need to manage the threads themselves, but also take into account what type of core they run on, and Python straight up report them as the same.

CaptainOfCoit··on Microsoft 365 Copilot – Arbitrary Data Exfiltration via Mermaid Diagrams
> There’s probably LOTS of vulns in copilot

Probably exactly why they "determined" it to be out of scope :)

CaptainOfCoit··on Nvidia DGX Spark: When benchmark numbers meet production reality
There wasn't any instructions how the author got ollama/llama.cpp, could possibly be something nvidia shipped with the DGX Spark and is an old version?
CaptainOfCoit··on A bug that taught me more about PyTorch than years of using it
I remember many similar cycles of having different browsers open side-by-side, and trying to pinpoint (without the developer tools we know and love today) the exact reason why one border was one pixel in one browser, and two pixels in the other, throwing the whole layout off.

Also remembering when Firebug for Firefox appeared, and made so many things so much easier. Suddenly things that took hours took days, and it was so much easier when you had some introspection tools.

CaptainOfCoit··on A definition of AGI
> defining AGI as matching the cognitive versatility and proficiency of a well-educated adult

Seems most of the people one would encounter out in the world might not posses AGI, how are we supposed to be able to train our electrified rocks to have AGI if this is the case?

If no one has created a online quiz called "Are you smarter than AGI?" yet based on the proposed "ten core cognitive domains", I'd be disappointed.

CaptainOfCoit··on YouTube Just Ate TV. It's Only Getting Started
People use separate computers for wide range of reasons. My desktop isn't always running Linux for example, or even from the same partition always, and to run something 24/7 I need to host it not on my for-work desktop. I also run some less trusted software on separate server and network than say Home Assistant and Frigate.
CaptainOfCoit··on YouTube Just Ate TV. It's Only Getting Started
I think it's broken, yeah. I think the whole "art for money" thing doesn't make sense in general and something else has to be figured out. Artists should be able to survive without depending on things like "perfectly competitive goods" or whatever.
CaptainOfCoit··on YouTube Just Ate TV. It's Only Getting Started
> I bet if something like that happened, it'd quickly soar to $0.2 an episode in the next year, then slowly creep up more and more

Yeah probably, until they find the point where more people leave because it's too expensive than they'll earn by raising prices, then they'll oscillate or find a new direction. Isn't that how capitalism is supposed to work?

CaptainOfCoit··on YouTube Just Ate TV. It's Only Getting Started
> probably around when South Park left Netflix, I started pirating again

Unrelated, but fun example as South Park is probably the only show on TV that also let people watch the entire show (-latest seasons it seems) for free online! https://www.southparkstudios.com/seasons/south-park

Been like that (in many places) for many many years at this point too :)

CaptainOfCoit··on YouTube Just Ate TV. It's Only Getting Started
Let me pay $0.1 for each episode I watch, make everything available and route to the right entity that should be paid and then offer one cross-platform client that everyone pooled their efforts into. And since we're dreaming, make it a open collaboration with a FOSS client too.

I'd predict most of the piracy would again disappear quickly as long as it's better, faster and has virtually everything people wanna watch. Basically replicate what Spotify did, but more open, so closer to what Grooveshark tried to do I guess.

CaptainOfCoit··on YouTube Just Ate TV. It's Only Getting Started
> Even if you subscribed to them all you'd still not have everything

And even if you could get all the video itself, it's not guaranteed you'd get the right video+audio+subtitles combination that you want, as everything seems to be negotiated separately.

So while one service could offer the right audio and the right video but not the subtitles you want, another service could have the right video and the right subtitles but instead be dubbed without original audio.

It became a whole mess for people and eventually it was again simpler to just resort to piracy for the even the slightly technical consumers.

CaptainOfCoit··on Let's Help NetBSD Cross the Finish Line Before 2025 Ends
> The cost of creating new computers has got to be pretty high to the environment

But aren't those made regardless if the people with old computers upgrade to them or not? I guess over time, they'll make less if people buy less, but the ones we'd purchase today has already been made, and might as well replace less energy efficient devices than just being added to the global count.

CaptainOfCoit··on Torchcomms: A modern PyTorch communications API
And I thought it was about a stick with flammable material on top. Probably the truth sits somewhere in the middle and this is a stick for communication.
CaptainOfCoit··on Downloadable movie posters from the 40s, 50s, 60s, and 70s
LED walls are cool (and cheap via China) otherwise, and you can start small and then expand if you want since it's relatively modular, just a bunch of square LED panels linked together. You would need a driver though which you may or may not be able to hide behind/somewhere else, makes it kind of bulky compared to just a vertical TV :)
CaptainOfCoit··on A bug that taught me more about PyTorch than years of using it
> Not that I understand much of what they say, but it appears there are a lot of correctness bugs in pytorch that are flying under the radar, probably having a measurable impact on the results of model quality.

Do you have any links to public thoughts about this? As if it was true, could mean a lot of research could be invalidated, so obviously would make huge news.

Also feels like something that would be relatively easy to make reproducible test cases from, so easy to prove if that's true or not.

And finally if something is easy to validate, and would make huge news, I feel like someone would already have attempted to prove this, and if it was true, would have published something a long time ago.

