HNHacker News
TopNewBestAskShowJobs

hirsin

2,339 karma · joined October 14, 2014

Identity product manager at GitHub - @hpsin. I own the Apps and Authorization platforms. Previously Microsoft Identity protocols PM for Entra and the Microsoft Account systems.

Views my own.

submissionscomments
hirsin··on Data centers in space makes no sense
Good point - the comms satellites are not even "keeping" some of the energy, while a DC would. I _am_ now curious about the connection between bandwidth and wattage, but I'm willing to bet that less than 1% of the total energy dissipation on one of these DC satellites would be in the form of satellite-to-earth broadcast (keeping in mind that s2s broadcast would presumably be something of a wash).
hirsin··on Data centers in space makes no sense
Simply put no, 50MW is not the typical hyperscaler cloud size. It's not even the typical single datacenter size.

A single AI rack consumes 60kW, and there is apparently a single DC that alone consumes 650MW.

When Microsoft puts in a DC, the machines are done in units of a "stamp", ie a couple racks together. These aren't scaled by dollar or sqft, but by the MW.

And on top of that... That's a bunch of satellites not even trying to crunch data at top speed. No where near the right order of magnitude.

hirsin··on It looks like the status/need-triage label was removed
Tbc apps can be owned by orgs today, but the process is annoying - devs create the app and then transfer it to the org, and then are made managers of the app. Really high overhead.

It's part of the push we've been making over the last year or two to improve custom roles and finer-grained authorization for resources.

hirsin··on It looks like the status/need-triage label was removed
The owner is a Google employee, but for the sake of safety it should be owned by a real Google org. I've just asked them to migrate it to their OSS org.

Unfortunately the app creation flow on GitHub makes it impossible (for now) for a normal org user to create an app for the org, so apps end up getting created on personal accounts and become load bearing. We've got a work item to make it possible to give app creation rights to your org members, I've got it high on the priority list for the next six months.

Re:payment As I understand it each org that uses the gemini cli agent puts their api key in their actions secrets, which gets picked up and used to call Google inference APIs. So the org these comments are in is paying for the inference.

hirsin··on Brands upset Buy For Me is featuring their products on Amazon without permission
"Amazon announced it" in some back alley press report and certainly not in a proactive outreach way to tell these folks they were listing their products. At the very least there's a trademark issue here because these sellers in no way gave Amazon permission to reuse the images and descriptions of their products.

If I announce in my local paper (you get to guess which one) that you'll be throwing a party outside your house, I don't think you'll be on the side of "just tell them to go away and my neighbors will totally understand it wasn't really me"

hirsin··on Start your meetings at 5 minutes past
Yes, outlook supports both. At Microsoft though we only ever used "start five late".
hirsin··on Start your meetings at 5 minutes past
I've always wondered at the company cultures between Google and Microsoft - Gcal supports ending meetings five minutes early while Outlook supports starting five minutes late.

At Microsoft it was obvious how five minutes late was optimal - meetings usually dragged on past their end time anyhow, but never started early so it gave folks time to eg get to their next meeting (in person), coffee, bio break, etc.

Does Google have a culture of meetings ending on the dot with finality? I just don't see that working with human nature of "one last thing" and the urge to spend an extra few minutes to hammer something out.

It's just laughable to me to bother with a "ends five minutes early" option. It just doesn't work - you know you're not cutting into anyone's next meeting by consuming those last five minutes. But you can't know that if you push into the next half hour block - maybe they have a customer call up next that starts on time, so you have to wrap up.

hirsin··on Spherical Snake
I was unsure of the licensing, so happy to take it down if it's not open - but I forked this to test some agent features on GitHub mobile and was happy with it. https://hpsin.github.io/SphericalSnake/ and the PR I single shotted for testing https://github.com/hpsin/SphericalSnake/pull/1

Thanks for a fun mobile friendly test run!

hirsin··on How AI labs are solving the power problem
You've got an extra actor in the mix that makes for a different argument and actually supports the idea that it's racist, I think.

Namely - I think most agree that it's racist to mindlessly assume race and poverty are correlated. The argument here is that the AI companies made that assumption - in other words, they're being called racists.

I don't think it's racist to speculate that a corporation, that made choices that specifically impact black neighborhoods, is racist.

hirsin··on Scientists edited genes in a living person and saved his life
Expanding the timeline a bit, CRISPR was known as a possible gene targeting/editing tool by 2008 at least - I distinctly recall learning about it then in a guest lecture.
hirsin··on -tucky (2023)
Are you saying those are additional possible meanings of Pennsyltucky, or that you've heard people use it to mean all of those?

I have only ever heard it used to mean the rural areas between the two cities, in keeping with the saying "Pittsburgh on one side, Philly on the other, and Kentucky in between", which has of course confused people not familiar with the stereotypes or geography.

The other famous use of Pennsyltucky is the character in Orange is the New Black, which I've always taken to mean "she acts like she's from Pennsyltucky".

I guess we need to wait for the term to be used enough to get into a dictionary to get it well defined

hirsin··on Android introduces $2-4 install fee and 10–20% cut for US external content links
Yep, I misunderstood that key point here but can't edit anymore.
hirsin··on Android introduces $2-4 install fee and 10–20% cut for US external content links
Ahh that's a really good call out, thank you. Basically negates most of what I wrote.
hirsin··on Android introduces $2-4 install fee and 10–20% cut for US external content links
They're not even serving the file. That cost is born by the external provider.

