lordofmoria

This is a great question!

I think we now know, collectively, a lot more about what’s annoying/hard about building LLM features than we did when LangChain was being furiously developed.

And some things we thought would be important and not-easy, turned out to be very easy: like getting GPT to give back well-formed JSON.

So I think there’s lots of room.

One thing LangChain is doing now that solves something that IS very hard/annoying is testing. I spent 30 minutes yesterday re-running a slow prompt because 1 in 5 runs would produce weird output. Each tweak to the prompt, I had to run at least 10 times to be reasonably sure it was an improvement.

Things PWAs can't do: 1. On mobile, access full-definition camera/video as part of MediaDeviceCapture. There are new javascript APIs for this, but they're only partialy supported (the name of the new escapes me)

Absolutely agree - that's why I said "so the real difference is you've conveniently pre-loaded all your sensitive information in one go for the bad actor."

Everything is a tradeoff - but the basic balance is very strongly in favor of password managers:

1. without a password manager that is shared on all your devices, you WILL re-use passwords out of frustration. 2. without a password manager, if you do any sort of regular sharing passwords with a engineering team, friends & family, you'll resort to pretty insecure channels. 3. true E2E encryption, while still providing some surface area, has proven in the field through multiple pretty bad breaches[1], that it's a security model that holds up under real-world circumstances.

On the flip side, you are right: you are one compromised browser extension / binary away from having your local vault decrypted, and ALL your passwords compromised. But think about this: if someone has this much local access, chances are they can install a keylogger anyway, or read your clipboard, so the real difference is you've conveniently pre-loaded all your sensitive information in one go for the bad actor.

[1]For example: https://blog.lastpass.com/2022/12/notice-of-recent-security-...

Glad to see DaisyUI on here - it’s a component library designed with tailwindcss - it hits that fine balance for component libraries between covering the hard-to-do stuff (modals, accordions, drop-down) without building such big components that you end up constantly tinkering to get what you want.

In case anyone is interested, Heroku finally released pgvector support for Postgres yesterday: https://github.com/heroku/roadmap/issues/156

Pgvector is an extremely excellent way to experiment with embeddings in a lightweight way, without adding a bunch of extra infrastructure dependencies.

You’re not alone…I think the docs for hotwire need two entry points:

1. (This is the current entry point): I have a rails app already, and I’m looking to progressively enhance it with a splash of turbo, responsiveness, magic. 2. (This is where something is missing): I’m building a rails app for the first time, and want to start out with a relatively high level of interactivity using hotwire. The docs don’t really offer much wisdom here, I’ve found, probably because the main adopters have all added this incrementally.

When you’re building from scratch, it’s harder to know which pattern will work best.

I tend to agree - search, and particularly search-for-humans, is really a team sport - meaning, very rarely do you have a single search algo operating in isolation. You have multiple passes, you filter results through business logic.

Having said that, I think pgvector has a chance for less scale-intense needs - embedding as a column in your existing DB and a join away from your other models is where you want search.

I don’t get why you’d want to bolt RBAC onto these new vector dbs, unless it’s because they’ve caused this problem in the first place…

This. You don’t need to create the first thing in a category or choose something complex to be successful.

You may be able to hack together a basic feature flagging product in 2-3 days, but like many domains, it goes incredibly deep and there’s a lot of hidden nuance if you focus on it. If the value doesn’t drop off for those long-tail “deep” features and people will pay extra for you to handle the nuance - voila, you have an amazing SaaS, potentially.

You have the wrong paradigm. Airtable doesn’t improve on excel - it makes databases accessible to non-technical people. It’s the new MS Access: simple GUI for doing Joins, lookups, foreign keys without knowing that’s what you’re doing.

One aspect of this that I don’t hear often is that growing more slowly allows you to actually have a chance at testing profitability and making adjustments in business model to achieve profitability as you grow.

People assume that profitability is perfectly predictable in a spreadsheet - anyone who has run a business for any sustained amount of time knows how false that is. Sure, if you run a SaaS, the margins may be so large that you can hand-wave profitability and probably be ok.

But remember, your first super productive workers are not the ones who are are around 5 years later.