CaptainOfCoit··on Feed the bots
Huh, that's interesting, I'm not too familiar with US law, so not surprising I didn't know that :) Time to lookup if it works similarly in my country today, last time I was involved with anything slightly related to it was almost two decades ago, and at that point we (as a company with legal consul) made choices that assumed public info was OK to use, as it was public (paraphrased from memory), but might look differently today.

Thanks for adding the additional context!

CaptainOfCoit··on A bug that taught me more about PyTorch than years of using it
Thanks a lot for the pointers, I think I've done a similar approach to what you suggest, lots of tiny (relative) tests for each step in the process, and doing sort of sanity checking between the naive stuff I first wrote which works and which does inference correctly, and the new kernel which is a lot more performant, but currently incorrect and produces incoherent outputs.

I'll try to replace bits by simplified versions though, probably could help at least getting closer to knowing where the issue is.

Anyone have more debugging tips I'd greatly appreciate it! Nothing is too small or "obvious", as I'm about to lose my mind more or less.

CaptainOfCoit··on Armed police handcuff teen after AI mistakes chip bag for gun in Baltimore
Because it's a duplicate, the very same story was featured yesterday (https://news.ycombinator.com/item?id=45684934) with over 400 comments, so (sadly for you) it proves that the point you were trying to make is hilariously wrong.
CaptainOfCoit··on Feed the bots
> you use a known (even leaked on the website) password to "bypass the security" in order to "gain access to content you're not authorized to see", I think you'd get in trouble

I agree, but if someone has a website that says "This isn't the real page, go to /real.html and when authentication pops up, enter user:password", then I'd argue that is no longer "gaining access to content you're not authorized to see", the author of the page shared the credentials themselves, and acknowledged they aren't trying to hide anything, just providing a non-typical way of accessing the (for all intents and purposes, public) content.

CaptainOfCoit··on A bug that taught me more about PyTorch than years of using it
Would make sense I suppose if I was using two different GPUs for the same thing and get two different outcomes. But instead I have two implementations (one naive, one tensor cores) running on the same GPU, but getting different outcomes, where they should be the same.

But then this joke might be flying above my head as well.

CaptainOfCoit··on A bug that taught me more about PyTorch than years of using it
Magnitudes away (maybe "small numerical difference" was an understatement), my current hypothesis is that I'm doing scaling wrong somewhere, but I can't help but sometimes slide into the "maybe there is something deeper wrong" territory in the evening after another day...
CaptainOfCoit··on Clojure Land – Discover open-source Clojure libraries and frameworks
> CL saves me round after round of bugs that in clojure aren't found until you run the code

It is true that a lot of things don't surface until you run the code, but the way you run code in Clojure is also different than other languages (but similar to CL) where this isn't that big of a problem.

Usually you evaluate the very code you're working on, as an isolated unit, after every change, with just a key stroke. Again, not different than CL, but very different than the rest of the Algol-like languages where you'd put the code you're editing under unit tests or worse, manually run the full program after each change.

CaptainOfCoit··on A bug that taught me more about PyTorch than years of using it
To be fair, you can easily click to hide those expanded sections. I found it a neat compromise between "Link to (usually) obtuse Wikipedia article" which aren't usually written for laypersons, and forcing me to read through stuff I already know about, I just hid the sections I already understood but found value in the others.
CaptainOfCoit··on A bug that taught me more about PyTorch than years of using it
Only slightly related, but how common are bugs in GPUs and/or CUDA? I'm currently on Day 5 of trying to debug why my GPT-OSS implementation (not using PyTorch) I've made from scratch isn't working correctly, and while I have it somewhat working with some naive and slow methods, I'm now doing an implementation of the tensor cores and have been just stuck for 2-3 days because of some small numerical difference I can't understand why it's happening.

Every day I'm getting closer to believing this is some sort of hardware bug in Blackwell or in CUDA itself, but as we know, the bug is (almost) never in the compiler or in the hardware. Until it is...

CaptainOfCoit··on Feed the bots
I don't think it'd be illegal for anyone.

The (theoretical) scenario is: There is a website (example.com) that publishes the correct credentials, and tells users to go to example.com/authenticate and put those there.

At no point is a user (or bot) bypassing anything that was meant to stop them, they're following what the website is telling them publicly.

CaptainOfCoit··on Feed the bots
> but the legal implications of trying passwords to try to scrape content behind authentication could pose a barrier

If you're doing something alike to cracking then yeah. But if the credentials are right there on the landing page, and visible to the public, it's not really cracking anymore since you already know the right password before you try it, and the website that put up the basic auth is freely sharing the password, so you aren't really bypassing anything, just using the same access methods as everyone else.

Again, if you're stumbling upon basic auth and you try to crack them, I agree it's at least borderline illegal, but this was not the context in the parent comment.

CaptainOfCoit··on Advent of Code 2025: Number of puzzles reduce from 25 to 12 for the first time
We all have our writing quirks, like how some people use shorthand for words where there is only a marginal difference (like "people" => "ppl"), or even people who capitalize the start of sentences, but not the start of their whole text.

Some thoughts maybe should remain internal :)

Page 1 of 26Next →