HNHacker News
TopNewBestAskShowJobs

freeqaz

3,392 karma · joined October 14, 2013

Head of Security Architecture @ Scale AI - also ex-YC (LunaSec, S19), ex-Figma, ex-Uber, ex-Snap

Email me or go to my domain -- freeqaz.com

Personal email: me at freeqaz

----

[ my public key: https://keybase.io/lunasec; my proof: https://keybase.io/lunasec/sigs/4BoTHAkR8TsFV_1S1Rg-Ed_nFD14ocW-gSgKRhhyNIE ]

YC Badge: 0xcb17dfcabdb996705e2859e224d4cdd94d9ae344

submissionscomments
freeqaz··on Next.js 15.1 is unusable outside of Vercel
What are the best alternatives? Why Vite?

I use Next for a handful of small projects, and SEO was always touted as the big benefit to me.

I can just generate a bunch of static files, copy to S3, and be done. Is that not true anymore?

freeqaz··on Ask HN: Who wants to be hired? (June 2025)
Location: Seattle, WA

Remote: Yes or hybrid

Willing to relocate: No

Technologies: Security, AI, LLMs, AppSec, ex-YC Founder

Resume: https://freeqaz.com

Email: me at (the above domain)

---

I'm a versatile engineer with 15+ years of professional experience now. Ex-(Uber, Snap, YCombinator, Figma).

Actively interviewing but always curious about interesting opportunities. Looking to work more directly with AI and LLMs, as that has been my focus in recent years!

freeqaz··on Hyper Typing
Does anybody have a good example of an 'alternative' that handle complex static types more gracefully? The Go language discourages Generics in favor of empty interface which feels similar to what the author is arguing... but I also find myself not always loving Go because of that. (I heavily lean on things like .map() in TS).

Trying to think of alternatives, I can only think of Haskell and C++ which are their own flavors of pain. In both C# and Java I've fallen into Hyper Typing pits (often of my own creation eee).

So what else exists as examples of statically typed languages to pull inspiration from? Elm? Typed Racket? Hax? (Not Scala even though it's neat lol)

Anybody have any tips to explore this domain in more depth? Example libraries that are easy to debug in both the happy and unhappy cases?

freeqaz··on GitHub Models API now available
What is the purpose of GitHub providing these APIs? All I can think is that it allows billing against a GitHub organization. Maybe if you want to use an LLM in your CI/GitHub Action it would be useful?
freeqaz··on TransMLA: Multi-head latent attention is all you need
Also makes models smarter ("expressive")
freeqaz··on Mistral ships Le Chat – enterprise AI assistant that can run on prem
I imagine that this in quantized form would fit pretty well and be decent. (Qwen R1 32b[1] or Qwen 3 32b[2])

Specifically the `Q6_K` quant looks solid at ~27gb. That leaves enough headroom on your 64gb Macbook that you can actually load a decent amount of context. (It takes extra VRAM for every token of context you need)

Rough math, based on this[0] calculator is that it's around ~10gb per 32k tokens of context. And that doesn't seem to change based on using a different quant size -- you just have to have enough headroom.

So with 64gb:

- ~25gb for Q6 quant

- 10-20gb for context of 32-64k

That leaves you around 20gb for application memory and _probably_ enough context to actually be useful for larger coding tasks! (It just might be slow, but you can use a smaller quant to get more speed.)

I hope that helps!

0: https://huggingface.co/spaces/NyxKrage/LLM-Model-VRAM-Calcul...

1: https://huggingface.co/bartowski/DeepSeek-R1-Distill-Qwen-32...

2: https://huggingface.co/Qwen/Qwen3-32B-GGUF

freeqaz··on 'I paid for the whole GPU, I am going to use the whole GPU'
How do Serverless GPU Cloud Providers deal with that then? Do they go down the Infiniband-to-NAS rabbit hole to build all of their infrastructure? Or do they just setup an NVME RAID cache to hold the models locally? (Maybe an LRU? With the system memory also being used?)

I imagine in the real world that model usage follows a zipfian distribution, ie, a small number of models (<10) represent 95% of the machines for inference workloads. And, for those machines, you can just load the weights off of your ~40gbit ethernet connection since they're never cycling.

But for that last 5%, I feel like that's where it becomes important. If I'm running a weird, custom model and I want Lambda-like billing... what's the stack? Is the market big enough that people care? (And do most people just use LORAs which are much easier to hot swap?)