Your first smart and capable customers are not your average customer 5 years down the line.

If you are pursuing revenue growth at any cost, you could end up with a lot of revenue and no hope at being profitable.

Spreadsheets and fancy decks can be made to convincingly present whatever story you want to tell, regardless of reality - look at Uber/Lyft. When you look at how the public markets are punishing this now, it seems obvious, but when you’re smaller and gunning for your next round, it’s probably the furthest from your mind.

Couldn’t agree more - my kids have been reading the two “big ones” - Cars and Trucks and strings that go, and “What do People Do All Day?” almost every night for a year now. There’s always a delightful new discovery and it’s an endless source of “Why?” questions with interesting answers!

My favorite tidbit has to do with the third defenestration of Prague (1948):

It was widely viewed as a likely assassination by the communists of foreign affairs minister Jan Masaryk. A clever poem emerged from it, with typically dark eastern bloc humor:

“Jan Masaryk was a very tidy man. He was such a tidy man that when he jumped he shut the window after himself.”

- David L. Roll, George Marshall: Defender of the Republic (2019)

You’re forgetting that companies need both Visionary AND Execution focused leaders at the very top.

I’m an execution through and through guy, but I learned early on that my co-founder’s ideal traits are the opposite of mine, and that’s what you’re seeing here.

What’s being described is a classic Visionary - spontaneous, jumps around and can be distracting, yes - but crucially, is also an amazing innovator and motivator of people.

In a successful startup, you need both Visionaries and Execution people.

I recommend Rocket Fuel - https://www.amazon.com/Rocket-Fuel-Essential-Combination-Bus...

I just went through looking for, and failing to find, a good typeahead library. I could not find one I liked. Typeahead is probably the most sophisticated UI element, and the most demanding in terms of what users expect.

Two pro tips:

1. Apparently this is also called “combo box” - Tailwind has one: https://tailwindui.com/components/application-ui/forms/combo...

I eventually rolled my own using tailwind’s scaffold: it ended up being about 300 lines of JS to handle things like keyboard actions, pressing enter, focus/non-focus, denounce search.

But the benefit? It does exactly what I want.

Every day it seems like the vendor-lockin-plus-$$$ vs developer-experience tradeoff that comes with Auth0 gets less and less worth it, unless you're a massive B2C app like OpenAI (which uses Auth0).

- the economics for the middle (aka most risky) scaleup stage, as talked about in this post, are not great.

- Yes, Oauth is complicated, but so is Auth0. OSS stuff like Passport (for the JS ecosystem), authlib for python, and omniauth for the ruby is basically just as easy, and the vendor lock in on storing users in Auth0 is quite massive.

- WorkOS and a slew of new products exist to cover B2B SAML enterprise-SSO-connections at a smidgen of the cost of Auth0 (which charges multi-thousands-per-connection).

> especially early on when my focus should be testing my product, not optimizing my could infrastructure for scale that might never be needed.

In that case, go with managed services like render, Heroku, or fly. MRSK, or any DIY deployment, is not going to save you the hours of tinkering you will inevitably do to get the non-server stuff up for even a low-usage production app: 1. One-click Deploys, basic CI/CD 2. Redis/memcache 3. Database / migrations / rollback / backup 4. Logging / metrics / down detection & basic high availability 5. Keeping up with basic upgrades

Sadly the mistake was even more basic than you’re likely thinking - as I recall, min-max is necessarily breath-first, and I simply pushed onto the queue from the wrong side (think: append instead of push), so the queue was backwards, and breadth first traversed from right to left. Same time complexity, but slightly different paths reached within the same time constraints!

In 2008, I was taking COS 217 at Princeton - our final project was to write a program to play Othello competitively. We were told to use alpha-beta-pruning for grading, but that there would be a tournament at the end of class, so we could tweak our programs for that (the assignment was insanely hard, so of course no one had time to tweak).

To my surprise, I won the tournament, despite having done the bare implementation with no tweaks! I didn’t get a perfect grade on the assignment though - apparently I had miss implemented the queue for the alpha-beta search, and had completely reversed the queue ordering.