The four dollars is for providing the platform that the user used to navigate to the link and download the zip file.

That's a fun bit of argument from the owners of Chrome.

hirsin··on Android introduces $2-4 install fee and 10–20% cut for US external content links
The apparent information gathering and brutal review process is unbelievable here. If I'm understanding this correctly, the requirement is that eg Epic Game Store must register and upload every single APK for every app they offer, and cannot offer it in their store until Google approves it, which may take a week or more - including every time the app updates.

Meanwhile they get full competitive insight into which apps are being added to Epics store, their download rates apparently, and they even get the APKs to boot, potentially making it easier for those app devs to onboard if they like, and can pressure them to do so by dragging their feet on that review process.

> Provide direct, publicly accessible customer support to end users through readily accessible communication channels.

This is an interesting requirement. I want to see someone provide the same level of support that Google does to see if it draws a ban.

hirsin··on Economics of Orbital vs. Terrestrial Data Centers
Oh, fully agreed. Orbital datacenters don't solve many to any engineering problems either, so I figure its adherents are as much into legal problem solving as they are engineering problem solving.
hirsin··on Economics of Orbital vs. Terrestrial Data Centers
At this point I'm going to assume that anyone pushing datacenters in space wants to host child pornography. That's the only realistic workload that ticks all the boxes for orbital datacenters.
hirsin··on GraphQL: The enterprise honeymoon is over
Strongly agreed.
hirsin··on From Azure Functions to FreeBSD
Every Microsoft employee is given a license as part of working there, at least if you're in the eng orgs.

I've had mine for over a decade.

hirsin··on GraphQL: The enterprise honeymoon is over
Authz overhead for graphql is definitely a problem. At GitHub we're adding github app support to the enterprise account APIs, meaning introducing granular permissions for each graphql resource type.

Because of the graph aspect, queries don't work til all of the underlying resources have been updated to support github apps. From a juice vs squeeze perspective it's terrible - lots of teams have to do work to update their resources (which given turnover and age they may not even be aware of) before basic queries start working, until you finally hit a critical mass at some high percentage of coverage.

Add to all that the prevailing enterprise customer sentiment of "please anything but graphql" and it's a really hard sell - it's practically easier and better to ask teams to rebuild their APIs in REST than update the graphql.

hirsin··on From Azure Functions to FreeBSD
Yes, it's the standard Visual Studio Enterprise credit that you get with the license - 150/month

https://azure.microsoft.com/en-us/pricing/member-offers/cred...

hirsin··on From Azure Functions to FreeBSD
The author chose a library that didn't support TLS, written by a company that isn't Microsoft. Terrible devex indeed but hard to see why that's the fault of the platform that required TLS.
hirsin··on I wasted years of my life in crypto
Only one of those things is a state enforced requirement (the deed) and everything else are system requirements that do not get solved with bitcoin. What mortgage company is going to loan you a million dollars ("in btc" whatever) without figuring out if you're a good risk? That's not the currency of choice making you get cross examined, it's the nature of the thing you are trying to do.

Maybe the suitcase of anonymous cash bit is easier but only because you're doing that to dodge taxes... In which case feeling like a criminal might be a bit on point.

hirsin··on I wasted years of my life in crypto
What made you feel like a criminal? Buying a home is fairly straightforward and has almost no state verification of any piece of it, at least in the US.

Was it something the state enforced, or something being done by the agents of the transaction (ie the mortgage company)?

hirsin··on GitLab discovers widespread NPM supply chain attack
Yep, I saw the cat and mouse ending at ever increasingly invasive verifications involving more parties, that could ultimately still be worked around by a state actor. We already get asked for "block access from these country ip ranges please" as a security measure despite it being trivially bypassed, so it is easy to predict a useless but strong demand for blocking users based on their verified country.
hirsin··on GitLab discovers widespread NPM supply chain attack
This was largely the reason I rejected "real name verification" ideas at GitHub after the xz attack. (Especially if they are state sponsored) it's not that hard for a dedicated actor (which xz certainly was) to get a quality stolen identity.

The inevitable evolution of such a feature is a button on your repo saying" block all contributors from China, Russia, and N other countries". I personally think that's the antithesis of OSS and therefore couldn't find the value in such a thing.

hirsin··on An Economy of AI Agents
For better or worse, Accelerando comes to mind _a lot_ when trying to figure out how agent platforms should work. Hopefully for better.
hirsin··on Are consumers just tech debt to Microsoft?
Yes, the article should really be titled "Is Windows just tech debt to Microsoft?" and could have been published five or six years ago.
hirsin··on Email verification protocol
Fedcm offers some hope here, where the browser gets some capability to announce the federation domains to the RP. It's not straightforward though, of course. In this case though it's inverted - you are providing the url of the MCP server, and the MCP server is providing the url of an authz server it supports. The client is uses the metadata lookup to know if it should include PKCE bits or not.
hirsin··on Email verification protocol
This is because the MCP folks focus almost entirely on the client developer experience at the expense of implementability CIMD is a bit better and will supplant DCR, but overall there's yet to be a good flow here that supports management in enterprise use cases.
← PreviousPage 2 of 22Next →