Training I imagine is a totally different ballpark because you're constantly checkpointing, transferring data at each step, etc, versus inference. That's a world I know a lot less about though!

freeqaz··on 'I paid for the whole GPU, I am going to use the whole GPU'
How fast are modern GPU boxes able to spin up these days? Loading in a massive blob of weights into VRAM feels like it's gotta be the bottleneck even if server provisioning is fast.

Or am I naive and my knowledge is outdated? I am genuinely curious what people see and what providers are capable of in 2025.

freeqaz··on 'I paid for the whole GPU, I am going to use the whole GPU'
Anything you feel is worth adding for the HN crowd while you've got our attention? :)

(Thanks for writing this btw!)

freeqaz··on N8n – Flexible AI workflow automation for technical teams
As somebody working in AI Security: There isn't one currently. If you're feeding untrusted inputs into an LLM (today), you have to treat the entire prompt as radioactive.

That means: - Limit the potential for a malicious prompt to do anything bad - Scope permissions to the lowest level you can

There are some other mitigations (moderation APIs using a 2nd LLM), but in general they're not 100% solutions. You really need to design your systems around accepting this limitation today.

More info on this wiki here: https://github.com/tldrsec/prompt-injection-defenses

freeqaz··on Mercury: Commercial-scale diffusion language model
Here are two papers linked from Inception's site:

1. Discrete Diffusion Modeling by Estimating the Ratios of the Data Distribution - https://arxiv.org/abs/2310.16834

2. Simple and Effective Masked Diffusion Language Models - https://arxiv.org/abs/2406.07524

freeqaz··on Mercury: Commercial-scale diffusion language model
Anybody able to get the "View Technical Report" button at the bottom to do anything? I was curious to glean more details but it doesn't work on either of my devices.

I'm curious what level of detail they're comfortable publishing around this, or are they going full secret mode?

freeqaz··on Mercury: Commercial-scale diffusion language model
Their pockets are probably not as deep as Google's in terms of willingness to burn cash for market share.

If speed is your most important metric, I could still see there being a niche for this.

From a pure VC perspective though, I wonder if they'd be better off Open Sourcing their model to get faster innovation + centralization like Llama has done. (Or Mistral with keeping some models private, some public.)

Use it as marketing, get your name out there, and have people use your API when they realize they don't want to deal with scaling AI compute themselves lol

freeqaz··on Mercury: Commercial-scale diffusion language model
Facebook has their Chameleon model from 2023 that was in this space. Ancient now.

There is also this GitHub project that I played with a while ago that's trying to do this. https://github.com/GAIR-NLP/anole

Are there any OSS models that follow this approach today? Or are we waiting for somebody to hack that together?

freeqaz··on Mercury: Commercial-scale diffusion language model
this video showing how diffusion models generate text is mesmerizing to look at! (comment in top thread linked in your search results)

https://www.reddit.com/media?url=https://i.redd.it/xci0dlo7h...

freeqaz··on Espressif's ESP32-C5 Is Now in Mass Production
If it's like the other ESP32s with PSRAM support then 2-8MB most likely. IIRC it is addressed in the same way as the NAND, so the more RAM the less NAND you can have.

Maybe not applicable for this new one, but that's my understanding for the S3/C5 models. (something like 16mb NAND and 8mb PSRAM)

freeqaz··on Google to buy Wiz for $32B
Imagine you are a company, like Wiz, that is still growing fast.

Sure, your valuation could be based on revenue today. But why would you sell if you're "worth" $12bn right now, but you'll be "worth" 32bn in a few years? Why give up the control?

The only way for a company like Google to buy Wiz is to add a premium. Otherwise the company will just say "no".

This literally happened to Figma as well. And there is a history of this with companies like Instagram/WhatsApp.

In retrospect, was it stupid for Facebook to acquire Instagram/WhatsApp for large premiums?

freeqaz··on Exult: Recreating Ultima VII for modern operating systems
Easy for you, not easy for my Uncle or Nephew.

Companies like GoG (Grand old Games) have done a lot to "polish" the DosBox experience but it's still ... rough. Small things like mouse movement just feeling jank make a big difference.

A game can be _functional_ but if the UX is so poor/dated that it doesn't hold up, then I think projects like this make a lot of sense. Having high quality buttons, config menus that match modern UI expectations, and HiDPI font rendering goes a long way towards getting my non-technical family members to stick around.

It just makes it more accessible. But maybe my take is spicy. Anybody agree/disagree?

freeqaz··on Apple pulls data protection tool after UK government security row
That's why it's important to use apps like Signal where you can set the retention of your messages. I've got everybody I know using it now!
freeqaz··on Burning in woman's legs turned out to be slug parasites migrating to her brain
I grew up in Hawaii and this is the first time I've ever heard of this. There are lots of low-probability diseases like this out there.