Of course, searching “in reverse” through the alpha-beta tree turned out to be the difference that won me the tournament. It was rather humiliating, but a good lesson on sheer luck’s role in academic approaches to AI.

We’re newly public (NYSE:NOTE), so customers and ARR :)

There's all sorts of cool data analysis that can be done with this data. I lead engineering for a company that ingests these open APIs and sells a service that enhances the metadata on these records and allows users to follow new changes in bills/legislation (think: following a PR). You'd be surprised how many organizations want it, and I don't just mean large corps (yeah, I know...but see the discussion around transparency below in the comments!). We have a lot of very cool institutions as well. If you're a Rails dev or like Data Science, we have some openings: https://careers.fiscalnote.com/

FiscalNote | Remote | Full-Time | https://fiscalnote.com

Fiscalnote is a late stage startup that provides data analytics on policy and regulations.

Here are our open roles:

- Engineering Manager, Rails: https://jobs.lever.co/fiscalnote/7ad4b7a8-9b8c-4593-842e-74a...

- Lead React Frontend Engineer: https://jobs.lever.co/fiscalnote/42226db9-a039-499e-a7d1-611...

- Machine Learning Engineer: https://jobs.lever.co/fiscalnote/c4ffa794-75da-4c06-a8f3-e25...

- Senior Elasticsearch Engineer, Search & Discovery team: https://jobs.lever.co/fiscalnote/ac4b8ea7-f6be-4e33-a0f2-363...

Happy to chat, 6B 65 6E 2E 6B 61 6E 74 7A 65 72 40 66 69 73 63 61 6C 6E 6F 74 65 2E 63 6F 6D

I used to be with the SSO-wall-of-shame crowd...until I had to maintain and support SSO within a production app. G-suite/Social SSO? Fine. Not a problem. SAML? Good luck automating that and not having to reset certs / tweak things per-client. That's why it costs money.

Another problem I have with the "SSO should be free, because it's security-related" argument is that it's a misunderstanding of why it costs money. It's not because companies want to gate security features. It's because when you're trying to create a pricing model for an otherwise free product, going from "I'm ok with manually inviting/deactivating users" to "I now need SSO, because this product has enough adoption within the company to merit it" happens to be an almost a perfect way to delineate between casual freemium users and business users who should be paying. That, combined with my initial point, is why I dropped out of the SSO tax crowd.

(op here) I actually completely agree - you're right: "simple outperformed smart" doesn't point to a useful, nuanced solution. I wrote more in-depth here about slightly-more-specifically where there are problems, curious your thoughts, feel free to DM me or comment on the blog (this thread is kinda dead)! https://kenkantzer.com/5-software-engineering-foot-guns/.

Honestly, early on in our code auditing days, there were surprises - a lot of the more meta-lessons in here fomented in the last few years, looking back, and would NOT have been something I’d have thought early on.

On the other hand, regarding micro-services question: no, not even one surprised us positively. Now keep in mind, we didn’t audit absolutely massive FANG companies where mice services are probably necessary for org reasons(though a few unicorns/near-unicorns).

But how do you avoid astroturfing? Seems like someone with two accounts (or a small cabal) could get anything they want published with very low friction.

Are you considering a strongly-bound 1-account-per-person model with verified accounts?

I was so happy to have found I bonds in the last few months.

This does beg the question - is there any other “safe, relatively liquid” option that has even close to the same yield as I Bond? Seems like traditional bank savings and short term CDs are still well below 1% everywhere.

It’s interesting how many of these happened during WWII. The fact that the Pentagon was built in under 500 days is astounding, if you’ve ever walked through the place.

True urgency is really such a key predictor to things getting done impossibly fast, and our brains are great at detecting manufactured urgency.

I read this right after reading about Tony Hsieh’s last few days - https://www.wsj.com/amp/articles/the-rise-and-fall-of-the-ma....

The author of this needs to seriously think about where this “new management philosophy” might take them and them clients, should they be successful. Better if they weren’t.

wow, thanks for this link, I wasn't even expecting a 1Password solution, but the very first item on that is exactly what I was getting at.

Though this seems to be maybe aimed at enterprise, I hope they continue their tradition of releasing features on personal as well.