You're probably more likely to die on the car ride to/from the airport than something like this, statistically.

freeqaz··on Burning in woman's legs turned out to be slug parasites migrating to her brain
Gotta wash your salad!

I know when traveling, a lot of people recommend using a produce washing agent. I was curious to look this up to see what they're doing.

EcoLab has their safety data sheet published here[0].

You mix it with water and it contains:

- Lactic Acid (reduces pH, likely killing some pathogens)

- Sodium hydrogensulfate (also reduces pH)

- Dodecylbenzenesulfonic acid, sodium salt (food safe surfactant to loosen microbes)

0: https://assets.pim.ecolab.com/media/Original/10085/US-Z8-913...

freeqaz··on The origins of 60-Hz as a power frequency
Interesting to think about what the future could look like. What if breaker boxes were "smart" and able to negotiate higher voltages like USB-C does? It would avoid the problem of a kid sticking a fork in an outlet, or a stray wire getting brushed accidentally when installing a light fixture.

Time will tell!

freeqaz··on The origins of 60-Hz as a power frequency (1997)
If we could magically pick a frequency and voltage for electrical systems to use (without sunk costs), what would it be?

What's the most efficient for modern grids and electronics?

Would it be a higher frequency (1000hz)?

I know higher voltage systems are more dangerous but make it easier to transmit more power (toaster ovens in the EU are better because of 240v). I'm curious if we would pick a different voltage too and just have better/safer outlets.

freeqaz··on Ask HN: Who is hiring? (February 2025)
I don't see any open internships on the careers site. Let me ping the recruiter and see though
freeqaz··on Ask HN: Who is hiring? (February 2025)
Figma | Security Engineer | Remote or Hybrid (SF, NYC, Seattle) | https://figma.com | Full-Time, $149-350k + Equity

Figma makes the tools that modern companies use to design apps. And because of that highly sensitive data, security is extremely important to get right. (If the next iPhone were designed using Figma and a breach leaked it... yeah, you get the point.)

Anyway, I am on the security team over here at Figma and reminding the excellent HN folks that we're hiring. I'm primarily working on AI and Snowflake Security currently, but I've hopped around over the past year. You likely will too!

We are a bit of a weird hybrid hiring-wise though. We need engineers with a security background than can _also_ write production-grade software.

(If you are a regular SWE then please check out Figma Careers page for a better role to apply for. There are many open roles, though keep in mind that Figma tends to only hire at the "Senior" bar and up. Not very many junior folks here.)

This is the link for my team if you're interested! Feel free to ping me at my email on my profile if you have questions. Cheers!

https://job-boards.greenhouse.io/figma/jobs/4214880004?gh_ji...

freeqaz··on Complete hardware and software setup for running Deepseek-R1 locally
Do you get more bandwidth at the cost of latency?

Also how much would stuffing a GPU or 3 (3090/4090) improve speeds, even with heavy CPU layer offloading, or would the penalty be too big? I know in some cases you're swapping data into the GPU, but in others you're just doing parts on the CPU. I'm curious what the comparison for speed would be.

freeqaz··on Bloomberg Announces Effort to Ensure U.S. Honors Paris Agreement Commitments
"Executive Order 11246, signed by President Lyndon B. Johnson in 1965, prohibits employment discrimination by federal contractors based on race, color, religion, sex, or national origin, and requires them to take affirmative action to ensure equal employment opportunities. It aims to promote non-discriminatory practices in hiring and employment for organizations that do business with the U.S. government."
freeqaz··on Possible Nintendo Switch 2 Tech Specs
TL;DR

- CPU: Arm Cortex-A78C 8 cores Unknown L1/L2/L3 cache sizes

- GPU: Nvidia T239 Ampere 1 Graphics Processing Cluster (GPC) 12 Streaming Multiprocessors (SM) 1534 CUDA cores 6 Texture Processing Clusters (TPC) 48 Gen 3 Tensor cores 2 RTX ray-tracing cores

- RAM: 12 GB LPDDR5

From the other thread: https://news.ycombinator.com/item?id=42726594

freeqaz··on Blue Origin New Glenn Mission NG-1 – Live
I had a close friend who was at Blue for a few years under Bob Smith (former CEO). It wasn't great. Just a toxic culture it seemed like, and their HQ is a giant stretch fabric tent with terrible acoustics lol
freeqaz··on Blue Origin New Glenn Mission NG-1 – Live
Some more info from Ars: https://arstechnica.com/space/2025/01/an-icy-vent-line-may-h...
← PreviousPage 2 of 24Next →